The hidden cost of security tool sprawl
Security tool sprawl slows teams down. State of Threat Management data shows how connected workflows help them act on known risks faster.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
944 matching stories — announcement, in Breach & Attack Simulation / Pen Testing — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Singapore & MAS AI Red Teaming Requirement: A Closer Look
Security leaders at key financial institutions in Singapore now have a new line in their compliance calendars: AI-assisted red teaming, a requirement MAS introduced on 1 July 2026. What appears to be a scoping exercise actually asks a harder question, i. e., how does a bank differentiate between another convincing report and one that secures ... Read more
Build or Buy AI Pentesting? 5 Tests to Judge Production Readiness
Before you build an AI pentesting agent, run it through 5 tests for production readiness. Mark Kuhr breaks down what separates a prototype from a system. The post Build or Buy AI Pentesting? 5 Tests to Judge Production Readiness appeared first on Synack.
What Security Metrics Actually Matter?
Security activity doesn’t always equal risk reduction. Learn how attack paths, business impact, verification, remediation speed, and recurrence can show whether CTEM is actually working.
Zero-Day Attack Prevention: Catching Unknown Vulnerabilities Before Threat Actors Do
On September 1, 2026, OpenAI announced that its Astra model had reached the Critical tier for cyber capability under the company’s Preparedness Framework, a first for its systems. While working through an internal benchmark of 20 recently disclosed vulnerabilities in Google’s V8 engine, the model found two zero-days that no one had asked it to ... Read more
22 of 37 surveyed companies that enforce AI agent permissions still have agents sharing credentials
The AI Bill of Materials: What Security Teams Must Track in 2026
Question 14 on the customer questionnaire asks which models process their data and whether any of it was used for training. You can answer for the two systems your team built, and for none of the eleven you did not. An AI-BOM is what closes that gap.
How AI Is Changing the Roles Required in the Security Operations Center
As AI takes on more of the enrichment, correlation, and initial assessment inside the SOC, roles, skills, and KPIs still require deliberate redesign. Security leaders need to decide where automation is dependable, where human judgment should remain decisive, and how teams should be measured when alert handling is no longer the center of the operating modelThe Gartner® report, The Roles Required for the AI-Enabled Security Operations Center (SOC), examines the roles and capabilities Gartner expec
Top endpoint security tools for developers in 2026
Comparing the top endpoint security tools for developers in 2026. We look at Aikido Security, GitGuardian Developer Endpoint Protection, Koi Security, Socket, and CrowdStrike Falcon Category: DevSec Tools & Comparisons
Skyhawk Security mentioned in the 2026 Gartner® Agentic Security: Preemptive Exposure Management Demands AI-Driven Validation and Autonomous Interdiction Report
Skyhawk Security is named as a Sample Vendor in Gartner’s new research, Agentic Security: Preemptive Exposure Management Demands AI-Driven Validation and Autonomous Interdiction, published September 28, 2026. We’re proud of the recognition. In our opinion, it reflects something we have believed since the start: defenders cannot keep up with AI-powered attackers by counting vulnerabilities. They […] The post Skyhawk Security mentioned in the 2026 Gartner® Agentic Security: Preem
Higher education is under siege, and fragmented security is making it harder to respond
Higher education faces a difficult security equation. Universities hold large volumes of sensitive student, financial, health, and research data while supporting open networks, distributed users, legacy infrastructure, and increasingly complex cloud environments. Attackers have taken notice, and the pressure on security teams continues to grow.In Q2 2025, universities faced an average of 4,388 cyberattacks per organization per week, up 24% from the same period in 2024. Nine in ten universities r
Separating Signal from Slop: Triaging CVEs in the Age of AI Security Research
AI-assisted research is flooding the CVE pipeline with bugs that score critical but depend on configurations almost nobody runs. Bishop Fox tested four high-profile Nginx CVEs in the lab, measured real-world prevalence, and explains how to separate actual risk from well-marketed noise.
Six Damn-Vulnerable Apps, One Autonomous Loop
Anyone can find a bug in a deliberately-vulnerable app. The harder question — the one that actually matters in production — is: can you run a real security program end to end and prove a fix held? Find it, prove it’s exploitable, prioritize it, patch it, and re-test to confirm it’s closed. This post runs that whole […] The post Six Damn-Vulnerable Apps, One Autonomous Loop appeared first on Faraday.
Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS
Horizon3 researchers used Anthropic’s Mythos to uncover a chain of cryptographic weaknesses in Rejetto HFS, recover a predictable signing key, forge an admin session, and achieve remote code execution.
Penetration Testing for Compliance Officers: A Non-Technical Buyer’s Guide
Why Pentest Proposals Never Seem to Match A compliance officer receives a request for a penetration test, contacts several providers, and receives proposals that appear to describe completely different services. One covers external IP addresses, another includes applications and APIs, and a third promises audit-ready evidence without explaining what was tested. This guide to penetration […] The post Penetration Testing for Compliance Officers: A Non-Technical Buyer’s Guide appeared f
CovertSwarm named a Sample Vendor for Agentic Red Teaming in the Gartner® Emerging Tech Impact Radar: Preemptive Cybersecurity
The question for security leaders is who's in charge of the agents that test their defenses. We think it should be ethical hackers. That's how we're building our agentic capabilities. The post CovertSwarm named a Sample Vendor for Agentic Red Teaming in the Gartner® Emerging Tech Impact Radar: Preemptive Cybersecurity appeared first on CovertSwarm.
How Web Application Penetration Testing Uncovers Privilege Escalation in Multi-Tenant SaaS Platforms?
Multi-tenant SaaS platforms serve many customers through a shared application, making proper access control and tenant separation important security concerns. A privilege escalation issue can allow a user to access functions, records, or tenant data beyond the permissions assigned to that account. In this blog, we will discuss How Web Application Penetration Testing Finds Privilege […]
Your AI Agent Is Safe. Until It Starts Acting.
Agentic AI Security Model safety is not agent safety. Confusing the two may become one of the more consequential mistakes we make as AI moves from answering questions to taking actions. Agentic AI security is the practice of keeping an autonomous AI agent safe while it acts, not just while it answers. It sits downstream… Read More »Your AI Agent Is Safe. Until It Starts Acting. The post Your AI Agent Is Safe. Until It Starts Acting. appeared first on FireCompass.
Controversial spyware firm Paragon to go public by end of year
The company plans to close the deal around the end of the year at which point Paragon will begin trading on Nasdaq under the REDLattice umbrella.
Skyhawk Security Named in 2026 Gartner® Emerging Tech Impact Radar: CSP Infrastructure and Operations report
Skyhawk Security is proud to be named a Sample Vendor for Intelligent Simulation in Gartner Emerging Tech Impact Radar: CSP Infrastructure and Operations, published September 22, 2026. In our opinion it is the only security-focused company on that vendor list, and we believe that says something important about where cloud defense is heading. In the […] The post Skyhawk Security Named in 2026 Gartner® Emerging Tech Impact Radar: CSP Infrastructure and Operations report appeared first on Sky
AI Pentesting or AI-Powered AppSec? Know What You’re Actually Buying
The security industry is entering a new era of AI-powered security testing.  Agentic AI can reason through applications, identify vulnerabilities, generate exploits, adapt its approach, chain weaknesses together, and validate […] The post AI Pentesting or AI-Powered AppSec? Know What You’re Actually Buying appeared first on Ridge Security.
Zilliz / Attu | 2.6.5
Two vulnerabilities in Zilliz Attu 2.6.5 chain into something serious. Missing authentication lets anyone proxy requests unauthenticated, and a regex bypass defeats the private IP block. Bishop Fox turned both into full Kubernetes namespace takeover in a cloud deployment. Update to 3.0.0 now.
Penetration Testing Vendor Comparison: What Enterprises Should Compare
Why Two “Penetration Testing” Quotes Rarely Mean the Same Thing Most comparisons of penetration testing vendors begin too late. Buyers shortlist several providers, collect proposals, and then try to compare services that were never equivalent in the first place. One vendor may quote for a single application and a final report, while another may include […] The post Penetration Testing Vendor Comparison: What Enterprises Should Compare appeared first on Synack.
Can a Price Manipulation Flaw Break Your E-commerce Checkout? What Web Application Penetration Testing Finds?
An e-commerce checkout handles product prices, quantities, discounts, shipping charges, and payment details, making it a key area for security testing. A weakness in checkout logic can allow unauthorized changes to order values or payment information. In this blog, we will explain how price manipulation can affect e-commerce checkouts, how attackers may misuse checkout parameters, […]
Build better policies based on FireTail’s topic-based guardrails. - FireTail Blog
Sep 30, 2026 - Timo Rüppell - What is changing.As part of our September 2026 update, we’ve made a change. Now, you can only create new topic-based guardrail policies using FireTail's native topics and topic-based guardrails. You can no longer base a new policy on the topic-based guardrails available in AWS.That is the whole change. If you do not build a new topic-based guardrail policy, you will notice nothing at all.What this means for you.Nothing, if you have policies in place today. Existing
Mobile App Security: Reverse-Engineering APKs and IPAs to Uncover Hidden Attack Vectors
Key Takeaways Buried in OpenAI’s evaluations of its GPT-6 Astra model sits a finding that mobile teams should sit with for a minute. The model reverse-engineered compiled software well enough to escape a browser sandbox and chain privilege-escalation flaws on a hardened operating system, according to the company’s published evaluations. Reading compiled binaries used to ... Read more
Translating Pentest Findings into Business Risk the Board Will Act On
How security leaders and service providers can close the gap between technical vulnerability lists and executive action. Security teams today are conducting more testing than ever before, ranging from continuous security assessments and pentesting to red and purple teaming engagements. Yet, despite this constant stream of security intelligence, the deliverable presented to executives and board... The post Translating Pentest Findings into Business Risk the Board Will Act On appeared first on Ple
Weekly Report: New Hacking Techniques and Critical CVEs 21 Sep to 27 Sep 2026
CISA added at least 11 vulnerabilities to its Known Exploited Vulnerabilities catalog between 21 and 27 September 2026, five of them carrying a CVSS score of 9.0 or higher, and all eleven confirmed under active exploitation at the time of addition. At least three of the week’s flaws had public proof-of-concept detail circulating before vendors… Read More »Weekly Report: New Hacking Techniques and Critical CVEs 21 Sep to 27 Sep 2026 The post Weekly Report: New Hacking Techni
Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 21 Sep to 27 Sep 2026
The week of 21 to 27 September 2026 was defined by attackers monetizing access faster than victims could detect it. Bitget lost 351.6 million dollars to a suspected North Korean crew that spoofed its own wallet approvals, ShinyHunters claimed a breach of FBI job applicant data through an unpatched Oracle PeopleSoft zero-day, Gyazo confirmed 23.6… Read More »Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 21 Sep to 27 Sep 2026 The post Weekly Cybersecurity Int
Aikido funds Node.js security
Aikido is an inaugural partner in OpenJS's Security Stewardship Program, funding bug bounties and maintainer support for Node.js. Category: Aikido
Teaching Offensive AI New Movesets
How Novee post-trains offensive reasoning inside the Novee Gym, and turns overlooked small models into capable exploit agents. The post Teaching Offensive AI New Movesets appeared first on Novee.
Horizon3 Earns Cyber Essentials Certification Covering NodeZero EU Network
Horizon3 today announced that it has earned Cyber Essentials Plus certification covering its NodeZero AWS EU network. The network supports Horizon3’s EU data sovereignty site in Germany.
9 Ways AI Risk Platforms Document GenAI Compliance
Ask a team how their GenAI is controlled and you'll get a decent answer. Ask them to prove it—for a specific system, on a specific date—and the room goes quiet. Nine ways platforms generate the evidence as a by-product of the controls themselves.
Stolen AI credentials feed growing LLM proxy economy
The Sentinel Data Lake Is Finally Somewhere You Can Hunt (Mostly)
Sentinel now lets you run KQL against lake-tier data straight from Advanced Hunting, but setting out your shop correctly matters more than you may know.
GroovyGate RCE: Root Access Despite a 403
As threat actors move toward automated zero-day discovery, the defensive side needs the same thing, agents that can hunt for vulnerabilities faster than a human team and find the bugs before someone else’s agent does. Vulnetic has joined that effort, running Sable against open-source…
What Is an ASV, and Why Do You Need One?
If your organization accepts payment cards, protecting cardholder data means meeting specific requirements under the Payment Card Industry Data Security Standard (PCI DSS). For many organizations, one of those responsibilities is ASV scanning. An ASV, or Approved Scanning Vendor, is an organization approved by the PCI Security Standards Council (PCI SSC) to provide external vulnerability […] The post What Is an ASV, and Why Do You Need One? appeared first on Carson & SAINT | Cybersecurity.
Australia didn’t detect the breach. It was told about it.
On June 18, 2026, an OpenAI agent doing what it was told, looking up statistics about Australia, decided the fastest route to the answer ran through a private government statistics portal holding Medicare data. So it went in. Nobody in Australia knew. OpenAI itself didn’t know until August, when a review of misaligned model activity […] The post Australia didn’t detect the breach. It was told about it. appeared first on Skyhawk Security.
Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?
Why Should Web Application Penetration Testing Start Before Your FinTech Product Handles Money?
In this blog, we will discuss how Web Application Penetration Testing can help protect FinTech applications and financial transactions. We will also cover the security checks that should be completed before a product handles money, common VAPT mistakes, production testing practices, and the right time to perform web application penetration testing. Why is Web Application […]