Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

4 Easy Standards To Protect Team Data

Protecting team data starts at the workstation level, moving beyond access logs or password policies to secure the physical environment each employee operates in every day. Inconsistency creates immediate exposure points across the office because varying screen habits and device positions generate discrete gaps that software policies cannot close alone.

4 Simple Habits To Stop Email Hackers

Stopping email hackers requires adopting four specific habits: letting AI filter inbound messages, identifying manufactured urgency, verifying requests through second channels, and locking accounts with passkeys. These zero-skill routines block the credential-harvesting tactics that compromise shopping, streaming, and financial profiles. Consider a content creator receiving a brand partnership offer from a recognizable sportswear company. The logo perfectly matches the corporate website, the tone sounds professional, and the message includes a simple link labeled to review the contract.

Top tips: Your work laptop has a life after office hours

Top tips is a weekly column where we highlight what’s trending in the tech world and share ways to stay ahead. This week, we’re taking a moment to talk about what goes on between you, your work laptop and the IT team once you log off for the day. You shut your laptop at the end of the workday. As far as you're concerned, work is over. But for your IT team, their work might just be getting started.

How to Secure Agentic Coding Tools: Cursor and Claude Code

Cursor and Claude Code now read source code, install packages, and push commits with much of the access a senior engineer has, and often with less oversight. Give an agent a prompt to fix a bug, and it may pull a private API key from a config file, pass a customer record into its context window, or send a snippet of proprietary logic to a third-party model provider to reason about the fix. Security teams built policy for developers typing code by hand.

Active Supply Chain Attack on npm Packages (keyv, cacheable): Immediate Mitigation Required

A sophisticated supply chain attack has actively compromised multiple npm packages, including keyv, cacheable, cacheable-request, flat-cache, file-entry-cache, and possible related adapters. Attackers took control of a popular maintainer’s npm account on or before August 4, 2026, and began publishing trojanized package versions containing a preinstall hook (setup.mjs) as a loader.

What is AI harness engineering?

Harness engineering is the practice of building the layer, including code, that turns an AI model from a text generator into an agent that can take actions. In short, an AI agent is a model plus a harness. The model decides what to do next, and the harness makes it happen, connecting the model to tools, context, external systems, and validation. In a lot of practical work, and especially in security work, the harness decides the quality of the output more than the choice of model does.

SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299

On July 30th, 2026, SolarWinds released fixes for a critical Authentication-Bypass vulnerability in Web Help Desk (WHD) tracked as CVE-2026-28323, and a related high-severity Denial-of-Service vulnerability, tracked as CVE-2026-28299. Although no active exploitation has been observed yet, WHD is commonly internet-facing and the authentication bypass requires no credentials, making it a likely target once exploit code becomes available.

Mapping One Control Set to NIST CSF, ISO 27001 and CIS v8

Most security programs answer to three frameworks at once and document themselves three times. A customer questionnaire asks for ISO 27001 evidence, a cyber insurer asks for NIST CSF alignment, an assessor references CIS safeguards, and the same firewall rule gets described in three vocabularies for three audiences. The duplication is self-inflicted rather than required, and a holistic approach to cybersecurity GRC starts by recognizing that one program is being described repeatedly. ‍

Who's Accountable When an AI Agent Makes the Wrong Call?

On a Tuesday morning in Q3, a procurement agent at a mid-market manufacturer approved a $340,000 payment to a vendor account. The vendor name matched the approved-vendor list. The invoice format matched the standard template. The agent verified both, cross-checked the amount against historical purchase orders, and released the payment through the treasury API within eleven minutes of the invoice arriving. No human touched the transaction.