Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In 2025, we saw attackers get bolder and smarter, using AI to amplify old tricks and invent new ones. The reality is, innovation cuts both ways. If you have tools, AI is going to make them even more dangerous. Last year proved that every leap forward in technology brings new risks right alongside the rewards. At CyberArk Labs, our mission is to uncover hidden vulnerabilities and provide actionable insights that help organizations fortify their defenses.

PAM solutions increasingly focus on zero standing privilege, just-in-time access, and session visibility to reduce identity-based risk and meet Zero Trust and cyber insurance requirements. Organizations should evaluate PAM platforms based on deployment flexibility, identity integration, and operational overhead.

NIS2 is the EU's comprehensive cybersecurity directive requiring essential and important entities to implement robust risk management, incident reporting within 24 to 72 hours, and supply chain security. Penalties can reach €10M or 2% of global turnover. Netwrix solutions help organizations support compliance through data security posture management, identity management, privileged access management, and audit-ready reporting.

Integrating security into the software development lifecycle (SDLC) is no longer optional. DevSecOps adoption promises to bridge the gap between development speed and security rigor, enabling teams to build secure software faster. However, the path to a mature DevSecOps practice is filled with obstacles. Understanding these challenges is the first step toward overcoming them. This post outlines the top 10 challenges that hinder effective DevSecOps adoption.

Malicious actors use different tactics to launch cyberattacks, commonly referred to as attack vectors. They exploit misconfigurations, weak controls, and other poor security practices to gain unauthorized access to victims’ systems. There is a document co-authored by cybersecurity authorities from various countries, like the US, Canada, the UK, the Netherlands, and New Zealand. It is released by CISA (Cybersecurity and Infrastructure Security Agency).

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! Not following general advice, or skipping calling IT support can be a bad move…

Remember that annoying ‘paperclip’ in Microsoft Word 97? The one that was always trying to help you…Fast forward nearly 30 years and we now have AI. In the race to adopt artificial intelligence, businesses are embedding AI systems into their daily operations, streamlining workflows, enhancing productivity, and centralizing knowledge. But what happens when that very system becomes an attacker’s most valuable asset?

Hardware inventory management is the systematic practice of identifying, tracking, and maintaining an accurate record of all physical IT assets, such as laptops, servers, printers, and network devices, throughout their entire lifecycle, from acquisition to retirement.

The theoretical phase of the Cybersecurity Maturity Model Certification (CMMC) is over. As of November 10, the “Enforcement Era” has officially begun with the activation of Phase 1. For Department of Defense (DoD) contractors, compliance is no longer a future goal—it is a present-day barrier to entry. If you want to bid, you must have your house in order.

The Shai-Hulud npm supply chain incident was a wake-up call for the industry. The attack involved malicious packages containing hidden exfiltration scripts that targeted developers’ machines and CI environments. At Snyk, we watched this incident unfold in real-time, observing how quickly attackers can pivot from one compromised credential to a full-scale ecosystem infection.