|
By Pedro Umbelino
Most of the exposure research we publish goes one way. We count some category of internet-exposed devices, the number is bigger than you hoped, and it is climbing. Webcams. Industrial control systems. NTP servers old enough to vote. The story is almost always "there is more of this exposed than there should be, and it is getting worse.".
|
By Emma Stevens
Financial institutions are not short on cybersecurity policies, frameworks, or regulatory requirements. Turning those requirements into a living risk management program can be challenging. Organizations need a program that can keep pace as technology environments expand, cloud adoption grows, third parties are added, and external exposures change. Especially as the threat landscape continues to evolve.
|
By Emma Stevens
AI is quickly becoming one of the most useful tools available to security researchers. Its ability to analyze enormous volumes of data, identify vulnerabilities, reconstruct attacks, connect seemingly unrelated signals, and help defenders respond faster than humans could alone is incredibly beneficial.
|
By Pedro Falé
In this post, we will uncover the “Fuyao Enterprise,” a previously unknown, sophisticated and highly modular botnet operating within Android TV boxes. This operation marks a shift in modern ad-fraud, where automated bots fake both clicks and views to defraud advertisers and ad-networks. While deploying novel tactics and techniques, Fuyao managed to escape public research for several years. Now, its operators openly advertise their network of over 120,000 “AI digital humans.".
|
By Jake Olcott
AI is compressing the cybersecurity timeline faster than most institutions can adapt to it. Not only do security leaders have to deal with this new reality, they have to answer key questions to internal and external audiences about their efforts — including regulators.
|
By Abdullah Al Rashid
Bitsight's annual Ratings Algorithm Update (RAU) has been in effect as of July 16, 2026. In preparation, RAU 2026 Preview was made available in April 2026. As in the past, RAU 2026 is an effort to account for the continuous evolution of the threat landscape the Bitsight security ratings seek to quantify. This year's update is focused on modernizing the rating by improving how it is composed from various risk vectors (RVs). In particular, this entails the following.
|
By Greg Keshian
The security world has a new focus: VulnOps. In response to Mythos, Daybreak, and the other frontier models that are sure to follow, organizations are racing to build permanent vulnerability operations functions that combine vulnerability management with more robust automation. The need for this discipline was always there. But now that AI can discover and help weaponize vulnerabilities at machine speed, the old quarterly-scan-and-patch approach is becoming less viable.
|
By Emma Stevens
TeamPCP is a financially motivated ransomware group tied to software supply chain compromise, credential theft, extortion, and abuse of developer infrastructure. The group is also tracked through aliases including ShellForce, PCPcat, TeamPCP, DeadCatx3, Altered Spider, and PersyPCP. The group has also claimed ownership of CipherForce, which it describes as its private locker.
|
By Emma Stevens
I remember the days when merely saying “AI” was enough to earn glares for bringing up such a taboo subject, almost equivalent to saying “Voldemort.” Now, AI is at the center of many people’s daily lives and certainly at the center of business operations. I find myself using AI for everyday tasks. Unfortunately for security teams, the bad guys are using it too.
|
By Emma Stevens
AI is becoming part of almost everything: customer support, security operations, software development, research, analytics, internal workflows, and, most importantly, drafting emails. AI is increasingly embedded in real business processes, and that creates new risks, not to mention the level of unprecedented access mainly of these platforms to our data. Token torching (a type of Denial-of-Wallet (DoW) attack) is one emerging AI risk.
|
By Bitsight
More data does not always mean better decisions. For TPRM teams, the value comes from actionable, correlated intelligence that helps identify which risks need attention first. In this clip from Three Hard Truths About TPRM, Julie Gaiaschi of TPRA and Vanessa Jankowski of Bitsight discuss how threat context can help organizations prioritize third-party risk, strengthen supply chain resilience, and support business continuity under pressure.
|
By Bitsight
Third-party risk doesn’t wait for annual reviews. Vendor ecosystems change constantly, and risk teams need visibility that keeps pace. In this clip from Three Hard Truths About TPRM, Julie Gaiaschi, CEO and Co-Founder of TPRA, and Vanessa Jankowski, SVP and GM of Bitsight’s TPRM solution, explore why continuous monitoring and real-time visibility are critical for stronger accountability, faster response, and better resilience across the vendor ecosystem.
|
By Bitsight
Not every vendor risk deserves the same level of attention. The real challenge is knowing which risks matter most to the business. In this clip from Three Hard Truths About TPRM, Julie Gaiaschi of TPRA and Vanessa Jankowski of Bitsight discuss why business context is becoming the new filter for prioritizing third-party risk — helping teams focus on continuity, revenue protection, and the vendors that truly impact operations.
|
By Bitsight
Third-party risk management can’t stop at static vendor lists. In today’s interconnected business environment, organizations need to understand the dependencies behind their vendors — including subcontractors, fourth parties, and concentration risks that can affect operational resilience. In this clip from Three Hard Truths About TPRM, Julie Gaiaschi, CEO and Co-Founder of TPRA, and Vanessa Jankowski, SVP and GM of Bitsight’s TPRM solution, discuss why stronger Nth-party visibility is essential for modern third-party risk programs.
|
By Bitsight
Frontier AI is compressing the time between vulnerability discovery and exploitation, making reactive security strategies harder to sustain. In this webinar, Roland Cloutier (Former CISO of of ByteDance & TikTok, ADP, and EMC) and Gabi Reish discuss how security leaders can move beyond patching everything to prioritize real risk, measure cyber readiness, and communicate security posture to the board.
|
By Bitsight
Frontier AI models like Mythos have intensified the urgency to rethink cybersecurity. But for third-party risk teams, the harder question remains: how do we prioritize the actions that actually drive business outcomes? As TPRM becomes more tightly tied to business impact, resilience, continuity, and revenue protection, leaders need a clearer view of the hard truths shaping their programs.
|
By Bitsight
As organizations shift to cloud services and third-party vendors, maintaining visibility and control over cyber risk has become increasingly complex. In this video, we explore one of the biggest challenges facing security leaders today: how to manage cyber risk without full visibility into your environment. Learn why visibility is critical to effective cybersecurity—and how the right data enables organizations to.
|
By Bitsight
The cyber risk landscape is evolving faster than ever—creating new challenges for organizations trying to maintain visibility and control. In this video, we explore why data is the foundation of effective cyber risk management. As risk becomes more dynamic and complex, organizations must be able to: Respond to threats as they emerge—not after the fact Without high-quality, actionable data, managing cyber risk simply isn’t possible.
|
By Bitsight
Vendor relationships don’t stay static—and neither does the risk they introduce. In this video, we break down a common misconception in third-party risk management: that vendor risk remains constant after onboarding. The reality? As vendors grow and their digital footprint expands, risk increases over time. Learn why organizations must move beyond point-in-time assessments and adopt a more modern approach to vendor risk management.
|
By Bitsight
Bitsight is the global leader in cyber risk intelligence, leveraging advanced AI to empower organizations with precise insights derived from the industry’s most extensive external cybersecurity dataset. With more than 3,500 customers and over 68,000 organizations active on its platform, Bitsight delivers real-time visibility into cyber risk and threat exposure, enabling teams to rapidly identify vulnerabilities, detect emerging threats, prioritize remediation, and mitigate risks across their extended attack surface.
|
By BitSight
Cybersecurity ROI isn't about cost savings. It's about how your cybersecurity program helps you achieve your goals while managing risk to a level that your executive team is comfortable with. So if you shouldn't measure success in cost savings, how do you measure it? BitSight is providing five steps that help CISOs and executive teams evaluate their company's cybersecurity performance.
|
By BitSight
Are you overwhelmed by the intricacies of your attack surface? Concerned about the rising risk of vulnerabilities in your and your partners' digital ecosystems? New BitSight research finds that the average vulnerability remediation rate across organizations is about 5 percent per month, sparking concern that the status quo of exposure and vulnerability management is broken. Moreover, organizations face significant challenges in managing vulnerabilities in their extended, third-party ecosystem, and most security leaders do not have the tools to address these emerging threats.
|
By BitSight
Traditional vendor risk management programs are not effective at mitigating risk in ever-expanding third-party networks, and yet 69% of businesses still rely on manual processes. It's time to take your program to the next level. How can you centralize, automate, and streamline your process to manage hundreds of vendors as effectively as you manage ten? Scalable VRM continuously detects, monitors, and mitigates risk, going beyond due diligence and initial assessments to constantly reassess and proactively act on vendor risk.
|
By BitSight
Stop reacting to cyber risk as it comes. BitSight for Security Performance Management empowers security leaders to strengthen cyber resilience over time with objective, meaningful, and evidence-based metrics. Gain insights, drive decisions, and build confidence with our suite of advanced analytics.
- August 2026 (3)
- July 2026 (9)
- June 2026 (16)
- May 2026 (11)
- April 2026 (9)
- March 2026 (12)
- February 2026 (13)
- January 2026 (12)
- December 2025 (15)
- November 2025 (10)
- October 2025 (15)
- September 2025 (12)
- August 2025 (8)
- July 2025 (10)
- June 2025 (7)
- May 2025 (5)
- April 2025 (6)
- March 2025 (6)
- February 2025 (8)
- January 2025 (16)
- December 2024 (10)
- November 2024 (4)
- October 2024 (10)
- September 2024 (8)
- August 2024 (7)
- July 2024 (11)
- June 2024 (8)
- May 2024 (14)
- April 2024 (11)
- March 2024 (6)
- February 2024 (7)
- January 2024 (26)
- December 2023 (4)
- November 2023 (7)
- October 2023 (10)
- September 2023 (11)
- August 2023 (16)
- July 2023 (15)
- June 2023 (13)
- May 2023 (17)
- April 2023 (19)
- March 2023 (7)
- December 2022 (2)
- August 2022 (2)
- July 2022 (8)
Bitsight is a cyber risk management leader transforming how companies manage exposure, performance, and risk for themselves and their third parties. Global enterprises, governments, and organizations rely on Bitsight to prioritize their cybersecurity investments, build greater trust within their ecosystem, and reduce their chances of financial loss. When unrelenting market pressure pushes organizations to uncertainty and caution, they turn to Bitsight to confidently navigate cyber risk and grow with confidence.
Bitsight's universally recognized risk standard and market-leading data provides actionable insights into how companies set and manage to standards and report results to internal and external stakeholders. Built on over a decade of technological innovation, Bitsight's integrated solutions deliver value across enterprise security performance, digital supply chains, cyber insurance, and data analysis.
Bitsight is on a mission to free the global economy from the material impact of cyber incidents.