How to build a continuous pentesting program
A continuous pentesting program scales when you raise your automated baseline, so scarce expert hours go only where a human is irreplaceable.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
417 matching stories — in API Security — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
API Security for Small Business: Enterprise-Grade Protection That Fits Your Team
Key Takeaways Small businesses need API security: 46% of all data breaches hit companies with fewer than 1,000 employees, and […] The post API Security for Small Business: Enterprise-Grade Protection That Fits Your Team appeared first on .
Incident Automation: Benefits, Tools & Best Practices
Key Takeaways Incident automation is software running defined steps of an incident’s lifecycle without a person starting them. It spans the moment a finding becomes a declared incident through to the closed record: paging, enrichment, containment, and the write-up. Each step can be approved independently, although the order in which teams introduce automation matters One […] The post Incident Automation: Benefits, Tools & Best Practices appeared first on Orca Security.
Weekly Threat Report September 1-8, 2026: Magento RCE, Exploited Langflow and Rails Flaws, N-central RMM Risk & the AI/API KEV Surge
The Week in One Line An actively exploited, unauthenticated CVSS 10.0 Magento/Adobe Commerce RCE forced Adobe to issue an emergency […] The post Weekly Threat Report September 1-8, 2026: Magento RCE, Exploited Langflow and Rails Flaws, N-central RMM Risk & the AI/API KEV Surge appeared first on .
NIS2 Compliance in the AI Age: Why Traditional Cybersecurity Isn’t Enough
Discover why achieving NIS2 compliance is more challenging in the AI age, the four key challenges organizations face, and why segmentation is essential.
Introducing Salt Claude Connect: Continuous MCP Server Visibility for Claude Enterprise
For organizations running Claude Enterprise, Salt now has a direct answer.
How Amp got its SOC 2 type II pentest evidence in hours
Amp is building the AI hiring team for frontline employers. Compliance was in the product from day one, which meant a pentest in year one. Here is how they scoped it, ran it in hours with Escape, and made sure they're ready for their SOC 2 Type II audit.
Top 10 DDoS Protection Providers in the USA (2026)
In December 2025, Cloudflare experienced the largest publicly documented DDoS attack ever recorded, reaching 31.4 Tbps. The attack dissipated almost […] The post Top 10 DDoS Protection Providers in the USA (2026) appeared first on .
CMCDv2: Leveling Up Your Video Streaming Telemetry
Elevate your video streaming telemetry with CMCDv2. Discover how Request, Response, and Event modes offer deeper, full-stack insights into viewer performance.
Cloud Transformation Strategy, Benefits & Best Practices
Key Takeaways Cloud transformation is the change an organization makes to how it builds, runs, and funds software once its workloads live in cloud computing environments. It covers the move itself and what the move was meant to enable. Deployment practices change, capacity decisions change, and so does ownership of what breaks at 2 am. […] The post Cloud Transformation Strategy, Benefits & Best Practices appeared first on Orca Security.
What is Cloud Security?
Forecasts predict the global cloud security market will grow from an estimated $46.16 billion in 2026 to approximately $133.39 billion by 2035. At a time when cloud computing represents a requirement for competitive advantage, understanding cloud security is paramount to any organization and tech leader. Cloud security encompasses the technologies and practices that protect your […] The post What is Cloud Security? appeared first on Orca Security.
Inside AI-Powered WAF Detections: Architecture and Safety Controls
Accelerate Migrations: Introducing Direct Fetch for Fastly Object Storage
Accelerate your data migrations with Fastly's new Direct Fetch API for Object Storage. Transfer from S3-compatible sources directly, bypassing client limits.
What are agentic pentesting tools?
Traditional security testing tools excel at applying proven security checks quickly and consistently. Agentic pentesting tools add another dimension: they use AI agents to explore applications, adapt their testing based on runtime behavior, and investigate attack paths that may require multiple steps or changing strategies.... Read more The post What are agentic pentesting tools? appeared first on Invicti.
Indusface WAS AI-Assisted Pentest: Comprehensive Vulnerability Assessment Across Web, API and AI Apps
Manual pentesting samples your risk. Indusface WAS AI Pentest tests every endpoint, role, and workflow, with expert validation on every finding. The post Indusface WAS AI-Assisted Pentest: Comprehensive Vulnerability Assessment Across Web, API and AI Apps appeared first on Indusface.
CVE-2026-0768: Critical RCE in Langflow AI Agent Builder
Critical Langflow RCE (CVE-2026-0768) is under active exploitation via the validate endpoint. Learn the impact, IOCs, and how AppTrana blocks it. The post CVE-2026-0768: Critical RCE in Langflow AI Agent Builder appeared first on Indusface.
Mend Renovate Enterprise: managing dependencies at agentic scale
How Mend Renovate Enterprise keeps dependency updates flowing at agentic scale.
Ten Years, Two Photos, and One Bet That Got Much Bigger
Salt didn’t predict the agentic era. We built for the foundation it would eventually run on. And that original bet has only gotten bigger.
Analyzing a Go-Based IoT Self-Propagating DDoS Botnet
Building Fastly Log Analytics Tools: An Open-Source Approach to Deeper Insights
Gain deeper insights with Fastly Log Analytics. Build an open-source, self-hosted dashboard to own your data, reduce vendor costs, and troubleshoot instantly.
Secure What Agents Do, Not Just What They Say
Salt Security and CrowdStrike give joint customers visibility across the full agentic path, from the model to the system where the action lands
Agents Without Guardrails: Why Agentic AI Governance Must Focus on Behavior, Not Just Identity
Enterprises have spent decades building security around a familiar question: Who are you? Identity and access management (IAM), authentication, service accounts, OAuth tokens, and role-based access controls all start there. Establish identity, assign permissions, and control access. Agentic AI changes the equation. AI agents do not simply access systems. They reason, select tools, call APIs, retrieve […]
Agents Without Guardrails: Why Agentic AI Governance Must Focus on Behavior, Not Just Identity
Enterprises have spent decades building security around a familiar question: Who are you? Identity and access management (IAM), authentication, service accounts, OAuth tokens, and role-based access controls all start there. Establish identity, assign permissions, and control access. Agentic AI changes the equation. AI agents do not simply access systems. They reason, select tools, call APIs, retrieve […] The post Agents Without Guardrails: Why Agentic AI Governance Must Focus on Behavior,
Mini Shai-Hulud hits openapi-react-query-codegen: 10 malicious npm versions
An npm supply chain attack published ten malicious versions
Inside a Sophisticated, Automated Sweepstakes Attack — and How Cequence Stopped It
Some attacks announce themselves with malformed requests and datacenter IP ranges. The most dangerous ones look exactly like your best customers. Cequence recently encountered an incident of the latter kind alongside a major consumer brand — a large, patient, and genuinely sophisticated automated abuse campaign against a high-value prize sweepstakes — and the telemetry is […]
eXate and IBM Sovereign Core Announce a Validated Golden Pattern for Boundary-Controlled Data Flow
eXate and IBM Sovereign Core have announced a validated golden pattern for Sovereign Boundary Control, pairing IBM's sovereign infrastructure with eXate's geo-aware data tagging and context-aware entitlements. Together they govern how data crosses sovereign boundaries — closing the gap between data residency and real data-level control, a discipline that matters even more as sovereign AI scales.
The skill layer is a dependency problem without a lockfile: what the OWASP Agentic Skills Top 10 gets right
Nine solved supply chain risks, one new gap: the OWASP Agentic Skills Top 10.
LLM security testing: how to pentest LLMs and MCP servers
LLM security testing for pentesters: map attacks to the OWASP LLM Top 10, break a vulnerable MCP server locally, and turn what you find into regression tests. Including solutions for enterprise scale.
8 Best API Security Testing Tools in 2026
Compare eight of the best API security testing tools in 2026, including StackHawk, ZAP, Burp Suite, and more. See how they compare on API coverage, authentication, CI/CD integration, pricing, and authorization testing. The post 8 Best API Security Testing Tools in 2026 appeared first on StackHawk, Inc..
Broken Access Control: Examples, Detection, and Prevention
Learn how broken access control vulnerabilities like IDOR and privilege escalation happen, how code review can detect them, and how runtime testing verifies authorization across users, roles, and resources. The post Broken Access Control: Examples, Detection, and Prevention appeared first on StackHawk, Inc..
API Penetration Testing: Methodology, Checklist & Tools
Learn how API penetration testing uncovers BOLA, BFLA, authentication, injection, and business logic vulnerabilities—and why continuous runtime testing helps secure APIs between pentests. The post API Penetration Testing: Methodology, Checklist & Tools appeared first on StackHawk, Inc..
Bring Your Own CA: Introducing the Thales Imperva SSL Integration Center, Featuring DigiCert Trust Lifecycle Manager
Somewhere in your estate right now, a certificate is counting down to its expiry date. Today you probably know which one, because renewals still come around annually and someone owns the calendar. The industry is taking that comfort away: the CA/Browser Forum has voted to cut the maximum TLS certificate lifespan to 47 days by […] The post Bring Your Own CA: Introducing the Thales Imperva SSL Integration Center, Featuring DigiCert Trust Lifecycle Manager appeared first on Blog.
[tl;dr sec] #342 - Figma's Agentic Detection, Agent Identity, Uber's Agent-(E)DR
How Figma scales their detection and response, 1Password and Cloudflare on least privilege and identity for Agents, Uber's paper and OSS repo on monitoring and securing enterprise AI agents
The Cyber Resilience Act and the key role of security testing
Learn what the EU Cyber Resilience Act requires for security testing, how to set a defensible cadence, and where APIs, web apps, LLMs, and MCP fit.
Equixly and Qualys partner to bring exploit validation into vulnerability management
How does the Equixly–Qualys integration work? Exploit-validated API and application findings land in Qualys VMDR automatically, scoped by your asset inventory.
Imperva API Security Token & Authentication Risk Report: Nearly 40% of APIs Face Multiple Authentication Risks
Every year, the security industry publishes benchmark reports built more or less the same way: pick a handful of common vulnerabilities, measure how often they show up, publish the percentages, and move on. We just finished our second year running one of those reports — and the most important thing we found wasn’t a percentage. […] The post Imperva API Security Token & Authentication Risk Report: Nearly 40% of APIs Face Multiple Authentication Risks appeared first on Blog.
SwyftComply AI: How We Turn Vulnerability Flood Into Audit-Ready Protection
SwyftComply AI closes the vulnerability discovery-to-protection gap before attackers exploit it. Autonomous protection, expert-verified, audit-ready. The post SwyftComply AI: How We Turn Vulnerability Flood Into Audit-Ready Protection appeared first on Indusface.
Equixly named an IDC Innovator
Equixly was named an IDC Innovator in IDC Innovators: Autonomous Penetration Testing for DevSecOps, 2026 (Doc #US54175326, July 2026).
CopyEscape: Taking Over Docker Hosts with docker cp
Imperva Red Team uncovered CVE-2026-17106, a container-to-host arbitrary file-write vulnerability in Docker’s docker cp command. Docker later confirmed that the same CVE also affected sbx cp when copying files out of Docker Sandboxes. A malicious container or sandbox could exploit the copy process to create or overwrite files outside the destination selected by the user, […] The post CopyEscape: Taking Over Docker Hosts with docker cp appeared first on Blog.
Corsha Wins Silver Globee® Award for Best Critical Infrastructure & OT Security Solution in the 21st Annual 2026 Globee® Awards for Technology
Recognized for Technology Innovation, Digital Transformation, and Measurable Business Impact