30
30
Cyble Introduces Major Upgrade to its Executive Monitoring Module
Cyble upgraded Executive Monitoring in Cyble Vision, unifying impersonation, exposure, and mention findings with AI scoring and multi-channel alerting.
Cyble released a major upgrade to Executive Monitoring within its Cyble Vision platform, consolidating Mentions, Impersonations, Exposures, and a new Surface Mentions source (blog and news coverage) into a single findings stream. The release adds AI-generated verdicts and recommendations, per-executive Risk and Reputation scoring for board reporting, and richer onboarding with aliases, reference images, and addresses to cut same-name false positives. Alerting now supports data residency, bulk import, delivery via email, WhatsApp, and SMS, an Access API, and branded executive PDF reports; the upgrade is live with no customer action required.
15
F5 speeds up virtual patching to counter AI-driven threats
F5 added anomaly detection and agentic threat intelligence to its AI-powered WAF, enabling virtual patch enforcement against exploits within minutes.
F5 announced enhancements to F5 WAF for Distributed Cloud, adding anomaly detection that builds per-application traffic baselines and agentic threat intelligence built on technology from the Fletch acquisition. The AI-powered WAF scores each request in real time with a neural network risk engine, and internal testing claims 98% threat detection efficacy with false positives reduced to 1%. Automated virtual patching via Distributed Cloud Web App Scanning extends to F5 WAF for BIG-IP, letting teams block actively exploited vulnerabilities at the request level in minutes; agentic features are rolling out over coming months.
30
30
Mars Security brings threat intelligence to detection in real time
Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.
Mars Security announced a capability that automatically turns newly published threat intelligence from sources like CISA, Mandiant, Unit 42, and Microsoft into MITRE ATT&CK-mapped detection rules. Each rule is written in the native query language of the customer's telemetry (CrowdStrike Falcon, Wiz, Splunk, firewalls, identity providers, AWS, Snowflake, Databricks) and backtested against 30 days of the customer's data before deployment, with indicator scoring to drop noisy or stale indicators. The platform also maps existing detection coverage, flags gaps such as AWS CloudTrail tampering and pass-the-hash movement, and delivers some recommendations as open pull requests for detection-as-code workflows.
24
Mars Security Launches Real-Time Intel-to-Detection Engine That Turns Live Threat Intelligence Into Backtested Detections in Minutes
Mars Security launched Real-Time Intel-Based Detection, converting advisories into MITRE ATT&CK-mapped, backtested detection rules for CrowdStrike, Wiz, and Splunk within minutes.
The capability turns newly published threat intelligence from CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence into validated detection rules within minutes, each backtested against 30 days of the customer's own telemetry before deployment. Rules are written in native query languages across CrowdStrike Falcon, Wiz, Splunk, firewalls, Linux Sysmon, identity providers, AWS telemetry, and data lakes such as Snowflake and Databricks, with no data ingestion or stack changes. The feature is available at no additional cost to existing customers and on AWS Marketplace. Mars also flags detection coverage gaps and extends monitoring to credentials leaked by AI coding agents.
24
ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response
ANY.RUN integrates its interactive sandbox, IOC lookups, and STIX/TAXII threat feeds natively into SentinelOne for faster automated malware triage.
ANY.RUN and SentinelOne launched connectors that embed interactive sandbox analysis and threat intelligence into the SentinelOne console via Singularity Hyperautomation. Suspicious files and URLs from alerts are automatically submitted to the ANY.RUN sandbox, with behavioral verdicts and risk scores returned into alert notes. On-demand IOC lookups draw on sandbox history from 16,000 organizations and 700,000 analysts. A separate STIX/TAXII feed streams verified malicious IPs, domains, and URLs through the SentinelOne Marketplace TAXII Connect app.
25
F5 Bot Defense uses real-time risk scoring to detect fraud and abuse
F5 enhances Distributed Cloud Bot Defense with persistent device identification, real-time risk scoring, and agent-aware policies to manage AI agent traffic.
F5 announced enhancements to Distributed Cloud Bot Defense adding persistent device identification, real-time device risk scoring, risk-based workflow enforcement, and an agent-aware policy framework integrated with the F5 Application Delivery and Security Platform. The features aim to expose multi-account abuse, credential stuffing, and account takeover while allowing trusted AI agents to transact at machine speed. It targets fraud and abuse detection as agentic AI becomes a key interaction channel for sites, apps, and APIs.
22
WordPress Blocks High-Risk Plugin Releases With New AI-Powered Automated Security Review
WordPress.org now runs AI-powered automated security reviews on every plugin release, automatically blocking high-risk updates before distribution to millions of sites.
WordPress launched an automated security review that combines multiple AI models and Jetpack Scan during a six-hour cooldown to score each plugin release; updates above the blocking threshold are automatically held back from the WordPress.org update API. The change follows a July 28 incident where a backdoor added to a plugin with roughly 20,000 active installations was detected during cooldown and never delivered; the Plugins Team removed it 26 minutes after a Wordfence notification. Blocked developers receive an email with findings and are advised to publish a corrected version rather than await manual appeal.
58
OpenAI Builds ‘Defense Factory’ Where AI Agents Continuously Find and Fix Vulnerabilities
OpenAI unveils a Defense Factory where AI agents continuously discover, validate, and fix vulnerabilities, integrating GitHub, Snyk, Semgrep, Tenable, and ServiceNow.
OpenAI introduced a Defense Factory, an agent-first cybersecurity operation that connects AI agents to developer and security tools via APIs, CLIs, and Model Context Protocol integrations including GitHub, GitLab, Snyk, Semgrep, Tenable, Jira, Linear, and ServiceNow. During an internal security sprint, over 250 people across more than 100 service areas closed 53 urgent or high-priority issues on day one, achieved a 90.6% accepted ownership-assignment rate, and Codex generated all remediation patches with only 0.53% rolled back. Agent-assisted deduplication flagged 37% of findings as duplicates, and runtime validation reproduced 19.5% of findings, cutting the false-positive rate to 0.81%. OpenAI argues defenders must exploit a temporary 'defender's window' using source-code access and frontier models before open-weight models enable autonomous offensive agent fleets.
55
Product showcase: GitGuardian Honeytoken catches credential theft as it happens
GitGuardian now deploys honeytoken decoy AWS credentials across developer fleets via MDM, generating high-fidelity alerts when infostealers test stolen credentials.
GitGuardian extended its honeytoken platform so decoy AWS credentials can deploy fleet-wide to developer laptops through existing MDM tooling, with deleted decoys automatically replaced at the next sync. When a harvester tests a decoy, the platform logs the API call in the controlling AWS account and raises an incident naming the source machine and file, routed via email, Slack, Teams, ServiceNow, or webhooks. The capability responds to infostealers such as Shai-Hulud that scan entire filesystems and validate stolen credentials within seconds. GitGuardian is building decoys for Kubernetes and package registry credentials using random, structure-free identifiers that resist detection.
22
This Key Will Self-Destruct: An Open Standard for Revocable API Keys
SecurityWeek opinion piece proposes ORKS, an open standard adding issuer prefixes, discovery files, and unauthenticated revocation endpoints to make leaked API keys quickly revocable.
The article argues that plain API keys leak frequently yet lack any standardized revocation mechanism, unlike OAuth tokens which gained RFC 7009 revocation in 2013, and that GitHub's Secret Scanning Partner Program solves this only in a proprietary, invite-only way. The author proposes ORKS (Open Revocable Key Standard), with a draft spec on GitHub, built on four parts: keys embedding their issuer domain in a fixed prefix format, a discoverable /.well-known/api-key-config JSON file, unauthenticated revocation by possession of the full key, and declared constraints such as IP allowlists, expiry, scopes, and mTLS. An optional quarantine mode inspired by Toyota's andon cord restricts a reported key to read-only and throttled operation for a default 24-hour window before automatic revocation. The piece frames AI agents as making this urgent, since agents hold many credentials, can exfiltrate them via prompt injection, and can leak secrets into logs at machine speed.
30
AI-Infra-Guard: Open-source security scanner for AI systems
Tencent's Zhuque Lab open-sourced AI-Infra-Guard, a scanner that fingerprints AI services, checks 1,600+ CVEs, and evaluates MCP skills.
AI-Infra-Guard fingerprints running AI services such as Ollama, vLLM and ComfyUI, checks them against more than 1,600 known CVEs, and inspects MCP servers and agent skills across 14 risk categories. Its SkillTrustBench judging set contains 5,520 human-labeled samples, with false positive rates of 1.20%–18.67% depending on the judging model. Users include ICBC, China Merchants Bank, China Telecom, Lenovo, vivo and Bilibili. Release 4.1.9 hardened scanning agents against indirect prompt injection, and the open-source build ships without authentication, requiring a reverse proxy with Basic Auth or an IP allowlist.
35
Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes
Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.
Mars Security, an autonomous threat hunting and detection engineering platform founded by former offensive security operators, announced Real-Time Intel-Based Detection. The capability ingests advisories from sources like CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence, maps indicators to MITRE ATT&CK, and authors native query logic across connected infrastructure including CrowdStrike Falcon, Wiz, Splunk, Sysmon, identity providers, Snowflake, and Databricks. Every rule is backtested against 30 days of historical telemetry to quantify false positives before analyst approval and one-click deployment. The feature is free for existing customers and available via AWS Marketplace.
22
Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests
Reflectiz launched a multi-agent AI penetration testing platform for websites, claiming up to 10x more coverage than conventional pentests.
Reflectiz, a continuous web exposure management vendor, launched a multi-agent penetration testing platform for websites under a new Offensive Hub. Four specialized agents crawl the site like a real user, fingerprint the stack, run attacks, and independently validate findings to remove false positives. The company claims up to 10x more coverage than conventional pentesting by starting from its pre-existing live model of each site. Findings integrate via REST API, CI/CD triggers and Slack, and the Atlas remediation agent guides fixes.
20
Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests
Reflectiz launched a multi-agent AI penetration testing platform for websites, claiming up to 10x more coverage than conventional pentests by leveraging existing site context.
Reflectiz, a web exposure management vendor, announced an agentic penetration testing product within a new Offensive Hub. The platform uses specialized AI agents for crawling, stack fingerprinting, attack execution, and independent validation, claiming to cover the OWASP Top 10 and reduce false positives. Findings integrate with existing workflows via REST API, CI/CD triggers, and Slack, and an AI remediation agent named Atlas guides fixes. The announcement is a vendor press release with a planned September 15 webinar demo.
22
Synology ActiveProtect Manager 2.0 improves AI-driven security
Synology released ActiveProtect Manager 2.0, expanding backup coverage to EC2, Azure, Proxmox and Google Workspace, with AI anomaly detection and malware scanning coming in 2.1.
Synology launched ActiveProtect Manager 2.0 for its DP Series data protection appliances, adding platform coverage for Amazon EC2, Azure VM, Proxmox VE, Nutanix AHV and Google Workspace. The release introduces cross-platform recovery, expanded backup destinations including Azure Blob Storage, and volume-level software storage encryption. The upcoming 2.1 update will add AI/ML anomaly detection tracking change rates, mass deletions and entropy, plus pre-restore malware scanning using Microsoft Defender, Bitdefender and ESET with Auto Fallback to the last clean version.
25
Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira
Stratus Security open-sourced Sift, a CLI secrets scanner covering Active Directory, SharePoint, Teams, Slack, Jira, and Confluence, outperforming Snaffler in benchmarks.
Stratus Security released Sift, a free open-source command line tool that hunts passwords, API keys, and sensitive data across local disks, Windows shares, Active Directory, SharePoint, OneDrive, Teams, Slack, Jira, and Confluence. In the firm's benchmarks, Sift scanned 250,000 files in 10.61 seconds versus Snaffler's 25.48 and averaged 92 MiB memory versus Snaffler's 337 MiB. Optional false-positive filtering runs through a local language model via Ollama, and scans write checkpoints so interrupted runs resume. The tool found thousands of credentials in Jira ticket comments that prior pentesting had missed.
28
55
30
30
30
30
30
30
30
30