Help Net Security

This webinar is designed for leadership and management professionals looking to enhance their organization’s security posture in the cloud. The authors explore CIS Hardened Images: how they work, the security benefits they offer, and why they’re especially valuable for public sector organizations. Throughout the discussion, you’ll gain a clear understanding of how these pre-configured security solutions align with the CIS Benchmarks to help mitigate risks and ensure compliance with critical frameworks. The webinar breaks down … More →

The post Webinar: Cloud security made easy with CIS Hardened Images appeared first on Help Net Security.

AU10TIX is enhancing its product suite with the launch of AnyDoc Authentication, a capability that exposes forged, tampered, or synthetic non-ID documents that may bypass traditional identity verification methods. AnyDoc harnesses advanced AI, forensic forgery detection, and metadata analysis to empower businesses to detect document fraud, maintain regulatory compliance, and scale secure onboarding. This critical layer of protection supports a diverse range of document types, including utility bills, bank statements, tax filings, business licenses, and … More →

The post AU10TIX AnyDoc Authentication identifies tampered or forged documents appeared first on Help Net Security.

Two Mirai botnets are exploiting a critical remote code execution vulnerability (CVE-2025-24016) in the open-source Wazuh XDR/SIEM platform, Akamai researchers have warned. What is Wazuh? Wazuh is a popular open-source security information and event management (SIEM) and extended detection and response (XDR) solution that’s widely used for host-based intrusion detection, log analysis, file integrity monitoring, and more. It’s core components are: Wazuh Manager (server component), which analyzes data and triggers alerts. Made to be installed … More →

The post Unpatched Wazuh servers targeted by Mirai botnets (CVE-2025-24016) appeared first on Help Net Security.

Cymulate releaseed AI-powered detection engineering assistant for security information and event management (SIEM) rule threat coverage validation. Now, the Cymulate Platform automates and streamlines the detection engineering process for blue teams and SecOps, allowing them to build, test and optimize threat detection with AI-assisted live-data attack simulations and customized threat detection. With this launch, Cymulate eliminates the friction of manual detection validation by automating the correlation and testing process, answering the two most important questions … More →

The post Cymulate streamlines threat detection with AI-powered detection engineering assistant appeared first on Help Net Security.

Thales launched Thales File Activity Monitoring, a new capability within the Thales CipherTrust Data Security Platform that enhances enterprise visibility and control over unstructured data, enabling organizations to monitor file activity in real time, detect misuse, and ensure regulatory compliance across their entire data estate. As the only integrated platform provider that secures structured and unstructured data, Thales provides comprehensive monitoring and auditability for data types that were previously difficult to track. File Activity Monitoring … More →

The post Thales File Activity Monitoring enhances enterprise control over unstructured data appeared first on Help Net Security.

At Span Cyber Security Arena, I sat down with Iva Mišković, Partner at the ISO-certified Mišković & Mišković law firm, to discuss the role of legal teams during cyber incidents. She shared why lawyers should assume the worst, coordinate quickly, and ask the right questions to support IT. Mišković explained that a legal strategy, built on understanding tech workflows, helps lawyers build trust with CISOs and respond to cyber threats. Every cyber incident should be … More →

The post The legal questions to ask when your systems go dark appeared first on Help Net Security.

Patero launched CryptoQoR, a new crypto-agile software module that establishes secure communication channels and proactively mitigates security risks using hybrid post-quantum encryption. The solution can be readily deployed into existing infrastructure to improve current cryptographic protection and immediately remediate risks associated with quantum attacks. The post-quantum cryptography (PQC) market is projected to grow from $302.5 million in 2024 to $1,887.9 million by 2029. The approach to “Q-day,” the day when quantum computers can be used … More →

The post Patero CryptoQoR mitigates risks associated with quantum attacks appeared first on Help Net Security.

Security teams are leaning hard into AI, and fast. A recent survey of 500 senior cybersecurity pros at big U.S. companies found that 86% have ramped up their AI use in the past year. The main reason? They’re trying to keep up with a surge in AI-powered attacks. But even as AI tools help with tasks like threat detection and data analysis, the pressure on security teams is getting worse. Nearly 70% of respondents say … More →

The post AI threats leave SecOps teams burned out and exposed appeared first on Help Net Security.

Black Kite announced AI-powered cyber assessments, an automated solution for streamlining third-party cyber risk assessments. With its automation-led approach, Black Kite is redefining how enterprises assess risk across their vendor ecosystems to make informed decisions and bring cyber resilience to their supply chain. “Managing cyber ecosystem risks is complex, and all too often, enterprises are further challenged by cyber assessment processes that do not work in today’s environment,” said Chuck Schauber, CPO, Black Kite. “In … More →

The post Black Kite unveils AI-powered cyber assessments appeared first on Help Net Security.

In this Help Net Security video, Eoin Wickens, Director of Threat Intelligence at HiddenLayer, explores the security risks posed by agentic AI. He breaks down how agentic AI functions, its potential to revolutionize business operations, and the vulnerabilities it introduces, such as prompt injection and excessive system privileges. Wickens offers real-world attack examples, explains why traditional security practices need rethinking, and outlines practical steps to mitigate risk. Learn why monitoring, logging, and privilege scoping are … More →

The post Securing agentic AI systems before they go rogue appeared first on Help Net Security.

DNS4EU, an EU-based DNS resolution service created to strengthen European Union’s digital sovereignty, has become reality. What is DNS? The Domain Name System (DNS) “translates” human-readable domain names into IP addresses and back, and is essential for accessing websites. Most users use DNS resolver services provided by their internet service provider (because they are automatically configured) or a public DNS provider like Google or Cloudflare. DNS4EU is meant to be a resilient, fast, reliable, secure, … More →

The post EU launches EU-based, privacy-focused DNS resolution service appeared first on Help Net Security.

Contrast Security announced Northstar, a major release for the company that redefines how businesses see cyberattacks, stop breaches, and protect their applications and APIs. Contrast pairs runtime data and contextual analysis with AI-powered auto-remediation to cut response times and eliminate noise. The Contrast Graph: Live runtime insight that drives precision At the core of the platform is the Contrast Graph, which powers its most advanced capabilities, including optional agentic AI workflows that help teams respond … More →

The post Contrast Northstar pairs runtime data and contextual analysis with AI-powered auto-remediation appeared first on Help Net Security.

With an exploit for a critical Roundcube vulnerability (CVE-2025-49113) being offered for sale on underground forums and a PoC exploit having been made public, attacks exploiting the flaw are incoming and possibly already happening. According to the Shadowserver Foundation, there is no lack of possible targets: around 84,000 internet-facing installations – predominantly in Europe, Asia, and North America – are still unpatched. What is Roundcube? Roundcube is a free and open-source web-based email client that’s … More →

The post Roundcube RCE: Dark web activity signals imminent attacks (CVE-2025-49113) appeared first on Help Net Security.

In this Help Net Security interview, Renana Friedlich-Barsky, EVP and CISO at LPL Financial, discusses how threat actors are targeting high-net-worth clients and exploiting digital touchpoints in wealth management. She explains why firms must embed security from the start to protect sensitive assets and ensure seamless, secure client experiences. How are threat actors evolving their tactics to target high-net-worth clients or exploit digital touchpoints in wealth management platforms? Threat actors are becoming more targeted and … More →

The post Balancing cybersecurity and client experience for high-net-worth clients appeared first on Help Net Security.

The threat landscape in the bioeconomy is different from what most CISOs are used to. It includes traditional risks like data breaches, but the consequences are more complex. A compromise of genomic databases, for example, does not just expose personal health data. It can also leak proprietary genetic sequences that represent years of research and investment. These are not just privacy violations; they are breaches that can cripple a business’s future R&D pipeline. One example … More →

The post CISOs, are you ready for cyber threats in biotech? appeared first on Help Net Security.

fiddleitm is an open-source tool built on top of mitmproxy that helps find malicious web traffic. It works by checking HTTP requests and responses for known patterns that might point to malware, phishing, or other threats. fiddleitm features “I created fiddleitm because I needed a replacement for a similar project I ran for years using Fiddler. It needed to be cross platform compatible and highly extensible. This is a web proxy and debugging tool by … More →

The post fiddleitm: Open-source mitmproxy add-on identifies malicious web traffic appeared first on Help Net Security.

Using the MITRE ATT&CK framework as a baseline, organizations are generally improving year-over-year in understanding security information and event management (SIEM) detection coverage and quality, but plenty of room for improvement remains, according to CardinalOps. MITRE ATT&CK enhances SOC visibility Founded in 2013, the framework’s underlying goal remains unchanged–to help defenders align their defenses and prepare to detect and prevent a wide range of tactics, techniques, and procedures (TTPs) observed in real-life attack scenarios. Mapping … More →

The post Enterprise SIEMs miss 79% of known MITRE ATT&CK techniques appeared first on Help Net Security.

In just 12 months, attackers attempted to steal more than $300 million via vendor email compromise (VEC), with 7% of engagements coming from employees who had engaged with a previous attack, according to Abnormal AI. Vendor email compromise risks increase with organization size Employees struggle to differentiate between legitimate messages and attacks, especially when those emails appear to come from a trusted vendor. Employees in the largest organizations, with workforces of 50,000 or more, had … More →

The post Employees repeatedly fall for vendor email compromise attacks appeared first on Help Net Security.

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: June 2025 Patch Tuesday forecast: Second time is the charm? Microsoft has been busy releasing more out-of-band (OOB) patches than usual throughout May. Google fixes Chrome zero-day with in-the-wild exploit (CVE-2025-5419) Google has fixed two Chrome vulnerabilities, including a zero-day flaw (CVE-2025-5419) with an in-the-wild exploit. Rethinking governance in a decentralized identity world Decentralized identity (DID) is gaining traction, and … More →

The post Week in review: Google fixes exploited Chrome zero-day, Patch Tuesday forecast appeared first on Help Net Security.

Millions of Internet-of-Things (IoT) devices running the open-source version of the Android operating system are part of the Badbox 2.0 botnet, the FBI has warned. Cyber criminals are using the botnet to perform ad fraud and click fraud. Access to and use of the compromised devices is also offered for sale through residential proxy services, which facilitate malware distribution, DDoS attacks, account takeover attacks, fake account creation, etc. “The Badbox 2.0 threat in particular is … More →

The post Millions of Android devices roped into Badbox 2.0 botnet. Is yours among them? appeared first on Help Net Security.