Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

I recently wrote about how today’s cyber risk is defined less by breakthrough innovation and more by the industrialization of existing weaknesses. Given this, I wanted to dig a little deeper. Over a weekend I conducted some analysis on a longitudinal Aggregate Cyber Risk Index that scores six core threat vectors daily for 1,000 days on a 0–100 scale, drawing on six macro categories.

Every company has a version of the same thing. Sometimes it’s a security wiki. Sometimes it’s a Confluence page. Sometimes it’s a PDF nobody wants to update.

According to Bitsight Threat Intelligence, NoName057(16) remains one of the most visible pro-Russian hacktivist groups conducting distributed denial-of-service (DDoS) attacks against countries and organizations perceived as supporting Ukraine. This matters because the risk can extend beyond direct business ties to Ukraine, and the group may also target organizations that do business with vendors, suppliers, partners, or service providers perceived as supporting Ukraine.

If you run engineering, security, or compliance at an Indian tech company, DPDP compliance is knocking at your door fresh and clean in less than a year. Our aim is not to present scary statistics but to help you recognize the urgency of the matter and become DPDP compliant at the earliest. Since this law safeguards a nation’s data, the DPBI can thus stack penalties across multiple contraventions in a single incident. So stop debating whether the law applies to you; it almost certainly does.

If Gen AI adoption were a drinking game, most companies would be three rounds in and still adding shots. I mean, with a new LLM-powered feature every sprint, agents wired into internal APIs, RAG pipelines indexing everything from Confluence to the HR drive, i.e., fast, exciting, and almost nobody checking what happens when someone hands the model a sentence or a txt.file it wasn’t supposed to receive.

For years, application security ran on a simple assumption: software moves through a lifecycle, and security inspects the artifacts as they travel from development to production. Developers plan, write code, commit it, test it, scan it, and ship it. Every control built, including pull request reviews, CI/CD gates, and post-commit scanning, assumed a human was sitting between each step, making decisions a tool could later check.

Security budgets have never been higher. The average enterprise now runs 50 security tools, and most teams added more last year than the year before. And yet, alert fatigue is at the breaking point. Coverage gaps in mobile and API environments continue to widen. The exploitability problem at the center of most AppSec programs remains unsolved. Breaches keep happening. Risk scores don't move.