Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

APT-C-60 Exploits Zero-Day Vulnerabilities: Inside the SpyGlace Loader, COM Hijacking, and C2 Infrastructure

The cyber espionage landscape continues to evolve in sophistication and stealth—and among the more notable actors is APT-C-60. In recent months, this adversary has significantly escalated its tactics by leveraging zero-day vulnerabilities and orchestrating multi-stage campaigns to deploy the SpyGlace back-door.

Dynamic Roles, Real Security: Why OnDemand Permissions Beat PreDefined Policies

How context‑aware, short‑lived roles eliminate privilege sprawl and accelerate secure engineering without overburdening admins Access management for remote resources has come a long way from VPNs and bastion hosts. The rise of cloud platforms, microservices and remote workforces has driven a shift toward Cloud-native security controls that integrate directly with AWS, Azure, GCP and Kubernetes.

10 Things to Look for When Choosing an Account Takeover Solution

Account takeover (ATO) fraud has become one of the fastest-growing threats for enterprises. No longer confined to banks, ATO now targets retailers, SaaS platforms, airlines, and any business that maintains digital accounts for customers. The problem? Most enterprises are still relying on outdated defenses like domain takedowns, MFA, and dark web monitoring. By the time these tools kick in, fraudsters have already stolen customer credentials and inflicted brand damage.

What is KeeperAI?

KeeperAITM is an agentic, AI-powered engine embedded within KeeperPAM that delivers real-time threat detection and response, as well as privileged session analysis. Built for Privileged Access Management (PAM), KeeperAI monitors user activity, providing behavioral insights and automated incident response in both live SSH sessions and post-session playback.

Why Mid-Market Organizations Can't Afford to Ignore Open Source Vulnerabilities

There are millions of dollars on the line for companies relying on open source. Failure to stay CVE-free can lead to churn, closed-lost deals, and countless engineering hours wasted chasing fixes instead of shipping features. Unlike enterprises with large budgets and compliance buffers, a single failed review, missed SLA, or unresolved CVE can derail $5M–$20M in just one quarter. This is the difference between hitting growth targets or missing them entirely.

70% of IT and security pros say SSO is falling short - Here's how to close the gap

When IT and security teams lack visibility and control over the SaaS apps employees use, the result is wasted spend, unsanctioned access, and compliance failures. Yet 1Password’s research shows that all too often, SaaS usage is evading the tools meant to govern it.

The New Attack Surface: How to Break (and Defend) Large Language Models

Large Language Models now automate customer support, write code, classify emails, generate content, and - disturbingly - execute tasks through plugins and agents. Once an AI can act on your behalf, it becomes part of your operational infrastructure, not a toy. OWASP’s Top-10 for LLM Applications formalized the threat landscape, and quietly confirmed what security researchers have been yelling for two years.

How Physical Asset Security Strategies from Cybersecurity Apply to Gold Bullion Storage

The parallels between protecting digital assets and physical gold bullion reveal a fundamental truth about modern security architecture: threats evolve, but the principles of defense remain constant. Organizations safeguarding high-value physical assets can extract substantial operational advantage by adopting frameworks originally designed for cyber defense. This convergence of physical and digital security thinking represents a strategic shift in how enterprises approach asset protection.

PCI DSS 6.4.3 Is the Canary in the Coal Mine for Client-side Security

Here's the hard truth: 98% of websites load third-party scripts. Few teams know exactly what scripts are loaded. Even fewer know what those scripts do (what elements in the browser they are interacting with), and a miniscule amount of teams have any control over what those scripts do. When I say "teams" I'm referring to different stakeholders - security engineers, risk & fraud analysts, compliance managers, and even the marketing department. That's one of the challenges of client-side security. Almost every internal department touches the website. It might be the most collectively edited environment that exists in a company.