|
By Shane Moosa
Researchers recently analyzed 18,000 Claude Code configuration files pulled from public GitHub repositories. What they found was straightforward and alarming: developers are already installing mistyped, misconfigured, and near-identical MCP server names — often without realizing it. The human-error condition that makes typosquatting work was already present at scale before any attacker needed to exploit it.
|
By Shane Moosa
We’ve established the new forensic reality: a massive 72.9% inventory gap exists between the vendors you monitor and those invisible to your security. We have seen the shortcomings of SSO and its inability to holistically monitor all the vendor applications your users engage with, along with a Shadow AI explosion that is compounding both issues. The era of procurement-only discovery is over. To secure the modern cyber workforce, we must pivot from "buying-based" to usage-based discovery.
|
By Shane Moosa
In February 2026, researchers uncovered something that should give every security leader pause. A malware operation called SmartLoader, previously known for targeting consumers who downloaded pirated software, had completely pivoted its infrastructure. SmartLoaders new target was developers, and its new entry point was a protocol most security teams had never heard of. The payload delivered to victims: every saved browser password, every cloud session token, every SSH key on the machine.
|
By Edward Kost
Shadow IT refers to any technology—including hardware, software, cloud services, SaaS applications, or AI tools—used within an organization without the explicit approval of the IT or security department. Shadow IT is rarely malicious. It is usually the result of employees searching for a means of making their workflows more efficient. When sanctioned corporate tools are perceived as too slow, rigid, or complex, users often "self-serve" by adopting unvetted alternatives to meet their deadlines.
|
By Shane Moosa
The classic tradeoff in cybersecurity has always been simple: more visibility at the cost of speed. But today, that tradeoff is breaking down. As attackers leverage AI to find and exploit vulnerabilities at unprecedented scale, the sheer volume of alerts is burying security teams. The result? An expanding exposure gap. It is taking longer than ever to triage and remediate threats, creating a dangerous window between when a tool pings and when a human in the SOC can actually take action.
|
By Revashni Moodley
There’s no way to stop the clock in cybersecurity for InfoSec teams, but you can find ways to manufacture a better way to spend their time. Tiering does just that, prioritizing your team’s most finite resource. But to start, you need better data, and most importantly, better logic to redefine how you work.
|
By Edward Kost
Most organizations need both a cyber-focused TPRM platform and a compliance-focused TPRM platform, but it can be difficult to see where one tool ends and the other begins. If you're currently evaluating TPRM platforms, this guide clarifies the differences between the two.
|
By Revashni Moodley
Cybersecurity doesn’t really have quiet days. Usually, it’s just long stretches of constant noise before realizing you’ve been blindsided. That blindside is a flat list of unprioritized vendors. Without a way to filter what matters when a team needs to mitigate the fallout of a crisis, a vendor inventory like this becomes a compliance-only activity that offers a false sense of security.
|
By Revashni Moodley
The thing about blanket approaches is that they rarely work or scale. The same holds true for third-party cyber risk management. Treating every provider, stakeholder, or partner with the same intensity is neither productive nor cost-effective. While defaulting to treating every vendor at the same risk level is common, it is not a resilient security strategy.
|
By Shane Moosa
Humans have always sought to streamline productivity through the most convenient solutions available, prioritizing speed to stay ahead and gain an edge over the competition. From the assembly line to the cloud, the goal remains the same: do more with less friction. Today, that convenience is synonymous with AI. While these tools have revolutionized how we work, the reality remains that rapid innovation always comes with a hidden cost.
|
By UpGuard
In 2026, a slow assessment is a security risk. Every day spent in manual handoffs is a day of exposure for your organization. Join us at UpGuard Summit to see how our new Risk Automations engine transforms TPRM from a static checklist into an autonomous system. We will show you how to automate everything from vendor follow-ups to instant Jira routing for IT and Legal.
|
By UpGuard
How many new vendors did your team engage with today? If you’re looking at your official procurement list, the answer might be zero. But if you’re looking at employee behavior, the reality is likely much higher. Find out more about the shadow supply chain in our most recent research report: Interested in finding out more about UpGuard?
|
By UpGuard
Shift to a proactive posture and automate outcomes. Explore how our new Risk Automations connects UpGuard to your existing security stack to resolve threats across your ecosystem in real-time.
|
By UpGuard
Modern threats move faster than humans can process. Join UpGuard CISO Phil Ross to discover how to replace manual bottlenecks with a machine-speed operating system for risk that orchestrates vendor, human, and attack surface defenses into one unified strategy.
|
By UpGuard
Eliminate the manual hand-off between business units and security. Learn how our new portal automates the entire onboarding workflow, aligning vendor requests with security reviews from day one.
|
By UpGuard
Modern threats move faster than humans can process. Join UpGuard CISO Phil Ross to discover how to replace manual bottlenecks with a machine-speed operating system for risk that orchestrates vendor, human, and attack surface defenses into one unified strategy. Interested in finding out more about UpGuard?
|
By UpGuard
Jess Hooper, Vice President, Product Get first look at the next frontier of Cyber Risk Posture Management. From AI-agent orchestration to the next generation of our vendor system of record, see how we’re building the future of automated defense.
|
By UpGuard
Banning AI seems logical. Our new report shows why it's failing. The problem? The people you're blocking are often top performers. They're confident, innovative, and willing to work around the rules to get value. This video explains why this paradox changes everything. You can't just block curiosity. You have to harness it. Download the complete (ungated) report.
|
By UpGuard
Managers: When your team needs answers, are they coming to you or to AI? Our new report found 27% of employees now trust AI more than their colleagues or managers. In this video, we break down why banning AI creates a trust vacuum that's fundamentally breaking team structures.
|
By UpGuard
Explore how you can prioritise workforce risk scores with real-time coaching to reduce unsafe behaviour. Interested in finding out more about UpGuard?
|
By UpGuard
You understand the risks that third party vendors pose to your business, and you're ready to do something about it. What are the capabilities you need to understand your cyber risk, manage your vendors, and avoid data breaches?
|
By UpGuard
The fact that one has to "make a case" for Microsoft in the DevOps sphere puts them at a disadvantage, especially competing against major open source options with large community bases and proven performance. But, moving forward, one can expect the gap between Microsoft and other tools to close further, as they continue pressing their business in this direction.
|
By UpGuard
Perhaps your organization is looking to make a transition from traditional IT operations and development practices to DevOps, or you're looking to realign your career path with DevOps to position yourself more favorably to future opportunities. Whatever your motivations are, this eBook will provide you with foundation knowledge for boosting your career with DevOps.
|
By UpGuard
Cybersecurity is officially dead. Worldwide spending on security-related hardware, software and services rose to $73.7 billion in 2016 from $68.2 billion a year earlier, according to researcher IDC. This number is expected to approach $90 billion in 2018.
|
By UpGuard
ServiceNow® customers optimizing their IT service delivery and management processes require deeper context and detail level behind IT asset changes--information the leading help desk automation and incident reporting platform does not provide. In this report you'll learn how UpGuard fills this visibility and awareness gap, keeping ServiceNow® in line with the true state of your environment.
|
By UpGuard
Selecting a security provider is no easy feat-it includes months of designing a company's security strategy, evaluating different solutions, budgeting accordingly, and assuring stakeholders the investment will pay off by keeping their business safe.
|
By UpGuard
DevOps and ITIL should be compared with an eye towards the problem you're trying to solve, with a focus on the tangible benefits you and your team would see from using each.
|
By UpGuard
With the enterprise so dependent on technology and digitized assets, how can it prevent data-related disasters from sinking the business? The answer is by taking a new approach to managing cyber risk as a function of business risk at large. McKinsey calls this "Digital Resilience", but it can simply be thought of as conducting business safely in today's connected environments.
|
By UpGuard
Software engineering is changing and DevOps is at the heart of it. An organization's ability to be responsive to the business requires better collaboration, communication, and integration across IT.
|
By UpGuard
There is no doubt that the DevOps movement has gone mainstream. When even IBM and HP are dedicating sites to it there is no longer any question. If we were to place it on the Gartner Hype Cycle even the most devoted proponents would have to admit that it's rapidly approaching the "Peak of Inflated Expectations".
- April 2026 (7)
- March 2026 (8)
- February 2026 (1)
- January 2026 (4)
- December 2025 (10)
- November 2025 (14)
- October 2025 (8)
- September 2025 (14)
- August 2025 (7)
- July 2025 (2)
- June 2025 (14)
- May 2025 (13)
- April 2025 (11)
- March 2025 (11)
- February 2025 (9)
- January 2025 (4)
- December 2024 (5)
- November 2024 (9)
- October 2024 (4)
- September 2024 (6)
- August 2024 (12)
- July 2024 (11)
- June 2024 (15)
- May 2024 (20)
- April 2024 (28)
- March 2024 (24)
- February 2024 (11)
- January 2024 (22)
- December 2023 (22)
- November 2023 (12)
- October 2023 (23)
- September 2023 (27)
- August 2023 (37)
- July 2023 (23)
- June 2023 (19)
- May 2023 (17)
- April 2023 (17)
- March 2023 (15)
- February 2023 (15)
- January 2023 (9)
- December 2022 (7)
- November 2022 (23)
- October 2022 (13)
- September 2022 (28)
- August 2022 (32)
- July 2022 (6)
- June 2022 (21)
- May 2022 (20)
- April 2022 (16)
- March 2022 (15)
- February 2022 (8)
- January 2022 (12)
- December 2021 (16)
- November 2021 (11)
- October 2021 (9)
- September 2021 (12)
- August 2021 (13)
- July 2021 (6)
- June 2021 (4)
- May 2021 (14)
- April 2021 (7)
- March 2021 (11)
- February 2021 (10)
- January 2021 (4)
- December 2020 (15)
- November 2020 (7)
- October 2020 (17)
- August 2020 (9)
- July 2020 (2)
- June 2020 (8)
- May 2020 (12)
- April 2020 (17)
- March 2020 (19)
- February 2020 (15)
- January 2020 (15)
- December 2019 (10)
- November 2019 (13)
- October 2019 (14)
- September 2019 (10)
- August 2019 (10)
- July 2019 (2)
- June 2019 (1)
- May 2019 (2)
- March 2019 (1)
- November 2018 (4)
- October 2018 (1)
- September 2018 (12)
- August 2018 (2)
- July 2018 (3)
- June 2018 (2)
- May 2018 (5)
- April 2018 (6)
- March 2018 (1)
- February 2018 (1)
- January 2018 (1)
- December 2017 (1)
- November 2017 (1)
A better, smarter way to protect your data and prevent breaches. Our products help security, risk and vendor management teams take control of cyber risk and move faster with confidence.
UpGuard gathers complete information across every digital surface, stores it in a single, searchable repository, and provides continuous validation and insightful visualizations so companies can make informed decisions.
UpGuard then aggregates this information into an industry standard cyber risk score called CSTAR. The CSTAR score is a single, easy-to-understand value representing an organization's aptitude in monitoring compliance, tracking unwanted change, and detecting vulnerabilities in their infrastructure.
Businesses depend on trust, but breaches and outages erode that trust. UpGuard is the world’s first cyber resilience platform, designed to proactively assess and manage the business risks posed by technology.