Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In July, we launched Tines 3B to the world, and it’s been incredible to see the response from our customers. It wasn’t a surprise though, we had a sneak peek of how much value 3B could bring when we launched it internally. On June 2, around eight weeks before the product's general availability, we unlocked the doors of 3B, let every single Tines employee into our own instance, and invited them to start building.

Most organizations already have an insider risk management (IRM) program in some form. They have a tool, a dashboard, and an analyst reviewing alerts. What they often lack is a program built on the specific capabilities that turn activity logs into stopped incidents and reduced insider risk.

Air-gapped networks are supposed to be untouchable. No internet connection, no remote pathway, no way in for an attacker sitting halfway across the world. But ask any security team that has actually run one of these environments, and you'll hear a different story. Air gaps stop remote attacks cold. But they do almost nothing to stop a stolen password, a careless USB stick, or an insider with too much trust and too little oversight. That's the gap, and Multi-Factor Authentication (MFA) is here to fill it.

An application that was AI-free at the last audit may be processing corporate data through a language model today. Nobody procured it, nobody approved it and nobody was asked. A vendor shipped a release. ‍ Third-party AI governance is built almost entirely around procurement. Assess the vendor, negotiate terms, sign a data processing agreement, add the tool to a register. The apparatus requires a purchasing event, and an embedded feature produces none, so the apparatus never engages. ‍

A public body has no revenue to lose, no share price to move and no insurance market pricing it the way one prices a manufacturer. It faces the same regulatory pressure to quantify cyber exposure as anyone else, and the standard model's central input does not exist. ‍ Substituting the loss categories is the easy half and it is where most guidance stops. The harder question is what the resulting figure is for, because the decisions a private company makes with it are mostly unavailable. ‍

For years, our security team has run pentests against business-critical applications across industries, and one pattern stands out. The vulnerabilities that are the most difficult to remediate are business logic vulnerabilities: IDOR, broken access control, privilege escalation, and multi-step workflow abuse. These are the kind of vulnerabilities pentest experts find by noticing a broken assumption behind one API call and chasing it until the full exploit path becomes clear.

Due diligence in a merger or acquisition is, by design, exhaustive. It brings a level of scrutiny that touches almost every part of a business. From financial audits and legal reviews to commercial assessments, buyers work hard to make sure nothing important gets missed. And yet there’s one area that continues to catch organisations off guard, even in the most professionally run due diligence processes: The cost of a data breach has never been higher. Digital estates have never been more complex.