Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A decade ago, the primary focus of TPRM was questionnaire management and distribution, usually done in a simple and manual way, relying on vendors to self-report on their security practices. Today the basic best practices of TPRM have grown to include continuous monitoring and other advanced AI-based capabilities like CVE alerting for third parties as elementary aspects of an effective program.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! Another shop falls to the hackers but this time just the usual password stuffing. People, sort your passwords out.

In a previous blog, we discussed how AI is reshaping software development at every level. This shift means developers need new skills to stay effective. In fact, Gartner predicts that generative AI will require 80% of the engineering workforce to upskill through 2027. So what can today’s developers do to stay ahead? Here are a few steps to consider.

Cybercriminals never rest. Using increasingly sophisticated methods, they continuously turn companies and individuals into victims of their cyberattacks. But what if they were the ones who fell into a trap? Let’s explore the idea of a honeypot, a technique designed to lure hackers and give them a taste of their medicine.

Third-Party Risk Management (TPRM) is a critical function for modern organizations, given the reliance on external vendors and partners. The interconnectedness of digital ecosystems means that a breach at a third party can have severe repercussions for your organization. In a recent Dark Reading survey, 30% of organizations experienced some or many supply chain attacks over the past 12 months, and only 14% of respondents reported themselves confident their supply chain is completely secure.

Hybrid enterprises, defined by the coexistence of on-premises systems and cloud-based solutions, have become the norm in today’s digital economy. The evolution of IT infrastructure and the widespread adoption of cloud environments have dramatically broadened the attack surface. Enterprises face persistent threats including advanced persistent threats (APTs), data breaches, ransomware attacks, and insider risks.

Confidence in Latin America is not just high—it’s active. Only 29% of institutions cited regulatory uncertainty as a barrier (compared to a global average of 41%), and just 7% mentioned lack of internal expertise—the lowest of any region. Over 70% say their infrastructure, including APIs and wallets, is already ready for stablecoin integration, and 86% have partnerships in place to support this shift. This foundation is what enables institutions to move beyond experimentation.

According to a report, 71% of energy industry professionals consider their organizations more vulnerable to OT cyber events than ever. These are private organizations, but the stakes are much higher for government-owned systems. Government-owned energy systems such as national grids, nuclear facilities, pipelines, and strategic reserves are foundational to national sovereignty and public welfare.