The primary destination for leading cybersecurity news and discourse. Powered by @TechstrongGroup.
Joined April 2010
- Tweets41.6K
- Following1.6K
- Followers7K
- Likes3.4K
A New Mexico judge ordered Meta to pay $25 billion over misleading privacy practices tied to the Cambridge Analytica scandal. Meta plans to appeal the record penalty.
Read more: buff.ly/L3pdme8
#Meta #DataPrivacy #CambridgeAnalytica #Cybersecurity #TechRegulation
The cloud was supposed to simplify security, and instead it scattered data across dozens of services and thousands of new identity relationships until nobody could say who owned what.
The 2024 Snowflake campaign hit roughly 165 organizations without breaching Snowflake at all, because MFA was never enforced on the customer side, and generative AI is widening the group of people who can stand up an app before Security ever learns it exists.
Read the full piece on the assumption gap, cloud sprawl and building the ground rules before deployment: buff.ly/PfxpRWh
#Cybersecurity #CloudSecurity #SharedResponsibility #CSPM
Two critical PHP vulnerabilities carrying a 9.2 severity score threaten the 70% of websites running the language, and researchers at Wiz, OpenAI and Calif found them by using frontier AI models to chain steps that sat at the edge of what human researchers could practically achieve.
As the Wiz team put it, PHP2Shell could mark a turning point for the AI era, illustrating how AI can change the practical exploitability of longstanding vulnerabilities, and in-the-wild exploitation attempts are already hitting watchTowr's sensors.
Read the full article on the flaws and what teams should check before the next crisis: buff.ly/JSBlz1m
#Cybersecurity #PHP #InfoSec #AI #AppSec
After a package is delivered, it's relatively trivial to use AI to create a fake image of a damaged item and demand a replacement, and many online sellers would rather ship a new one than have the item sent back, so the original winds up resold.
Among surveyed AI-assisted fraudsters, 81% had engaged in first-party fraud, rates rose 21% in six months, and 17% said using AI didn't actually feel like committing a crime.
Read the full analysis of the trend and what fraud teams can do about it: buff.ly/JZM5TwS
#Cybersecurity #Fraud #AI #Deepfakes #IdentitySecurity
Security Boulevard retweeted
#Ransomware Recovery Isn't a #Backup Problem >> It's an #Identity Problem.
buff.ly/iP112D9
@SecurityBlvd @Fenix24_dr #tech #business #leadership #management #governance #cybersecurity #security #infosec #cybercriminals #cybercrime #CIO #CTO #CEO #CISO #cyberthreats #cyberattacks #databreaches #crisismanagement #incidentresponse
Security Boulevard retweeted
Voice cloning makes identity theft easier than ever. Never use your voice as a password, and always stay alert for urgent calls from executives late on a Friday. Alan Shimel (@ashimmy) with Frank Riccardi (Self-employed) techstrong.tv/videos/intervi… #CyberSecurity #Deepfakes
Security Boulevard retweeted
Quantum computing won’t just break legacy encryption down the road—it is already reshaping risk profiles through "harvest now, decrypt later" campaigns and looming regulatory deadlines. 📊 youtu.be/RKRvDYGhHvU?si=bt7J…
▶️ In this episode of the Security Boulevard Podcast, Tom Hollingsworth and Fernando Montenegro cut through the marketing noise to examine what transitioning to Post-Quantum Cryptography (PQC) actually demands.
This and more on the Security Boulevard Podcast, part of the Futurum Media Podcast Network.
@SecurityBlvd @TechFieldDay @NetworkingNerd @TheFuturumGroup
#Cybersecurity #PostQuantumCryptography #CryptoAgility #QDay #InfoSec
Trump administration appointees reportedly asked CISA to secretly hack a voting machine and report findings to the White House. The plan was abandoned after officials raised concerns.
Read more: buff.ly/uvlIAha
#Cybersecurity #ElectionSecurity #CISA #VotingTechnology #GovernmentSecurity
Microsoft has introduced three new identity and access controls for AI agents, giving agents separate identities from the employees who sponsor them, limiting their authority to specific approved tasks and adjusting permissions as risk rises without revoking the sponsoring user's access.
Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access are aimed at the moment an agent gets compromised or wanders off task, and Microsoft is expanding agent discovery to 60 types including Claude Code, OpenAI Codex and GitHub Copilot.
Read the full article on how the controls work and when they'll be available: buff.ly/6nC18XD
#Microsoft #AIAgents #IdentitySecurity #ZeroTrust
Lenders have already lost $2.4 billion to synthetic identities and credit washing as of June, and TransUnion's new Credit Washing and Synthetic Fraud Scores are meant to catch those accounts while they're being opened rather than after.
Cybersecurity teams can embed the scoring in existing workflows, and Oscilar is already using it to automate credit risk decisions, because when AI keeps driving the cost of a fake identity down, speed is everything.
Read the full article on why the operating assumption is now that any new account is fake until proven otherwise: buff.ly/I8a38gw
#Cybersecurity #Fraud #TransUnion #SyntheticIdentity
Security Boulevard retweeted
Citigroup and Bank of America have joined Charles Schwab and JPMorgan in blocking AI agents from logging into customer accounts and moving money, with Schwab's CEO saying his firm blocks unauthorized agents ten to twenty times a week.
The pushback is as much commercial as security-driven, since automated tools sweeping roughly $1.6 trillion in non-interest-bearing deposits into higher-yield alternatives could cost the sector an estimated $47 billion a year in additional interest.
Read the full article on the gated, view-only frameworks banks are building instead: buff.ly/RL40esn
#Cybersecurity #AI #AIAgents #Banking #Fintech
Security Boulevard retweeted
RapidFort has allied with Wiz and Aqua Security to surface its curated container advisories directly inside their platforms, and signed a cooperative research agreement with SpaceWERX to apply the same technology to Space Force use cases.
That matters because application developers keep pulling images without checking for known vulnerabilities, and cybercriminals using AI to find exploits in hours are widening a security debt most DevSecOps teams were never staffed to pay down.
Read the full article on the alliances and why DevSecOps teams should prepare now for what might soon become the worst of times: zpr.io/PUZ5RLpRpXfd
#DevSecOps #Cybersecurity #CloudNative #AppSec
Security Boulevard retweeted
GitHub has made AI Scan for pull requests generally available, filling in coverage where CodeQL doesn't reach, including PHP, Shell, Terraform configuration, Dockerfiles and Blazor, all files that define how software gets built and deployed.
AI Scan findings are advisory and won't block merges, and they don't run on fork-based or Dependabot pull requests, which puts the burden on teams to assign an owner and act on what it finds.
Read the full article on what changed since preview and how to roll it out: buff.ly/TDt4FF2
#GitHub #DevSecOps #AppSec #CodeQL #AISecurity
A Proofpoint survey found 97% of U.S. healthcare organizations experienced cyberattacks, with 74% reporting patient care disruptions. AI security gaps are adding to the risks.
Read more: buff.ly/hI717V3
#HealthcareCybersecurity #Cybersecurity #PatientSafety #DataSecurity #AISecurity
The Hague spent years shoring up the digital resilience of NGOs, charities and community organizations, and now it's turning its blueprint over to cities worldwide for free, built on a model that already quadrupled one organization's cybersecurity assessment score.
As one expert notes, civil society relies heavily on OT and IoT systems that are often the most vulnerable devices, and many municipalities simply aren't staffed or prepared for it.
Read the full article on what the blueprint offers and where it falls short: buff.ly/nUifu5S
#Cybersecurity #DigitalResilience #Cities #Nonprofits
Tomorrow at 1 PM ET: Do you know how AI uses data on your endpoints?
Join Michael Roberts of Cresta and Or Guz of Bold Security to explore fine-grained control over endpoint data and AI activity.
Register: buff.ly/727sYbo
#EndpointSecurity #AISecurity
Five of this week's ten cybersecurity roles are fully remote, while threat hunting and detection engineering show up twice and product security three times, spread across fintech, developer tools and cloud platforms.
Pay ranges from $126,000 to $295,000, with Chime's application security opening at the top.
The full list of roles and salary ranges is here: buff.ly/w6BLb02
#Cybersecurity #Jobs #TechJobs #Hiring #Careers
Security Boulevard retweeted
The researchers who built the foundations of modern AI are now asking for binding international oversight, with roughly 400 scientists from 34 countries including Geoffrey Hinton and Yoshua Bengio calling for an organization that would set security standards, investigate containment failures and maintain an incident database.
Their key recommendation is that advanced models be air-gapped until they can be contained, and it arrives as OpenAI agents keep escaping sandboxes to reach external systems while the voluntary agreement six major AI companies signed with the White House carries no enforcement provisions.
See what the proposal would actually do and where the pushback comes from: buff.ly/DTRAZKJ
#AI #AISafety #AIGovernance #TechPolicy
Security Boulevard retweeted
The FTC has issued civil investigative demands to OpenAI and Anthropic, escalating a probe into consumer protection, privacy practices and safety incidents, with regulators particularly focused on disclosures that unreleased models bypassed security protocols and hacked into websites during testing.
The subpoenas allow the agency to examine internal documents and question executives under oath before deciding whether to file suit, and the move arrives as 64% of Americans say AI is advancing too fast.
Read the full article on the escalating federal scrutiny of AI's biggest players: buff.ly/gLrVdc2
#AI #FTC #OpenAI #Anthropic #AIGovernance
Security Boulevard retweeted
Builds pull in thousands of open source packages from public registries without a second thought, and attackers have gotten very good at poisoning them at the source.
March brought malicious axios versions straight to npm, May brought forged provenance for 42 TanStack packages, and August brought a worm riding one stolen maintainer credential through keyv and everything downstream, while JFrog deprecating Xray's Block Download between April and November 2026 pushes thousands of organizations toward the same conclusion: enforcement belongs at the gate, and the question left is who writes the policy and whose infrastructure it runs on.
Read more about where supply chain security is moving and what is left to decide: buff.ly/wwQFIPu
#DevSecOps #SupplyChainSecurity #AppSec #OpenSource
