Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Q&A between researchers who are improving deepfake detection

In the real world, attackers don't just generate a selfie, submit it, and move on. If one attempt fails, they’ll refine the image and try again. Existing datasets often fail to account for these variations, leading the researchers’ detection models to fall short in real-world scenarios. Zhaofeng Si, a PhD student at University at Buffalo who interned at Persona as a research scientist, and Saatvik Billa, an ML engineer and researcher at Persona, worked together this summer on a fraud taxonomy and a real-world selfie fraud benchmark.

The Massive Existential Opportunity for MSPs and MSSPs in the Age of AI

Non-human identities, machines and AI agents are expanding the cyber attack surface, making visibility and governance challenging for managed service providers. This challenge also creates a distinct avenue for MSPs to grow. At the Elovade UK and Ireland Annual Partner Conference, Keeper Security CEO and Co-Founder Darren Guccione spoke on the importance of securing and governing AI agents – and how Keeper Security is built to do just that in a modern, unified platform.

JumpCloud Workflows from Your AI Client (via MCP Server)

Discover how to run JumpCloud Workflows directly from your AI client using the JumpCloud MCP Server. In this demo, see how IT teams can use natural language to build, manage, troubleshoot, and execute workflows, making IT automation simpler and more accessible. Explore how JumpCloud brings AI-powered automation into your everyday IT operations.

AI Is Calling In Every Risk You've Accepted: Seven Insights From The AI Security Panel: Unfiltered

On October 14th, the afternoon before the AI Security Summit (AISS) flagship event in San Francisco, Snyk hosted The AI Security Panel: Unfiltered. Yahoo Finance's Deirdre Bosa moderated four people who see AI security from very different seats.

Scanning AI Assets: Catching What SCA and SAST Might Miss

Your standard application security tools are designed to protect your software pipeline by checking third-party components for known vulnerabilities (via SCA), analyzing source code for security flaws (via SAST), and scanning for accidentally exposed credentials (using secret scanners). But if a developer drops a SKILL.md file into their coding agent, installs a plugin from a marketplace, or pulls in an APM manifest, your AppSec scanners may not catch it.

Shadow AI Detection Now Extends to Developer Workstations

ZIP files shared between co-workers containing new agent skills, locally-developed MCP servers passed between developers, and locally stored newly-minted agents are all seemingly harmless files that are commonly used in corporate software development environments. Unfortunately, far from being harmless, these locally stored files can contain AI assets that were never detected or registered as an approved artifact in your applications.

Cloudflare Responds to Critical PHP RCE Vulnerabilities: Why WAF Enforcement Matters

Two critical PHP vulnerabilities have been disclosed, potentially exposing millions of web servers to remote code execution. Cloudflare has already responded by deploying emergency WAF protections. For Reach customers using Cloudflare WAF, Reach Drift automatically detected the new rules and confirmed they were enabled and configured to block malicious traffic.