Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

kroll

Azure Monitor Agent Metrics Extension Vulnerability: From Engagement to CVE

Jun 30, 2026 By Kroll In Kroll
This article was authored by Cristhian Parrot from the Kroll Offensive Security Team. Kroll’s Offensive Security Team recently discovered a new vulnerability within Microsoft’s Azure Monitor Agent Metrics Extension, which demonstrates how subtle configuration issues can introduce significant security risks in widely deployed infrastructure components.
Read Post
cyberhaven

How to Discover and Control Shadow AI Agents in Your Environment

Jun 30, 2026 By Bruce Chen In Cyberhaven
Most security programs have a working model for responding to shadow AI: identify the unsanctioned tools employees are using, sanction or block them, and update the acceptable use policy. That model worked, however imperfectly, when the threat was limited to web-based GenAI applications. It does not work when the threat is an autonomous agent, running locally on an endpoint, that reads the file system, calls external APIs, and transmits internal data.
Read Post
acronis

Rethinking IaaS: Why partner cloud is a timely growth opportunity for service providers

Jun 30, 2026 By Allison Ho In Acronis
If you’re a service provider, you’ve probably felt the shift already. Clients are asking tougher questions about cost. Some are frustrated with hyperscaler bills. Others are rethinking VMware. And more are paying attention to where their data lives and who controls it. Put all of that together, and it’s clear: Infrastructure is becoming a strategic conversation again. One that creates both pressure and opportunity. eBook How to build a profitable IaaS business with Acronis Cyber Frame.
Read Post
kovrr

Shadow AI Explained: What It Is, Where It Hides, and What It Costs

Jun 30, 2026 By Kovrr In Kovrr
Shadow AI is the term for AI tools, models, and capabilities that operate within an organization without formal approval, oversight, or governance. It is the enterprise AI equivalent of shadow IT, which is the unauthorized software and cloud services that proliferated as employees found faster ways to get work done than waiting for IT procurement cycles. The difference is that the consequences of unmanaged AI are considerably more significant than those of unmanaged software.
Read Post

Defending the Authentication Flow: Device Code Phishing with Selena Larson

Jun 30, 2026 By Rubrik In Rubrik
Selena Larson, Staff Threat Researcher and Lead, Intelligence Analysis and Strategy at Proofpoint and Host of the DISCARDED podcast, joins host Caleb Tolin to detail the specific mechanics of device code phishing campaigns, revealing how adversaries exploit legitimate communication structures to capture administrative and enterprise access. The discussion centers on the rapid commercialization of cybercrime, highlighting the leak of specialized kits in late 2025 that catalyzed the democratization of sophisticated technical exploits.
View Video

Ep. 4: The Sony Playbook

Jun 30, 2026 By Rubrik In Rubrik
It’s been nearly 12 years since North Korea launched its crippling attack on Sony Pictures Entertainment over a Seth Rogen film. Most Americans remember the celebrity leaks, the embarrassing emails, the Hollywood spectacle of it all. What they missed was the playbook: Why simply hack an organization when you can bleed reputations dry? Turn stolen data into psychological warfare. It was a model that would soon echo everywhere from Russian intelligence operations to modern ransomware gangs.
View Video
miniorange

NIST Privileged Access Management: Complying with the NIST Requirements

Jun 30, 2026 By Stutee Raja In miniOrange
Privileged accounts are the crown jewels of any IT environment. Admin credentials, root access, service accounts. These are what attackers go after first, because compromising one can hand them the entire organization. Forrester puts the number at 80% of security breaches involving privileged accounts. NIST frameworks, particularly SP 800-53, exist to make sure you're not leaving that door unlocked.
Read Post
miniorange

OAuth vs. API Keys for AI Agents: Why Static Credentials Break in Production Systems

Jun 30, 2026 By miniOrange In miniOrange
How do you ensure AI agents authenticate when they interact with your entire enterprise ecosystem when you aren’t there to watch their every move? Today, AI agents can do many things autonomously. They can update CRM records, create tickets, trigger workflows, modify data, and just about anything. The importance of authentication increases as they become more autonomous day by day. For years, API keys were the easy default for connecting applications to APIs.
Read Post
veracode

Top 10 Application Security Risks (2026 Edition)

Jun 30, 2026 By Theo Weismann In Veracode
You already know the threats are getting worse. What’s harder to articulate — especially to leadership — is exactly how they’re getting worse, and what’s slipping through the cracks in your current program. The application security risks your teams face in 2026 are not just more numerous than they were five years ago; they’re structurally different.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.