Search: “identity”

349 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 98 AI safety & security 75 Data breach 56 Phishing & fraud 54 Threat actor 50 Research 47 AI research 44 Tools 43 Exploit / PoC 35 Advisory 32 Policy & legal 29 Vulnerability 28 Malware 26 Model release 21

SeverityAll critical 40 high 131 medium 137 low 8 info 361

Key Reasons Why Identity Fabric Matters in 2026

Identity sprawl and unowned machine identities leave enterprise access unobserved at runtime; identity fabrics aim to close the gap between policy intent and execution.

This sponsored explainer describes identity fabric as an architectural approach connecting identity providers, governance systems, applications, and infrastructure into one observable layer that compares designed access intent with runtime execution. It argues identity sprawl across SaaS, APIs, and cloud workloads, plus unmanaged non-human identities (service accounts, bots, workloads, API keys), leaves overprivileged, dormant, and unowned machine identities unmonitored. IdP-only monitoring misses application-layer attacks, and the piece advocates behavioral visibility and lifecycle governance for secrets and machine identities.

The Hacker NewsAug 28, 11:30 UTC · 19d agoIndustry

Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.

Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.

Palo Alto Unit 42Sep 14, 10:00 UTC · 3d agoResearch

Top 10 Best Cloud Infrastructure Entitlement Management (CIEM) Tools in 2026

2026 CIEM guide ranks Wiz, Prisma Cloud, Okta, Entra Permissions Management and specialists Sonrai, Britive, Tenable/Ermetic for cloud entitlement right-sizing.

Buyer's guide covers ten CIEM products across three market routes: CNAPP-bundled (Wiz, Prisma Cloud), identity-suite (Okta, CyberArk, SailPoint, Saviynt) and specialists (Sonrai, Britive, Tenable/Ermetic). It cites machine identities outnumbering humans 10:1 plus effective-permissions sprawl as core drivers, with JIT elevation as the fix. Notable consolidation includes Tenable acquiring Ermetic and Zscaler acquiring Canonic.

Cyber Security NewsSep 15, 06:30 UTC · 2d agoTools

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.

Palo Alto Networks Unit 42 describes post-exploitation techniques in which an attacker with root on a compromised Kubernetes node spoofs Linux cgroup metadata used by the SPIRE agent during workload attestation, tricking it into issuing a co-located workload's SPIFFE Verifiable Identity Document to an attacker-controlled process. The research shows the core trust assumption of machine-identity systems—that the node is trusted—collapses once root is obtained, exposing all cryptographic identities scoped to that node. Unit 42 released an open-source tool, Spooffe, for defenders to test identity exposure, and notes the technique has not been observed exploited in the wild.

Palo Alto Unit 42Sep 10, 10:00 UTC · 7d agoResearch1

SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise

SpyCloud survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.

The 2026 Identity Threat Report surveyed 750 cybersecurity leaders at organizations with 500+ employees across North America and Europe. Compromised non-human identities (31%) were the most cited primary attacker entry point, nearly double phishing (17%), while only 36% of organizations monitor AI agents, service accounts and API keys. 68% of respondents reported identity-based events, averaging eight each, and 91% use AI tools but only 56% have formal governance over their privileges.

GBHackersSep 9, 12:54 UTC · 7d agoResearch 2 sources

SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise

SpyCloud's 2026 survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.

SpyCloud's Identity Threat Report, based on a survey of 750 cybersecurity leaders at organizations with 500+ employees, found compromised non-human identities (31%) were nearly twice as likely as phishing (17%) to be the primary attacker entry point. 68% of organizations reported identity-based events averaging eight each, while 95% believe they have visibility into AI and NHI exposures but only 36% actually monitor them. The report also found 91% use AI tools with internal access but only 56% have formal governance, and introduces an Identity Threat Protection Maturity Model.

CSO OnlineSep 9, 12:00 UTC · 7d agoIndustry

IAM Compliance Requirements and Best Practices

A guide maps IAM compliance requirements across SOX, PCI DSS, HIPAA, ISO 27001 and NIST 800-53, urging verified enforcement over documented policies.

The guide argues IAM compliance requires demonstrating that access controls are enforced at runtime, not merely documented, highlighting gaps between policy intent and application-layer execution. It maps recurring requirements across SOX ITGCs, PCI DSS v4.0, HIPAA, ISO/IEC 27001:2022, NIST SP 800-53 and GDPR, covering least privilege, separation of duties, access certification and audit trails. It recommends continuous, evidence-backed verification and application-layer telemetry instead of relying on identity provider logs or quarterly access reviews.

The Hacker NewsAug 28, 09:06 UTC · 20d agoIndustry

12 Best CIEM Tools Compared (2026): Features & Pricing

Buyer's guide compares twelve CIEM tools; Microsoft discontinued Entra Permissions Management, while Tenable (Ermetic), CyberArk, and Wiz lead the 2026 scorecard.

The scorecard evaluates twelve cloud infrastructure entitlement management vendors on permission analytics depth, JIT enforcement, non-human identity coverage, pricing predictability, and bundle leverage. Tenable (Ermetic) leads at 4.70, followed by CyberArk and Wiz, while Microsoft's retirement of Entra Permissions Management (CloudKnox) forces existing customers into migration cycles. Pricing structures span per-identity, per-resource, per-workload, credit-based, and quote-based models.

GBHackersSep 16, 07:37 UTC · 1d agoIndustry 2 sources

Orchid Security targets AI agent risk with drift detection and kill switches

Orchid Security launched identity drift detection and application-level kill switches to govern AI agents that exploit enterprise identity debt.

Orchid Security announced AI readiness controls including agent discovery, continuous drift detection between an agent's intended purpose and observed behavior, and application-level kill switches that revoke credentials, disconnect tools, or suspend agent workflows. The company cites its Identity Gap 2026 finding that 57% of enterprise identity is unseen and unmanaged, which agents can leverage to gain elevated access in seconds to minutes. New integrations include a certified PAM integration for Palo Alto Networks Idira and identity telemetry streaming to Splunk Enterprise Security. The launch follows agentic enhancements to Orchid's Identity Control Plane in May 2026 and cites NIST's draft Cyber AI Profile and DORA as regulatory drivers.

Help Net SecuritySep 9, 13:29 UTC · 7d agoAI safety & security

Recorded Future Launches Digital Risk Protection, Unifying Brand and Identity Monitoring

Recorded Future launched Digital Risk Protection, unifying brand and identity monitoring across five external threat surfaces in one workflow.

Recorded Future announced Digital Risk Protection, combining brand threat monitoring and identity exposure monitoring across five use cases: malicious site, impersonation, code repository, dark web brand, and identity exposure monitoring. The platform includes an AI Triage Agent that automates alert evaluation with explicit verdicts and context, expanding social media analysis, OCR, full Telegram coverage, and infostealer log ingestion. Gartner's 2026 Magic Quadrant folded digital risk protection into cyber threat intelligence technologies, and the launch cites $15.9 billion in 2025 US fraud/scam losses, up 28% year over year.

Recorded FutureSep 9, 00:00 UTC · 8d agoTools

Threat Matrix: Mapping threats across cloud web applications

Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.

Microsoft introduced the cloud web applications threat matrix, which organizes attack techniques for cloud-hosted web apps and serverless platforms using MITRE ATT&CK tactics, from resource development through impact. The framework covers attack paths spanning application code, managed runtimes, workload identities, and deployment pipelines, cataloging techniques such as subdomain takeover, code injection in connected repositories, compromised registry images, exposed admin interfaces, and serverless trigger injection. It builds on Microsoft's earlier Kubernetes and storage services matrices to help defenders identify visibility gaps, prioritize hardening, and plan investigations in cloud-native environments.

Microsoft Security BlogSep 9, 21:30 UTC · 7d agoTools1

AI is making fraud harder to spot and identity harder to prove

Experian's 2026 report finds AI-generated scams, deepfakes and synthetic identities spreading across digital channels, pushing businesses toward adaptive identity verification and 'Know Your Agent' checks.

Experian's 2026 US Identity & Fraud Report, based on consumer and business surveys, found 60% of consumers aware of AI-generated image/video scams, 53% of AI phishing, and 47% of deepfake voice impersonation. 80% of US businesses already use machine learning or generative AI in fraud management, while AI chatbot account openings rose from 16% in 2025 to 27%. The report highlights adaptive authentication, behavioral biometrics, and emerging 'Know Your Agent' controls as AI agents begin acting on behalf of customers.

Help Net SecurityAug 20, 00:00 UTC · 28d agoPhishing & fraud

CISA and NIST Release Technical Checklist for Safeguarding Identity Tokens From Theft and Misuse

CISA and NIST published NIST IR 8587, final guidance for protecting identity tokens from forgery, theft, replay, and signing-key compromise.

NIST Interagency Report 8587 (September 15, 2026) expands the IA-13 'Identity Providers and Authorization Servers' control from NIST SP 800-53 R5.1.1, guiding federal agencies and cloud providers on SSO, identity federation, and machine-to-machine authentication. It requires hardware-backed signing-key storage for moderate-impact systems, 90-day key rotation for high-impact systems, token lifetimes under one hour, and sender-constrained mechanisms such as mutual TLS and DPoP. The report cites incidents including forged SAML assertions that exposed over 60,000 emails from a federal agency. It also extends guidance to agentic AI systems using signed tokens and urges post-quantum cryptography migration planning.

Cyber Security NewsSep 15, 17:04 UTC · 1d agoAdvisory1

AI workflows may be creating a dangerous new authorization blind spot

Noma Labs researchers describe 'workflow identity hijacking,' letting unauthenticated users trigger privileged AI workflows that execute actions with high-privilege service accounts.

Noma Labs lead researcher Sasi Levi detailed 'workflow identity hijacking,' where benign unauthenticated inputs via support inboxes, GitHub issues, or web forms trigger enterprise AI pipelines that execute privileged actions. The workflow runs using high-privilege service accounts or developer API keys, decoupled from the requester's identity, effectively creating a confused-deputy condition. Unlike prompt injection, the model behaves correctly; the failure lies in authorization enforcement at the workflow layer, and activity blends into routine automation. Mitigations include identity-aware access at execution points and user-context propagation between AI outputs and downstream operations.

CSO Onlineupdated Sep 10, 12:57 UTC · 6d agofirst Sep 10, 12:04 UTC · 6d agoAI safety & security 2 sources

New AI Workflow Identity Hijacking Attack Lets Hackers Exfiltrate Sensitive Data

Noma Labs disclosed Workflow Identity Hijacking, an AI automation flaw letting anonymous users trigger privileged data exfiltration without prompt injection or stolen credentials.

Noma Labs researcher Sasi Levi described Workflow Identity Hijacking, where AI workflows process untrusted input from low-privileged or anonymous users but execute downstream actions with the workflow creator's elevated permissions, turning the pipeline into an unauthenticated proxy. Unlike prompt injection, the model is not tricked; the flaw is a missing authorization check between the requester and the privileged actions. Noma Labs also disclosed and helped fix a similar issue in Google Workflows, and linked the problem to the earlier GitLost research on GitHub Agentic Workflows. Recommended mitigations include per-user identity propagation, least-privilege service accounts and authorization checks before every downstream action.

GBHackersSep 10, 07:51 UTC · 7d agoAI safety & security

Fideo Lens reveals connections across identities, accounts and devices

Fideo Intelligence launched Fideo Lens, an investigative platform mapping relationships across identities, accounts, devices and behaviors for fraud and AML teams.

Fideo Intelligence introduced Fideo Lens, an investigative intelligence platform that helps fraud, financial crime, and AML teams discover hidden relationships among identities, accounts, devices, and behaviors. The tool draws on the company's Identity Fraud Intelligence Network (iFIN) and offers interactive relationship mapping, entity resolution, explainable reason codes, and continuously refreshed data. It is designed to complement existing fraud, AML, and case management systems rather than replace them.

Help Net SecurityAug 25, 00:00 UTC · 23d agoTools

11 Best CSPM Tools Compared (2026): Features & Pricing

CSPM comparison ranks Wiz first for agentless attack-path analysis; notes Ermetic absorbed into Tenable and Lacework into Fortinet FortiCNAPP.

An editorial comparison of eleven CSPM tools ranks Wiz as the agentless attack-path momentum leader, Prisma Cloud as the breadth benchmark, and Orca as the agentless SideScanning pioneer. It highlights consolidation: Ermetic now powers Tenable Cloud Security and Lacework became Fortinet's FortiCNAPP. The guide recommends starting with free tiers from Defender for Cloud, Prowler, and native cloud tools before buying.

GBHackersSep 15, 06:37 UTC · 2d agoIndustry1

Ping Identity introduces enterprise security for personal AI agents

Ping Identity launched Enterprise Personal Agent Access to discover, authenticate and control personal AI agents like Claude at runtime.

Ping Identity announced Enterprise Personal Agent Access, delivered through PingOne Privilege, to give enterprises visibility and control over personal AI agents such as Claude and Claude Code. The product discovers agents including shadow AI, associates each session with the user and device behind it, and enforces allow, deny, log, human-approval or revocation decisions on agent access at runtime. It enables secretless developer workflows so agents can commit code without long-lived credentials while keeping actions attributable to the agent. Ping cites Gravitee research that 48% of production AI agents run unsecured and says the product is available now and piloting with global enterprises.

Help Net SecuritySep 3, 06:25 UTC · 14d agoAI safety & security

Top 10 Best Endpoint Privilege Management (EPM) Tools in 2026

A 2026 scorecard ranks ten endpoint privilege management tools, led by BeyondTrust, ThreatLocker and Delinea for elevation, coverage and policy depth.

The article ranks ten endpoint privilege management (EPM) tools using weighted criteria covering elevation workflow, platform coverage, policy depth, time-to-value and value. BeyondTrust scored highest overall (8.4) for cross-platform breadth, with ThreatLocker (8.2), Delinea (8.1) and Admin By Request (8.0) highlighted for allowlisting integration, cloud administration and deployment speed respectively. It also notes that Netwrix acquired CoSoSys in 2024, which affects bundling when shortlisting both EPM and device control.

Cyber Security NewsSep 10, 07:58 UTC · 7d agoIndustry

MFA's Weakest Link: Account Recovery Is the New Attack Path

Help desk account recovery is increasingly the weakest link in MFA-protected identities, as Scattered Spider's impersonation-driven Marks & Spencer attack demonstrated.

As MFA, conditional access, and phishing-resistant factors raise the cost of direct account takeover, attackers increasingly target the recovery process, convincing service desk staff to reset passwords or re-register MFA on attacker-controlled devices. CISA, FBI, and partner advisories describe Scattered Spider posing as employees to trigger such resets; the 2025 Marks & Spencer attack began this way and led to ransomware with an estimated £300 million profit impact. Microsoft now describes Entra ID account recovery as a high-assurance process, and the article promotes Specops Secure Service Desk for verified identity workflows.

BleepingComputerSep 9, 14:01 UTC · 7d agoPhishing & fraud

Top 10 Best Multi-Cloud Security Platforms in 2026

An editorial roundup of the ten best multi-cloud security platforms for 2026, split between CNAPPs (Wiz, Prisma Cloud) and cloud-networking security (Aviatrix).

The article frames multi-cloud security as two markets: CNAPP platforms (Wiz, Prisma Cloud, CrowdStrike, Orca, Defender) securing what runs in clouds, and cloud-networking-security platforms (Aviatrix) securing how clouds connect. It ranks ten platforms including Palo Alto Prisma Cloud for breadth, Wiz for correlation, Check Point CloudGuard, Fortinet, Aviatrix, Microsoft Defender for Cloud, Trend Micro, and CrowdStrike. It flags the ~$32 billion Google–Wiz acquisition as raising cloud-neutrality questions buyers should address contractually.

Cyber Security NewsSep 16, 09:50 UTC · 1d agoTools

Who's governing your AI? A trust framework for enterprise agents and models

DigiCert pitches AI Trust framework using PKI, DNS policy records and workload identity to govern shadow AI agents across enterprises.

The Register-sponsored piece outlines DigiCert's AI Trust framework for governing AI agents, built on PKI, DNS, and attestation, citing IBM's 2026 Cost of a Data Breach report that 68% of organizations lack AI governance or shadow AI detection. The approach treats agent identity as workload identity aligned with IETF WIMSE, NIST CSF 2.0, and SPIFFE/SPIRE, using short-lived credentials instead of static API keys. DigiCert also proposes DMARC-style DNS agent policy records and an AI Agent Passport cryptographically binding agent identity to approved operations, with a unified kill switch.

The Register · SecuritySep 15, 15:00 UTC · 1d agoAI safety & security1

How to correlate Kubernetes audit logs with container runtime data

Elastic Security Labs shows how to join Kubernetes audit logs with Defend for Containers runtime data to investigate service account abuse and container escapes.

Elastic Security Labs demonstrates correlating Kubernetes audit logs with Defend for Containers (D4C) runtime telemetry in Elastic. In an Amazon EKS lab, a compromised workload service account performed discovery, read secrets, minted a token, created a privileged pod, and execed into it to attempt a container escape via nsenter and chroot. The escape wrappers appeared only in the decoded Kubernetes audit requestURI, not in runtime process events. The post covers join fields, prebuilt EQL sequence rules, and continues the control-plane correlation thread from the TeamPCP container attack scenario and the Hugging Face intrusion write-up.

Elastic Security LabsSep 3, 15:19 UTC · 13d agoResearch1

CISA and NIST Issue Guidance to Protect Cloud Identity Tokens

CISA and NIST published Interagency Report 8587 with voluntary guidance to harden cloud identity tokens against theft, forgery, and lateral movement.

CISA and NIST released NIST Interagency Report 8587 on September 15 with final voluntary guidance for federal agencies, cloud providers, and their customers on protecting SSO, federation, and API tokens. Requirements include one-hour maximum token lifetimes, 90-day signing key rotation for high-impact systems, hardware-backed key storage, explicit audience fields, and keeping tokens out of logs. The guidance was motivated by the 2020 ADFS compromise where forged SAML assertions bypassed MFA, and an incident where a leaked consumer signing key enabled token forgery and theft of 60,000+ emails from one agency. Nearly 250 public comments shaped the text, with input from Google, Microsoft, Okta, AWS, Oracle, IBM, HashiCorp, Wiz, and the OpenID Foundation via the Joint Cyber Defense Collaborative.

Infosecurity MagazineSep 16, 14:00 UTC · 20h agoAdvisory

NHIs Now the Number One Corporate Entry Point for Hackers

SpyCloud survey finds non-human identities like AI agents and API keys were the primary entry point in 31% of intrusions, nearly double phishing.

SpyCloud's Identity Threat Report, based on a survey of 750 security leaders at organizations with 500+ employees, found non-human identities caused 31% of intrusions versus 17% for social engineering. Only 36% of organizations actually monitor NHIs although 95% believe they have adequate visibility into them. Some 68% of respondents suffered an identity-based event, with NHI-related misuse at 42%, and organizations able to see stolen session cookies reported identity incidents at a lower rate (37% vs 50%).

Infosecurity MagazineSep 9, 13:00 UTC · 7d agoResearch in the wild

Cybersecurity jobs available right now: June 30, 2026

Help Net Security lists cybersecurity job openings across the US, UAE, France, Israel, Japan, Ireland, India, and Canada at major employers.

The roundup includes roles such as AI Offensive Security Engineer at AGAPI, Cloud Security Engineer at Spotify, IAM Engineer at Proton, DFIR in Israel, and a Senior Inspector overseeing NIS2 and AI regulation compliance in Ireland. Most listings were marked as no longer accepting applications, with a few still open including DFIR at Cye, IAM Engineer at Proton, and Detection Engineering at Saronic. The list covers employers across finance, infrastructure, and technology sectors.

Help Net SecurityAug 20, 10:38 UTC · 28d agoIndustry1

Top 10 Best Microsoft Azure Security Tools in 2026

An editorial roundup of the ten best Azure security tools in 2026 names Defender for Cloud the native floor, with Wiz, Orca, and Prisma Cloud leading third-party options.

The brief reviews ten Azure security tools, positioning Microsoft Defender for Cloud's free foundational tier and published per-resource plans as the rational starting point for every Azure estate. Wiz and Orca are shortlisted for agentless attack-path correlation, Prisma Cloud for multicloud breadth, CrowdStrike for runtime protection, and Tenable for CIEM depth with Entra permission analytics. The piece emphasizes Azure's tight identity-infrastructure coupling via Entra ID as both an operational advantage and its most critical risk surface. Scoring is editorial, not lab-tested, with pricing compared by model only.

Cyber Security News08:31 UTC · 2h agoIndustry

Top 10 Best Cloud Detection & Response (CDR) Solutions in 2026

Editorial scorecard ranks ten 2026 cloud detection and response platforms; Sysdig, Wiz, and CrowdStrike lead, with Wiz's Gem Security acquisition highlighted.

The editorial scorecard rates ten CDR platforms on real-time detection (30%), cloud telemetry depth, response automation, correlation, and value. Sysdig earns the best real-time detection score for its Falco- and eBPF-powered runtime telemetry, Wiz (8.7) folds acquired Gem Security's real-time CDR into its security graph, and CrowdStrike (8.7) leads response automation. Specialists Stream.Security, Skyhawk Security, Sweet Security, and the open-source Falco project are also assessed.

Cyber Security NewsSep 16, 07:41 UTC · 1d agoIndustry1

NIST and CISA finalize playbook to stop token theft and forgery

NIST and CISA finalized NIST IR 8587, a playbook helping federal agencies and cloud providers defend identity tokens against theft and forgery.

The finalized NIST IR 8587 guidance covers protecting token signing keys, verifying tokens, lifetimes, revocation, session management, and dividing security responsibilities between cloud providers and customers. It cites an incident in which foreign actors forged tokens with a stolen commercial signing key to steal more than 60,000 emails from one government agency. It also recommends extending token protections to AI agents and preparing identity systems for a future post-quantum cryptography transition.

Help Net SecuritySep 16, 07:40 UTC · 1d agoAdvisory 2 sources

Zero trust has a big AI agent problem ahead

Experts argue agentic AI undermines zero trust: chained authorized actions create exfiltration paths, unregistered agents evade identity controls, and agent-to-agent messages stay opaque.

Security practitioners including Nik Kale (CoSAI), Krti Tallam (Kamiwaza.ai), and Mike Wilkes (Aikido Security) argue that agentic AI breaks zero trust assumptions because individually authorized actions can compose into unauthorized outcomes, such as chained reads and writes creating an exfiltration path. Most enterprise agents are unregistered shadow IT or third-party launched, subagents inherit privileges without recognized identity, and agent-to-agent communication, sometimes embedding instructions in media files, remains invisible to security teams. Proposed mitigations include short-lived delegated credentials modeled on OpenPGP subkeys, rate limits, sandboxing, approval gates, and immutable activity trails.

CSO OnlineSep 3, 08:25 UTC · 14d agoAI safety & security

eBook: Identity-First Threat Intelligence

Enzoic promotes an eBook on identity-first threat intelligence addressing infostealer-driven credential exposure across AD and IAM.

Help Net Security promotes an Enzoic eBook on identity-first threat intelligence. It covers how infostealer malware accelerates credential theft, why password reuse turns consumer breaches into enterprise risk, and where traditional IAM and Active Directory protections fall short. The eBook advocates real-time credential intelligence from Dark Web monitoring for earlier exposure detection and automated response.

Help Net SecuritySep 15, 13:00 UTC · 1d agoIndustry

Credential Theft: How Attackers Steal & Use Stolen Credentials

Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.

Huntress published an educational overview of credential theft, citing that roughly 70% of confirmed data breaches begin with stolen credentials. It details acquisition methods including phishing, adversary-in-the-middle attacks that capture MFA session tokens, infostealers (nearly a quarter of threats Huntress observed in 2025), Mimikatz-based credential dumping, credential stuffing, and password spraying. The piece then covers post-theft actions such as lateral movement, privilege escalation, account takeover, business email compromise, and ransomware, and closes with behavioral detection guidance and layered prevention strategies.

HuntressSep 10, 16:00 UTC · 6d agoResearch

Identity-Based AI Attack Threatens Security of Enterprise Data

Dark Reading describes 'workflow identity hijacking,' an identity-based attack that hijacks enterprise AI workflows through unauthenticated entry points.

Dark Reading reports on 'workflow identity hijacking,' an identity-based attack technique targeting AI-driven enterprise workflows. The technique reportedly bypasses standard security controls by sending a basic request through an unauthenticated entry point to hijack an organization's data. The teaser provides no further technical detail, affected products, or attribution.

Dark ReadingSep 9, 14:39 UTC · 7d agoAI safety & security

The 12 Best Managed XDR Services, Compared and Priced

A comparison of twelve managed XDR providers covering pricing models, telemetry breadth, and distinguishing genuine MXDR from rebranded MDR services.

The article compares twelve managed XDR providers including Bitdefender, CrowdStrike, Palo Alto Unit 42, Trend Micro, Fortinet, Secureworks Taegis, Stellar Cyber, Ontinue, and ReliaQuest, highlighting pricing models and telemetry breadth. It explains that genuine MXDR must actively monitor identity, cloud, and email telemetry rather than merely ingest it, and typically costs 30-60% more than endpoint-only MDR. It also notes Sophos completed its approximately $859 million acquisition of Secureworks in February 2025.

GBHackersSep 9, 08:07 UTC · 8d agoIndustry 3 sources2

Stop Telling People Not To Click Links

Tailscale CEO argues link-clicking is not the problem; deploying phishing-resistant authentication like passkeys and WebAuthn eliminates entire attack classes.

Tailscale CEO Avery Pennarun argues in an opinion piece that clicking links is a symptom, not the disease, and that weak authentication is the real failure behind phishing damage. He advocates phishing-resistant FIDO/WebAuthn, passkeys, and device-bound tokens, plus continuous identity-anchored network access so unexpected login prompts become suspicious signals. He argues this approach makes security less burdensome for users while neutralizing credential replay and fake login pages.

Lobsters · securitySep 3, 21:56 UTC · 13d agoIndustry

What 90 days and a small budget can buy in AI agent security

Versa Field CISO details hidden costs of self-hosting open-weight models and a 90-day AI agent security plan of inventory, blast-radius reduction and testing.

In a Help Net Security interview, Prasad Tharippala, Field CISO at Versa, argues running open-weight models in-house improves control but shifts hardening, patching, access control, monitoring and incident response onto the buyer, with underestimated costs in GPU infrastructure, licensing review, EU AI Act compliance and scarce AI/ML security skills. On red-teaming AI agents, he recommends testing prompt injection, indirect injection, excessive permissions, data leakage, memory and RAG poisoning, malicious tool outputs, cross-agent trust abuse and infrastructure attack paths, mapped to OWASP agentic guidance and MITRE ATLAS. He highlights the handoff between chained agents as a major risk zone and stresses exercising human approval, shutdown and rollback controls under test conditions. For teams with 90 days and small budgets, he ranks inventory, blast radius reduction and ongoing testing as the priority order.

Help Net SecurityAug 28, 00:00 UTC · 20d agoAI safety & security

New Huntress Managed ITDR Dashboard: Faster Identity Investigations

Huntress redesigned its Managed ITDR dashboard, adding Rapid Identity Triage, Failed Login Characterization, and Quick SIEM search to speed identity investigations.

Huntress announced a redesigned Managed ITDR dashboard aimed at accelerating identity threat investigations. New capabilities include Rapid Identity Triage, Failed Login Characterization, and Quick SIEM search. The update is a vendor product change with no incident or vulnerability details attached.

HuntressAug 27, 14:00 UTC · 20d agoTools

What Good Identity Hardening Looks Like

Huntress guidance defines mature identity hardening beyond baseline MFA, covering exception cleanup and detecting identity configuration drift before attackers do.

Huntress argues MFA is only a starting point and outlines what mature identity hardening actually looks like in practice. The guidance covers closing MFA exceptions and coverage gaps that create unauthenticated attack paths. It also stresses catching identity configuration drift before attackers can exploit it.

HuntressAug 25, 13:00 UTC · 22d agoResearch