What we built: July 2026
In July, Expel launched six new threat hunts spanning the AI attack surface, for new features, and one integration update.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
25,299 matching stories — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Introducing the Lumu Threat Observatory™
Reading Time: 4 minsLearn how real-time threat tracking helps protect your organization from the latest cyberattacks in your sector and in your location. The post Introducing the Lumu Threat Observatory™ appeared first on Lumu Technologies.
How to Read a SOC 2 Report: A Section-by-Section Guide
A few months ago, at an ISACA event, a woman came up to me for help interpreting her organization's SOC 2 report. She had strong business acumen, but she'd been handed the vendor risk function with almost no background in how to actually read one. That conversation stuck with me, because it's a common gap. Not all SOC 2 reports are created equal. They vary by type, scope, and auditor opinion, and reading one without context can lead to misplaced confidence in a vendor that hasn't earned it.
Cybersecurity Is Becoming a Growth Issue for MSOs, Not Just a Compliance Obligation
The post Cybersecurity Is Becoming a Growth Issue for MSOs, Not Just a Compliance Obligation appeared first on Clearwater.
What is Application Penetration Testing?
Regardless of new or old applications, they will need an application penetration test, especially if dealing with financial information.
Introducing Unit 42 Threat Intelligence: Know What Matters, Understand the Adversary, and Act Faster
Security teams do not need another threat feed. Instead, they need to know which threats matter to their organization, what’s coming, and what they should do next. That distinction has never been … The post Introducing Unit 42 Threat Intelligence: Know What Matters, Understand the Adversary, and Act Faster appeared first on Palo Alto Networks Blog.
Managing Vendor Sprawl: Strategies for Vendor Consolidation and Oversight
BLOG ARTICLE Table of Contents Vendor sprawl starts small. Marketing picks up a new analytics tool. Sales finds something that talks better to the CRM. HR grabs an engagement platform. Finance adds a reporting app. Each decision solves a real problem. Two years later the organization is paying for dozens […] The post Managing Vendor Sprawl: Strategies for Vendor Consolidation and Oversight appeared first on Netrix Global.
AI Threat Vectors Part 3: When the Attack Arrives by Email – Indirect Prompt Injection in Agentic AI
AI Agents Now Read Untrusted Content and Act On It An AI agent in your organization will summarize an email thread today that was never meant for it to read. The user asks something harmless: “What’s on my plate this week? The agent will pull in messages, invites, and documents to answer, and it will […]
Expel’s Q2 2026 threat report: Identity’s back on top, and Teams phishing isn’t slowing down
Expel's Q2 2026 threat data: identity attacks jump to 68.1%, Teams phishing drives an endpoint spike, and a new supply chain worm hits cloud infrastructure.
The ‘Air-Gap Conundrum’: When Password Managers Meet the Data Center Floor
Late one afternoon, a critical legacy server dropped offline. A diligent security admin rushed to the air-gapped data center floor to fix it, but ran into a familiar barrier: clipboard redirection was disabled by policy. Forced to manually transcribe a complex, 30-character randomized password on a rack keyboard, a single slipped finger triggered an immediate […] The post The ‘Air-Gap Conundrum’: When Password Managers Meet the Data Center Floor appeared first on Yubico.
When the Only Reliable Patch Is Physics: CISA’s PLC Alert and the AI-Accelerated Threat to Water
On July 30, CISA issued an urgent alert to the Water and Wastewater Systems Sector: remove publicly exposed programmable logic controllers and other operational technology from the internet, as soon as possible. The agency reported a significant increase in threat actors targeting PLCs in the sector — changing device passwords to lock operators out, altering... View Article The post When the Only Reliable Patch Is Physics: CISA’s PLC Alert and the AI-Accelerated Threat to Water appeared fi
Behavioral Risk Brief: Arch AUR Repository
The Claim Governance frameworks that treat package adoption as a routine maintenance mechanism create systemic risk when that same mechanism can transfer control of a trusted package name to an attacker. Zero Trust for Code addresses this by requiring a pre-execution trust decision on what a package does after any change in control, rather than extending […]
Why ISO 42001 Is About to Become Table Stakes
Rick Orloff is a Fortune 1000 CISO and Strategic Advisor at A-LIGN, with over 20 years of experience at companies including Apple and eBay. Four out of five organizations now field direct customer inquiries about their AI risk management practices, according to the 2026 Compliance Benchmark Report. That’s how a certification stops being a differentiator […] The post Why ISO 42001 Is About to Become Table Stakes appeared first on A-LIGN.
Teamwork Commerce
Client Experience Stories
Shadow AI Risks: 10 Hidden Threats and How to Control Them
What Is Shadow AI? Shadow AI (the use of unapproved AI tools, chatbots, and browser extensions by employees) creates massive operational and security blind spots. Major risks include data leaks of proprietary IP, regulatory compliance breaches (e.g., GDPR, HIPAA), API-key or credential exposure via system prompt leaks, and autonomous AI agents making unauthorized changes to […] The post Shadow AI Risks: 10 Hidden Threats and How to Control Them appeared first on Venn.
Why Responsible AI is the Corporate Governance you Already Trust, Just Extended.
By Steven Hill, Managing Partner, OakTruss Group LLC Boards and c-suites have been governing judgment since anyone reading this has been alive. They just haven’t been calling it that. Every officer who signs a contract, every manager who approves a budget, every clinician who authorizes a treatment, and every banker who approves a loan is exercising judgment on the company’s behalf. Every professionally managed organization built a complete apparatus to oversee judgment long ago: ledgers that...
EtherHiding: when blockchain technology becomes a cyber weapon
Preamble In the cybercrime world, a strange cat and mouse game is continuously taking place. Cybersecurity researchers tirelessly hunt attackers' infrastructures. As soon as some of their components are discovered and brougth to light, they quickly become obsolete because of their addition on IOC's lists... The post EtherHiding: when blockchain technology becomes a cyber weapon appeared first on Stormshield.
Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era
As AI expands who builds software, the developer workstation is becoming a new security perimeter. AI and third-party software increasingly operate with access to your most sensitive credentials and cloud environments.
CrashStealer, a new infostealer for macOS: how it works and how to stay safe | Kaspersky official blog
We break down CrashStealer — a new macOS infostealer: how it spreads, what data it steals, how it bypasses Apple’s built-in defenses, and what you can do to protect your Mac.
August 2026 CVE of the Month: The 7-Zip Bug Every Scorecard Says to Ignore (CVE-2026-58052)
In January 2023, this column's first life at Kenna featured CVE-2022-44698 , a Windows SmartScreen Mark-of-the-Web bypass that attackers were happily using while the scoring systems shrugged. Three and a half years later, here we are again. This month's pick scores 3.3 under CVSS v3.1, the kind of number that never makes a patch queue, and our sensors have recorded it being exploited in the wild multiple times in the past month.
Why App Control Fails Most Teams and How Managed ESPM Fixes It
App control works, but most solutions are built for enterprise budgets and headcount. See how Huntress Managed ESPM makes proactive endpoint hardening accessible for MSPs and small IT teams.
The Best Agentic SOC for Microsoft Sentinel in 2026 (and Where Security Copilot Fits)
The 8 best agentic SOC platforms for Microsoft Sentinel in 2026, compared. What Security Copilot's agents do today, GA versus preview, and where the gap is. The post The Best Agentic SOC for Microsoft Sentinel in 2026 (and Where Security Copilot Fits) appeared first on D3 Security.
Managing IT Backlogs | Locknet Managed IT
Most people carrying IT responsibility at a community bank or credit union are aware of two lists. They don't usually call them that. But they know them both. The first is the list of things that fill the day whether you planned for them or not. User support tickets. Password resets. Hardware that stops working. Security alerts that need immediate attention. The operational demands that arrive without warning and can't be deferred and that collectively make it almost impossible to get to anythin
SAI360 Named Bronze Stevie® Award Winner in 2026 Stevie® Awards for Technology Excellence
Leading integrated GRC platform recognized for innovation in AI-powered risk and compliance technology. August 3, 2026 — SAI360, the leading provider of integrated governance, risk and compliance (GRC) software, today announced it has been named the Bronze Stevie® Award winner for Company of the Year – Business Technology in the 2026 Stevie Awards for Technology ... The post SAI360 Named Bronze Stevie® Award Winner in 2026 Stevie® Awards for Technology Excellence appeared first on SAI360.
The Assets You Don’t Know You Own: Attack Surface Sprawl Is a Discovery Problem, Not a Tooling Problem
Modern organizations no longer operate within a fixed network perimeter. Cloud services, remote work, third-party integrations, and rapid digital expansion have made the boundary between "inside" and "outside" for the enterprise increasingly difficult to define. Attackers exploit this ambiguity by scanning continuously for weaknesses across an organization's hardware, software, cloud, and internet-facing assets. The uncomfortable truth security leaders must confront is simple: an organization ca
Top AI Coding Agent security resources — August 2026
August 2026's AI coding agent security roundup: a symlink flaw across six assistants, Cursor's CVSS 9.8 pair, a private repo leak, and a wiped database.
Tidal Cyber Brings Threat-Led Defense to the AI Tools Your Teams Already Use
Tidal Cyber Brings Threat-Led Defense to the AI Tools Your Teams Already Use New capabilities securely extend Threat-Led Defense into AI assistants and agentic workflows, enabling security teams to access trusted defensive intelligence where they already work.
Suspicious Email Attachments: How to Open Them Safely Without Risk
Blog Overview – You just got an email and looks normal: Maybe it’s an invoice, Delivery notice. But there is a Read More... The post Suspicious Email Attachments: How to Open Them Safely Without Risk appeared first on MailXaminer Official Blog.
Horizon3 Raises $250M Series E at $2B+ Valuation to Lead the “AI vs. AI” Cybersecurity Era
Horizon3, the AI-Native Proactive Security Company behind NodeZero®, the World’s Best AI Hacker™, today announced a $250 million Series E at a valuation of more than $2 billion.
The Biggest Mistake Organizations Make About Digital Sovereignty
If your sovereignty strategy starts with data centers, you’re probably solving the wrong problem.
7 Data Resilience Statistics for 2027 IT Planning
65% of IT professionals say their organization can recover from ransomware within 48 hours. Only 35% have met RPO and RTO targets in actual testing.
Visit the Top Industry Vendors in the Expo at Connections Live 2026
There’s a reason “Connections” is in the name of our annual user conference. We’ve built a tightknit community of customers and PDI associates over the last 40 years, and the connections are only growing stronger. But there’s another invaluable group that truly makes every Connections Live conference possible: our sponsors. The conference wouldn’t exist without them, so we want to extend a sincere thank you and shout-out to […]
Introducing Agent Intent-Based Access Control
The addition of Agent Intent-Based Access Control (IBAC) brings a new capability to Varonis Atlas that lets businesses connect AI agents to their enterprise data with safeguards that stop dangerous or out-of-policy behavior.
Cyber Risks a CERT-In Empanelled Auditor Can Detect
In this blog, we will discuss the common security risks a CERT-In empanelled auditor can identify across compliance processes, technical environments, and cloud infrastructure, and why addressing them early helps reduce business and security risk. A. Regulatory, Compliance, and Governance Risks 1. Insufficient Log Collection and Retention System logs provide valuable information during security investigations and compliance reviews. Missing […]
AI AUDEX: Advancing Autonomous Audio Processing for the DoW
... The post AI AUDEX: Advancing Autonomous Audio Processing for the DoW appeared first on Assured Information Security.
AI AUDEX: Advancing Autonomous Audio Processing for the DoD
... The post AI AUDEX: Advancing Autonomous Audio Processing for the DoD appeared first on Assured Information Security.
Blancco Leaders to Speak at ITAD Summit on Building Smarter, More Efficient IT Asset Processing Operations
Speaking and demo sessions will address how to reduce costs through integrated workflows and improve efficiency by eliminating disconnected tools and manual processes BOSTON and LONDON, August 3, 2026 — Blancco Technology Group, the industry standard in data erasure and mobile lifecycle solutions, will participate in two industry panels and present a product demo at […] The post Blancco Leaders to Speak at ITAD Summit on Building Smarter, More Efficient IT Asset Processing Operations appea
Microsoft Is Retiring SMS Authentication: What the Entra ID Passkey Mandate Means for Your Organization
Microsoft just set a hard deadline for the end of SMS authentication. Starting September 1, 2026, passkeys become the default sign-in experience in Entra ID. On February 1, 2027, Microsoft retires its SMS and voice delivery entirely, and users without another method will hit a blocking registration prompt. We broke down the full timeline, who is affected, and the three realistic paths forward in the blog. The post Microsoft Is Retiring SMS Authentication: What the Entra ID Passkey Mandate Means
External Identity Security: Reconnaissance on Your People Goes Undefended. That’s Changing.
Building the dossier file on Sarah used to take an attacker an afternoon. Now it takes 15 minutes, and nobody builds it by hand. She’s an executive assistant to the CFO of a company with a mature security program, and none of that program can see what’s about to happen, because none of it happens on company infrastructure. Her name went into a queue the moment an attacker found her LinkedIn. From there it runs on its own. A people-search site gives up her home address and her husband