This year’s Fierce TMF Summit took place in sunny Savannah Georgia, a city known for its ghosts. But the estimated 200 plus attendees of this year’s Summit aren’t afraid of your average ghosts and ghouls: instead, we shudder at tales of inspection findings, unruly document contributors, and other challenges in TMF management.

When a new vulnerability is found, the race is on to either solve it or exploit it (depending on which side you’re on). But while attackers are getting faster, companies not so much. Dev teams take around 215 days to resolve a security vulnerability. The numbers are only marginally shorter when dealing with critical vulnerabilities. This delay is particularly concerning given the rise in zero-day exploits, where hackers take advantage of a security flaw before the organization even knows it exists.

With $109.5 billion of growth expected between now and 2030, the global AI cybersecurity market is booming – and it's not hard to see why. According to a recent survey of security professionals, three-quarters (75%) have observed an increase in cyberattacks. Of these, the research found that an even greater proportion (an overwhelming 85%) blamed AI.

In the last blog on fixing vulnerabilities with Veracode Fix, we looked at SQL Injection remediation in a Java application. Since then, we have released Fix support for Python (and PHP) and launched a new VS Code plugin that includes support for Fix. It seems appropriate, therefore, to look at resolving a problem in a Python app using Veracode Fix in the VS Code IDE. This time let’s examine a simple cross-site scripting (XSS) weakness.

Infrastructure as code (IaC) provides an innovative approach to provisioning and managing cloud infrastructure through code, instead of doing it through manual processes. This foundational shift not only accelerates development cycles but also introduces new dimensions of risk that must be carefully managed. In this article, we'll delve into these challenges and explore strategies to secure IaC environments from potential vulnerabilities and threats. 

Malware loaders, critical for deploying malware, enable threat actors to deliver and execute malicious payloads, facilitating criminal activities like data theft and ransomware. Utilizing advanced evasion techniques, loaders bypass security measures and exploit various distribution channels for extensive impact, threat groups enhance their ability to download and execute various malware types as demonstrated by Smoke Loader and GuLoader, highlighting their role in extensive malware distribution.

Browser security is a set of measures and processes intended to protect users and their data when using web browsers. This includes mechanisms to prevent unauthorized access, safeguard against malicious software and other browser security threats, and ways to protect the privacy of online activities.

IoT devices have become a vital component of worldwide business operations for different industries, including healthcare, IT, transportation, etc. Organizations that invest in IoT deliver more value to their consumers than others. According to a report by Statista, the number of IoT devices is estimated to be 17.08 billion in 2024, and the figure is showing no signs of stopping. But as its usage is continuously increasing, so are the security concerns!

In the last few years, boards have rushed to incorporate Cyber Risk into the Board’s overall risk management duty, without really knowing how effective those efforts have been. For the first time ever, Diligent and Bitsight have partnered to see just how well the effort at the board level is translating into reducing Cyber Risk for their company.

Multi-factor authentication (MFA) is widely recognized as an important control to make our accounts more secure by providing protection beyond just passwords. When MFA is enabled, we tend to think our accounts are safe from unauthorized access — but what if we said it's time to rethink this belief?