Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Each month brings new evidence that cybersecurity is not just about reacting to incidents but anticipating them. The May 2025 threat landscape highlights the growing need for strategic vigilance, actionable intelligence, and timely intervention. With seventy-seven new vulnerabilities, five active exploits, and an uptick in ransomware activity, the month reinforces one clear message: the risk is real, and the window to act is now.

We’re excited to introduce the Vanta AI Agent—built to supercharge GRC teams. With a deep understanding of your program, the Vanta AI Agent proactively guides you through key workflows and takes action on your behalf, all while keeping you firmly in control. It continuously scans your program for inconsistencies and issues that are easy to overlook and handles the most tedious, repetitive tasks to enhance the overall quality of your program, and maximize your impact.

Executive leadership teams aren’t the only ones keenly aware that a merger or acquisition marks a vulnerable period. Attackers understand that times of change open fresh opportunities—not just to exploit transitional challenges in ERP systems or payroll but to actively capitalise on new financial realities – from manipulating stock prices via reputation damage to zeroing in on a target’s hypothetically more lucrative ransomware payout.

DevSecOps isn’t just a buzzword in 2025 – it’s how modern teams build software without leaving security behind. About 61% of DevOps teams have now adopted DevSecOps practices, meaning automated security checks are embedded throughout development. And for good reason: cyber threats are evolving, from surging open-source supply chain attacks (over 10,000 malicious packages were found in one quarter) to misconfigurations that attackers exploit in cloud infrastructure.

At Zenity, we're deeply committed to helping our customers harness and embrace the power of Agentic AI and citizen development platforms by getting these powerful tools into the hands of business users everywhere, responsibly.

As digital transformation sweeps across the healthcare sector, there has never been more at stake. Healthcare data is worth a lot on the black market. Unlike financial data, which has a short shelf life (accounts can be frozen, and fraud alerts issued), medical records stay fresh for a long time.

Key takeaways Most modern software isn’t built from scratch. It’s assembled from dozens, sometimes hundreds, of external components like open-source libraries, third-party APIs, CI/CD tools, build scripts, and deployment pipelines. This entire ecosystem is what we call the software supply chain. Similar to a physical supply chain, if one weak link breaks, the whole system is at risk.

Credential theft attacks have emerged as the dominant threat vector in 2025, with IBM X-Force observing an 84% increase in emails delivering infostealers in 20241 and credential theft attacks increasing by 703% in the second half2 of 2024. As vulnerability exploitation and credential theft now surpass phishing as the primary initial access methods, organizations must implement comprehensive credential theft prevention strategies to defend against credential-based attacks.

Apex predators in cybersecurity are the top-tier threat actors that most security teams never see coming. These aren’t script kiddies or opportunistic ransomware groups. We’re talking about nation-state APTs, elite criminal syndicates, and sophisticated actors with unlimited budgets and custom toolkits.