risk management news
16 stories
Mitigate Risks of AI-Generated Apps by Citizen Coders
The increasing use of AI tools by non-technical employees, often referred to as "citizen coders," to develop workplace applications presents significant security and data risks for organizations. While these AI-generated applications can boost productivity and streamline workflows, their rapid creation without proper oversight can lead to "shadow AI" assets with critical vulnerabilities,…
The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations
A recent report on the state of cybersecurity in 2026 indicates that the landscape is being profoundly influenced by the continued expansion of cloud computing, artificial intelligence, and distributed systems. This evolution is driving organizations to prioritize continuous visibility and control over a sprawling infrastructure encompassing numerous identities, devices, and data repositories.
Vulnerability Backlogs Are an Ownership Problem
A recent report highlights that the persistent challenge organizations face with vulnerability backlogs stems primarily from an ownership problem, rather than a deficiency in vulnerability scanning tools. The analysis suggests that while many enterprises have robust mechanisms for identifying security flaws, the subsequent remediation process falters due to an unclear assignment of…
What Is ISPM? How It Differs from IAM, PAM, IGA, and IDaaS
Identity Security Posture Management (ISPM) is emerging as a critical layer in the identity security stack, designed to provide continuous risk assessment and posture management across an organization's identity infrastructure. It is not intended to replace existing Identity and Access Management (IAM), Privileged Access Management (PAM), Identity Governance and Administration (IGA), or…
Shadow AI Poses Hidden Security Risks
The rapid adoption of artificial intelligence tools in the workplace has introduced a new cybersecurity challenge known as "shadow AI," where employees use unapproved AI services for work-related tasks. This practice, a form of shadow IT, is widespread, with some studies indicating that nearly three-quarters of employees have utilized AI tools not sanctioned by their employers.
Why "Shady AI" is Security's Next Big Governance Problem
A recent incident at Meta involving an approved artificial intelligence (AI) agent reportedly exposed sensitive data, bringing to light a new category of security challenge termed "shady AI." This incident underscores a significant governance problem for security teams, as the rapid evolution of AI capabilities and their diverse usage patterns within organizations are outpacing traditional…
Agentic AI Presents New Insider Threat Model for Orgs
The emergence of agentic AI systems is reportedly introducing a novel insider threat model for organizations, compelling a re-evaluation of established security paradigms. These autonomous AI entities, increasingly integrated into core business processes, are said to present risks akin to those posed by malicious or compromised human insiders. This development underscores the need for…
Rapid7 and Licencias OnLine Partner for Latin American Cybersecurity
Rapid7, a cybersecurity solutions provider, has announced a new strategic distribution partnership with Licencias OnLine (LOL) to expand its reach across Latin America. The collaboration aims to provide organizations in the region with enhanced cybersecurity operations platforms and support as they navigate increasing digital transformation, cloud adoption, and the integration of artificial…
CISA Issues Fresh SBOM Guidance. Did They Get It Right?
The Cybersecurity and Infrastructure Security Agency (CISA) has reportedly issued updated guidance concerning Software Bill of Materials (SBOMs), incorporating roughly two dozen modifications intended to improve their overall comprehensiveness. These revisions are presented as an effort to provide more detailed information within SBOMs. However, some observers have expressed reservations,…
Post-quantum cryptography (PQC) migration workshop report
The National Cyber Security Centre (NCSC) and Vodafone, in collaboration with the National Cyber Advisory Board, recently hosted the inaugural UK government and industry workshop on post-quantum cryptography (PQC) migration. The December 2023 event brought together security leaders and PQC specialists from various sectors, including industry, academia, and government, to address the complex…
Blind Trust in AI Creates Cybersecurity Risks
A recent report highlights a growing cybersecurity concern stemming from an overreliance on artificial intelligence models, specifically when these models are granted both interpretive and executive authority without human intervention. The core issue identified is the absence of critical human oversight in the loop, which can pave the way for unintended security vulnerabilities and potential…
Tennis Analogy Highlights Cybersecurity's Imperfect Nature
A China-linked threat actor, UAT-7810, is actively expanding its network of Operational Relay Boxes (ORBs) by exploiting known vulnerabilities in unpatched Ruckus and ASUS routers. The group is deploying a new set of custom malware, including updated versions of the "LONGLEASH" and "DOGLEASH" backdoors, to establish covert infrastructure for other advanced persistent threat (APT) groups.
Operationalizing Day Minus Seven: The Cloud-Native ROC
The cybersecurity landscape is rapidly changing with the advent of advanced AI models, leading to an era dubbed 'Day Minus Seven.' In this new paradigm, AI can discover, chain, and exploit vulnerabilities at speeds that outpace traditional security workflows. The primary challenge for security teams is no longer identifying vulnerabilities but rather discerning which exposures are genuine,…
5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management
Cloud Security Posture Management (CSPM) is undergoing a significant transformation, moving beyond its traditional role of periodic compliance checks to become a continuous, risk-based governance layer integrated into Cloud Native Application Protection Platforms (CNAPPs). This evolution is driven by the increasing interconnectedness of cloud environments and the demand for faster risk…
A Day With Your Vector Command Red Team Pod
A dedicated team of five security operators, functioning as a "Vector Command pod," provides continuous red teaming services designed to simulate real-world adversary behavior and uncover risks within a customer's environment. This approach aims to offer a more dynamic and actionable understanding of an organization's security posture compared to traditional point-in-time assessments.
Improving security posture across the Microsoft partner ecosystem
Microsoft is implementing a new strategy to bolster security across its extensive partner ecosystem, with a particular emphasis on Cloud Solution Providers (CSPs). These partners play a vital role in the deployment and ongoing management of Microsoft's cloud services, including Azure and Microsoft 365. The company's initiative aims to ensure the partner network maintains a high standard of…