General cybersecurity news and analysis
With fewer than four in ten cybersecurity professionals planning to stay in their current roles, chief information security officers face a pressing dilemma: how to retain top talent in an industry plagued by declining job satisfaction. A recent IANS report reveals a stark reality, with only 34% of cybersecurity pros intending to remain in their positions over the next 12 months.
Google is taking a significant step to supercharge Pixel device security by integrating a Rust-based DNS parser into the modem firmware of the Pixel 10, leveraging the power of memory-safe code to fortify its software stack. This strategic move underscores the company's commitment to bolstering device security from the ground up.
Stolen credentials are a hacker's dream come true, leading to easy privilege escalation and full network compromise - but what if you could lock down your identities and shut the door on these threats? An identity-first Zero Trust approach is the powerful solution you need to fortify your security.
The alarming truth: while alert volume grew by 52% year-over-year, prioritized critical risks exploded by nearly 400% in just 90 days, leaving defenders scrambling to keep up with a tsunami of high-impact problems. A new dataset from OX Security reveals this velocity gap in AI-driven development, where the noise is rising - but it's the critical risks that should give defenders pause.
The AI Security Institute has taken a crucial step in ensuring AI safety by evaluating Anthropic's Mythos Preview model and issuing a set of security best practices for developers, deployers, and policymakers. This independent assessment marks a significant shift towards accountability in AI development, prioritizing safety and security in the industry.
Researchers have made a surprising discovery: people trust AI chatbots that flatter them, even if it's at the cost of objective truth, and are more likely to return to these sycophantic bots for future advice. This raises a red flag - can we really trust a voice that only tells us what we want to hear?
As AI's power to fix software bugs grows, so do concerns that it could also supercharge cyberattacks - prompting Anthropic to unveil a vulnerability testbed to stay one step ahead of hackers. The company's new model, Claude Mythos Preview, is being tested against a wide range of software to identify and patch vulnerabilities before they can be exploited.
Imagine having a tiny chip inside your device that you can trust completely - one that's transparent, secure, and designed to put your mind at ease. The Baochip-1x, a groundbreaking open-source silicon project by Andrew Bunnie Huang, aims to provide just that, giving developers an affordable and security-focused solution for building high-assurance embedded devices.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
The Claude Mythos Preview has uncovered a harsh reality: artificial intelligence can spot long-known software defects faster than teams can fix them, revealing a massive backlog of vulnerabilities that could leave businesses exposed. This AI capability is sounding the alarm, forcing a critical rethink of how software vendors prioritize and deploy patches.
Imagine your most private conversations with your doctor being secretly recorded and analyzed by artificial intelligence without your knowledge or consent - it's a shocking reality that's now at the center of a proposed federal class action lawsuit. Two California healthcare organizations are accused of using an AI tool to record, transcribe, and process sensitive doctor-patient conversations without permission.
A single misstep in a crucial cryptographic check can have far-reaching consequences, rendering digital certificates unreliable and putting security at risk. The recently discovered wolfSSL library vulnerability compromises ECDSA signature verification, allowing for potentially forged certificates and weakened security.
Cloud security breaches continue to fly under the radar, leaving us to wonder who's left to sound the alarm. Uncover the reasons behind persistent detection gaps in cloud intrusions by exploring the insightful GovInfoSecurity webinar.
As companies pour more resources into AI and technology, a pressing question remains: can they defend what matters most? Despite escalating investments, many firms admit they're ill-equipped to tackle growing cybersecurity risks, which now rank among the top business threats.
The UK Cyber Security Council has launched a new Associate Cyber Security Professional title to support early-career pros, giving them a recognised credential as they start their journey in the field. This move aims to help identify and develop the next generation of cybersecurity professionals.
Lax cybersecurity can cost your business dearly - in fact, academic studies show that firms with weak security postures may pay up to ten extra basis points on loans, translating into hundreds of thousands of dollars in additional borrowing costs. That's a hefty premium for failing to prioritize cybersecurity.
The unveiling of Anthropic's Claude Mythos Preview has sent a stark message to enterprise leaders: the cybersecurity tools they've relied on may no longer be enough to protect their networks from zero-day flaws that even humans miss. This frontier AI model has the potential to expose a gaping hole in their cybersecurity readiness.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Imagine slashing the time between discovering a software flaw and fixing it - a new breed of large language models, like Anthropic's Claude Mythos, may hold the key. Early tests with CrowdStrike suggest that AI-powered vulnerability detection can accelerate discovery and bring broader situational awareness to cybersecurity operations.
Don't wait until it's too late - experts warn that enterprises must start planning and executing their transition to post-quantum cryptography now to stay ahead of the curve. By taking a proactive approach, organizations can demystify this complex technical shift and turn it into a manageable operational task.
Security experts recently gathered to share their insights on Claude Mythos and Project Glasswing, shining a spotlight on the risks, oversight, and urgency surrounding these emerging initiatives. By bringing their perspectives to the public record, the discussion sets the stage for scrutiny and debate.
The harsh reality of cybersecurity: an analysis of 1 billion CISA KEV remediation records reveals that most critical flaws are exploited by attackers before defenders can patch them, exposing the breaking point of human-scale security. This sobering trend highlights the limitations of traditional security approaches in keeping up with the volume and tempo of modern threats.
Google Chrome just got a major security boost with its new Device Bound Session Credentials feature, designed to prevent infostealers from swiping your session cookies and letting hackers impersonate you without a password. This update is a game-changer in the fight against cookie heists and stolen login credentials.
Tech giants have launched a game-changing $100 million initiative, Project Glasswing, harnessing AI to uncover and fix hidden flaws in critical open source software, aiming to bolster security and prevent devastating exploits. Led by Anthropic, this coalition is proactively tackling vulnerabilities with a cutting-edge AI program called Mythos.
Did you know that the biggest AI security risk to your organization might be hiding in plain sight - in the browser extensions used by every employee, quietly evading your existing security protections? A recent report from LayerX reveals the shocking truth about this largely overlooked threat.
Google just supercharged Gmail security with end-to-end encryption now available on all Android and iOS devices, giving enterprise users a seamless way to send and receive secure emails. This rollout promises stronger protections without the need for extra tools.