Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Tines

"Better than the tools we were quoted six figures for": How Tines' finance team built a custom billing app for <$1,000

Sep 21, 2026 By Tines In Tines
At Tines, Salesforce and NetSuite form our core finance and billing stack. But anyone using these tools will be familiar with the issues this set-up presents — it requires manual, time-consuming work to connect data across the two platforms. Over the years, my team evaluated a bunch of solutions to this problem, including third-party tools and NetSuite’s own native offering.
Read Post

One Image to Root Them All - The 443 Podcast - Episode 388

Sep 21, 2026 By WatchGuard Technologies In WatchGuard
This week on the podcast, we break down how a heap overflow in an image-decoding library nobody thinks about became a pull request inside OpenAI's internal monorepo. Three researchers chained it with an OpenAI single sign-on flaw to hijack employee ChatGPT and Codex accounts in under 72 hours; and had an AI write the exploit for them. Before that, we cover the actively exploited maximum-severity authentication bypass in Cisco's Identity Services Engine. Then we close with RatHat, a new Android malware that enables Wireless Debugging, reads its own pairing code from the screen, and asks a commercial AI assistant where to tap.
View Video
opti9

RTO vs RPO: What They Mean and How to Set Them Honestly

Sep 21, 2026 By Mark Mazza In Opti9
Recovery time objective (RTO) is how long a system can be down before the impact becomes unacceptable. Recovery point objective (RPO) is how much data the business can afford to lose, measured as a window of time before the incident. RTO looks forward from the moment things break. RPO looks backward from it. That distinction takes a paragraph to explain and years to get right, because the difficult part was never the definition.
Read Post
knowbe4

Millions of Phishing Emails Use ASCII Smuggling to Bypass Security Filters

Sep 21, 2026 By KnowBe4 Team In KnowBe4
A massive phishing campaign is using invisible Unicode tag characters to evade security filters, according to researchers at Microsoft. This technique, known as “ASCII smuggling,” has grown popular over the past year for launching AI prompt injection attacks, but the same tactic can hide suspicious text in emails.
Read Post
kovrr

The New Agent Control Standard Names the Controls, Not Their Value

Sep 21, 2026 By Kovrr In Kovrr
The OWASP GenAI Security Project unveiled an Agent Control Standard in early September, donated to the project and aimed at runtime enforcement for agentic systems. It sets out that agents should be inspectable, traceable and instrumentable, with declarative hooks and policy enforcement across frameworks. ‍ It answers which controls belong around an agent.
Read Post
kovrr

Why AI Review Cannot Keep Up With the Decision

Sep 21, 2026 By Kovrr In Kovrr
That human review becomes a bottleneck as agents scale is now widely observed. Five or ten agents working in parallel produce more decisions than one reviewer can evaluate, and under queue pressure the review degrades into approval without examination. ‍ The usual response is to move up a level, reviewing intents and boundaries rather than individual outputs.
Read Post
astra

Autonomous Pentesting Is About To Kill Security Abbreviations

Sep 21, 2026 By Ananda Krishna In Astra
I have watched the security industry run a very profitable game with abbreviations for the last decade. The simple way to do it is to invent a category, give it a cool catchy abbreviation, market it as the missing piece of the stack, and repeat. The greatest examples are CTEM, BAS, ASM, and EASM. Every one of them arrived promising to close the gap the last one left open, and every one of them ended up as a line item on a renewal spreadsheet that nobody at the buyer‘s side could confidently defend.
Read Post
astra

Can Autonomous Pentesting Rescue CVE Coverage From Vanity Metric Hell?

Sep 21, 2026 By Shikhil Sharma In Astra
The security industry killed CVE coverage as a credible metric, and it deserved to die. Vendors inflated the numbers for years in the name of depth, and nobody in the room had an incentive to ask whether they reflected real validated risk or just a longer signature list. So “CVE coverage is a vanity metric” became earned consensus. The question I keep coming back to is whether the autonomous pentesting era makes that consensus outdated.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.