Search: “Contrast Security”

29 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI safety & security 7 Industry 7 AI industry 5 Research 5 Vulnerability 4 AI policy 4 Policy & legal 3 Threat actor 3 Phishing & fraud 2 Tools 2 Malware 2

SeverityAll critical 0 high 5 medium 9 low 1 info 29

AI AppSec tools agree on just 5% of security findings

Contrast Security report finds 42 confirmed exploit attempts per application monthly and three AI scanners agreeing on only 5% of findings.

Contrast Security's AppSec Overflow 2026 report, drawing on telemetry from hundreds of thousands of production applications and APIs, found adversaries touch the average application every four minutes with 42 confirmed viable exploit attempts per application monthly, led by untrusted deserialization, path traversal, and method tampering. Legacy flaws Log4Shell and Spring4Shell remain widespread, mean time to exploit fell from over two years in 2018 to under three weeks for most 2025 exploited vulnerabilities, and average critical fix time is 92 days. Three AI scanners set on the same codebase agreed on only 5% of findings, and triaging a 2-million-line codebase scan cost roughly $128,000 versus $315 in API charges. Among exploited CVEs in the dataset, 82% of KEV-listed entries carried EPSS scores of 90% or higher, while CVE-2006-1547 and CVE-2023-38180 were confirmed exploited despite EPSS scores under 25%.

Help Net SecurityAug 31, 00:00 UTC · 17d agoResearch in the wildCVE-2006-1547 CVE-2023-381801

AI made software development unrecognizable. Is cybersecurity next?

Opinion piece argues AI-driven shifts that transformed software development—agent-run SOCs, autonomous triage—will soon reshape cybersecurity operations and staffing.

A CSO Online analysis notes Google Cloud research found 90% of developers already use AI, while a March 2026 Federal Reserve paper found coder employment growth fell roughly 3% since ChatGPT's arrival. Gartner predicts 80% of organizations will run smaller, AI-augmented engineering teams by 2030. Security leaders from Contrast Security, Menlo Security and the Cloud Security Alliance expect agent-run SOCs, machine-speed containment and abundant vulnerability discovery, but caution that absorption capacity and autonomous production-environment validation remain bottlenecks.

CSO OnlineSep 16, 08:25 UTC · 22h agoIndustry

Cybersecurity in Power Grids: Standards and Research Challenges

Survey contrasts IT and OT security in smart grids, reviewing IEC 62351, IEC 62443, ISO 27001 standards and AI-driven detection trends.

The paper examines Smart Grid cybersecurity, emphasizing critical distinctions between IT and OT environments. It analyzes grid architecture, substation threats, and key international standards including IEC 62351, IEC 62443, and ISO 27001. It concludes with an overview of recent research trends such as AI-driven threat detection.

arXiv cs.CRSep 15, 10:03 UTC · 1d agoResearch

VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities

Introduces VEX-Bench, 75 expert-labeled real-world cases testing whether LLM agents can assess supply chain vulnerability exploitability; frontier models reach about 80% F1.

VEX-Bench is the first benchmark evaluating LLM agents on assessing whether upstream dependency vulnerabilities are exploitable in downstream projects, with 75 real-world expert-labeled cases across Python, Java, and Go mined from GitHub. Nine models across three agent harnesses were evaluated; GPT-5.5 and Claude Opus 4.6 reach approximately 80% F1 on binary vulnerability-status classification, but only GPT-5.5 surpasses 70% macro-F1 on fine-grained justification classification. The gap highlights the difficulty of moving beyond binary exploitability calls to explaining exploitability reasons, unlike prior benchmarks targeting zero-day settings.

arXiv cs.CRSep 7, 22:52 UTC · 9d agoResearch1

How to secure hybrid meeting rooms without sacrificing user experience

Sponsored Barco piece, citing IDC data, says security is now the top videoconferencing purchase criterion as NIS2 and Cyber Resilience Act compliance pressures mount.

The sponsored article cites IDC research showing security (31%) now outranks price (26%) and quality (25%) as the top videoconferencing purchase criterion. It highlights concerns like malware propagation (47%), missed patches (39%), and risky user behavior (37%), and references NIS2, the Cyber Resilience Act, the Radio Equipment Delegated Act, and ISO/IEC 27001. Barco ClickShare marketing director Yannic Laleeuwe argues security is now a prerequisite for market access and resilience, but warns that usability tradeoffs drive risky workarounds.

The Register · SecuritySep 8, 15:00 UTC · 8d agoIndustry

Post-quantum cryptography adoption and the national security implications

Opinion analysis argues quantum computing favors nation-state espionage, leaving lagging post-quantum adoption at critical infrastructure exposed to harvest-now-decrypt-later attacks.

A CSO Online opinion piece argues that the extreme cost and infrastructure requirements of quantum computers will concentrate cryptographically relevant quantum capability among nation-states and a few corporations, favoring espionage and economic espionage over criminal monetization. It highlights harvest-now-decrypt-later risk to long-lived secrets, expert warnings such as Filippo Valsorda's, and diverging CRQC timelines with Google suggesting possibly 2029. The piece predicts governments, banks, and targeted sectors will adopt PQC first while utilities, small hospitals, and local government lag, widening exploitable gaps in critical infrastructure reminiscent of Salt Typhoon-style access.

CSO OnlineSep 9, 09:00 UTC · 7d agoIndustry

Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes

Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.

Mars Security, an autonomous threat hunting and detection engineering platform founded by former offensive security operators, announced Real-Time Intel-Based Detection. The capability ingests advisories from sources like CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence, maps indicators to MITRE ATT&CK, and authors native query logic across connected infrastructure including CrowdStrike Falcon, Wiz, Splunk, Sysmon, identity providers, Snowflake, and Databricks. Every rule is backtested against 30 days of historical telemetry to quantify false positives before analyst approval and one-click deployment. The feature is free for existing customers and available via AWS Marketplace.

CSO OnlineSep 8, 15:05 UTC · 8d agoTools2

China Calls Amodei’s AI Proposal a New Cold War Playbook

China's government rejected Dario Amodei's frontier AI slowdown proposal as a 'Cold War playbook' aimed at containing China's tech sector.

China's Foreign Ministry and state-backed Global Times attacked Anthropic CEO Dario Amodei's 'We Must Pace the Frontier' essay, calling it fearmongering and US containment strategy. Amodei proposed stronger independent testing, greater coordination between AI companies, and international safety cooperation, while supporting continued restrictions on China's access to advanced AI chips. The dispute unfolds ahead of a planned September 24 Trump-Xi meeting on AI governance, with Trump rejecting slowdown calls and Chen Yixin of China's Ministry of State Security separately warning that advanced AI enables large-scale vulnerability discovery and hacking.

Security AffairsSep 14, 18:11 UTC · 2d agoAI policy

How to level up from security pro to security leader

Career advice piece argues aspiring CISOs must pair technical depth with business fluency, communication, and cross-department influence.

The article offers guidance for security professionals moving into CISO and security leadership roles, drawing on interviews with CISOs at ExtraHop, BlueVoyant, Infosys, and others. It emphasizes translating technical risk into business priorities, building trust across departments, and understanding how the company makes money. An analysis of CISO job postings found employers value communication skills, regulatory knowledge, and business education over mastery of specific security platforms.

CSO OnlineSep 14, 08:25 UTC · 2d agoIndustry

The latest AI doomsayer is China’s intelligence boss

China's State Security Minister Chen Yixin frames AI as a strategic battleground, urging technological sovereignty and new AI laws as CAC publishes safety framework 3.0.

Chen Yixin, China's minister for State Security, published an article in China Cyberspace Magazine calling AI the main battleground for global technological competition and warning it could be weaponized to exploit vulnerabilities, attack infrastructure, and steal secrets. He urged technological sovereignty, special AI laws, and Xi Jinping-aligned modernization of national security capabilities, citing risks from foreign AI products and user data leakage. The Cyberspace Administration of China followed with version 3.0 of its AI Safety Governance Framework, endorsing regulatory sandboxes and risk-controllable mechanisms. The stance implies continued exclusion of Nvidia and AMD GPUs from the Chinese market.

The Register · SecuritySep 15, 04:56 UTC · 2d agoAI policy

New AI Workflow Identity Hijacking Attack Lets Hackers Exfiltrate Sensitive Data

Noma Labs disclosed Workflow Identity Hijacking, an AI automation flaw letting anonymous users trigger privileged data exfiltration without prompt injection or stolen credentials.

Noma Labs researcher Sasi Levi described Workflow Identity Hijacking, where AI workflows process untrusted input from low-privileged or anonymous users but execute downstream actions with the workflow creator's elevated permissions, turning the pipeline into an unauthenticated proxy. Unlike prompt injection, the model is not tricked; the flaw is a missing authorization check between the requester and the privileged actions. Noma Labs also disclosed and helped fix a similar issue in Google Workflows, and linked the problem to the earlier GitLost research on GitHub Agentic Workflows. Recommended mitigations include per-user identity propagation, least-privilege service accounts and authorization checks before every downstream action.

GBHackersSep 10, 07:51 UTC · 6d agoAI safety & security

The Outsized Shadow: Why 5% of AI Users Are Your Biggest Security Risk

Akamai's 2026 Enterprise AI Usage report finds the top 5% of AI power users create outsized shadow AI, data leakage, and agent security risks.

Akamai's State of the Internet: Enterprise AI Usage Risk Report 2026, based on real-world usage telemetry, finds the top 5% of enterprise AI power users interact with AI models at 12 times the rate of the bottom 50% of the workforce. 47.11% of enterprise AI conversations occur through personal identities rather than corporate-managed accounts, and 14.4% run through corporate email addresses tied to personal freemium subscriptions. 17.7% of employees at midsize enterprises use AI browser or IDE extensions, of which 16.31% contain known CVE vulnerabilities and nearly 75% request high or critical permissions. The report also describes emerging attack vectors including Vibe Hacking, CursorJacking, and CometJacking indirect prompt injection.

The Hacker NewsAug 24, 11:30 UTC · 23d agoAI safety & security1

ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents

ActGuard audits LLM agent actions before execution against predicted tool priors, masking only malicious spans from indirect prompt injections while preserving utility.

ActGuard is a pre-execution action auditing framework against indirect prompt injection in LLM agents, judging whether external content causes the current action to deviate from a locally reasonable expectation rather than whether content is inherently suspicious. At each step it predicts the tools likely used by the upcoming action, builds a local tool prior, then performs tool-level contrastive analysis and parameter-level evidence localization to identify deviations. A verifier masks only spans confirmed as malicious and regenerates the action from the sanitized context. On challenging tool-using agent benchmarks it reduces attack success to state-of-the-art levels while keeping task utility close to the no-attack setting; code is publicly available on GitHub.

arXiv cs.CRSep 14, 03:47 UTC · 3d agoAI safety & security

Trump may be forced to reveal secret rules feds use for AI safety testing

Protect Democracy sued four federal agencies to force disclosure of the administration's secret framework for frontier AI safety reviews.

Nonprofit Protect Democracy sued four federal agencies, including the Office of the National Cyber Director, OSTP, Treasury and Commerce, seeking disclosure of the secret voluntary framework used for pre-release safety reviews of frontier AI models. The complaint demands the framework text, participant identities and selection criteria by September 30, alleging OpenAI negotiated a private agreement limiting distribution of its cutting-edge models to government-vetted partners. The suit follows the launch of the GOLD EAGLE clearinghouse and the completion of the review framework on August 3, with California Senator Josh Becker supporting the request while the state considers the SB 813 bill for transparent AI safety standards.

Ars Technica · AISep 2, 17:58 UTC · 14d agoAI policy

MFA's Weakest Link: Account Recovery Is the New Attack Path

Help desk account recovery is increasingly the weakest link in MFA-protected identities, as Scattered Spider's impersonation-driven Marks & Spencer attack demonstrated.

As MFA, conditional access, and phishing-resistant factors raise the cost of direct account takeover, attackers increasingly target the recovery process, convincing service desk staff to reset passwords or re-register MFA on attacker-controlled devices. CISA, FBI, and partner advisories describe Scattered Spider posing as employees to trigger such resets; the 2025 Marks & Spencer attack began this way and led to ransomware with an estimated £300 million profit impact. Microsoft now describes Entra ID account recovery as a high-assurance process, and the article promotes Specops Secure Service Desk for verified identity workflows.

BleepingComputerSep 9, 14:01 UTC · 7d agoPhishing & fraud

Stop Telling People Not To Click Links

Tailscale CEO argues link-clicking is not the problem; deploying phishing-resistant authentication like passkeys and WebAuthn eliminates entire attack classes.

Tailscale CEO Avery Pennarun argues in an opinion piece that clicking links is a symptom, not the disease, and that weak authentication is the real failure behind phishing damage. He advocates phishing-resistant FIDO/WebAuthn, passkeys, and device-bound tokens, plus continuous identity-anchored network access so unexpected login prompts become suspicious signals. He argues this approach makes security less burdensome for users while neutralizing credential replay and fake login pages.

Lobsters · securitySep 3, 21:56 UTC · 13d agoIndustry

Cybersecurity IR Workshop: The workshop you shouldn’t miss

Microsoft's DART team promotes a 2-3 day Cybersecurity Incident Response Readiness Workshop that stress-tests IR plans against simulated attacks.

Microsoft's Detection and Response Team (DART), which delivers Defender Experts incident response and has supported organizations across 54 countries, is offering its Cybersecurity Incident Response Readiness Workshop. The scenario-driven engagement exercises detection, investigation, containment, and decision-making across identity, endpoint, cloud, and communications, ending with prioritized recommendations. It is available to Unified Enterprise agreement customers via their Customer Success Account Manager.

Microsoft Security BlogSep 1, 18:55 UTC · 15d agoIndustry

GPT-6 Astra gives mathematicians a breather, and OpenAI says that's by design

OpenAI's GPT-6 Astra tops ulam.ai's ErdosBench math benchmark with 106 of 226 problems solved, while the company prioritizes recursive self-improvement over math optimization.

OpenAI's GPT-6 Astra leads ulam.ai's ErdosBench with a score of 3.23, solving 106 of 226 open math problems and fully solving 43, ahead of GPT-5.6 Sol's 78 solved problems. Chief scientist Jakub Pachocki said OpenAI deliberately avoided targeted math optimization to prioritize recursive self-improvement and automated alignment research. Benchmark developer Przemek Chojecki estimated the gain at 5-10% across tested math-research skills. Mathematician Terence Tao warned at the 2026 International Congress of Mathematicians that AI-generated proofs could shift mathematics from proof scarcity to proof overload.

The Decoderupdated Sep 12, 20:00 UTC · 4d agofirst Sep 10, 13:45 UTC · 6d agoAI industry 11 sources1

‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

White House launches Watershed 250, a six-month Texas pilot using volunteer vendor cyber and AI tools to harden water utility defenses.

The Office of the National Cyber Director and Texas Cyber Command will oversee the six-month Project Watershed 250 pilot to improve water sector cybersecurity through industry-donated red teaming, system hardening and AI tooling. Twelve companies including Microsoft, Fortinet, Google Cloud, Palo Alto Networks, AWS, Cloudflare, Zscaler, Forescout, Abnormal AI and Dragos participated in the rollout. Officials cited recent attacks including an Iranian-backed campaign against 30 water systems in 12 states and a 2024 incident in Muleshoe, Texas. Some water-security professionals criticized the program as lacking dedicated funding.

CyberScoopAug 31, 20:21 UTC · 16d agoPolicy & legal1

Hillingar - MirageOS Unikernels on NixOS

A technical write-up details Hillingar, enabling reproducible Nix-based builds and NixOS deployment of MirageOS OCaml unikernels such as authoritative DNS servers.

This blog post (published December 2022, updated February 2025) describes Hillingar, work from the author's master's thesis enabling reproducible builds and deployments of MirageOS OCaml unikernels using Nix and a custom NixOS module, demonstrated with an authoritative DNS server. MirageOS unikernels embed application and low-level OS code in a single kernel, allowing dead-code elimination that reduces attack surface and improves efficiency. The post covers challenges such as solving opam dependency version constraints when linking a single dependency set.

Lobsters · securitySep 4, 09:17 UTC · 12d agoTools1

UK's Online Safety Act has made 'absolutely no difference,' kids say

UK Children's Commissioner tells Lords committee the Online Safety Act has 'made absolutely no difference' and criticizes Ofcom over risk assessment transparency.

England's Children's Commissioner Dame Rachel de Souza testified that more than a year after key Online Safety Act child-protection duties took effect, children report no meaningful change in accessing harmful content. She criticized Ofcom for refusing to share companies' safety risk assessments under section 393(1) of the Communications Act 2003, and planned to use statutory powers to compel disclosure. She argued the OSA has not kept pace with AI-driven harms (citing the 'Grok nudifying' controversy) and urged Ofcom to 'use its teeth,' contrasting the UK's approach with Meta's proposed $18 billion US child-safety settlement.

The Register · SecuritySep 3, 09:14 UTC · 13d agoPolicy & legal1

Srsly Risky Biz: Trump's Private Hacker Memo Is the Right Idea

A Trump presidential memo directs DHS to authorize vetted private-sector hackers to conduct cyber operations against foreign cybercriminal groups (CE-TCOs).

A presidential memorandum directs the Department of Homeland Security to establish a program authorizing private companies to conduct cyber surveillance and cyber effects operations against Cyber-Enabled Transnational Crime Organisations (CE-TCOs). Participating companies must pass vetting, obtain government approval before operations, and post a USD $1 million bond. The accompanying fact sheet cites more than USD $20.8 billion in US losses to cyber-enabled crime in 2025. Critics worry about accidental escalation if operations touch foreign government systems.

Risky Business NewsAug 20, 05:29 UTC · 28d agoPolicy & legal1

Who gets to define the rules for AI?

Cohere CEO Aidan Gomez attacks big-lab antitrust exemption proposals as cartel behavior that lets incumbents write AI safety rules.

Cohere CEO Aidan Gomez argues that proposals from large AI labs—particularly Anthropic's roadmap requesting antitrust exemptions for safety coordination—amount to a cartel letting incumbents define rules for everyone else. He draws parallels to the 1975 SEC NRSRO credit-rating designations and the EU's 1985 Motor Vehicle Block Exemption, where safety justifications produced incumbent-protecting market structures. Gomez supports independent review of highly capable AI systems but disputes who writes the standards, who conducts review, and who participates. He also warns AI cyber offense is getting cheaper faster than defenses are improving.

Hacker News · AISep 14, 04:49 UTC · 3d agoAI policy HN 41↑ · 29 comments

OpenAI reports AI "research interns" and warns about its own pace at the same time

OpenAI claims its automated research intern milestone is met, with agents now doing 3.1 workdays per human day, while Pachocki warns monitoring is weakening.

OpenAI says it achieved its goal of an 'automated research intern' handling scoped multi-day research tasks under human guidance, per internal measurements without detailed validation. The report states the median researcher spends over $600 daily on inference (90th percentile above $7,000), token output grew 124-fold since December 2025, and agents run 3.1 agent workdays per human workday as of mid-August; tasks under 15 minutes succeed 86% autonomously, but over half of four-to-eight-hour tasks need human intervention. In an accompanying essay, Jakub Pachocki warns chain-of-thought monitoring is losing reliability, notes the Hugging Face incident showed values-spirit violations, calls for binding independent audit standards, and argues no lab has solved alignment well enough to keep scaling at maximum speed.

The DecoderSep 7, 13:05 UTC · 9d agoAI industry

The Intelligible World of Agents

Recorded Future argues cybersecurity AI agents perform better when reasoning over structured, curated intelligence graphs rather than fragmented alerts or open-source noise.

In a vendor essay, Recorded Future describes how its security agents produced more authoritative analyses after being re-architected to reason primarily over the Recorded Future Intelligence Graph instead of weighting open-source information equally. The author argues agentic decision quality depends mainly on a structured, current operational world model of assets, vulnerabilities, threat actors, detections and organizational context, not on model intelligence itself. The piece further claims frontier model access is commoditizing and that orchestration tooling will converge, making trusted representations of organizational knowledge the durable competitive differentiator.

Recorded FutureSep 10, 00:00 UTC · 7d agoAI safety & security

NVIDIA Brings Real-Time AI to Broadcast, Sports and Global Streaming at IBC

NVIDIA expanded its AI for Media suite at IBC 2026, adding NIM microservices for synthetic video detection, body pose, frame generation, upscaling and HDR.

At IBC 2026 in Amsterdam, NVIDIA announced a major expansion of NVIDIA AI for Media, a collection of GPU-accelerated SDKs, NIM microservices and blueprints for broadcast and streaming workflows. The Synthetic Video Detector (SVD) NIM microservice reaches 99.3% accuracy on text-to-video and 97.7% on image-to-video content, while Video Frame Generation boosts frame rates 2x-4x and Video Super Resolution adds 10-bit support; TrueHDR converts SDR to HDR at up to roughly 2,000 nits. Partners including Dalet, TwelveLabs, Wowza, Vizrt and Ross Video are integrating the new services into verification, compliance and live-production workflows.

NVIDIA BlogSep 9, 16:00 UTC · 7d agoAI industry

When AI quietly breaks things, who pays?

Reed Smith partner David Halbreich explains how AI companies can avoid D&O/E&O coverage gaps around mergers, governance warranties, and claims timing.

In an interview, insurance recovery partner David Halbreich of Reed Smith outlines insurance pitfalls for AI companies under claims-made D&O and E&O policies. He highlights 'straddle' claims after mergers that fall between tail coverage and go-forward policies, potentially leaving policyholders with no coverage. He also warns that governance artifacts submitted in insurance applications, such as bias testing records and model cards, can become warranties carriers use to deny claims, and discusses who should answer AI-use questions and how business interruption coverage applies to cloud and compute vendor outages.

Help Net SecuritySep 3, 00:00 UTC · 14d agoAI industry

OpenClaw Power, MacBook Simplicity: Five Days With Grok Bot

Hands-on review finds Grok Bot simplifies agent setup via browser logins and bot abstraction, contrasting with the user-owned OpenClaw platform.

After five days with Grok Bot, the reviewer highlights browser-based sign-in as the key differentiator: connecting X, Freshdesk, and Google Calendar required only logins, no MCP configs or API keys. The piece contrasts Grok Bot's managed 'agent computer' with OpenClaw 2.0's user-owned Gateway, which now supports reusing Claude Code or Codex logins and ships a native Codex runtime. Grok Bot introduces 'Bots' as composable units arranged in 'group chats', exemplified by an Agentic Engineer Bot routing tasks across Claude Code, Codex, and Grok Build CLI. The reviewer used Grok Bot with a Cursor Pro+ account.

Latent SpaceSep 5, 15:01 UTC · 11d agoAI industry1