Application Security

End of life for Microsoft Office puts malicious macros in the security spotlight

Organizations migrating away from end-of-life Microsoft ecosystems must consider the impact of macro policies. And those staying should better protect their systems with key rules and settings.

AI supply chain threats loom — as security practices lag

Recent findings of AI ecosystem insecurities and attacks show how important MLSecOps is to securing AI strategies from complex and often highly concealed risks.

Misconfigured MCP servers expose AI agent systems to compromise

Hundreds of Model Context Protocol (MCP) servers used to link LLMs to third-party services, data sources, and tools include default configurations that could expose users to unauthorized OS command execution and other risks.

Third-party risk management is broken — but not beyond repair

TPRM today prioritizes fear of penalty over pursuit of real security. By investing in a comprehensive, targeted approach, organizations can reclaim TPRM as an essential part of their security strategies.

How to Get Your Software CA Veracode Verified

How to log and monitor PowerShell activity for suspicious scripts and commands

Attackers are increasingly abusing sanctioned tools to subvert automated defenses. Tracking your Windows fleet’s PowerShell use — especially consultant workstations — can provide early indications of nefarious activity.

The 20 biggest data breaches of the 21st century

Data breaches affecting millions of users are far too common. Here are some of the biggest, baddest breaches in recent memory.

Mirai botnet weaponizes PoC to exploit Wazuh open-source XDR flaw

Popular for monitoring Docker containers, Wazuh is being exploited by two Mirai botnet variants — one of which aligns closely with researchers’ previously released proof-of-concept attack against the vulnerability.

8 security risks overlooked in the rush to implement AI

Nearly two-thirds of companies fail to vet the security implications of AI tools before deploying them. Stressing security fundamentals from the outset can cut down the risks.

Enterprise-specific zero-day exploits on the rise, Google warns

Vulnerabilities in enterprise network and security appliances accounted for nearly half of the zero-day flaws exploited by attackers last year, according to Google’s Threat Intelligence Group.