Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The rise of generative AI has fundamentally changed how we work, create, and collaborate. But as organizations rush to integrate AI tools into their workflows, they're inadvertently creating entirely new categories of data risk that traditional security measures weren't designed to handle.

Cybersecurity weaknesses span both software and hardware systems, creating numerous opportunities for exploitation. Among the most common access vectors leveraged by threat actors are phishing attacks and Common Vulnerabilities and Exposures (CVEs). When left unpatched, CVEs can pose significant risks to an organization’s systems, exposing sensitive data and operational assets to potential compromise.

The speakers at ShowMeCon 2025 explored why policy isn't protection without validation. AI, identity, and threat detection must align to reduce operational risk.

Your IT department just sent out its annual reminder to complete security awareness training. Employees dutifully clicked through their training modules, passed a short quiz, and checked off the compliance box for another year. Ask yourself, does this process really give you confidence that your organization is prepared to dispel today’s security threats? Well, the odds aren’t in your favor.

I hear a lot these days about SBOMs and how they are going to be the key to supply chain security accountability, to even include a Presidential Executive Order mandating SBOMs in the procurement process for federal agencies. There are multiple areas of research going on in this area, such as this Academic SBOM Repository. But before we get too far down the road, let’s get one thing straight: SBOM isn’t going to save us. It’s a transparency tool, not a solution.

A staggering 74% of cybersecurity incidents originate from within, and when looking at insider risk, 82% of incidents result from unintentional actions by well-meaning employees. More people are working from home, bringing their own devices, and connecting globally, which is widening the threat landscape. Attackers are more advanced, as they utilize AI and other technology to make their phishing and hacking attempts more sophisticated.

For the second time in a row, Bitsight has been named an Overall Leader in the KuppingerCole Leadership Compass for Attack Surface Management (ASM)—and it’s not just a title. The report offers a deep dive into how organizations are using ASM to get ahead of cyber threats by proactively managing their digital risk.

On June 4, Asana identified a bug in its Model Context Protocol (MCP) server and took the server offline to investigate. While the incident was not the result of an external attack, the bug could have exposed data belonging to Asana MCP users to users in other accounts.

Did you know that it is estimated that 45% of organizations worldwide will have suffered attacks on their software supply chains this year? Cyber risk is real, and its consequences can be devastating. As digital transformation continues to reshape how businesses operate globally, cyber threats are increasing at a rapid and alarming pace. The term cyber risk refers to the damage posed by these cyber threats.

While we talk a lot on this site about the US Government’s various cybersecurity frameworks, like FedRAMP and CMMC, there’s one significant framework that deserves just as much attention: ISO 27001. ISO 27001, being an ISO standard, is an international framework for cybersecurity divorced from any one country’s government.