Email still the main channel for cyberattacks and disinformation
Malicious actors are increasingly exploiting email to impersonate brands, launch phishing campaigns, and spread false information -- often using sophisticated methods made simpler by emerging technologies.
A new report from Valimail shows that email continues to be the most exploited attack vector for cybercriminals and disinformation campaigns, with artificial intelligence dramatically increasing the sophistication of these threats.
SaaS security needs a more unified approach
New research commissioned by Valence Security from the Cloud Security Alliance looks at the current state of SaaS security to uncover key challenges and explore how organizations are securing and managing their SaaS environments.
It finds SaaS security is a top priority for 86 percent of organizations, with 76 percent of respondents saying they are increasing their budgets this year.
Surge in AI fraud leads to revenue losses
A new report reveals that 73 percent of UK fraud professionals report that online fraud has negatively affected their company's revenue in the past year.
The UK Fraud Industry Pulse Survey from Veriff shows 72.5 percent of businesses have seen an increase in online fraud over the past 12 months.
Enterprises change how they manage cyber risk
A new report from Zafran Security shows that enterprise risk management is shifting from volume to value, and from patching everything to fixing what matters most.
The study, carried out by Foundry MarketPulse, reveals that only one in 50,000 vulnerabilities actually pose a critical risk -- and the ones getting exploited the most are often old, quiet, and ignored.
Identity verification shifts in 2025 and what they mean for business and consumers [Q&A]
Generative AI is already defeating traditional identity verification (IDV) methods like knowledge-based authentication, 2FA, and more.
This shift is likely to see the acceleration of new forms of IDV in 2025 that place a greater emphasis on ensuring they're both more secure and easy for people to use. This will result in a convergence of customer identity and access management (CIAM) which essentially gives customers more control over their identity and verification.
Most enterprise hybrid Active Directory environments have critical vulnerabilities
A new survey of more than 1,000 IT and security professionals carried out for Cayosoft finds that 88 percent of enterprise hybrid Active Directory environments have critical vulnerabilities.
Microsoft Active Directory is a key element of enterprise IT, but the 2025 Active Directory Insights report identifies glaring gaps in resilience, security, and operational efficiency that could leave critical systems exposed to attack.
Credential theft escalates as threat actors use stealthier tactics
Cybercriminals are pivoting to stealthier tactics, with lower-profile credential theft spiking, while ransomware attacks on enterprises have declined.
These are among the findings of a new report from IBM X-Force which also observes an 84 percent increase in emails delivering infostealers in 2024 compared to the previous year, a method threat actors rely heavily on to scale identity attacks.
New watchdog platform designed to protect enterprise AI deployments
As enterprises turn to increasingly sophisticated AI applications and agentic AI workflows, the large cloud footprint required to support such complex systems has become critically difficult to secure.
To address this issue Operant AI is launching AI Gatekeeper, a runtime defense platform designed to block rogue AI agents, LLM poisoning, and data leakage wherever AI apps are deployed, securing live AI applications end-to-end beyond Kubernetes and the edge.
Flawed phone apps could risk enterprise data
Analysis of over 17,000 enterprise-used mobile apps by Zimperium zLabs finds that 92 percent of all apps and 56 percent of the top 100 apps use flawed cryptographic methods that could be putting organizations at risk.
Even more concerning, five percent of top 100 apps were found to have high-severity cryptography flaws including hardcoded keys and outdated algorithms.
Could this be the end of CVE? And what does it mean for cybersecurity?
The CVE (Common Vulnerabilities and Exposures) database is widely used across many cybersecurity tools, allowing the tracking of vulnerabilities.
The CVE program has been in existence for 25 years but today MITRE -- the non-profit organization which looks after the database -- has announced that its contract with the US Department of Homeland Security to operate the CVE Program hasn't been renewed.
Microsoft vulnerabilities hit a record high in 2024
The latest annual Microsoft Vulnerabilities Report from BeyondTrust, reveals a record-breaking number of reported vulnerabilities last year.
Total vulnerabilities reached an all-time high of 1,360 in 2024, an 11 percent increase from the previous record of 1,292 in 2022. Elevation of Privilege (EoP) vulnerabilities comprised 40 percent of all those reported.
Browser extensions leave enterprises open to attack
Despite being present on virtually every employee's browser, extensions and plug-ins are rarely monitored by security teams or controlled by IT and a new report shows that could be leaving enterprises at risk.
The study from LayerX Security combines statistics from real-life usage data from enterprise users, with data available from public extension stores to reveal how organizations and employees interact with extensions, the associated risks and security blind spots.
Less than a third of companies consistently meet compliance standards
New research shows that only 29 percent of all organizations say their compliance programs consistently meet internal and external standards.
The report from Swimlane reveals that fragmented workflows, manual evidence gathering and poor collaboration between security and governance, risk and compliance (GRC) teams are leaving organizations vulnerable to audit failures, regulatory penalties and security gaps.
AI makes bots easier to deploy and harder to detect
Automated bot traffic surpassed human-generated traffic for the first time in a decade last year, making up 51 percent of all web traffic. This shift is largely attributed to the rise of AI and Large Language Models (LLMs), which have simplified the creation and scaling of bots for malicious purposes.
The latest Imperva Bad Bot Report from Thales shows cybercriminals are increasingly leveraging these technologies to create and deploy malicious bots which now account for 37 percent of all internet traffic -- a significant increase from 32 percent in 2023.
TP-Link becomes a CVE Numbering Authority to improve cybersecurity
As someone who uses and loves TP-Link products (including its affordable routers and smart home devices) I’m truly elated to see the company taking cybersecurity more seriously. You see, the company has officially joined the CVE Numbering Authorities (CNAs), meaning it can now assign CVE IDs to security flaws found in its own products.
Here’s why it matters, folks: CVEs (Common Vulnerabilities and Exposures) are used to track publicly known cybersecurity issues. By becoming a CNA, TP-Link gains the power to document and disclose vulnerabilities faster and more transparently. That’s a win for both the company and the people who rely on its devices every day (such as yours truly).
Recent Headlines
Most Commented Stories
Betanews Is Growing Alongside You
Only a fool still uses Windows 7
© 1998-2025 BetaNews, Inc. All Rights Reserved. Privacy Policy - Cookie Policy.