Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Cloud complexity is growing. So are the risks—and the opportunities. As organizations scale their infrastructure across hybrid environments to innovate quickly, security strategies must evolve just as fast. The rapid adoption of multi-cloud environments and the proliferation of human and machine identities have intensified the challenge.

What does “secure by default” really mean—and is it enough? In this episode of CyberArk’s Security Matters, host David Puner sits down with Scott Barronton, Chief Information Security Officer (CISO) at Diebold Nixdorf, to explore the often-overlooked risks of cloud default settings and how assumptions can lead to vulnerabilities.

Enterprise security teams commonly focus on controlling AI agent conversations through prompt filters and testing edge cases to prevent unauthorized information access. While these measures matter, they miss the bigger picture: the real challenge is granting AI agents necessary permissions while minimizing risk exposure. This isn’t a new problem—it’s the same fundamental challenge we’ve faced with human users for years.

A newly discovered exploit, “ToolShell,” is fueling a wave of targeted attacks against on-premises Microsoft SharePoint servers. The zero-day exploit chains two vulnerabilities—CVE-2025-53770, a remote code execution (RCE) vulnerability and CVE-2025-53771, a spoofing vulnerability that allows attackers to bypass authentication. When combined, this critical zero-day vulnerability gives attackers persistent unauthenticated remote access to on-premises SharePoint servers.

When attackers gain access to a single endpoint—like a developer’s workstation or an HR system—it’s often game over. With some skill and patience, that foothold can escalate into full-blown disruption: stolen data, operational downtime, and brand damage. For years, technologies like application control have served as the frontline defense against this. But in a world rife with rapid change and evolving threats, traditional approaches are showing their age.

The June 2025 disclosure that over 16 billion passwords were leaked has raised significant concerns in the digital community. Reports suggest that many of these credentials are recycled from previous breaches, with a significant number used for business access. This massive data breach highlights the urgent need to strengthen password security. Don’t wait for the next breach to act. Follow these steps to safeguard your data today.

Developers now chart courses through environments as dynamic and unpredictable as open skies, plotting efficient courses through shifting clouds of technology to reach ambitious goals. Increasingly, AI assistants are copilots on these journeys—streamlining workflows, reducing repetitive tasks, and enabling teams to navigate more complex terrain with speed.

At CyberArk, the trust and security of our customers are at the heart of everything we do. Today, July 15th, we are addressing the publication of several Common Vulnerabilities and Exposures (CVEs) related to CyberArk Secrets Manager, Self-Hosted (formerly Conjur Enterprise) and Conjur Open Source (OSS). We regret the challenges this situation may pose to our customers and reaffirm our commitment to supporting them through the resolution process.

What does it take to stay calm in the face of constant cyber pressure—and why does that mindset matter more than ever? In this episode of Security Matters, host David Puner speaks with Den Jones, founder and CEO of 909Cyber, about his transition from enterprise chief security officer (CSO) to cybersecurity consultant.

Modern enterprises are facing an identity explosion. Fueled by cloud adoption, DevOps acceleration, and now agentic AI, the number of human and machine identities is growing faster than most organizations can manage. According to the CyberArk 2025 Identity Security Landscape, 9 out of 10 organizations report a successful identity-centric breach, with relentless and sophisticated bad actors continuing to target identities. Machine identities now outnumber human identities by an astonishing 82:1.

Scattered Spider has emerged as one of the most disruptive advanced persistent threats in recent years, breaching major organizations across telecom, gaming, transportation, and retail. In the last few months, the group has escalated its activity—targeting financial services and launching coordinated ransomware campaigns that have crippled operations and exposed sensitive data.

Alex was the kind of IT administrator who kept everything humming smoothly behind the scenes at QuantumAxis Corp. Servers, user accounts, random requests at 4:55 PM on Fridays—he put out the fires and stayed out of the drama. So, when the CISO asked for a “quick chat,” he braced himself. “Alex,” she said, with zero preamble, “we’ve had too many close calls lately.

Technology is moving at the speed of light, and two forces—quantum computing and AI agents—are poised to shake up cybersecurity. We’re not talking about some far-off future; this is happening now. The message for CISOs and security leaders is simple: If you’re not preparing now, you’re already behind. As we say in Brazil, “Melhor prevenir do que remediar” or “better to prevent than remediate.”