Think about all the vendors your company pays for. How many do you think there are? Out of those, how many do you think it actually uses? Spendesk examined this question in over 5,000 small- to medium-sized enterprises (SMEs) in the U.K., France, Germany, and Spain. The results were surprising. The study found that the average SME has 800 suppliers. That’s nine times the average SME headcount. What’s more, SMEs are only using about a quarter of them.

Most organizations now recognize that even if they have a strong internal security posture, a security lapse by any one of their many third-party vendors or partners can be just as catastrophic to their business as a direct breach. Industry and government regulators are increasingly focused on this topic as well, resulting in a wave of new compliance requirements that extend to third-party risks.

Healthcare and pharma companies are at the forefront of our most important need as humans: saving lives. To succeed, they require highly skilled staff members, medical equipment, drugs and resources. On top of these, there is another equally crucial component that will determine their ability to perform their jobs: their network. A secure, reliable and high performing network will ensure patient safety, data integrity and operational efficiency.

In this post, we explore a powerful, yet widely unknown attack vector which has emerged in the last couple of years known as ‘Repo Jacking’. During our research, we discovered the enormous potential to compromise software components with tens of millions of downloads across the Terraform IaC (Infrastructure as Code) and Composer (PHP package registry) ecosystems. Despite its power, Repo Jacking remains under-researched and frequently misunderstood.

Workflow automation offers huge potential benefits for security teams, including improved incident readiness, faster time to value, enhanced team retention, and reduced errors. Whether your team is planning to embrace security automation for the first time or enhance an existing program, a clear roadmap is essential. In this post, I'll share a step-by-step guide for security teams looking make the most of workflow automation and the technology that's allowing teams to work even faster, AI.

‍After cyber insurance rates skyrocketed from late 2020 to 2022, when the majority of the market had little choice but to switch to a completely remote way of working, prices have slowly started to drop. This new downward trend is promising, as organizations are increasingly searching for the most cost-effective ways to manage their cyber risks and offset potential losses.

Read also: A Scattered Spider member arrested in the UK, LockBit affiliates plead guilty, and more.

Local administrator rights provide users with unrestricted access to their machines, enabling them to install applications, modify system settings and perform other administrative tasks. While this level of freedom can enhance productivity and flexibility, it also poses significant threats to security, compliance and business continuity. Accordingly, best practices recommend strictly limiting local admin rights.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! I’m sure some of you out are still dealing with the last week’s issue and never want to hear the word CrowdStrike again, well this might have helped.