Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
894 matching stories — in Identity Threat Detection and Response — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Point72, Citadel, Millennium Management and Two Sigma were all hit this week in a coordinated AI vishing campaign,according to InvestmentNews, also published in Bloomberg, Reuters, and other leading media. Attackers used cloned voices to impersonate IT staff and colleagues, calling help desk agents directly and pressuring them into resetting credentials and account access in real time. As AI erodes our ability to distinguish real from fake, removing human subjectivity from identity decisions is
A control that's supposed to close itself, and sometimes doesn't. Secrets are supposed to expire on their own. That's the entire point of setting an expiration in the first place: nobody has to remember to revoke it, nobody has to catch it manually, the credential just stops working when the date and time passes. Most of the time, that assumption works. When it doesn't, the result isn't a loud failure or a system going down, it's a quieter and riskier one. The secret keeps authenticating,...
AI bots scrape your content to train models you'll never be compensated for. Here's how to block them, from robots.txt to advanced bot management, and what each method actually stops.
Every AI agent an organization deploys is also a new non-human identity, whether anyone thinks of it that way or not. It authenticates, holds credentials, acts on systems, data, and other services. It takes these actions continuously, at machine speed, with no human standing nearby to notice when something does not adhere to policy. Most security teams don't think of it that way yet. An agent feels like a feature, a script or a workflow bolted onto an existing product. But to a vault, an IAM...
Picture a routine agentic workflow: a user delegates a task, and an AI agent takes… The post How Microsoft and PlainID Extend Trust Through Agentic Workflows appeared first on PlainID.
What is agentic AI governance? Agentic AI governance is the set of authorization policies and… The post Agentic AI Governance: A Complete Guide appeared first on PlainID.
Identity and access management has grown up inside the Fortune 500. The function now reports… The post What 20 Fortune 500 IAM Leadership Titles Reveal About the Agent Authorization Gap appeared first on PlainID.
IAM was built to govern the login event. AI agents don't have one. A new wave of "AI-native" IGA platforms is selling faster connectors and cleaner dashboards as innovation — but it's the same declarative model with better onboarding. This piece walks through where IAM came from, where that model is already breaking under AI agents, and why the industry needs a control plane, not another rebrand. You can't govern what you can't see.
Orchid's new integration with Palo Alto Networks Idira® helps security teams discover hidden privileged identities, add critical context, and bring them into an established privileged access workflow.
AI agents need their own identities, scoped permissions, and real-time oversight. Here's how AI agent access control works, and why traditional IAM isn't enough.
Police flag 4,000 URLs to disrupt The Com, theft victims sue Apple over a $1.8M wallet scam, and OpenAI and Anthropic models reach real systems in cyber tests.
The vulnerability: CVE-2026-42897, a cross-site scripting (XSS) flaw in Outlook Web Access (OWA), the browser-based interface for on-premises Microsoft Exchange Server. CVSS score: 8.1 (High). Affected systems: On-premises Exchange Server 2016, 2019, and Subscription Edition (SE). How the attack works: An unauthenticated attacker sends a "half-click" phishing email — no links, no attachments, no action [...] The post Russian Hackers Are Exploiting an Unpatched Outlook Web Access Flaw appeared fi
MAI-Cyber-1-Flash il suo primo modello di intelligenza artificiale specializzato nella cybersecurity Accanto nasce Project Perception un nuovo sistema di sicurezza agentico.
How Push’s agentic detection pipeline turns intel into huntable characteristics of attacker behavior, deriving durable detections from a range of sources.
Count the vulnerabilities in the July intrusion at Hugging Face. There are three. A zero-day in JFrog Artifactory, the package-registry cache proxy that was the evaluation environment's only permitted egress. Then an HDF5 external-reference file read and a Jinja2 template injection, both in the same dataset config loader. That is the entire exploitation budget for a campaign that crossed five trust boundaries at three companies. Every other door was either unlocked or had the key taped to it....
If Microsoft Defender quarantines BrowserModifier:Win32/MediaArena on one of your endpoints, the alert reads like a win. Our SOC data says treat it as a live persistence incident instead. In the case we timed, the payload finished writing its persistence 21 seconds into execution. Quarantine didn’t complete until 29 seconds. By the time the alert fired, […] The post MediaArena malvertising: why a quarantine isn’t the end of the incident appeared first on Heimdal Security Blog.
Part 1 attacked the MCP server itself. This part assumes all of that is patched and breaks in through the identity layer instead — where nothing is a bug you can close, and the server does exactly what it was told by the wrong person. We walk the 2026-07-28 authorization spec and the RFCs behind it, the confused-deputy attack that comes from getting consent wrong, how EMA and ID-JAG move consent to the IdP — and the four gaps that remain open afterwards, where every token is valid and nothing in
Part 1 attacked the MCP server itself. This part assumes all of that is patched and breaks in through the identity layer instead — where nothing is a bug you can close, and the server does exactly what it was told by the wrong person. We walk the 2026-07-28 authorization spec and the RFCs behind it, the confused-deputy attack that comes from getting consent wrong, how EMA and ID-JAG move consent to the IdP — and the four gaps that remain open afterwards, where every token is valid and nothing in
MCP replaced manual API wiring with one open protocol — and in doing so created a new attack surface where the server itself is the payload. Nothing in the protocol separates a description that documents a tool from one that commands the model. Part 1 of a two-part series. We walk the four adversary classes against MCP — tool poisoning, typosquatting, rug pulls, command injection, API key exfiltration, and sandbox escapes — reconstructing known CVEs against their pre-patch versions to show the m
Every organization requires a different approach to Multi-Factor Authentication (MFA). Depending on the size, complexity, and sensitivity of an organization’s data, the requirements of an MFA solution can vary significantly. To provide the necessary level of cybersecurity protection, a tailored approach to MFA is often necessary.   Among the leading players in the MFA market, Cisco […]The post Duo Alternatives: Comparing Multi-Factor Authentication (MFA) Solutions for Highe
Every enterprise is becoming an AI enterprise. AI agents are analyzing data, making decisions, interacting with customers, and taking actions across critical systems. As organizations race to deploy AI, a new workforce is emerging, one made up of AI agents, applications, service accounts, and other non-human identities operating at machine speed.
Silverfort Research. We reported this to Anthropic under coordinated disclosure. This post is the defensive companion: how the weakness works, and how defenders catch it. The post Skipping the lock: A Claude Code CLI weakness lets any macOS process read stored credentials appeared first on Silverfort.
On July 23, 2026, a bug in Microsoft's automated network maintenance system triggered a nearly five-hour outage across Microsoft 365 and Azure, cutting off a West US datacenter from Microsoft's global network. What happened The outage started at 10:44 AM ET during routine maintenance meant to isolate specific network paths in Microsoft's West US Azure [...] The post Microsoft 365 Outage: Bug Takes Down Microsoft 365 for Hours appeared first on Messageware.
Why Fuzed Identity Intelligence is Becoming Essential to Enterprise Security For years, enterprises have treated a digital identity as an internal construct. An employee had a corporate email address, a directory account, assigned devices, application entitlements, and a set of credentials. Security teams protected those assets through Identity and Access Management (IAM) solutions, Multi-Factor Authentication […]
