Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
944 matching stories — announcement, in Breach & Attack Simulation / Pen Testing — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Anthropic shipped Claude Opus 5, and on the Cyber Defense Benchmark it retakes #1 at 45.1% coverage — knocking GLM 5.2 out of the top 5. The bigger story: 0 refusals across all 26 campaigns, an offense-vs-defense capability gap that inverts by task, and Anthropic owning the whole token-efficient defense frontier.
Craig Rosewarne, Managing Director of Wolfpack Information Risk, explains why continuous, AI-enabled validation, paired with human-verified exploitability, gives security leaders a real-time view of what's actually at risk. The post Guest Blog: The Annual Pentest Is No Longer Enough appeared first on Synack.
We ran eight open source AI skill scanners against real attacks. A malicious skill got past all eight, including the current OASB leaderboard leader.
What decides whether a medical device pentest satisfies FDA review isn't how deep you test, it's whether the test was scoped from a threat model first. Here's how threat-model-first scoping of your web app and APIs produces evidence that clears review, under the FDA's 2026 guidance.
Choosing a vulnerability management platform is often viewed as a technical decision. Security teams compare features, evaluate integrations, and review reporting capabilities before selecting a solution that fits their environment. Those considerations are important, but they only tell part of the story. Once a platform is deployed, the conversation shifts from what it can do […] The post How to Measure the Business Value of a Vulnerability Management Platform appeared first on Carson & S
Security teams are already experimenting with AI. They use it to summarize technical information, improve remediation guidance, prepare executive communications, and analyze complex datasets. But when it comes to using AI with live exposure data, many teams have stopped short. Getting useful answers often means exporting findings, copying sensitive information into another tool, manually removing... The post Ask, Analyze, and Act with PlexTrac MCP appeared first on PlexTrac.
IDC has named Rapid7 a Leader in the 2026 Worldwide Managed Detection and Response Service for Midmarket 2026 Vendor Assessment (Doc #US52992326, July 2026). We believe this recognition and research highlights where MDR is heading.Many security programs are still built around a reactive sequence of detect, triage, and respond, but the timelines surrounding modern attacks have changed too quickly for that model to hold up on its own. Time-to-exploit has dropped from two years to 22 hours, while e
Checkpoint Technologies and TestSavant.AI Partner to Bring AI Assurance Testing to Enterprise Customers TAMPA, Fla. and LOS ANGELES, Calif., July 30, 2026 — Companies are putting generative AI into customer-facing products, internal tools, software platforms, and core business processes. Many are moving quickly, while the methods used to test these systems are still catching up. […] The post Checkpoint Technologies and TestSavant.AI Partner to Bring AI Assurance Testing to Enterprise Custo
Why should you? The post Attackers Don’t Respect Vendor Boundaries appeared first on Pentera.
Choosing a Vulnerability Assessment and Penetration Testing (VAPT) company is more than comparing prices or timelines. The quality of the assessment directly affects your ability to identify security weaknesses, prioritize remediation, and demonstrate your security posture to customers, regulators, and business partners. Asking the right questions before signing an agreement can help you avoid incomplete assessments, unclear reports, and […]
Moonshot's new open-weight flagship is #1 on WebDev Arena, beating Claude Fable 5 and GPT 5.6 Sol Max in blind human votes. On the Cyber Defense Benchmark it lands #7 of 22 at 33% coverage — the best Kimi yet, but behind open-weight leader GLM 5.2 on coverage, cost, and speed. Why general capability doesn't transfer to defense, and what would close the gap.
Recon, stolen credentials, hidden C2, and rebuild-or-patch. Four Hugging Face breach decisions that show whether you can catch an attack in progress. Category: News
Europe regulates AI through risk tiers and conformity checks. America accelerates AI through deregulation and infrastructure speed. Both models ask different questions but land on the same gap: neither tells you whether a live AI system actually holds up against real attacks. Enterprise AI security depends on evidence, not paperwork or policy. Continuous, human-validated offensive testing is the layer that both regulatory philosophies are missing and that every organization operating across bord
CISA's Binding Operational Directive 26-04, issued June 10, 2026, replaces the KEV directive with a four-variable risk model: asset exposure, KEV status, exploit automation, and technical impact. CISA publishes three of the four answers generically per CVE. The two that decide whether prioritization is defensible (real exposure and real impact in your environment) can only be proven by testing the asset the way an adversary would. Continuous, human-validated pentesting is built to produce that e
Aug 12, 2026 - Ayush Sethi - See more of your AI. Govern more of it. Prove where you stand.This is a broad release. It widens what FireTail can discover, deepens what it logs, gives governance more reach and more nuance, and pulls your AI risk into a single view. The throughline is the one we keep coming back to: see what AI is running across your organization, govern how it gets used, and be ready to show your posture when someone asks.Here is everything that shipped, grouped by the job it does
Security Advisory Patching Isn’t Enough: SharePoint CVE‑2026‑50522 Attackers are stealing IIS machine keys through a critical deserialization flaw — access that survives the patch. CVSS 9.8 Critical Status Actively Exploited KEV Added July 22 Federal Deadline July 25 — Passed The Short Version A critical SharePoint deserialization flaw is under active exploitation, and attackers are […]
Compare the top SAST tools of 2026 across detection depth, noise, remediation, and enterprise fit Category: DevSec Tools & Comparisons
The scenario is all too familiar for any cybersecurity professional: It’s late in the day, and a critical zero-day vulnerability is disclosed. When this happens, CISOs from every industry immediately turn to their Security Operations Centers (SOC) with the single most important, and often most difficult, question: "Are we exposed?”Answering questions like these when zero-days drop tends to trigger a frantic, high-stress fire drill. Analysts scramble to cross-reference outdated Configuration Mana
Microsoft outage disrupts Azure and Microsoft 365 as OpenAI’s test models escape containment, raising new fears of autonomous cyberattacks. The post The week in breach news appeared first on Kaseya.
FireCompass on HackerOne, US leaderboard highlights.   A three-month live experiment by FireCompass reached top-three positions across multiple HackerOne leaderboards, on a $5,000 monthly budget, less than a junior pen tester’s salary. BOSTON, July 28, 2026 /PRNewswire The cost of advanced offensive security is falling fast. In a three-month experiment on a live, authorized global… Read More »Press Release: AI Pentest Agent Reaches HackerOne’s Top 3 on a $5,000-a-Month Budge
Compare the best XBOW alternatives on six axes: scope, reasoning, autonomy, business context, retests, and closed-loop detection. An honest, dated matrix.
We’re pleased to share that Ridge Security has been accepted into Anthropic’s Cyber Verification Program (CVP), an application-based program that gives approved cybersecurity teams structured access to Claude’s full dual-use capabilities for legitimate […] The post Ridge Security Join Anthropic’s Cyber Verification Program appeared first on Ridge Security.
For years, security operations followed a familiar sequence: detect suspicious activity, investigate what happened, and respond before it caused significant harm. That model developed in a threat landscape where defenders had considerably more time to establish the facts and decide what to do next. In 2019, the average data breach took 206 days to identify and another 73 days to contain, creating a total breach lifecycle of 279 days.As the time between initial access and attacker movement contin
Jul 28, 2026 - Jeremy Snyder - If you've been anywhere near cybersecurity social media this week, you've seen the story: Hugging Face got breached, and the attacker turned out to be an OpenAI model, running as an autonomous agent, during an internal capability evaluation. I don't say this lightly: this is probably the single biggest AI security story of the year so far, and I think it's worth slowing down and actually walking through what happened, because the headlines are going to undersell th
Key Takeaways: If there’s one thing all of us can agree about modern security, it is that penetration testing is no longer a once-a-year activity. Modern attack surfaces do not stay still. New code ships faster, cloud infrastructure is constantly changing, and APIs are multiplying across product ecosystems. To keep up, engineering teams have moved ... Read more
FireCompass Emerging Research. April to July 2026. For one quarter, we ran our AI agent on HackerOne, in the open, competing against human researchers and every other agent hunting the same targets. No lab. No curated benchmark. The agent competed as firecompass-ai on a compute budget of about $5,000 per month. By the July snapshot,… Read More »How FireCompass AI Agents Reached HackerOne’s Top 3 on $5,000 a Month: Full Methodology, Data, and Limitations The post How FireCom
AttackIQ introduced the following scenarios in response to the recently published CISA Advisory (AA26-204A), which details how the Russian state-sponsored adversary known as Laundry Bear has targeted and compromised government and commercial organizations across Western countries through the exploitation of the Zimbra Collaboration Suite (ZCS) since at least July 2025. The post Response to CISA Advisory (AA26-204A): Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users o
In this blog, we will discuss what qualifies as a high-risk environment, why these environments require specialized security assessments, why enterprises trust CERT-In empanelled auditors for security audit of their High-Risk Environments, and risks of hiring Non-Empanelled Auditors in these cases.  What Are High-Risk Environments?  All IT environments don’t carry the same level of risk. Some systems process sensitive information, […]
In part two of our series, learn how attackers can leverage this legitimate tool to achieve undetected, arbitrary code execution as root, and explore the key detection methods you need to protect your Linux and Windows environments. The post Azure VM Command Execution using Third-Party Extensions – Salt Minion appeared first on NetSPI.
With evolving AI threats, traditional defences are no longer enough  Email has long been a point of vulnerability for businesses, but the scale and sophistication of attacks are evolving, posing The post Email security under NIS2 appeared first on Kaseya.
A question every business should be asking is: How quickly can we get back to business if something goes wrong?  Downtime is expensive, and in The post Cyber resilience in the age of NIS2: Why backup is no longer just an IT function appeared first on Kaseya.
How can engineering and development teams prove to security, legal, and compliance teams they have done the hard work to assure agents are trusted and they have been assessed for adversarial robustness before deployment, and that a monitoring system is in place to respond when trust degrades and failures happen - whether because of performance, accuracy, drift, and bias issues?
CovertSwarm has been named a Sample Vendor for Red Teaming as a Service in the Gartner Hype Cycle for XaaS, 2026, published 7 July 2026. Five weeks earlier, the Gartner Hype Cycle for Security Operations, 2026 named CovertSwarm a Sample Vendor in the same category. The post CovertSwarm named in two Gartner® Hype Cycle™ reports in the Red Teaming as a Service category appeared first on CovertSwarm.
How Claude Code permissions and auto mode actually work: the five gates, the classifier's consent model, the rules no approval clears, and cross-session permission laundering.
An OpenAI benchmark agent escaped its sandbox and breached Hugging Face, logging 17,000+ actions. What the evidence shows, what's unproven, and what to fix.
How an OpenAI model chained a zero-day to breach Hugging Face and steal a benchmark answer key, plus the isolation and identity controls that stop it.
Compare the top LLM security tools for AI applications, including Aikido, Snyk, Semgrep, Endor Labs, and Wiz, across code, supply chain, and runtime. Category: DevSec Tools & Comparisons
On July 16, 2026, Hugging Face disclosed an intrusion into part of its production infrastructure. A malicious dataset abused two code-execution paths in the dataset processing pipeline, a remote-code dataset loader and a template injection in a dataset configuration, to run code on a processing…
Key Takeaways Credentialed scanning (also called authenticated vulnerability scanning) is a vulnerability scan that logs into the target system with valid credentials and inspects it from the inside. Instead of poking at open ports and guessing versions from banners, a credentialed vulnerability scan reads the installed package list, patch level, registry keys, and configuration files ... Read more