Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,036 matching stories — announcement, in Vulnerability Management — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Key Takeaways Teams are remediating more than ever, but exposure from the vulnerabilities that matter is still rising faster than they can keep up with. Mean time to exploitation is about −7 days. Mean time to remediate sits around +30 days. Qualys research: closures rose from 73M (2022) to 473M (2025) – 6× – while […]
TL;DR: Financial institutions need to demonstrate that security controls are effective in production and that security investments reduce business risk. Across regulatory frameworks including NYDFS, OSFI, DORA, MAS and APRA, verified control evidence helps institutions demonstrate resilience and support accountable risk decisions. Aquasec connects runtime enforcement with FAIR based financial risk modeling, helping security leaders …
Businesses across industries and geographies are racing to develop, deploy, and use AI. Winning responsibly means embedding compliance early, before regulators and clients demand it. Awareness of AI risk is high: 4 out of 5 companies that use AI are getting questions from customers about risk, and for good reason. Data breaches are expensive, but […] The post AIUC-1: Turn Agentic AI Risk into Market Trust appeared first on A-LIGN.
Horizon3 has surpassed $100 million in annual recurring revenue, with ARR growing more than 120% year over year. The milestone reflects increasing adoption of the NodeZero platform, a channel-first growth strategy, and demand for continuous, production-safe autonomous penetration testing. Horizon3 also outlined its next phase of investment in sovereign cyber AI regions, critical infrastructure centers of excellence, and attack-defend AI learning loops.
Exposure management company Tenable Holdings announced that H₂O Retailing has deployed the Tenable One Exposure Management Platform across... The post H₂O Retailing deploys Tenable One to unify cyber exposure management across multi-cloud infrastructure appeared first on Industrial Cyber.
For twenty years, security has ended with a list of things for someone else to fix. Mondoo CEO Soo Choi on the launch of agentic remediation: exposure management that builds the fix, deploys it, verifies it, and keeps it fixed.
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls.The new privileged user in your environmentSecurity teams spent two decades learning how to work with the people they trust most. Domain admins, DBAs, finance approvers and contractors with VPN access all get a mature playbook: verified identity, scoped access, logged activity and a fast way to revoke it all.Today, we’re navigating the same kind of access with
OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8.6 High). The most serious functions allow for full database read (CVSS: 8.5 High) and an insecure file upload (CVSS: 9.6 Critical). The insecure file upload leads to remote code execution.Product descriptionArchib
When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published
As digital service providers increasingly rely on personal data to personalise customer experiences and support business decisions, managing privacy risks has become a business priority. Collecting and processing personally identifiable information (PII) also introduces regulatory, operational, and reputational risks. Organisations must not only protect personal data but also demonstrate that privacy controls are effectively implemented […] The post ISO 27701 Audit Checklist: Building a Ce
Discover how to secure AI agents in your cloud environment with Tenable One Cloud Exposure. We explore Microsoft Entra Agent ID and provide essential best practices for robust agentic AI identity security.Key takeawaysUnderstand your current maturity level and then build an appropriate action plan to secure your agent identities.Use your cloud providers’ native tools or Tenable One Cloud Exposure to locate and catalog every AI agent operating in your environment.Do not assign human identities or
Claroty’s Team82 research team reproduced three previously disclosed vulnerabilities in Danfoss AK-SM 800A refrigeration controllers using an artificial... The post Claroty Team82 shows AI can rebuild Danfoss controller exploits in 28 minutes, putting Internet-facing OT at risk appeared first on Industrial Cyber.
Discover how detection teams can split EDR-killer attacks into four distinct behavior hunts to catch BYOVD and driverless threats before ransomware fires.
Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them.
A weakness that looks convincing in one file can vanish once you see the whole application. Luke Potter explains how the Swarm keeps an AI lead separate from a proven finding, and why the practitioner always makes the final call. The post Why a vulnerability research agent has to look beyond one file appeared first on CovertSwarm.
Introduction An organization can identify hundreds or thousands of problems across internal audits, risk assessments, compliance reviews, control testing, cybersecurity assessments, vendor reviews and regulatory examinations. Identifying those problems is only the beginning. The harder questions are: Who owns the issue? How serious is it? What caused it? What must be fixed? When must remediation... The post Issue Management: Process, Lifecycle, Types & Best Practices appeared first on ASPIA
An attacker holding valid UpdraftCentral dashboard keys is installing backdoor plugins on connected WordPress sites. The campaign ran continuously through an 18-hour window on 18-19 October. Patchstack blocks UpdraftCentral remote commands and has deployed mitigation rules covering it. 19 October 2026 8:00 UTC: the campaign is active and no vendor fix exists. We update this […]
Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today announced that H₂O Retailing Corporation has successfully deployed the Tenable One Exposure Management Platform across its diverse multi-cloud infrastructure. The implementation provides the group with unified visibility, risk-based prioritization, and accelerated response times using AI capabilities to objectively assess which vulnerabilities pose the highest real-world exploitation risk.H₂O Retailing is a leading re
Operational Technology (OT) environments keep critical infrastructure running. From manufacturing plants and power grids to oil and gas facilities, water treatment systems, and transportation networks, these environments depend on Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems to monitor and control physical processes. As OT environments become more connected to enterprise […] The post OT Security Testing: Methodology For ICS and SCADA appeare
Security leaders often ask similar questions when asset records do not match network reality. The CMDB lists one set of devices, NAC sees another, scanners […] Source
Operational technology (OT) security leaders face a common set of challenges: discovering network assets, prioritizing vulnerabilities on unpatchable systems, detecting evolving threats, and reducing risk […] Source
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
Zero Trust programs typically start with users and managed endpoints, where identities are validated frequently and permissions are kept minimal and short-lived. Organizations then face […] Source
Learn how SentinelOne's Static AI blocked APT29's CaptiveCrunch campaign on the endpoint, stopping local DNS poisoning and captive portal network lures.
Authorities arrest cyber exec for extortion, cellular implant in Ledger wallets leaks seed phrases, and hackers heat French supermarket fridges to 50°C.
Explore how NodeZero autonomous penetration testing connects application, cloud, identity, and infrastructure weaknesses into validated attack paths, helping banks prioritize remediation and build evidence for the ECB’s cybersecurity supervisory recommendations.
Some awards you're happy to receive, while others make you stop for a moment. Receiving the 2026 Péter Szőr Award this week at Virus Bulletin in Seville for our research, BPFdoor in Telecom Networks: Sleeper Cells in the Backbone, was of the latter kind.Virus Bulletin created the award to honor Péter's life and work, and it recognizes outstanding technical security research: the rigorous, the deep, and the useful – exactly what he was known for himself. And as far as recognitions in our industry
We have the solution to the problem what every security team knows. Your scanner finishes its job and the outcome – you get a long list of findings. Some are real, some are guesses, some are not relevant to your organization and only a few comes with enough context to act on. This is what […] The post 10 Things to Look for in an AI-Powered Network Vulnerability Scanner appeared first on Kratikal Blogs.
Ask most teams for a map of their network and you’ll get one of two things: a diagram someone drew for an audit two years ago, or an export from the firewall and cloud consoles showing what each rule allows. Both describe intent. Neither describes what an attacker on the internet can actually reach today. […] The post How to Build Your Actual Network Map with Custom Agents in Orca appeared first on Orca Security.
Krybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves. Read more in my article on the Fortra blog.
Looking for the best vulnerability remediation software? Read our 2026 guide comparing the top automated tools for Windows, macOS, Linux, and third-party apps for MSPs and enterprises. The post Best Vulnerability Remediation Tools & Software in 2026 first appeared on Action1.
Looking for the best vulnerability remediation software? Read our 2026 guide comparing the top automated tools for Windows, macOS, Linux, and third-party apps for MSPs and enterprises. The post Best Vulnerability Remediation Tools & Software in 2026 first appeared on Action1.
Learn how to reduce MTTR (mean time to remediate) with practical strategies for patching, vulnerability remediation, and software incidents. Discover how to measure MTTR, identify bottlenecks across the five lifecycle stages, and use automation to shorten the path from detection to verified remediation. The post How to Reduce MTTR: A Practical Guide for Patching, Vulnerability Remediation, and Software Incidents first appeared on Action1.
AUTOCRYPT, a leading Physical AI security solutions provider, today announced it has been awarded “Automotive Cybersecurity Company of the Year” in the 7th annual AutoTech Breakthrough Awards program conducted by AutoTech Breakthrough, a leading market intelligence organization that recognizes the top companies, technologies and products in the global automotive and transportation technology markets today. AUTOCRYPT […]
Horizon3 has promoted Keith Poyser to General Manager, EMEA, following more than 260% regional revenue growth in the last fiscal year. Poyser grew the regional team from eight to more than 110 employees and will lead the company's next phase of expansion across Europe, the Middle East and Africa.
In the recently released 2026 SANS AI in Cybersecurity Survey, nearly two out of three security professionals said they have been given AI-generated guidance that later turned out to be wrong. Not from an experimental tool off in a sandbox, but from systems built into the security stack they were told to rely on. Security ... Inside Arctic Wolf and Anthropic’s Trust-First Approach to the Agentic SOC
Key Findings AI Agents Are the Newest Attack Surface The teams building fastest aren’t just shipping apps anymore. They’re shipping agents: support bots wired into ticketing systems, internal copilots with read access to the data warehouse, coding agents that can open pull requests, and autonomous workflows that call APIs on their own. Each one is […] The post Frontier-Level Red-Teaming From a Self-Hostable Open-Weight Model: Testing NVIDIA Nemotron 3.5 Super appeared first on
Every CMMC Level 2 assessment begins with the System Security Plan (SSP). Before an assessor interviews anyone or reviews a configuration, the plan has already described what the system includes, where its boundary sits, and how the organization says each requirement is met. A plan that describes the environment accurately lets an assessor confirm most statements directly […] The post CMMC System Security Plan: What Assessors Look For appeared first on A-LIGN.
AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and weaknesses of both approaches and explains where AI agents can improve security testing. [...]
TL;DR: Japan’s cyber emergency is a warning about what happens when familiar ransomware playbooks become faster, cheaper and easier to scale. AI reduces the time and coordination required to analyze targets, build tooling and chain destructive actions. That shortens the interval between initial access and business impact. Defenders need real time enforcement and containment that …