Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The digital privacy landscape is defined largely by two leading regulatory frameworks: the California Consumer Privacy Act (CCPA) and the European Union’s General Data Protection Regulation (GDPR). For businesses with online operations, understanding how the CCPA and GDPR differ is more than just a legal necessity—it’s a strategic imperative.

At first glance, a donut is harmless, maybe even delightful. But take a bite, and you might find something unexpected inside. Raspberry? Custard? Malware? Okay, maybe not malware (hopefully), but that’s exactly how many cyber threats operate: they hide in plain sight, waiting for the moment you drop your guard. This Donut Day, we’re taking a light-hearted look at five cyber threats that appear harmless but pack a punch.

APIs are essential, but they also represent a growing and complex risk to your organization. Intricate application architectures and an ever-evolving threat landscape already make API security a constant challenge. The increasing reliance on APIs by new technologies, including AI, further amplifies this risk.

When it comes to cybersecurity, organizations face an ever-present and often underestimated threat: human risk. Despite significant advancements in technological defenses, human error remains a leading cause of data breaches and security incidents. Industry studies consistently show that between 70% and 90% of data breaches involve some form of human-related cause—whether through social engineering, errors, or misuse.

A KnowBe4 co-worker of mine recently got this SMS phishing message (i.e., smish). They quickly identified it as a social engineering attack and shared it on our internal communication channel for sharing such things. I have had more and more of these types of similar smishes occurring over the last few months. It is an attempt to trick someone into worrying that their Gemini, Gmail, Microsoft, Instagram…or whatever account…is in the middle of being compromised and you need to react NOW! NOW!

The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the U.S. Department of Defense (DoD)’s updated cybersecurity compliance framework and an evolution of CMMC 1.0.

SAST tools automatically scan the source code of an application. The goal is to identify vulnerabilities before deployment. SAST tools perform white-box testing, which involves analyzing the code based on inside knowledge of the application. SAST offers granularity in detecting vulnerabilities, providing an assessment down to the line of code.

On June 4, 2025, Cisco released fixes for multiple vulnerabilities, several of which were noted to have publicly available proof-of-concept (PoC) exploit code. The most severe issue, CVE-2025-20286, affects cloud deployments of Cisco Identity Services Engine (ISE) on Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI).

Our latest State of Secrets Sprawl 2025 research reveals a troubling reality: the majority of leaked corporate secrets found in public code repositories continue to provide access to systems for years after their discovery.