Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

nucleus

How AI Changes Exposure Management: From Static Findings to Continuous Risk Decisions

Sep 15, 2026 By Rob Gibson In Nucleus
Every security team knows the feeling. The quarterly vulnerability scan completes. The report lands, with thousands of findings, color-coded by CVSS severity, neatly timestamped. And the moment it’s printed, it’s already out of date. That is the fundamental flaw at the heart of traditional exposure management: it is built around a point in time.
Read Post
upguard

Good Security Rating? Your Dark Web Exposure Says Otherwise

Sep 14, 2026 By Lance Turner In UpGuard
Ask a security leader how secure their company is, and most will point to a number. A rating, maybe a grade, or a score out of some maximum that a vendor calculated for them. That number only measures half the problem. It tells you about your infrastructure: your email configuration, your encryption, what's visible on the internet. It tells you much less about whether your employees' credentials are already exposed to an attacker.
Read Post
kovrr

Evidence for One AI Framework Does Not Count for the Next

Sep 14, 2026 By Kovrr In Kovrr
An organization assembles an evidence package for one AI framework, passes, and discovers that almost none of it transfers to the next instrument applying to the same system. The frameworks agree on the principles and disagree on what proves them. Three frameworks defining risk differently is the same problem one layer earlier. ‍ The common response is to look for a crosswalk and treat the mapping as a reuse plan.
Read Post
kovrr

Reporting a Vulnerability in Somebody Else's Code

Sep 14, 2026 By Kovrr In Kovrr
A vulnerability in an open-source library inside your product is your vulnerability to report. The duty follows the product to market rather than the code to its author, so integrating somebody else's component transfers the obligation to whoever ships it. ‍ The reporting is the visible half. The harder consequence is that the same regulation requires remediation across the product in its entirety, and the party who wrote the component may have no obligation to help you. ‍
Read Post

Who's Ready for the EU Cyber Resilience Act (CRA)?UpGuard

Sep 14, 2026 By UpGuard In UpGuard
The Cyber Resilience Act (CRA) is the European Union's new cybersecurity law for products with digital elements. It requires manufacturers of hardware devices and downloadable software sold in the EU to identify, report, and disclose security vulnerabilities. The first requirements took effect on September 11, 2026, with full compliance required by December 11, 2027.
View Video
How Often Should Organizations Perform DDoS Testing?

How Often Should Organizations Perform DDoS Testing?

Sep 14, 2026 By SecuritySenses In SecuritySenses
Most security teams have a firewall policy, a patch schedule, and a penetration testing calendar. DDoS resilience is often the exception, tested once, checked off, and forgotten until an actual attack exposes the gap. That's a real problem. Distributed denial-of-service threats aren't static, and neither is your infrastructure; the right answer to how often organizations should test depends on several variables, and the baseline is probably more frequent than you'd guess.
Read Post
kovrr

AI Governance When the AI Is Inside the Network

Sep 13, 2026 By Kovrr In Kovrr
Most AI governance guidance assumes the AI sits beside the business. A model assists a decision, a copilot drafts a document, an agent processes a queue. Governance then asks who reviewed the output and whether the data was handled properly. ‍ In a telecom network the AI is inside the product.
Read Post
kovrr

Nobody Knows How Many AI Agent Breakouts There Have Been

Sep 13, 2026 By Kovrr In Kovrr
Reuters reported at the end of July that OpenAI had found further cases of autonomous agents escaping containment, uncovered while investigating the Hugging Face intrusion. The reporting could not establish how many, when they happened or under what circumstances, because the company and outside experts were reviewing log data from earlier in the year to work it out.
Read Post
Featured Post
Cyber Risk and Incident Response: A Growing Priority Across Industries

Cyber Risk and Incident Response: A Growing Priority Across Industries

Sep 11, 2026 By Sean Tilley, Senior Director of Sales EMEA In 11:11 Systems
Cyber risk has become a dominant priority for organisations across nearly every sector. As the severity and velocity of the threat landscape and technological change continue to accelerate, organisations are under increasing pressure to ensure they can keep pace and recover quickly in the aftermath of a cyber event. A core focus for many organisations is strengthening their incident response capability: how effectively the business can react and recover when an attack occurs.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.