Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Most companies believe their security tools—WAF, EDR, API gateways—are enough to stop cyber attacks. But AI has changed the game. AI-powered attacks: –Learn your security patterns–Adapt in real-time–Bypass traditional defenses These tools were built for a predictable world. AI attackers are non-stop, intelligent, and evolving. That’s why even the best security systems are failing against modern AI threats.

HungryClaw… OpenLobster… KrillBox? Shout out to @AlexisGay for shining a light on the fact that shadow IT tools are getting more (shell)fishy—and dangerous—by the minute. According to our own findings, within 90 days of connecting to Vanta, organizations discover ~140 shadow IT tools accessing their environment. That's a lot of claws grabbing at your data. More insights to come! Stay tuned for our new Trust Signals series.

The EU Cyber Resilience Act (CRA) is set to transform cybersecurity—from a best practice into a legal requirement. But what does that "actually" mean for security teams, product leaders, and CISOs? In this episode, host Tova Dvorin and cybersecurity expert Adrian Culley break down the CRA in plain terms—and explain why the shift to continuous security validation is unavoidable. You’ll learn: With enforcement deadlines approaching and significant penalties on the horizon, the message is clear: If your security testing isn’t continuous, it’s not CRA-ready.

This week on the podcast, we discuss Anthropic's Project Glasswing and what the Claude Mythos announcement means to cybersecurity. After that, we cover FrostArmada, a campaign from a Russian GRU-backed threat actor that has compromised tens of thousands of home networking routers. Finally we end with a chat about Google Chrome 146's new feature to protect against session hijacking.