Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Top 6 Supplier Cyber Risk Assessment Tools for Third-Party Risk Management

Top 6 Supplier Cyber Risk Assessment Tools for Third-Party Risk Management

Feb 5, 2026 By SecuritySenses In SecuritySenses
Your vendors now sit on your cyber perimeter. A single exploited payroll plug-in can become front-page news overnight. In June 2024, the U.S. Justice Department told prosecutors to ask whether companies monitor third-party partners throughout the contract, not only at onboarding. That shift helped shape our review of six purpose-built platforms built for continuous oversight. In the sections ahead, you'll see how each tool automates vendor monitoring, uses AI to cut analyst effort, and helps you keep up with fast-moving compliance expectations.
Read Post
Sponsored Post
Ten threats traditional Antivirus misses (and Next-Gen AV doesn't)

Ten threats traditional Antivirus misses (and Next-Gen AV doesn't)

Feb 4, 2026 By Manish Mandal In ManageEngine
The cybersecurity arena is rapidly shifting and CISOs are locked in a relentless struggle against adversaries who rarely reveal themselves. Traditional antivirus (AV) solutions, which has been the primary shield (and still is for many companies) has reached its 'End of life'. The reason is clear: signature-based protection simply isn't enough anymore.
Read Post
sentrium

Disclosure: SupportCandy Ticket Attachment IDOR (CVE-2026-1251)

Feb 4, 2026 By Theklis Stefani In Sentrium
During independent security research conducted as part of the Wordfence Bug Bounty Program, we identified a broken access control vulnerability in the SupportCandy plugin for WordPress. SupportCandy is a helpdesk and customer support ticketing plugin that enables organisations to manage user-submitted support requests directly within their WordPress environment, including the ability to upload files and exchange attachments through ticket replies.
Read Post
safeaeon

Passwordless Authentication: Where It Strengthens Security and Where It Doesn't

Feb 4, 2026 By SafeAeon Inc. In SafeAeon
Passwords are still used almost everywhere. People reuse and share their passwords without knowing the risks. Attackers take advantage of these situations. Phishing emails and malware are enough to steal a password, and this is how many security incidents start. The problem can be reduced using passwordless authentication. When passwords are removed from the login process, attackers would find it difficult to attack that device or account.
Read Post
securonix

Analyzing Dead#Vax: Analyzing Multi-Stage VHD Delivery and Self-Parsing Batch Scripts to Deploy In-Memory Shellcode

Feb 4, 2026 By Akshay Gaikwad, Shikha Sangwan, Aaron Beardslee In Securonix
Securonix Threat Research has been tracking a stealthy malware campaign that uses an uncommon chain of VHD abuse, script-based execution, self-parsing batch logic, fileless PowerShell injections and ultimately dropping RAT. The attack leverages IPFS-hosted VHD files, extreme script obfuscation, runtime decryption, and in-memory shellcode injection into trusted Windows processes, never dropping a decrypted binary to disk.
Read Post
memcyco

Account Takeover Fraud in 2026: How Attacks Really Happen and How to Stop Them Before Impact

Feb 4, 2026 By Ran Arad In Memcyco
Account takeover (ATO) fraud is a critical threat to digital businesses. Despite heavy investment in MFA and login anomaly detection, many attacks succeed because they bypass traditional safeguards entirely. Modern ATO doesn’t start at the login screen. It begins upstream with pre-login exposure and real-time credential relay, allowing attackers to hijack sessions before traditional defenses even engage.
Read Post
WatchGuard

RIP mVPN: Why ZTNA Is the Future of Secure Access for SMBs

Feb 4, 2026 By Martin Lethbridge In WatchGuard
Once upon a time, the managed VPN (mVPN) was the hero of remote work. Employees worked from the office, servers lived in cupboards, and if you could gain access to the network, you were trusted. Fast forward to today, and that hero has not aged well. Hybrid work is permanent. Cloud apps rule. Attackers are smarter, faster, and annoyingly persistent. SMB IT teams are expected to hold it all together with limited time, limited budget, and zero tolerance for downtime.
Read Post
persona

7 ways synthetic identity fraud is changing in 2026

Feb 4, 2026 By Louis DeNicola In Persona
Synthetic identity fraud used to be a specialty fraud job. Bad actors created synthetic identities by modifying personal information, combining multiple real identities, or combining real and fake information. But building up identities convincing enough to pass muster took time, research, and effort. As a result, you typically saw synthetic identity fraud when bad actors targeted organizations that could pay off in a significant way.
Read Post
foresiet

Why This eScan Antivirus Supply Chain Attack Is a Security Nightmare

Feb 4, 2026 By foresiet In Foresiet
In mid-January 2026, one of the most ironic cybersecurity incidents in recent memory occurred: eScan antivirus software from MicroWorld Technologies began delivering malware to its own users. Attackers gained unauthorized access to a regional update server and quietly replaced a legitimate update component with a malicious version. For roughly two hours on January 20, 2026, systems that attempted to fetch updates received a trojanized Reload.exe instead of a security patch.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.