Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

With all of that background from parts 1, 2, and 3 of this series out of the way, let's turn to some practical considerations for real-world web applications. The inherent security restrictions for resources, including cookies and JavaScript, assume that each website contains all of its functionality in one neat, isolated package. But websites often contain content and functionality from multiple websites that trust each other.

At the beginning of June 2024, Bitsight TRACE started analyzing a new CISA KEV vulnerability that had just come out, with the goal of creating a detection capability that could be implemented on an Internet-wide scale.

In an era where digital resilience is vital to corporate health, cybersecurity is a critical governance issue. The partnership between Bitsight and Glass Lewis underscores this reality by providing companies with a forward-thinking approach to assessing cybersecurity as part of Environmental, Social, and Governance (ESG) considerations.

In the spring of 2024, amid growing international concern about supply chain risk and the trust and reliability of technology suppliers, the United States banned Kaspersky Lab, Inc., the Russia-based antivirus company from providing its products to the US market. The ban went into effect on September 30, 2024. What impact has the ban had on US and global usage of Kaspersky? Has it been effective? A new analysis from Bitsight contains some surprising results.

Imagine this: you're at home, eagerly waiting for the new device you ordered from Amazon. The package arrives, you power it on, and start enjoying all the benefits of 21st century technology—unaware that, as soon as you powered it on, a scheme was unfolding within this device. Welcome to the world of BADBOX. BADBOX is a large-scale cybercriminal operation selling off-brand Android TV boxes, smartphones, and other Android electronics with preinstalled malware. What does this mean?

This is a continuation of our series on web application security. If you haven't already read through parts 1 and 2, this is a good time to go back. If not, let's move on and answer the question left hanging during our last installment: what are request methods, including the POST request method, and how does logging out of a website work when it comes to cookies and session IDs? Let's also tackle the more important issue of how to combat cross-site request forgery (CSRF) attacks.

Today, I am thrilled to announce the official closing of Bitsight’s acquisition of Cybersixgill, a leading provider of cyber threat intelligence solutions. This is not only a pivotal step in our long-term vision—it’s a reinforcement of our promise to help each and every one of our customers to make smarter, faster risk decisions. Bitsight was founded on the belief that cyber risk is not binary.

Enterprise security is a job that is never truly done. Success comes down to prioritizing high-impact activities, executing them efficiently, and adapting as new information emerges. Bitsight Security Performance Management (SPM) is the centerpiece of this lifecycle for many organizations. It helps security teams understand their external attack surface in detail and make data-driven decisions about how to apply their limited resources most effectively.

SOC 2 compliance is no longer optional—it’s essential to a robust cybersecurity posture and cyber risk management strategy. It’s a key indicator of an organization’s commitment to securing data and maintaining operational resilience. In this blog, we’ll offer insights and recommendations to help your organization stay ahead as part of your overarching cybersecurity compliance strategy.

Thousands of organizations globally rely on the Bitsight Security Rating to prioritize their internal security efforts and ensure that third-party vendors meet their security commitments. While this is a highly strategic activity, progress is often measured in incremental steps as individual security findings are remediated over time.