Generative AI (GenAI) has the power to transform organizations from the inside out. Yet many organizations are struggling to prove the value of their GenAI investments after the initial push to deploy models. “At least 30% of GenAI projects will be abandoned after proof of concept by the end of 2025, due to poor data quality, inadequate risk controls, escalating costs or unclear business value,” according to Gartner, Inc.

Snyk Learn, our developer security education platform, just got better! We have expanded our lesson coverage and created a new learning path that covers the OWASP Top 10 for LLMs and GenAI, and is entirely free! As AI continues to revolutionize industries, ensuring the security of AI-driven systems has never been more critical.

Following the Sysdig Threat Research Team’s (TRT) discovery of LLMjacking — the illicit use of an LLM through compromised credentials — the number of attackers and their methods have proliferated.

On September 17, 2024, Broadcom released fixes for a critical vulnerability impacting VMware vCenter Server and Cloud foundation, tracked as CVE-2024-38812. This vulnerability is a heap-overflow flaw in the implementation of the DCERPC protocol that a remote attacker can use to send specially crafted network packets to vCenter Server, potentially leading to Remote Code Execution (RCE).

The Cato CTRL and Cato Application Security Research teams recently discovered CVE-2023-49559, a directive overload Denial of Service (DoS) vulnerability in the gqlparser library, which is a crucial component in the development and running of GraphQL applications. The vulnerability is of medium severity (CVSS score of 5.3). The gqlparser library is an integrated component of the gqlgen Golang GraphQL server, widely used in web applications to handle GraphQL queries.

Engineering Leaders are stretched thinner than ever, racing to deliver innovative products and scale operations while securing a complex digital ecosystem across the increasing perimeter of code, DevOps, compliance, and more. Remember the infamous MOVEit attacks that compromised nearly 2,000 organizations, from BBC and Harvard to local government agencies. Over 67 million individuals were affected, underscoring the devastating consequences of such breaches.

An offensive security program is an excellent component of a mature cybersecurity program, but kicking off that process can be overwhelming for some organizations. After all, offensive security has several components, such as Penetration Testing, Red Team exercises, incorporating threat intelligence, etc., so it can be hard to decide where to start. The answer to this dilemma starts with Managed Vulnerability Scanning (MVS).

In the fast-paced world of cybersecurity and system observability, timely and accurate incident investigations are crucial. Whether you’re a SOC admin hunting down vulnerabilities, a developer resolving critical system outages, or a team member tracking Real User Monitoring (RUM) errors, the ability to piece together evidence, understand the timeline, and collaborate effectively is the difference between days and weeks of investigation.

Not every cybersecurity threat originates outside of the organization. External threats tend to receive more attention, but an IBM report shows that a breach caused by an insider threat can carry an even higher cost. In fact, malicious insider attacks cost an average of $4.99 million despite accounting for just 7% of breaches. That makes them the most expensive breach vector in the report.