Machine identities make up the majority of the over 12.7 million secrets GitGuardian discovered in public in 2024. Let's look at how we got here and how we fix this.

The vendor risk management lifecycle (VRM lifecycle) is an end-to-end system that categorizes critical VRM or third-party risk management processes into three phases: vendor onboarding, ongoing risk management, and continuous monitoring.

When it comes to cybercrime, there are few tactics as useful and widespread as credential theft and the use of stolen credentials. In the 2023 breach of password management giant Okta, it was a set of credentials that jumpstarted the incident — threat actors hacked into an employee’s personal Google account, where they found an Okta customer service account had also been saved.

Imagine: You get an email from your bank alerting you to a suspicious login attempt. It looks identical to their usual security notices, down to the logo and phrasing. You click the link to review the activity, log into your account—and unwittingly hand your credentials over to a cybercriminal. This is the reality of clone phishing.

Welcome to this week’s Cyber Threat Intelligence Summary, where we bring you the latest updates and insights on significant cyber threats. This edition covers an alleged data breach at Ticketmaster, a cyberattack on Synnovis affecting London hospitals, and a data breach disclosed by the BBC. The full reports are available to CYMON users. Request access here.

In the dynamic world of cybersecurity, creating an effective offensive security program is paramount for organizations seeking to proactively identify and mitigate potential threats. An offensive security program encompasses a suite of strategic components designed to test and strengthen an organization's defenses. An effective offensive security program includes various components, such as penetration testing, red/purple teaming, managed vulnerability scanning, and bug bounty programs, to name a few.

I have created a comprehensive webinar, based on my recent book, “Fighting Phishing: Everything You Can Do to Fight Social Engineering and Phishing”. It contains everything that KnowBe4 and I know to defeat scammers. The evidence is clear – there is nothing most people and organizations can do to vastly lower cybersecurity risk than to mitigate social engineering attacks. Social engineering is involved in 70% to 90% of all successful attacks.

APIs are crucial for modern digital businesses because they allow different software systems to communicate and exchange data seamlessly and they are foundational to how modern applications are built. However, they are also vulnerable to cyberattacks because they are widely used. To address this growing threat, organizations are increasingly turning to API protection solutions to protect their valuable data and ensure uninterrupted business operations.

How many times can we say, “It’s been a busy week for the security industry,” before it becomes cliche? We recently discussed changes in the SIEM market, with mergers and acquisitions disrupting the traditional SIEM vendor landscape and XDR vendors introducing new SIEM solutions. This week, we continue to see a range of mixed messages from the market around the future of XDR and SIEM.

Summer 2024 is about to heat up, and you know what that means. Sun, sand, and surf? Don’t forget to pack your swimsuit and sunscreen! Snow cones, strawberries, and s’mores? Mmmm, yes, please! Sightseeing, stargazing, and … scams? Oh my! Oops. Sorry for ending on such a bummer. But summer isn’t all fun and games and, unfortunately, scamming is on the rise. In 2023 alone, scams cost people more than $10 billion.