Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

17 Endpoints, Zero Logins Required: Broken Access Control in AI-Built Apps

We handed four vibe-coding tools (Emergent, Replit, Lovable, Base44) the same prompt for a FastAPI user-management microservice. The spec was explicit: JWT auth, parameterized queries, rate limiting, four-tier role model with per-endpoint scope. Each tool shipped a build, and our flagship autonomous pentest surfaced 137 confirmed vulnerabilities across all four.

bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot

Software supply chain attacks are on the rise, and naturally taking the headlines. But with the rise of localized models and common software embedded into smart “things”, risks may even be hidden in plain sight – or, in some cases, quite literally watching you. Vulnerabilities and malicious packages may extend risks to the unlikeliest of places, demanding change and accountability in even some well-intended innovations.

Data residency for LLMs: what GDPR requires and your three options

Short answer: GDPR does not require personal data to stay in the EU. It lets data leave only with a valid transfer mechanism. Data residency for LLMs comes down to three options: use the EU region of a hosted API, tokenize before the API call, or run the model yourself. Only the third keeps data out of the US in the literal sense. A procurement lead at a European customer sends your team a one-line requirement: “keine Daten in die USA.” No personal data in the United States.

Security Integrations Break in Boring Ways: A Practical Look at Connector Development

Almost any enterprise SOC looks the same from the inside. Cloud platform. EDR. Identity provider. A couple of firewalls. A vulnerability scanner nobody fully trusts. And a SIEM that's supposed to hold it all together. Every tool works fine on its own. They just don't talk to each other. So the analyst becomes the glue. Terrible job for a person. Burns them out fast.

12 Best MCP Security Tools: Which Ones See Local Servers on Developer Laptops?

Model Context Protocol (MCP) servers can read your files, your tokens, and your build scripts. When a server runs as a quiet stdio process on a developer laptop, every gateway, proxy, and SIEM that inspects only HTTP traffic loses sight of it. The NSA's Artificial Intelligence Security Center covered this ground in its 20 May 2026 information sheet on MCP security design, which advises keeping data processing local where possible and separating components by trust level. Running a server locally satisfies the first point. It does nothing for the second unless somebody can see the process.

Hardening Edge Supercomputers: Securing the Deployment of Any Compact AI Supercomputer

Edge AI systems bring data center-class computing into offices, labs, and remote facilities where environmental controls and security practices may vary. Their compact size makes deployment easier, but it also creates new risks involving physical access, local networks, software supply chains, and sensitive data. Securing these systems requires a clear plan that covers the device, its operating environment and every service connected to it.

SMB1001 Certification in Australia: Cost, Timeline and Which Provider to Choose

SMB1001 is a cybersecurity standard that helps small and medium-sized businesses demonstrate their security controls through five certification tiers, from Bronze to Diamond. Dynamic Standards International (DSI) develops the SMB1001 standard but does not issue certificates. CyberCert, its current SMB1001 authorised certifier, manages certification and issues certificates through its digital platform.

DHCP Fingerprinting in Windows: Applying Smarter DHCP Policies for Device Profiling with DDI Central

Enterprise networks host a variety of devices, from workstations and VoIP phones to printers and IoT devices. Each group may have different network configuration requirements, making it increasingly difficult to maintain consistent settings as the network grows. Microsoft DHCP policies help address this challenge by evaluating attributes in DHCP requests and applying configurations based on defined conditions.