ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Source: Help Net Security

171 stories in the last 30d

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllTools 57Industry 50AI safety & security 21Exploit / PoC 19Phishing & fraud 15Research 15Data breach 12Threat actor 11AI tools & infra 11AI industry 10Advisory 9Malware 8Vulnerability 8Policy & legal 5
SeverityAllcritical 10high 39medium 38low 2info 174source: Help Net Security ✕

NIST and CISA finalize playbook to stop token theft and forgery

NIST and CISA finalized NIST IR 8587, a playbook helping federal agencies and cloud providers defend identity tokens against theft and forgery.

The finalized NIST IR 8587 guidance covers protecting token signing keys, verifying tokens, lifetimes, revocation, session management, and dividing security responsibilities between cloud providers and customers. It cites an incident in which foreign actors forged tokens with a stolen commercial signing key to steal more than 60,000 emails from one government agency. It also recommends extending token protections to AI agents and preparing identity systems for a future post-quantum cryptography transition.

Help Net Security · 2h agoAdvisory 2 sources

What happens when AI agent governance is missing at scale

meshIQ engineering head Gourab Basu argues AI agent governance must inspect proposed tool calls in-flow, since prompts alone cannot control nondeterministic agents.

In a Help Net Security interview, Gourab Basu, Global Head of Engineering at meshIQ, argues that prompt instructions are an insufficient control boundary for nondeterministic AI agents. He advocates a framework-independent governance engine that inspects proposed tool calls and parameters before execution, citing an example of pausing refunds above $100 for human approval. He warns that scaling from ten to a thousand agents makes manual oversight and destination-side controls unworkable, so governance must sit inside the agent execution flow across frameworks such as FastMCP.

Help Net Security · 4h agoAI safety & security

DeepZero: Open-source hunting for vulnerable Windows drivers

DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.

DeepZero is a free, open-source Python pipeline orchestrator that automates hunting for exploitable Windows kernel drivers relevant to BYOVD (bring your own vulnerable driver) attacks. Its seven-stage YAML pipeline parses PE headers, filters for kernel-mode drivers with IOCTL surfaces, excludes drivers listed on loldrivers.io, then runs headless Ghidra decompilation, Semgrep scanning, and an LLM-based exploitability assessment. The maintainer reports multiple verified vulnerabilities in the Snappy Driver Installer corpus, some still in the disclosure process, and notes findings involving plug-and-play-created device objects may need physical hardware to confirm.

Help Net Security · 4h agoTools

The modern attack chain: Rethinking Google Workspace security in the age of AI

Analysis of Vercel and Composio breaches shows stolen OAuth tokens, not phishing email, now open Google Workspace attacks — a path authorized AI agents follow.

The author analyzes the Vercel and Composio breaches as the same OAuth-first attack chain run twice: a stolen OAuth token, obtained via a compromised supplier, becomes the entry point rather than email. These tokens survive password resets, are hard to observe, and let attackers read Gmail and Drive data, take over accounts, and pivot laterally using stored credentials and password-reset magic links. The piece warns that authorized AI agents with overbroad OAuth grants can unintentionally traverse the same path — accessing inboxes, reading sensitive content, and exfiltrating data downstream — without any malicious actor or compromised credential.

Help Net Security · 5h agoResearch in the wild

MSPs say nearly half their customers rely on them for CISO services

Sophos survey finds MSPs act as CISOs for an average 46% of customers, mostly with partial compliance offerings and fragmented manual reporting.

A Sophos survey found MSPs estimate that 46% of their customers rely on them to act as CISOs, and most providers deliver only four to six of seven measured compliance services. More than half say they manage customers' full compliance programs, while compliance requirements influence roughly half of customers' security purchases. Nearly nine in ten providers use software, but most juggle multiple tools that cannot feed a central reporting platform, forcing staff to combine data manually. Providers estimated a unified platform would cut time spent on posture, compliance and reporting by about half; Sophos sells CISO Advantage via its Sophos Fusion system for this work.

Help Net Security · 5h agoIndustry

F5 Bot Defense uses real-time risk scoring to detect fraud and abuse

F5 enhances Distributed Cloud Bot Defense with persistent device identification, real-time risk scoring, and agent-aware policies to manage AI agent traffic.

F5 announced enhancements to Distributed Cloud Bot Defense adding persistent device identification, real-time device risk scoring, risk-based workflow enforcement, and an agent-aware policy framework integrated with the F5 Application Delivery and Security Platform. The features aim to expose multi-account abuse, credential stuffing, and account takeover while allowing trusted AI agents to transact at machine speed. It targets fraud and abuse detection as agentic AI becomes a key interaction channel for sites, apps, and APIs.

Help Net Security · 20h agoTools

Postman Passport controls API access without exposing credentials

Postman launches Passport, a secretless API access product keeping real credentials inside customer environments for humans and AI agents.

Postman announced general availability of Passport by Postman, a standalone API security product that keeps real API keys and tokens inside customers' own secret stores and issues inert secret references to developers, machines, and AI agents. It enforces grants down to exact action, host, and path, provides full call attribution and second-level revocation, and mints ephemeral task-scoped identities for agent fleets where sub-agents inherit only subsets of parent permissions. The product targets credential sprawl as AI agents call APIs at roughly 1,000x the rate of humans.

Help Net Security · 20h agoTools

UltraViolet Cyber Equinox measures detection coverage against MITRE frameworks

UltraViolet Cyber launches Equinox, an AI-automated platform mapping SIEM and EDR detection coverage against MITRE ATT&CK and ATLAS frameworks.

UltraViolet Cyber announced Equinox, a detection engineering platform from its TIDE team that maps existing detections and log sources against MITRE ATT&CK and MITRE ATLAS. It performs coverage analysis in under 30 minutes and recommends vendor or custom detections to fill gaps, with engineers reviewing and backtesting each recommendation. In one customer trial, mapped technique coverage rose from 59 of 222 techniques (26.6%) to 136 of 222 (61.3%) without increasing alert volume.

Help Net Security · 20h agoTools2

Globalgig expands managed security portfolio to protect enterprise AI

Globalgig adds managed AI security services covering posture management, access control, runtime protection and 24/7 AI threat monitoring built on Palo Alto Networks.

MSSP Globalgig expanded its managed security portfolio with enterprise AI protection spanning AI Security Posture Management, AI Access Security, AI Runtime Security, and AI Security Operations. The offering cites the 2026 Cost of a Data Breach Report finding that shadow AI was involved in 43% of breaches this year and 92% of AI-related breach victims lacked adequate AI access controls. Services are built on Palo Alto Networks technology, with Orchestra Insight supplying network context.

Help Net Security · 20h agoIndustry

eBook: Identity-First Threat Intelligence

Enzoic promotes an eBook on identity-first threat intelligence addressing infostealer-driven credential exposure across AD and IAM.

Help Net Security promotes an Enzoic eBook on identity-first threat intelligence. It covers how infostealer malware accelerates credential theft, why password reuse turns consumer breaches into enterprise risk, and where traditional IAM and Active Directory protections fall short. The eBook advocates real-time credential intelligence from Dark Web monitoring for earlier exposure detection and automated response.

Help Net Security · 21h agoIndustry

Microsoft sets security and safety rules for its AI models

Microsoft AI published a draft Humanist AI Code of Conduct setting safety rules and human-control requirements for its models, open for public consultation.

Microsoft AI released the first draft of its Humanist AI Code of Conduct, open for six weeks of public consultation, with a revised version expected later this year to guide model training from 2027 onward. The Code sets Absolute Constraints barring model assistance with chemical, biological, radiological, nuclear, and explosive weapons, offensive cyber operations, CSAM, malicious deepfakes, and mass civilian surveillance, while permitting authorized defensive cybersecurity work such as vulnerability discovery, malware analysis, and PoC exploit testing. It establishes an instruction hierarchy where the Code takes precedence over operator policies and user instructions, plus Human Control Requirements covering shutdown compliance, least privilege, and no autonomous goal initiation. MAI models will undergo red-teaming, safety evaluations, and pre- and post-deployment reviews; current models have not yet been trained on the Code.

Help Net Security · 23h agoAI safety & security

Akuity gives AI agents operational context to safely ship software

Akuity launches Agentic Control Plane and MCP Server to govern AI agent actions inside production software delivery pipelines.

Akuity introduced an Agentic Control Plane and MCP Server that lets AI agents such as Claude, Codex, and Cursor access deployment and cluster context under existing identity, permission, and audit controls. MLB reported the product identified over 100 degraded applications within hours. Akuity positions it against open-source MCP servers granting raw access with no identity inheritance or policy layer.

Help Net Security · 1d agoAI tools & infra

Traefik Labs brings independent verification to AI agent governance

Traefik Labs announces Sovereign Trust Plane in Traefik Hub, adding verifiable delegation, policy enforcement, and tamper-evident audit records for AI agent traffic.

Traefik Labs announced the Sovereign Trust Plane for Traefik Hub, generally available by September 30, 2026, providing delegated access, policy enforcement, and tamper-evident records for AI agent, tool, and API traffic. It implements the IETF ID-JAG draft with Okta Cross App Access and Janssen, enforces decisions through OpenID AuthZEN with OpenFGA and Cerbos, and commits cryptographic log fingerprints to transparency checkpoints verified by independently administered witnesses. The gateway also extends enforcement to MCP tool calls and the MCP server's backend API connection.

Help Net Security · 1d agoAI tools & infra1

Product showcase: mSecure makes one vault do more than remember passwords

Product showcase reviews mSecure password manager's AES-256 zero-knowledge vault with passkeys, 2FA storage, and multi-device sync options.

mSecure is a password manager and data vault for iOS, Android, macOS, and Windows using AES-256 encryption and a zero-knowledge architecture, with sync via mSecure Cloud, Wi-Fi, iCloud, or Dropbox, plus local-only storage. It supports passkeys, one-time passwords, a Security Center for weak/reused passwords, and a configurable password generator. Recovery features include two-factor authentication, auto-lock, a Self-Destruct option after failed unlock attempts, and iCloud backups on iOS.

Help Net Security · 1d agoTools1

Your employees are already using AI tools you never approved

OneTrust report: 74% of organizations have scaled AI adoption, but only 17% embed governance by design and agent use outpaces oversight.

OneTrust's 2026 AI-Ready Governance Report finds 74% of respondents report departmental or scaled AI adoption, yet only 17% report governance embedded by design and just 5% have coordination and accountability defined across the AI lifecycle. Nearly half experienced at least one incident in the past year where AI systems or agents took unapproved actions, with data loss, corruption, and misclassification cited as the most likely and least prepared-for risks. 33% say employees used unapproved AI tools because approved options were not available quickly enough, and 98% plan to increase AI governance technology budgets next financial year.

Help Net Security · 1d agoIndustry

Most chief audit executives can’t tell you what AI is worth yet

Gartner finds 93% of audit leaders use AI, but 54% of chief audit executives have not started measuring its value.

Gartner polls of 142 and 161 chief audit executives in May found 54% have not started measuring the value of AI in audit, only 7% tie AI to cost metrics, and just 38% have an AI strategy at any level, with 39% more building one. Among 743 respondents, 60% use AI for engagement preplanning and for drafting audit issues or reports, while only 30% apply it to audit testing, where hallucinations carry higher stakes. Unclear expectations for AI tool use (48%) was the most common barrier, ahead of technology and tool problems. Gartner recommends structured use cases for high-value workflows, which 12% of respondents are currently piloting.

Help Net Security · 1d agoIndustry

Cybersecurity jobs available right now: August 18, 2026

Help Net Security lists current cybersecurity job openings at ADI Global Distribution, Schneider Electric, L'Oreal, GovCIO, Elastic, and others across multiple countries.

A recurring job roundup featuring roles such as CISO at ADI Global Distribution, Cybersecurity Analyst at Schneider Electric in India, Cybersecurity Architect at L'Oreal in France, and security engineering positions at GovCIO, Neros Technologies, Elastic, and Chamelio. Most listed positions are no longer accepting applications; several emphasize AI-enabled security environments and identity threat detection and response. No vulnerability, incident, or research content is included.

Help Net Securityupdated · 1d agofirst · 6d agoIndustry 6 sources

Entrust turns cryptographic inventory data into security action

Entrust adds CBOM import/export, Ansible automation, and post-quantum readiness features to its Cryptographic Security Platform.

Entrust announced new capabilities for its Cryptographic Security Platform, including CBOM import/export to build cryptographic inventories, correlate assets and dependencies, and prioritize remediation of noncompliant or vulnerable crypto. New Ansible-based automation extends certificate lifecycle management across public and private PKI, while composite algorithm and SPIRE-based capabilities support phased post-quantum migration and trusted identities for AI agents. The platform is now deployable as-a-service or on-premises, aligning with DORA, NIS2, and recent U.S. post-quantum requirements.

Help Net Security · 1d agoTools

Bitsight connects threat intelligence and exposure monitoring across the supply chain

Bitsight made Beacon generally available, combining supply-chain exposure monitoring with MCP support to feed threat intelligence into AI workflows.

Bitsight announced general availability of Beacon, which continuously monitors critical vendors for exposure, vulnerabilities, malicious activity, intrusion, stolen credentials and compromise. New Model Context Protocol (MCP) and agentic capabilities push Bitsight intelligence into AI-enabled workflows, with over 400 customers signing up for early access in one month. The company cites data that third parties now account for almost half of enterprise breaches, up over 60% year over year.

Help Net Security · 1d agoTools

Dataminr uses agentic AI to predict and verify security threats

Dataminr launches agentic AI capabilities for corporate security, adding automated event corroboration, context, and near-term threat prediction.

Dataminr Advanced for Corporate Security introduces Agentic Corroboration, Agentic Context, and Near-Term Predictive Intelligence, now generally available, moving the company from real-time alerting to what it calls Autonomous Real-Time Intelligence. The product relies on more than 60 fine-tuned task-specific LLMs trained on a 10+ year proprietary event archive rather than general-purpose frontier models. Upcoming releases include ReGenAI Tailored Live Briefs, a Watchlist Agent, Agentic Search, and an Advanced API suite.

Help Net Security · 1d agoIndustry

ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities

ENISA launched the CRA Single Reporting Platform, making EU manufacturers report actively exploited vulnerabilities and severe incidents through one portal.

ENISA switched on the Cyber Resilience Act's Single Reporting Platform on 11 September 2026, the same day CRA reporting obligations became binding on manufacturers. Reports require an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days (one month after notification for severe incidents). Filings go through an EU Login account with MFA, are routed to a coordinating CSIRT chosen by the manufacturer, and no API is available in the first release. Open-source software stewards fall under the same obligations from 11 December 2027.

Help Net Security · 1d agoPolicy & legal

Airrived adds Agentic Observability to track AI agent actions and risks

Airrived launches Agentic Observability to give enterprises end-to-end visibility into AI agent actions, permissions, data flows, and costs.

Airrived announced Agentic Observability, an expansion of its enterprise Agentic OS that traces the full agentic lifecycle from enterprise data ingestion through agent reasoning to business outcomes. The platform surfaces each agent's creator, owner, permissions, permitted actions, and human-in-the-loop approval requirements, and tracks movement of PII, PCI, and PHI across agentic workflows. It also adds token- and model-consumption tracking to turn AI spending into measurable AI FinOps.

Help Net Security · 1d agoAI industry

WhatsApp Restricted Chat locks a conversation to your primary phone

WhatsApp is developing Restricted Chat, a per-chat setting blocking conversation sync to linked devices, defeating third-party clients and AI agents.

Restricted Chat, spotted in Android beta version 2.26.36.5 but not yet enabled, keeps a chosen conversation exclusively on the primary phone, out of reach of WhatsApp Web and linked secondary devices. It extends Advanced Chat Privacy controls: media is not auto-saved to gallery, export is blocked, and messages cannot be handed to Meta AI, with system messages notifying participants of changes. WhatsApp has not announced a release date.

Help Net Security · 2d agoIndustry

Turn it off and on again, but for critical infrastructure

KTH researchers trained a reinforcement-learning intrusion response agent on an emulated segmented OT network that autonomously resets hosts and processes to disrupt intruders.

Researchers at KTH Royal Institute of Technology built a containerized replica of a segmented industrial network, attacked it across 14 days, and captured 40,000 30-second traffic intervals to train a defense agent under partial observability. The agent observes six packet-count numbers per interval, maintains 500 running state hypotheses, and can reset supervisory hosts, water tank processes, or entire subnets, with resets rebooting the target, renewing credentials, and changing its IP. The best agent approached a full-visibility baseline but depends on an assumed attacker behavior model; the testbed comprised three supervisory hosts, two PLCs, two tanks, weak credentials, and CVE-2017-7494 exposure. The team released its implementation and plans validation on a real industrial testbed with a partner.

Help Net Security · 2d agoResearchCVE-2017-74942· 1 read

Permify: Open-source authorization as a service

Help Net Security profiles Permify, an open-source Zanzibar-style authorization service supporting RBAC, ABAC, and relationship-based rules with multi-tenant deployments.

Permify is an open-source authorization-as-a-service project modeled on Google Zanzibar that centralizes access-control decisions outside application code. It supports role-based, relationship-based, and attribute-based access rules, answers checks in tens of milliseconds via REST and gRPC, and runs from a single Docker command. It is a CNCF member and is freely available on GitHub.

Help Net Security · 2d agoTools1

Cybersecurity attention fades within months after a breach

ManageEngine survey of 700 breached organizations finds security attention fades within one to six months, while 91% still trust their posture.

A ManageEngine survey of 700 IT and security leaders in the US and Canada, all of whom had experienced a breach, found that 91% trust their current security posture and only 8% make security a permanent priority after an incident. 80% said post-breach focus lasts just one to six months, and nearly half made no wider changes after their incident. About two in three organizations using AI in security said they act on AI recommendations without additional verification. The report also flagged unclear ownership across security, IT, and business teams as a cause of delayed remediation.

Help Net Security · 2d agoIndustry

Certificate failures can cost firms over $250,000

DigiCert survey finds certificate failures cost firms over $250,000 per incident, with 47-day TLS certificates set to multiply management workloads by 2029.

DigiCert's Certificate Management Outlook reports that 34% of companies experienced outages from expired certificates and 40% from mismanagement, with nearly one in four citing incidents costing over $250,000. The CA/Browser Forum's move to 47-day certificate lifespans by 2029 will require renewals eight times more often and 40 times as many domain validations. Over half of organizations manage more than 1,000 certificates, yet only 10% have automation in place, with budget constraints and legacy systems cited as key barriers.

Help Net Security · 2d agoIndustry

AWS puts AI vulnerability detection to the test, and false positives pile up

AWS publicly released its Deception Benchmark (14,822 samples) showing leading AI models falsely flag 41-99% of safe code as vulnerable.

AWS released its Deception Benchmark publicly, containing 14,822 samples across 16 programming languages and more than 70 CWE categories, with 9,695 scored samples split into 6,988 code-level and 2,707 environment-gated challenges. AWS evaluated 12 models from five providers using single-turn prompts and found none met its production bar of below 10% for both false-positive and false-negative rates. With direct prompting, models caught nearly all real vulnerabilities but incorrectly flagged 41% to 99% of safe code, with precision between 52% and 71%. Asking models to prove exploitability reduced false positives by 17 to 74 percentage points but raised false-negative rates to 7-44%, with models struggling most when external controls like Kubernetes Network Policies blocked apparent exploits.

Help Net Security · 2d agoAI research

WordPress adds automated security checks to block risky plugin releases

WordPress.org now automatically security-reviews every plugin release and blocks high-risk updates before distribution to millions of sites.

The WordPress Official Plugin Repository Team launched an automated security review that scores each plugin and theme release during a six-hour cooldown, combining analysis from several AI models and Jetpack Scan, and automatically blocks releases deemed high risk. The change followed a July 28 detection of a backdoor committed to a release of a plugin with roughly 20,000 active installations; the release was withheld and the plugin closed for downloads 26 minutes after Wordfence notified the team. Blocked authors must fix findings and publish a new release scoring below the blocking threshold, or appeal to the Plugins Team.

Help Net Securityupdated · 4d agofirst · 6d agoTools 7 sources

Kiteworks expands runtime data governance with Bonfy.AI acquisition

Kiteworks acquired Bonfy.AI to add runtime, context-aware classification and enforcement of data exchanges by people, machines, and AI agents.

Kiteworks acquired Bonfy.AI to extend its Data Control Plane with inline, runtime data governance at the moment data is exchanged via email, file sharing, APIs, and AI agents. Bonfy.AI's technology evaluates sender, recipient, counterparty, channel, and business purpose to apply policy before a send completes, aiming to reduce false positives versus pattern-matching prevention tools. This is Kiteworks' eighth acquisition in under five years, with compliance framing around provable control for CMMC 2.0, HIPAA, and GDPR.

Help Net Securityupdated · 4d agofirst · 5d agoIndustry 2 sources1

Automox Mitigation Worklets cut endpoint exposure to unpatchable flaws

Automox launched an AI-speed Mitigation Worklet Pipeline that drafts and publishes mitigations for unpatchable vulnerabilities within hours of disclosure.

Automox announced its Mitigation Worklet Pipeline, which uses AI to draft mitigations for unpatchable vulnerabilities and publishes human-reviewed Worklets to its catalog within hours of disclosure. The company cites rising vulnerability volume, including a record Patch Tuesday with 973 CVEs, as motivation. Customers can search Worklets by CVE, control deployment targets, and verify execution through Activity Logs and Policy Results.

Help Net Security · 5d agoTools

Building a ransomware decision tree before the call comes in

Arctic Wolf's IR VP urges pre-deciding ransomware response choices on containment, negotiation authority, law enforcement engagement, and crisis communications.

A Help Net Security video features Kerri Shafer-Page, VP of Incident Response at Arctic Wolf, walking through a ransomware decision tree. She recommends settling four decision areas in advance: containment, extortion negotiation limits, law enforcement involvement, and communications. She frames paying as a business decision that can cost less than insurance retention and renewal hikes, and notes agencies may know the threat actor and help avoid sanctions issues.

Help Net Security · 5d agoIndustry

Companies may be measuring phishing resilience the wrong way

Pistachio's 2026 report analyzing 648 organizations finds click rates alone mislead; combining clicks, credential submission, and reporting better measures phishing resilience.

Pistachio's Phishing Behaviour Report 2026 analyzed 648 organizations and 123,692 users across 354,962 simulations between June 1, 2025 and May 31, 2026. It found click and credential-submission rates rose during the first six months of training before declining, and from the six-month peak to the 12-month stage clicks fell 27% while credential leaks dropped 41%. The report-to-click ratio increased from 1.3 at three months to 1.8 at 12 months, framing employees as an active detection channel. Departmental analysis showed Construction had the highest cumulative click rate (41.31%) and Health the lowest report rate (13.17%), supporting more targeted training.

Help Net Security · 5d agoPhishing & fraud

AI is changing what Salesforce security needs to govern

WithSecure's Trust Mapping paper proposes a framework for governing trust relationships across Salesforce workflows, AI agents, integrations and connected SaaS systems.

WithSecure's paper 'Navigating Trust in the Modern Salesforce Ecosystem' introduces a Trust Mapping Framework spanning five domains: entities, information, connections, actions and system outcomes. It applies to Salesforce, Agentforce, Headless 360, third-party SaaS and AI-assisted workflows where users, AI agents, APIs and integrations form trust relationships. A Discovery step maps relationships, a Governance step assesses, restricts or retires them, and the paper defines 'trust drift' such as stale credentials, excessive access and unvalidated AI recommendations.

Help Net Security · 5d agoResearch1

Akeyless adds real-time enforcement for AI agents in production

Akeyless launches Agentic Runtime Authority, enforcing real-time intent-based access control on AI agent actions, with integrations for Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore

Akeyless announced general availability of Agentic Runtime Authority, a real-time identity control layer that evaluates AI agent actions and blocks policy-violating actions before execution, layered on top of its SecretlessAI credential brokering. New integrations cover Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore, alongside an Agentic Access Dashboard with session kill switches and event forwarding to Splunk, Datadog and Microsoft Sentinel. The vendor's platform already secures over 220 billion machine identity interactions for Fortune 500 organizations.

Help Net Securityupdated · 5d agofirst · 6d agoTools 2 sources1

Kevin Mandia joins the Amazon board with 30-plus years in cybersecurity

Amazon elected Mandiant founder Kevin Mandia to its board of directors on September 8, citing cybersecurity as a top organizational risk.

Amazon added Kevin Mandia, founder and former CEO of Mandiant (acquired by Google in 2022), to its Board of Directors. He currently leads security company Armadin as founder and CEO and is co-founder and general partner at venture firm Ballistic Ventures. Mandia has over 30 years of cybersecurity experience, including service on NSTAC and CISA's Cybersecurity Advisory Committee and prior roles as a Pentagon computer security officer and Air Force Office of Special Investigations special agent.

Help Net Securityupdated · 5d agofirst · 6d agoIndustry 2 sources

Your passkeys can now move between password managers on Android

Google enabled direct password and passkey transfers between Android password managers, initiated from the destination app without unencrypted file exports.

Android now supports moving passwords and passkeys directly between password managers without exporting them to a file, replacing the previous unencrypted-export workflow. The transfer is initiated in the receiving app, which hands off to Android to detect installed managers and request authorization in the source app. The feature works today with Google Password Manager, 1Password, Bitwarden, and Dashlane, with more partners promised but unnamed. Google says data moves between apps in seconds and calls the handoff secure, without detailing the protections.

Help Net Security · 5d agoTools

OpenSSL’s new alpha build speeds up post-quantum crypto

OpenSSL 4.1.0 alpha1 adds DTLS 1.3 support and speeds up ML-DSA and ML-KEM post-quantum operations across several architectures.

The OpenSSL project released the first alpha of OpenSSL 4.1.0, months before general availability. The build adds DTLS 1.3 (RFC 9147) to secure UDP-based traffic such as VPNs, video calls and IoT, and includes optimized ML-DSA and ML-KEM operations for ppc64le, s390x and x86_64 plus AVX-512 acceleration for SHAKE hashing and AES-CBC decryption. Breaking changes include a new Net::Curl::Easy dependency for tsget, dropped Windows-on-Itanium and Windows CE support, and replacement of the no-ecdsa/no-ecdh Configure options with no-ec. It also adds GREASE support (RFC 8701), a DTLS mode for the SSL listener API, IKEv2 KDF support, and initial Elbrus2000 processor architecture support.

Help Net Securityupdated · 5d agofirst · 6d agoTools 2 sources

Scytale expands vendor risk management with AI-powered TPRM tools

Scytale launched AI-powered third-party risk management in its Vendors module, automating vendor discovery, risk scoring, and continuous vendor posture monitoring.

Scytale added AI-driven TPRM capabilities to its Vendors module, combining automatic vendor discovery from SSO providers and integrations with AI enrichment and dynamic risk scoring. The platform now continuously monitors vendors for breaches, data exposures, and vulnerabilities via third-party intelligence APIs, with proactive email notifications and auto-generated audit-ready security reports. It integrates with cross-framework control mapping for SOC 2, ISO 27001, GDPR, HIPAA, and SOX ITGC. Scytale cites Verizon's 2026 DBIR, which found 48% of breaches involved a third party, up 60% year over year.

Help Net Security · 5d agoTools

Product showcase: GitGuardian Honeytoken catches credential theft as it happens

GitGuardian now deploys honeytoken decoy AWS credentials across developer fleets via MDM, generating high-fidelity alerts when infostealers test stolen credentials.

GitGuardian extended its honeytoken platform so decoy AWS credentials can deploy fleet-wide to developer laptops through existing MDM tooling, with deleted decoys automatically replaced at the next sync. When a harvester tests a decoy, the platform logs the API call in the controlling AWS account and raises an incident naming the source machine and file, routed via email, Slack, Teams, ServiceNow, or webhooks. The capability responds to infostealers such as Shai-Hulud that scan entire filesystems and validate stolen credentials within seconds. GitGuardian is building decoys for Kubernetes and package registry credentials using random, structure-free identifiers that resist detection.

Help Net Security · 6d agoTools