Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Hackers Skipped the Payment Step: BLA 4 is Pure Logic Evasion #transitionvalidation #businesslogic

Missing Transition Validation (BLA 4) is a subtle but devastating threat. It exploits the sequence of steps in your application's workflow. The flaw? Your application fails to check that Step 2 (Payment) occurred before allowing access to Step 3 (Confirmation). The attacker simply draws a line straight to the goal! This attack is: Difficult to Detect: It uses valid requests in an invalid sequence. Tightly Coupled: It's unique to your application's specific logic. You need deep, sequence-aware runtime protection.

Identity is quietly becoming the bottleneck in Automotive

Automotive programs are moving faster than many engineering teams planned for. Regulatory pressure — from UN R155/R156 (WP.29) and ISO/SAE 21434 to the forthcoming EU Cyber Resilience Act — is reshaping expectations for how identity, signing, and software integrity are managed across the entire ECU and OTA lifecycle. At the same time, SERMI is redefining workshop and diagnostic access, introducing strong authentication into processes that were previously loosely governed.

Advanced Data Tokenization: Best Practices & Trends 2025

Breaches got faster. Architectures got messier. And data stopped living in tidy tables. Modern stacks push personal and regulated data through microservices, data lakes, event streams, vector stores, and LLM prompts. Encryption still matters, but it protects containers, not behaviors. As soon as an app decrypts a record, risk comes roaring back.

19 AI Risk Leaders Driving Enterprise Transformation

‍ AI has moved from experimentation to everyday infrastructure, shaping decisions and workflows across nearly every industry. However, in the rush to harness its speed and efficiency, many enterprises adopted GenAI and other AI systems faster than they built the structures necessary to govern them. The result is an all-too-familiar pattern of powerful technology being deployed widely before its risks are fully understood, let alone managed. ‍

EP 20 - Why agentic AI is changing the security risk equation

As enterprises embrace agentic AI, a new security risk equation emerges. In this episode of Security Matters, host David Puner sits down with Lavi Lazarovitz, VP of Cyber Research at CyberArk Labs, to unpack how AI agents and identity security are reshaping the threat landscape. Learn why privileged access is now the fault line of enterprise security, how attackers exploit overprivileged AI agents, and what security teams must rethink before scaling AI. Packed with real-world examples and actionable insights, this is a must-listen for anyone meeting the challenges of AI and cybersecurity.

Enterprise PII Protection: Two Approaches to Limit Data Proliferation

As enterprise data moves across applications, databases, and analytics pipelines, uncontrolled proliferation of PII increases compliance risk and a potential breach. IT leaders and product managers are often struggling to find the best way to protect data. Protecto Vault helps organizations contain this risk by centralizing PII governance and offering two powerful architectural models to minimize data exposure – the Tokenization Model and the Centralized Profile Model.

AI hype & the future of SecOps, what's changed in 30 years? With Erik Bloch from Illumio [271]

On this episode of The Cybersecurity Defenders Podcast we speak with Erik Bloch, VP of Security at Illumio, about better tools to combat burnout rate and discuss the reality of AI in security. Erik Bloch has 30+ years of information and cyber security experience, both as an IC and as a leader of teams. “People first” has always been his approach. He has led entire security and IT functions at smaller companies, and been the CISOs leading big teams at larger orgs.

Snyk Log Sniffer: AI-Powered Audit Log Insights for Security Leaders

Snyk empowers organizations to build fast and stay secure. As security and engineering teams scale their use of Snyk across the enterprise, understanding what's happening across your group and organizations becomes critical–from API integrations and user access patterns to policy changes and security events. However, raw audit logs alone can be overwhelming and difficult to interpret. Security leaders need instant visibility into critical events, risk patterns, and user activity.