Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,046 matching stories — in Breach & Attack Simulation / Pen Testing — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Penetration testing proposals are rarely easy to compare. One vendor prices by application, another by testing days, another by credits, and another by AI test runs. Choosing the right penetration testing vendor therefore requires more than comparing report length, brand recognition, or the initial quote. This guide provides an enterprise checklist and weighted scorecard for evaluating scope, methodology, tester quality, finding validation, reporting, remediation, governance, and total program c
Two critical vulnerabilities in Veeam Service Provider Console chain into unauthenticated remote code execution on the management server sitting above every tenant's backups. Bishop Fox confirmed the full chain end to end, breaks down both root causes, and shares a safe detection tool and IOCs.
A sad start Last year one of my colleagues, Ken, received the sad news that a father of a friend had passed away. He was a tech-savvy gentleman and had invested in smart tech to make his and his family’s life easier and, just as we recommend, he used strong and unique passwords everywhere. He stored all his passwords in an encrypted Excel spreadsheet… the […] The post Estate planning of credentials appeared first on Pen Test Partners.
Most software runs on decisions nobody made. We talk about why gating, pinning, backporting, and SBOM upkeep only work if someone actually owns them. Category: News
Aikido Security has achieved ISO 42001 certification, the global standard for AI governance, covering AI pentesting, Code Security Audit, and Deep PR Review. Category: Compliance
A failed security audit can delay compliance projects, customer onboarding, product launches, and business growth. In many cases, the problem is not the organization’s security program alone, it is also the quality and depth of the security assessment. An incomplete security audit can leave important risks undiscovered and create additional work later. In this blog, we’ll discuss the common reasons security […]
Aikido's agents pentest your Android app and its backend in a single whitebox assessment. You get reproducible findings, AutoFix, and retests for every issue. Category: Product & Company Updates
Key Takeaways ModeloRAT is a Python-based Windows Remote Access Trojan first observed in January 2026 targeting domain-joined hosts. The CrashFix campaign delivers it through a fake NexShield Chrome extension that crashes the browser, then shows a repair prompt. C2 traffic uses HTTP port 80 with RC4 encryption, zlib-compressed JSON, and adaptive beaconing intervals. Eight command types give operators full remote code execution, payload deployment, self-update, and clean implant termination. The
Alibaba's 27B open-weight model ties GPT-5.6 Luna at 52 on the Artificial Analysis Intelligence Index, then finds 10.6% of a real attack at 3x the cost.
A few years ago, Dow's cyber engineering team made the switch from point-in-time pentesting to continuous coverage for their high-value assets. How'd they do it? By partnering with Synack. And keep in mind this was before the recent wave of AI-powered pentesting solutions. Dow was ahead of the curve. The post How Continuous Pentesting Became Standard Practice at Dow appeared first on Synack.
CISA added 9 vulnerabilities to the Known Exploited Vulnerabilities catalog between 17 and 23 August 2026, across five separate batches. Seven of the nine carry CVSS scores of 9.0 or above, all nine have confirmed in-the-wild exploitation, and one, the Microsoft SharePoint flaw CVE-2026-55040, was exploited within days of a public proof of concept. Patch… Read More »Weekly Report: New Hacking Techniques and Critical CVEs 17 Aug to 23 Aug 2026 The post Weekly Report: New Hacking T
The week of 17 to 23 August 2026 was defined by stolen and sprayed credentials doing the work that malware used to do. France’s tax authority DGFiP confirmed that attackers used compromised access points to extract data on 678,000 individuals. A threat actor calling themselves TheHatman put 3.64 million employee records from Fortune 500 Azure… Read More »Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 17 Aug to 23 Aug 2026 The post Weekly Cybersecurity
This year we took an important step as a company: Faraday landed in Chile. And we did it the right way — with boots on the ground and a presence at one of the region’s leading cybersecurity events, CyberSec 2026. Here’s how it went. A new chapter for Faraday in LATAM Expanding our presence across […] The post Faraday in Chile: our CyberSec 2026 recap appeared first on Faraday.
Horizon3 appoints federal go-to-market veteran Chad Keefer as Vice President of Federal Sales to lead growth across civilian, defense, and intelligence agencies.
We are excited to announce that Skyhawk Security has been named a finalist in SiliconANGLE’s 2026 TechForward Awards in the AI-Powered Threat Detection category category. Skyhawk Security, a pioneer in AI-based cloud security, delivers an autonomous, preemptive cloud security platform that detects threats before they become breaches. Traditional threat detection tools alert after an attacker is […] The post Skyhawk Security named an AI-Powered Threat Detection Category Finalist in the Sili
New conversational, agentic AI platform unifies data security, attack surface management, and attack-path mapping into a single system that reasons, decides, and acts at machine speed — before a breach can occur. MIAMI, FL — August 25, 2026 — CYBRAL today announced the launch of CYBRAL ONE, an agentic AI platform built to help enterprises and small organizations move from reactive defense to pre-emptive cybersecurity. Simple to operate and requiring no technical expertise, CYBRAL ONE gives...
Mythos readiness is a security program's proven ability to withstand attacks weaponized at the speed of frontier AI models such as Anthropic's Claude Mythos, where disclosure-to-exploit is measured in hours rather than weeks. A Mythos-ready organization can show which controls hold, which do not, and what evidence backs each decision to patch, mitigate, monitor, or accept.
Learn how the Horizon3 CTEM Operating Loop and NodeZero turn Continuous Threat Exposure Management into a repeatable process for discovering, validating, prioritizing, remediating, and verifying exploitable exposure.
Sep 11, 2026 - Ayush Sethi - What your workforce's AI prompts reveal in aggregate Most AI security controls judge one prompt at a time. We built Topics to read the layer above them, where a workforce's prompts add up into a pattern that no single message shows.Someone in your legal team pastes a contract that is still under negotiation into an AI tool and asks it to flag any clauses that put you at a disadvantage. To every control watching that message, it is a document question. There is no PII
For Choosing a CERT-In empanelled auditor, organizations also need to assess the auditor’s technical expertise, testing approach, industry experience, reporting quality, and support after the assessment. The wrong choice can result in incomplete testing, unclear findings, or delays in meeting security and compliance requirements.  In this blog, we cover the common mistakes organizations should avoid when selecting a […]
TL;DR How we ended up here My colleague Adam Bromiley and I recently tripped over one of those ‘What!?’ findings. We could completely break an IT-OT segmentation without having to do … anything.  We were on an OT-focused engagement, working out of a control room. We use a risk-averse methodology for these engagements, so we began with passive monitoring and low-risk […] The post One SSID To Rule Them All appeared first on Pen Test Partners.
Six vendors, six spreadsheets, every box green—and the matrix still can't tell you which platform actually discovers shadow AI. Evaluate against your real obligations instead, across the six dimensions that separate platforms from pitch decks.
The ransomware gang Gunra has been creating havoc - exploiting unpatched VPNs and firewalls to steal data, encrypt systems, and extort victims across healthcare, finance, manufacturing, and more. Read more in my article on the Fortra blog.
Will AI replace penetration testers? An AI agent beat 9 of 10 pros in a Stanford, CMU and Gray Swan AI study. What it still cannot do, and why it matters.
NetSPI introduces EchoBench, a human-calibrated benchmark for autonomous AI web app pentesting. EchoBench measures finding fidelity, difficulty-reach, OWASP breadth, and repeatability to accurately gauge AI security capabilities against real human outcomes. The post Introducing EchoBench: A Human Calibrated Benchmark for Autonomous Pentesting appeared first on NetSPI.
As AI-driven identity verification becomes the front line of defense against fraud, this piece breaks down how to stress-test these systems, from building synthetic IDs and deepfake voices to uncovering the gaps attackers are most likely to exploit. The post Verifying the Verifier – Assessing Identity Verification Services appeared first on NetSPI.
[e2pdf-download id="1" dataset="23072" button_title="Download Intelligence Brief"][e2pdf-download id="1" dataset="22799" button_title="Download RB-034 Intelligence Brief"] The post test appeared first on Redbot Security.
Choosing a CERT-In empanelled auditor involves more than checking empanelment status. As a CISO, you also need to evaluate the technical skills of the team, their penetration testing approach, and their experience with your technology environment. Empanelment confirms that the organization meets CERT-In’s requirements, but it does not by itself tell you how deeply the team will […]
How Did BFSI Perform in Prevention and Detection in 2026? BFSI prevention effectiveness stands at 67% in thePicus Blue Report 2026, down nine points from the 76% recorded in the previous edition. Financial institutions logged 65% of simulated attacks, meaning the attacker behavior was recorded somewhere in their telemetry, but alerted on only 16%, so fewer than one in six attacks reached a security team as an alert. This year's figures come from more than 338 million attack simulations that Picu
Sep 11, 2026 - Jeremy Snyder - If you were at RSA Conference last year, you probably remember the goats. Or the puppies. Or the miniature petting zoos. It was a year of "over-the-top" spectacle. A bit of a circus, if I’m being honest.Coming into RSAC 2026, the vibe shifted. The show floor was noticeably more subdued, and frankly, I welcomed it. The industry seems to have traded the gimmicks for a renewed focus on actual business outcomes.That’s not to say it was boring. We saw a wrestling ring o
CVE-2026-8452 lets an unauthenticated attacker corrupt memory in Citrix NetScaler's SAML parser with a single request, potentially leading to remote code execution. Bishop Fox breaks down the patch, how to safely verify it across a fleet, and what exploitation actually looks like in the logs.
TL;DR  A perfectly normal amount of luggage  On Tuesday 4th August, 5 brave souls set off to the faraway climes of Nevada, bound for DEF CON 34. We had 9 cases of tech with us, a motley assortment of flight simulators, industrial control CTFs and plenty more.  We supported the ICS Village for the first time, reflecting our […] The post DEFCON 34: Planes, PLCs and 6am runs appeared first on Pen Test Partners.
Ask any security engineer what they actually think about their vulnerability scanner, and you will get a version of the same answer. They trust maybe 20% of what shows up in the patching queue. The rest gets a suspicious glance, and a slow death in a backlog. That is the real cost of a false ... Read more
AttackIQ has released an updated assessment in response to the recent revision of CISA Advisory AA25-071A, dated August 18, 2026, which details new behaviors exhibited by Medusa Ransomware. The post Updated Response to CISA Advisory (AA25-071A): #StopRansomware: Medusa Ransomware appeared first on AttackIQ.
Over half of the Swarm travelled to Las Vegas for DEF CON 34. They came home with a first-place trophy, a costume award, and a stronger case for why point-in-time testing is dying. The post What the Swarm brought home from DEF CON 34 and Black Hat USA 2026 appeared first on CovertSwarm.
Most enterprises should treat annual penetration testing as a baseline, not a complete answer. PCI DSS is the one framework with an explicit annual and change-triggered mandate. SOC 2, the current HIPAA Security Rule, and ISO 27001 all expect testing to follow the organization's own risk assessment and control design, not one fixed calendar date. HHS has proposed an annual HIPAA pentesting requirement, but that rule has not been finalized. Enterprises that combine a formal annual assessment with
