Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Why Physical Infrastructure Still Matters in a Cyber World

As organizations accelerate cloud adoption and digital transformation, it's tempting to think physical infrastructure is becoming less important. Software-defined networks, virtual machines, and remote access tools dominate security conversations. Yet the reality is more nuanced. Digital systems still rely on physical foundations, and when those foundations fail, even the most sophisticated cyber defenses can unravel.

Cyber War is Already Here. CISOs Must Prepare for Cyber Conflict

Cyber warfare isn’t coming—it’s already here. This conversation on The Cyber Resilience Brief dives into the Fifth Domain of Warfare—and why nation-state cyber activity should matter to every organization. From Russia’s chaos-driven campaigns to China’s long-game persistence, Iran’s retaliatory attacks, and North Korea’s financial theft—your network isn’t a bystander.

How to Protect Telematics Systems from Cyberattacks?

Telematics systems face elevated cybersecurity risks due to continuous connectivity between vehicles, cloud servers, and users. This constant data exchange expands the attack surface across fleet operations, making these systems attractive targets for cyber threats. Cyberattacks on telematics infrastructure can expose sensitive data such as vehicle locations, driver behavior, operational workflows, and personal information. When compromised, this data can disrupt fleet operations, damage trust, and create serious compliance and regulatory risks.

Strengthening Security with Up-To-Date Firewalls: A Guide for MSPs

Network devices that reach their End of Life (EOL) represent a significant risk that many organizations overlook. Beyond the lack of vendor support, they can become open doors for increasingly sophisticated attacks. A recent analysis by CSO reveals that two out of three security breaches originate from outdated firewalls and network devices -‒ with unpatched firmware and vulnerabilities that attackers know inside out.

Savanti: How Agentic AI Supercharge Cato's R&D Efficiency

Savanti is Cato Networks’ internal, agentic AI assistant that blends knowledge from Slack, Confluence, Git, and Jira to provide instant, context-rich answers. Savanti routes each query through an adaptive reasoning workflow by choosing between direct, deep, or multi-step reasoning based on the question’s complexity. Every answer is grounded in real internal context, backed by citations, and evaluated for confidence before being delivered.

How does DDI Central assist in onboarding and managing Cisco DHCP routers within a network?

DDI Central now offers the ability to onboard an organization’s Cisco routers into the application, giving network administrators hands-on control over router configurations and resources. It also enables centralized monitoring of all DHCP leases across the router’s pool ranges. Administrators can add and manage DHCP pool ranges for both DHCPv4 and DHCPv6.

Cato's ASK AI Assistant: Turning Complex Network Operations Into Simple Conversations

Every superhero needs a sidekick. For your network and security teams, that is Cato’s ASK AI Assistant, our new AI Assistant built to help you see, solve, and secure faster than ever. This isn’t a basic Q&A tool. It brings customer-specific information and ability to work with other tools to answer complex questions.

How Permit-All Mode Simplifies Troubleshooting Across Routing and Firewalls

When application traffic fails to reach its destination, teams must determine whether the problem lies in routing, firewall rules, NAT behavior, or a combination of all three. In many environments, these components overlap in ways that make traditional troubleshooting slow and error-prone. Engineers often have to run repeated tests, stage changes, or temporarily disable rules to understand why a flow is being blocked.

Cato CTRL Threat Research: Vulnerability Discovered in Open WebUI Enables Account Takeover and Remote Code Execution (CVE-2025-64496)

Cato CTRL’s Vitaly Simonovich (senior security researcher) has discovered a vulnerability (CVE-2025-64496 with a “High” severity rating of 7.3 out of 10) in Open WebUI in versions 0.6.34 and older. This flaw affects the Direct Connections feature, which lets users connect to external AI model servers (ex: OpenAI’s API). If a threat actor tricks a user into connecting to a malicious server, it can lead to an account takeover attack.

Episode 5 - Detecting DNS Covert Channels in the Wild (Part 1)

In Episode 5 of Corelight Defenders, I, Richard Bejtlich, engage with Corelight's co-founder and chief scientist, Vern Paxson, to delve into the intricate world of DNS covert channels. We explore how adversaries exploit DNS lookups to silently communicate within tightly controlled enterprise environments. Vern explains various methods attackers may use, from encoding data in seemingly benign domain names to manipulating the timing of requests. Our discussion highlights the challenges of detecting these covert channels, especially in the presence of network monitoring.