Security Boulevard

Is Your Organization Overlooking the Nuances of Non-Human Identity Management? Spotlighting the Intricacies of Non-Human Identity Management How often does your security team delve into the complexities of Non-Human Identity (NHI) management? When organizations increasingly shift operations to the cloud, managing these machine identities becomes crucial for maintaining robust security. But what exactly are NHIs, […]

The post Are your company’s NHIs meticulously managed appeared first on Entro.

The post Are your company’s NHIs meticulously managed appeared first on Security Boulevard.

How Can Non-Human Identities Revolutionize Cloud Security? Have you ever considered how machine identities play a role in your cloud security strategy? When organizations increasingly rely on cloud environments, the significance of securing Non-Human Identities (NHIs) and Secrets Management has become a priority. Despite the varied organizational structures across industries like financial services, healthcare, or […]

The post What makes NHIs crucial for secure cloud environments appeared first on Entro.

The post What makes NHIs crucial for secure cloud environments appeared first on Security Boulevard.

What Is the Impact of Non-Human Identities on Cloud Security? When dealing with cyber threats, how secure is your AI? Non-Human Identities (NHIs) have emerged as pivotal resources, particularly in managing protected AI environments such as Agentic AI. NHIs, essentially machine identities, are integral in safeguarding confidential information across multiple sectors, including financial services, healthcare, […]

The post How can Agentic AI stay protected against cyber threats appeared first on Entro.

The post How can Agentic AI stay protected against cyber threats appeared first on Security Boulevard.

Sonatype Security Research has identified two hijacked npm packages in the React Native ecosystem that receive more than 30,000 downloads collectively per week and were modified to deliver multi-stage malware. Sonatype is tracking the malicious packages as sonatype-2026-001153.

The post Hijacked npm Packages Deliver Malware via Solana, Linked to Glassworm appeared first on Security Boulevard.

Look, I’m not a developer, and the last time I truly “wrote code” was probably a good number of years ago (and it was probably Perl so you may hate me). I am also not an appsec expert (as I often remind people).

Below I am describing my experience “vibe coding” an application. Before I go into the details of my lessons — and before this turns into a complete psychotherapy session — I want to briefly describe what the application is supposed to do.

Anton’s vibe app screenshot

We have a podcast (Cloud Security Podcast by Google), and I often feel that old episodes containing useful information aren’t being listened to and the insights from them go to waste. At the same time, for many organizations today, the answer to their current security problems may well have been discussed and solved in 2021. This may be strange to some, but for many organizations, the future is in the past. Somebody else’s past!

So I wanted “a machine” that turns old episodes into role-specific insights, without too much work by a human (me). This blog is a reflection on how things went.

First, my app is using public data — namely podcast transcripts and audio — to create other public data (social media posts). Since the inputs and outputs are public, this certainly made me at peace with vibe coding. Naturally, I needed to understand how the app would be coded, where it would live and what I should do to make it manifest in the real world. So I asked Gemini, and it suggested I use AI Studio by Google, and I did (non-critically) exactly that.

When I started creating the app, the question of storage immediately came up. Jumping a little bit ahead, you will see that authentication / credentials and storage were two security themes I reflected on the most.

You want to read a file from storage, but what storage? More importantly, whose storage? At this point, I had my first brush with anxiety of the “vibe process.” I didn’t want to just vibe code without a full understanding of the data access machinery. I immediately said, “No, I don’t want to store data in my Google Drive using my credentials.” I just didn’t trust it.

In fact, I didn’t trust the app with any credentials for anything — work or personal — at all! Given that I have public data, I decided to store it in a public wed folder. AI Studio suggested ways to store data that people might not fully understand, and this is my other reflection: If I’m not a developer, and I don’t know the machinery behind the app, how do I decide? These decisions are risk decisions and “a citizen vibe coder” is very much not equipped to make them. Well, I sure wasn’t.

So what are the security implications of the decisions a developer makes — sometimes guided by AI and sometimes on their own? Can I truly follow an AI recommendation that I don’t understand? Should I follow it? If you don’t understand what happens, I can assure you, you certainly do not understand the risks!

As a result, I did not trust the app with any credentials or authenticated access. Of course, a solution may have been to use throwaway storage with throwaway credentials, but I think I do not need this in my life... Anyhow, many actions that you take during vibe coding, whether suggested by AI or not, have security implications.

In addition, the app interacts with the environment. If the app is being built in a corporate environment, it interacts with corporate security “rules and tools”, and some things you may want to do wouldn’t work. I’m not going into details, but I had a couple of examples of that. If you vibe code at work and you are doing it through, let’s say, shadow AI, there will be things your AI (and you) would want to do, but your employer security would not allow. And often with good reasons too! So you ask AI for more ways and hope it won’t say “just disable the firewall.”

The next conundrum, apart from storage, was output quality. What about quality and those hallucinatory mistakes? Now, I know my app uses an LLM to condense a summary of the podcast transcript into brief insights for social media. And before my app runs, another LLM turns MP3 into text. And it also uses an LLM to make the visual summaries. So, the question is: who handles the mistakes, and how?

For example, I tried to use a certain “well known” model to create a visual summary. Of course, the visual summary was incredibly accurate in most cases, but sometimes “mistakes were made” and words were corrupted (“verifigement” happened to me in one case). If an LLM powered tool can do something, it does not mean it will do it equally well every time (unless you build validators AND the things that you need to do can in fact be validated). So validate!

Further, I read somewhere that the process for dealing with AI mistakes is different from the process for dealing with human mistakes. I am sure I could write another module for the app to check if an image has correct text or add another validation technique, but it is interesting that I faced this very quickly.

Thus I have to deal with “AI-style mistakes”, and I cannot solve them by having a human review everything. I can tell you right away, even from my small project, that having a human review is a non-starter. It’s theoretically correct, but practically won’t happen. It absolutely will not happen if you take the koolaid and transform your business process to be “AI native.” Having humans review boring tasks like checking image text is completely insane. That’s not going to fly. HITL is DOA (for these tasks).

So: storage, credentials, trust, and quality all came up. Another decision arose when I needed to store intermediate results of my insight generation. Again, trust issues surfaced because data storage. AI Studio suggested choices, I asked AI about pros/cons, and made the decision. Again all these decisions are risk decisions.

Finally, certain mistakes come up all the time, repeatedly, and I have to tell AI Studio to write things multiple times because it doesn’t always “get” it (example: my podcast episode URLs). This is another lesson: sometimes it takes multiple prompts, and constant reminders (say to validate the links)

All in all, I’ll continue to experiment — got more ideas that I want. Here are some outputs of my app…

• On X: example example example
• On LinkedIn: example example

Anton vibe app UX

Now the explicit lessons for those who need this crisp and actionable:

1. You Make Implied Security Decisions with Every Prompt

When you “vibe code,” you aren’t just describing features; you are making risk and security decisions. If you ask an AI to “save this data,” and you don’t specify how or where, the AI may choose the path of least resistance — usually a public bucket or a local file with cleartext credentials. In the world of AI-generated code, silence is a security decision.

2. Credentials and Storage: The Boring Stuff is Still the Hard Stuff

Storage and credentials were the key themes for me. This is the great irony of modern development: AI can write a complex LLM orchestration layer in seconds, but it may struggle to help a novice set up a secure, encrypted secrets manager. The “plumbing” of security remains the primary friction point.

3. AI Mistakes Require a New Response Model

Traditional QA seems designed for deterministic human error. AI “style mistakes” (like corrupted words in a visual summary) are stochastic and weird. And common! Human review is a “non-starter” for these tasks. Security and quality validation for AI-generated content must itself be automated (AI-on-AI validation) because humans simply won’t do the “deathly boring” work of checking verbatim accuracy at scale. Turtles all the way down can happen to you.

4. Corporate Guardrails vs. AI Ambition

The AI you vibe code with may not know your corporate policy. It will suggest “awesome” features that would immediately trigger a compliance violation. A few times while vibe coding, I heard a subtle lawyercat meowing in the air duct… When vibe coding in a corporate environment, you quickly hit the wall where “what the AI wants to do” meets “what security allows.” This reinforces the need for platform-level guardrails rather than just merely developer education.

5. Public Data is the Only “Safe” Vibe

My “peace of mind” came from the fact that your inputs and outputs were already public. To me, this is the only way to vibe code safely without a full understanding of the underlying security stack. The moment you move from “public podcast audio” to “proprietary customer data,” the risk model shifts from “fun experiment” to “data breach.”

Anyhow, this was my mildly-AI-assisted stream of vibe consciousness.

Enjoy the show! Now with video!

Anton’s Vibe Coding Experience: A Reflection on Risk Decisions was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Anton’s Vibe Coding Experience: A Reflection on Risk Decisions appeared first on Security Boulevard.

96.5% of orgs run AI on production databases. Learn why database change governance matters more than model risk, and how leading teams govern AI-speed change.

The post AI is Already in Your Database: The Real Risk is How You Govern Change | Liquibase appeared first on Security Boulevard.

I'm excited to announce that I will be leading the DCIM Leadership Workshop at Data Center World AFCOM 2026 this April, taking over from Bill Kleyman. For the past nine years, Bill has set the gold standard for this workshop, making it a crucial event for data center leaders to tackle real-world challenges. In this three-hour session, we'll dive deep into managing AI workloads, liquid cooling integration, and the shift toward autonomous operations. I'm honored to continue Bill's legacy and look forward to having honest, challenging conversations that push our industry forward.

The post The Now, New and Next in Data Center Infrastructure Management appeared first on Hyperview.

The post The Now, New and Next in Data Center Infrastructure Management appeared first on Security Boulevard.

BSidesSLC

Author, Creator & Presenter: Andrew Crottym - Warrant Officer (Cyber Warfare), United States Army Reserve

Our thanks to BSidesCache for publishing their Creators, Authors and Presenter’s outstanding BSidesCache 2025 content on the Organizations' YouTube Channel.

Permalink

The post BSidesCache 2025 – From Law Enforcement To Cybersecurity: Building Skills That Matter appeared first on Security Boulevard.

Microsegmentation has moved well beyond a narrow infrastructure conversation. Today, teams need to enforce policy across cloud workloads, data centers, user endpoints, containers, and OT and IoT environments without creating more operational friction than security value. That broader requirement is exactly why we built the ColorTokens Xshield Enterprise Microsegmentation Platform™ the way we did. It is also […]

The post ColorTokens Once Again Named a Leader and Outperformer in the 2026 GigaOm Radar for Microsegmentation appeared first on ColorTokens.

The post ColorTokens Once Again Named a Leader and Outperformer in the 2026 GigaOm Radar for Microsegmentation appeared first on Security Boulevard.

The phishing site it is not affiliated with Igloo Inc or Pudgy Penguins, but is designed to lure fans and steal their crypto passwords.

The post Fake Pudgy World site steals your crypto passwords appeared first on Security Boulevard.

Cloud adoption didn’t simplify network security. It multiplied it. Today’s enterprises operate across data centers, hybrid environments, and multiple public clouds. Security teams now manage AWS security groups, Azure Firewall...

The post Best Cloud Firewall Vendors for 2026 appeared first on Security Boulevard.

The rise of AI-assisted software development has introduced a new bottleneck: code verification. While AI can generate code at unprecedented speeds, manually verifying that code for quality and security often breaks a software developer's flow.

The post Announcing native MCP Server in SonarQube Cloud appeared first on Security Boulevard.

Author, Creator & Presenter: Dhivva Balasubramanian - Cybersecurity IAM Manager, Southwest Airlines

Our thanks to BSidesCache for publishing their Creators, Authors and Presenter’s outstanding BSidesCache 2025 content on the Organizations' YouTube Channel.

Permalink

The post BSidesCache 2025 – Hackers Don’t Break In. They Log In. appeared first on Security Boulevard.

Explore key cybersecurity requirements and implementation deadlines for electric power utilities included in the NERC CIP-003-9 standard for Low-Impact BES (Bulk Electric System) Cyber Systems, and how Tenable can help deliver the comprehensive visibility required to ensure compliance.

Key takeaways

1. NERC CIP-003-9 introduces specific requirements for electric power utilities and related sectors with low-impact BES cyber systems.
2. Many municipally owned utilities, public power authorities and state or locally operated transmission entities fall within the scope of Low Impact BES Cyber Systems and will be impacted by these revisions.
3. With the first major implementation deadline on April 1, 2026, and others in 2028 and 2030, entities must begin planning and implementation now to avoid audit friction.
4. Tenable OT Security addresses core NERC CIP requirements through continuous asset discovery, anomaly detection with real-time alerts, data retention, and access control.

Navigating the road to NERC CIP compliance: The looming April deadline

Electric power utilities in North America are under pressure to comply with the latest security provisions from the North American Electric Reliability Corporation (NERC). The newest set of provisions will be implemented over the next four years, starting in April of this year.

Specifically, the NERC Critical Infrastructure Protection (CIP) Reliability Standard CIP-003-9 becomes officially enforceable on April 1, 2026. As part of the Supply Chain Low-Impact Revisions, this standard introduces specific requirements for electric power utilities and related sectors with low-impact BES (Bulk Electric System) cyber systems. This update is particularly significant for municipally owned utilities and cooperatives that may have previously operated under lighter oversight but are now pulled into higher compliance tiers due to recent updates like CIP-002-7.

At a high level, the BES includes the electrical generation resources, transmission lines, and interconnections generally operated at voltages of 100 kV or higher. Historically, “low-impact" assets were subject to lighter oversight, but the evolving threat landscape—specifically targeting the supply chain—has necessitated a more rigorous approach.

CIP-003 requires organizations to specify consistent and sustainable security management controls that establish responsibility and accountability to protect BES Cyber Systems against compromise that could lead to misoperation or instability in the BES. 

The NERC CIP compliance roadmap: 2026, 2028, and 2030

The transition to full compliance isn't a one-time event; it's a tiered rollout. Understanding these milestones is critical for budget and resource planning:

Deadline Milestone Focus Area April 1, 2026 Enforcement begins Implementation of Supply Chain Low-Impact Revisions (CIP-003-9). 2028 horizon Expanded controls Focus shifts toward deeper evidence collection and refined incident response reporting. 2030 and beyond Full maturity Continuous monitoring and automated audit trails become the expected standard. How Tenable OT Security simplifies NERC CIP alignment

Meeting NERC CIP requirements can be a manual, spreadsheet-heavy nightmare—especially for local government entities that lack the massive compliance departments found in larger investor-owned utilities. Tenable OT Security acts as a force multiplier, allowing small IT teams to automate asset discovery and evidence collection without exhausting limited public sector budgets. Tenable OT Security is designed to help organizations meet these technical and operational demands with confidence, turning a compliance burden into a strategic advantage.

We address the core pillars of the standard through:

• Asset discovery: Identify every device in your environment—including those deep in the "low-impact" layers—to ensure nothing is left unmanaged.
• Anomaly detection: Real-time monitoring to catch unauthorized configuration changes or suspicious network behavior that could signal a supply chain breach.
• Data retention and reporting: Automatically generate the reports needed for audits, reducing the "compliance fire drill" that usually occurs when regulators knock.
• Access control and exposure management: Prioritize the risks that actually matter in terms of uptime and cyber resilience, ensuring you are both compliant and secure.

Tenable OT Security supports compliance with CIP-003 through real-time alerts designed to help security teams enforce security management policies.
 

An example of how a user can leverage the Compliance Dashboard in Tenable OT Security with multiple security frameworks selected to evaluate, monitor, and report on compliance with relevant regulatory compliance frameworks and industry standards. 

Tenable OT Security alerts in real-time on any unauthorized access activities to the OT environment as well as enabling the enforcement of security management policies. In addition, it fully audits all OT activities, including controller engineering activities like logic updates, configuration changes and firmware uploads/downloads. Tenable OT Security tracks the source of the activity, the exact commands used, the devices impacted and the specific impact to these devices, as well as the date and time of each activity. This comprehensive audit trail enables grid owners and operators to establish responsibility and accountability. It also helps in the prevention of malicious or erroneous activities that could lead to misoperation or instability of the plant.

The Tenable One advantage

While NERC CIP focuses specifically on the grid, modern utilities don’t operate in a vacuum. The convergence of IT and OT means your cyber exposure is interconnected. 

For state and local government entities that operate power generation, transmission or distribution infrastructure, cyber risk doesn’t exist solely within the grid environment. IT systems supporting billing, emergency communications, identity access management and cloud based service delivery are increasingly interconnected with OT environments. For a local government, a cyber incident in the grid doesn't just impact power; it can ripple through essential public services. Tenable One provides a unified view, helping SLG leaders bridge the gap between small IT teams and complex OT systems.

The Tenable One exposure management platform provides a unified view of your entire attack surface. By combining OT-specific insights with IT, cloud, and identity data in a single view, Tenable One allows you to see beyond basic compliance—enabling you to prioritize risk across your entire infrastructure and communicate your security posture from the control room to C-suite.

Learn more:

• Download the guide to compliance with NERC CIP standards
• Register for our April 15th webinar, “NERC CIP-003-9: Addressing the April 1st Enforcement.”
• Request a personalized demo to see the power of Tenable One in action.
• Get in touch to discuss your unique IT/OT security compliance challenges.
• Explore our NERC CIP resources to learn more about securing your critical infrastructure.

The post How to prepare for NERC CIP compliance deadlines in 2026 and beyond appeared first on Security Boulevard.

In a previous blog, we presented NIST's benchmark definition of integrity monitoring.

The conclusion was clear: Many vendor claims of file integrity monitoring (FIM) capabilities do not match this definition.

Change detection across system components, including files, is crucial and implemented in many tools, including EDR/XDR. However, while these systems often claim FIM capabilities, file change detection alone falls short of true FIM.

The post FIM Test: A Method for Distinguishing True FIM Capabilities in a Crowd of Claims appeared first on Security Boulevard.

Find your most sensitive code and prioritize fixes.

The post Introducing AI-powered Contextual Project Classification: From severity scores to business risk appeared first on Security Boulevard.

New York, United States, 17th March 2026, CyberNewswire

The post Orchid Security Recognized by Gartner® as a Representative Vendor of Guardian Agents appeared first on Security Boulevard.

Learn how to implement identity management for multi-tenant SaaS applications with secure authentication, tenant isolation, and access control.

The post Identity Management for Multi-Tenant SaaS Applications appeared first on Security Boulevard.

New York, NY, 17th March 2026, CyberNewswire

The post GitGuardian Reports an 81% Surge of AI-Service Leaks as 29M Secrets Hit Public GitHub appeared first on Security Boulevard.

GitGuardian’s 5th State of Secrets Sprawl report is here. In this blog, we unpack the key findings behind the 2026 edition, from AI-driven leak growth to the remediation gaps security teams can’t ignore.

The post The State of Secrets Sprawl 2026: AI-Service Leaks Surge 81% and 29M Secrets Hit Public GitHub appeared first on Security Boulevard.