Organizations often find themselves caught in a perpetual cycle of identifying, prioritizing, and mitigating vulnerabilities that pose the most risk. Amid this ongoing battle, a significant challenge is often overlooked: security debt. Much like technical debt, security debt refers to the accumulation of unresolved vulnerabilities within an organization’s systems and software.

Data security leaders, take note: Nightfall has emerged as a frontrunner in G2's Fall 2024 reports, securing top positions in Data Loss Prevention Software, Data Security Software and Sensitive Data Discovery Software categories. This achievement reflects our unwavering commitment to excellence, as well as your trust in our AI-powered solutions. We extend our deepest gratitude to our valued customers and supporters, as your feedback helps us to drive innovation.

John Lennon popularized the phrase, “Life is what happens when you’re making other plans.” And that’s an apt characterization for how we think about threat intelligence. We tend to focus on it to block or alert-on an attack. Meanwhile life is what’s happening to our threat intel while we’re making these plans. When we don’t pay attention to the threat intelligence lifecycle, we can run into trouble.

A phishing campaign is targeting GitHub users with phony CAPTCHA pages, according to researchers at McAfee. The phishing emails ask users to address a security vulnerability in a GitHub repository that they recently contributed to, and contain a link to find more information about the alleged vulnerability. This link leads to a fake CAPTCHA page that attempts to trick them into installing malware.

While today’s AI is focused on user-agent interactions, the real revolution is on the horizon, where AI agents will increasingly communicate, collaborate, and share data amongst agents. This shift brings unprecedented opportunities and new and complex data protection challenges.

Security operations teams face escalating demands to promptly detect and respond to third-party cyber threats, largely due to the increasing number of data breaches occurring within an organization’s supply chain. An effective program to manage this type of cyber risk is essential for safeguarding sensitive data and maintaining business continuity.

A high severity OS command injection vulnerability, CVE-2024-8190, has been found in Ivanti Cloud Services Appliance (CSA) versions 4.6 Patch 518 and earlier. This flaw allows attackers with admin access to remotely execute malicious commands, potentially taking full control of the system. Ivanti has already released updates, but this command injection vulnerability is actively exploited in the wild, making immediate action critical.

As a security professional considering a robust bot defense strategy, it’s important to understand the ever-evolving nature of bot threats and the critical need for a scalable, robust solution. Traditionally, businesses rely on agent-based bot management solutions, also known as client-side or front-end detection, by deploying small pieces of software (agents) on customer devices to detect malicious activity. However, these approaches carry significant risks.

Security practices in DevOps have evolved from being a minor concern to one of the main focus points, which resulted in the DevSecOps movement. It’s about “shifting security to the left” in the software development lifecycle – so the security measures are a fundamental component. Traditionally, security management was moved to the final stages of developing software, and it has proven its ineffectiveness in dealing with the challenges of modern software projects.

Industrial Control Systems (ICS) have become a ubiquitous part of modern critical infrastructure. Automatic Tank Gauge (ATG) systems play a role in this infrastructure by monitoring and managing fuel storage tanks, such as those found in everyday gas stations. These systems ensure that fuel levels are accurately tracked, leaks are detected early, and inventory is managed efficiently.