Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

kovrr

When the Model Disagrees With Your Security Team

Aug 27, 2026 By Kovrr In Kovrr
A model ranks phishing sixth. The security team has spent three years on phishing and knows how often people click. Somebody in the room concludes the model is wrong, or that the security team is attached to its own program, and the meeting stops being useful. ‍ Most of these disagreements are not about risk. They are about which question each side answered, and establishing that first resolves a surprising proportion of them without anyone conceding anything. ‍
Read Post
kovrr

Turning the OWASP Agentic Top 10 Into Expected Loss

Aug 27, 2026 By Kovrr In Kovrr
The OWASP list for agentic applications, published in December 2025, gives security teams a shared vocabulary for what goes wrong when software acts rather than answers. Ten categories covering planning, tools, identity, supply chain, code execution, memory, inter-agent communication, cascading failures, human trust and rogue behavior. ‍ Translating that into a financial figure is where programs stall, and the usual attempt makes a specific error.
Read Post
kovrr

The Three Questions Every AI Telemetry Claim Should Survive

Aug 27, 2026 By Kovrr In Kovrr
‍ Coding-agent telemetry, today, cheaply, answers four real questions: which agents are running and operated by whom, what an agent invoked, what happened in a session in order, and whether a run looks abnormal. Part 1 of this series covers that case in full. ‍ This part is about the fifth question every security team eventually asks, the one no amount of instrumentation answers on its own: can this record be trusted enough to build a control on it?
Read Post
upguard

Jira + UpGuard: Automating Risk Management Together

Aug 27, 2026 By Revashni Moodley In UpGuard
If your security team runs on Jira, sprints and backlog included, UpGuard plugs straight into it: vendor findings, breach alerts, and user risk signals can all surface as issues your team is already triaging. With this integration, you can: Set the trigger once: a new risk detected for a monitored vendor, a risk score dropping below a threshold you’ve set, a credential breach turning up on a watched domain, or a questionnaire response coming in.
Read Post
keep

How to improve your cyber maturity

Aug 27, 2026 By Keep Information Security Services In KEEP
Most organisations that get hit by a serious cyber attack weren’t careless: Ransomware, supply chain attacks and identity-based breaches aren’t hypothetical risks anymore. They happen to businesses and public sector organisations of every size, across every sector. And the ones that come through them best aren’t necessarily those with the biggest security budgets.
Read Post
seemplicity

The CRA Deadline You Can't Ignore: What Every Company Needs to Fix Before September 2026

Aug 27, 2026 By Kevin Swan In Seemplicity
The EU Cyber Resilience Act (CRA) introduces a 24-hour reporting requirement for actively exploited vulnerabilities from September 11, 2026. For companies selling products with digital elements into the EU, meeting that deadline will require more than compliance documentation — it demands fast vulnerability identification, clear ownership, reliable SBOM visibility, and a remediation process that can move quickly.
Read Post
knowbe4

Warning: Malicious AI Tools Are Spreading in the Criminal Underground

Aug 27, 2026 By KnowBe4 Team In KnowBe4
Criminals are now selling malicious AI tools for use in cyberattacks, according to researchers at Trellix. These tools dramatically lower the barrier for unskilled crooks to launch sophisticated attacks. “In the first half of 2026, the Trellix research team identified multiple distinct AI-related offerings across major underground forums,” the researchers write.
Read Post
knowbe4

Voice Phishing Attacks Target Hedge Fund Employees

Aug 27, 2026 By KnowBe4 Team In KnowBe4
Google’s Threat Intelligence Group (GTIG) is tracking a voice phishing (vishing) campaign that’s targeting hedge funds and financial firms. The researchers attribute the attacks to “UNC6671,” an extortion group formerly known as “BlackFile.” The attackers pose as IT staff informing employees of urgent, mandatory migrations.
Read Post
astra

Autonomous Pentesting for SaaS Companies in 2026: The Complete Guide

Aug 27, 2026 By Jinson Varghese In Astra
You ship to production every day while your last pentest happened 11 months ago. Just say that sentence out loud, and we ought to rest our entire case of autonomous pentesting for SaaS companies right there. Everything below is just the supporting evidence. The mismatch isn’t subtle. Your engineers deploy continuously, your infrastructure reshapes itself weekly, and your security validation still runs on a calendar designed for software that shipped twice a year.
Read Post
Featured Post
Why AI is becoming harder to budget for

Why AI is becoming harder to budget for

Aug 27, 2026 By Katie Barnett, Director of Cyber Security at Toro Solutions In SecuritySenses
For most business technology, the cost is relatively easy to understand. You buy a licence, agree a contract or pay for a certain level of usage, and you have a reasonable idea of what you will spend over the year. AI is making that much harder. As businesses move beyond individual AI subscriptions and start using AI across more of their operations, costs can vary considerably depending on which models are being used, how often they're being used and what they're being asked to do.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.