Security Boulevard

How Can Non-Human Identities Enhance Your Security Protocols? Are you fully harnessing the potential of Non-Human Identities (NHIs) in securing your enterprise’s digital? With digital environments increasingly rely on machine interactions, Non-Human Identities have emerged as crucial components of a robust cybersecurity strategy. Understanding and managing these entities can significantly strengthen your organization’s security posture, […]

The post How improved can compliance be with AI integration? appeared first on Entro.

The post How improved can compliance be with AI integration? appeared first on Security Boulevard.

At 6:32 a.m., a hospital in Belgium pulled the plug on its own servers. Something was already inside the network, and no one could say how far it had spread. By mid-morning, scheduled procedures were canceled. Critical patients were transferred out with help from the Red Cross. Staff went back to paper. Emergency services ran at reduced […]

The post When Hospitals Go Dark and Browsers Turn Rogue appeared first on ColorTokens.

The post When Hospitals Go Dark and Browsers Turn Rogue appeared first on Security Boulevard.

Session 10C: Privacy Preservation

Authors, Creators & Presenters: Xiaoguang Li (Xidian University, Purdue University), Zitao Li (Alibaba Group (U.S.) Inc.), Ninghui Li (Purdue University), Wenhai Sun (Purdue University, West Lafayette, USA)

PAPER
On the Robustness of LDP Protocols for Numerical Attributes under Data Poisoning Attacks

Recent studies reveal that local differential privacy (LDP) protocols are vulnerable to data poisoning attacks where an attacker can manipulate the final estimate on the server by leveraging the characteristics of LDP and sending carefully crafted data from a small fraction of controlled local clients. This vulnerability raises concerns regarding the robustness and reliability of LDP in hostile environments. In this paper, we conduct a systematic investigation of the robustness of state-of-the-art LDP protocols for numerical attributes, i.e., categorical frequency oracles (CFOs) with binning and consistency, and distribution reconstruction. We evaluate protocol robustness through an attack-driven approach and propose new metrics for cross-protocol attack gain measurement. The results indicate that Square Wave and CFO-based protocols in the server setting are more robust against the attack compared to the CFO-based protocols in the user setting. Our evaluation also unfolds new relationships between LDP security and its inherent design choices. We found that the hash domain size in local-hashing-based LDP has a profound impact on protocol robustness beyond the well-known effect on utility. Further, we propose a zero-shot attack detection by leveraging the rich reconstructed distribution information. The experiment show that our detection significantly improves the existing methods and effectively identifies data manipulation in challenging scenarios.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – On the Robustness Of LDP Protocols For Numerical Attributes Under Data Poisoning Attacks appeared first on Security Boulevard.

Security researchers from LayerX discovered 16 malicious Chrome extensions created by the same threat actor designed to intercept users' interaction with ChatGPT chatbots and steal their account credentials, the latest instance in a growing trend.

The post LayerX Discovers Malicious Chrome Extensions Stealing ChatGPT Accounts appeared first on Security Boulevard.

Artificial intelligence and machine learning (AI/ML) are no longer emerging capabilities inside enterprise environments. In 2025, they became a persistent operating layer for how work gets done. Developers ship faster, marketers generate more content, analysts automate research, and IT teams rely on AI to streamline troubleshooting and operations. The productivity gains are real, but so are the tradeoffs.As AI adoption accelerates, sensitive data increasingly flows through a growing number of AI-enabled applications. These systems often operate with less visibility and fewer guardrails than traditional enterprise software. At the same time, threat actors are following the data. The same forces making AI more accessible, with faster automation and more realistic outputs, are also compressing the timeline for attacks and making them harder to detect.The newly released Zscaler ThreatLabz 2026 AI Security Report examines how enterprises are navigating this shift. The report draws on analysis of nearly one trillion AI and ML transactions observed across the Zscaler Zero Trust Exchange™ throughout 2025. That activity translates to hundreds of thousands of AI transactions per organization per day, offering a grounded view into how AI is actually being used across global enterprises.The findings reinforce what many security teams already feel. AI is now embedded across daily workflows, governance remains uneven, and the enterprise attack surface is expanding in real time.This blog highlights a subset of the most significant findings and implications for security teams. The full report provides deeper analysis of risk patterns, and practical guidance for enterprise leaders tasked with safely operationalizing AI at scale.5 key takeaways for security teams in 2025Enterprise AI adoption is accelerating fast and expanding the attack surfaceEnterprise AI/ML activity increased more than 90% year-over-year in 2025. ThreatLabz analysis now includes over 3,400 applications generating AI/ML traffic, nearly four times more than the previous year. This growth reflects how quickly AI capabilities are being embedded into day-to-day workflows.Even when individual applications generate modest volumes of traffic, the overall ecosystem effect matters. Risk scales with sprawl. As AI features appear across vendors and platforms, security teams inherit governance responsibility across thousands of applications rather than a small set of standalone tools. What was once a limited category has become a distributed system.The most used AI tools sit directly in the flow of work and the flow of dataWhile the enterprise AI adoption landscape continues to evolve, with models such as Google Gemini and Anthropic gaining traction more recently, enterprise usage in 2025 remained concentrated around a small set of productivity-layer tools. When analyzing AI/ML activity across the full year, the most widely used applications were Grammarly, ChatGPT, and Microsoft Copilot, reflecting how deeply AI is now embedded in everyday work. Codeium also ranked among the top applications by transaction volume, underscoring the growing role of AI in development workflows where proprietary code is constantly in motion.ThreatLabz also examined data transfer volumes between enterprises and AI applications. In 2025, data transfer to AI tools rose 93% year-over-year, reaching tens of thousands of terabytes in total. The same applications driving productivity gains from writing/editing to translating/coding - are often the ones handling the highest volumes of sensitive enterprise data - reinforcing how closely AI adoption and data risk are now linked.Many enterprise organizations are still blocking AI outrightNot every organization is ready to enable broad AI access across the business. While overall blocking declined year-over-year, suggesting progress toward more policy-driven AI governance, enterprises still blocked 39% of all AI/ML access attempts in 2025.This pattern reflects unresolved risk rather than resistance to AI itself. Blocking is often used when organizations lack confidence in visibility, internal guardrails, or how AI systems behave once deployed at scale. ThreatLabz red team testing supports this caution. Every enterprise AI system tested failed at least once under realistic adversarial pressure, with failures surfacing quickly.Blocking may reduce exposure, but it does not stop AI-driven work. Users often shift to unsanctioned alternatives, personal accounts, or embedded AI features inside approved SaaS platforms, frequently with less visibility and fewer controls. The long-term goal is safe enablement, allowing organizations to support AI use while managing risk consistently.AI adoption varies widely by industry, concentrating risk unevenlyAI/ML usage increased across every industry in 2025, but adoption was not uniform. Each sector is moving at a different pace and with different levels of oversight. Finance & Insurance once again generated the largest share (23.3%) of enterprise AI/ML activity. Manufacturing remained highly active at 19.5%, driven by automation, analytics, and operational workflows.Industry context matters. In sectors where AI intersects with regulated data, operational technology or supply chain systems, the stakes for data protection and access control are higher. Blocking patterns also varied widely, highlighting that AI governance cannot be one-size-fits all. Controls must align with industry risk profiles, compliance requirements, and operational dependencies.Threat actors are already using AI across the attack chain   ThreatLabz case studies show that generative AI is actively being used by adversaries to accelerate existing tactics rather than replace them. Attackers are using AI to support initial access, social engineering, evasion, and malware development, making malicious activity harder to distinguish from legitimate use.Campaigns analyzed in the report include AI-assisted social engineering, fake personas, and signs of AI-assisted code generation. For defenders, this means AI security must account not only for how employees use AI, but also for how adversaries are using it to move faster and blend in once they gain access.The "hidden" growth story: embedded AI is expanding risk where least expectedNot all enterprise AI shows up as standalone generative AI usage. Increasingly, AI operates through embedded features built into everyday SaaS applications. These capabilities often activate by default, run continuously in the background, and interact with enterprise data without being labeled or governed as AI.Embedded AI may feel like a simple feature enhancement, but it often introduces new data pathways. As a result, AI can interact with sensitive enterprise content in places security teams are not actively monitoring or classifying as AI usage at all. This is a growing blind spot that requires ongoing monitoring and significant attention across security teams and the industry. How Zscaler secures AI adoption and accelerates AI initiativesAs AI becomes more embedded across the enterprise, from public GenAI tools to private models, pipelines, agents, and supporting infrastructure, security teams need controls that extend beyond traditional app security. They need visibility into how AI behaves across the system.Zscaler helps organizations secure AI usage with protections that span the AI security lifecycle:AI asset managementGain full visibility into AI usage, exposure, and dependencies across applications, models, pipelines, and supporting infrastructure (ex: MCP pipelines), including AI bills of material (AI-BOM) to discover your full footprint and identify risks.Secure access to AIEnforce granular access controls for AI applications and users. Inspect prompts and responses inline to ensure safe and responsible use of AI apps by preventing sensitive data from being sent to external models or returned in unsafe outputs.Secure AI applications and infrastructureProtect the AI systems enterprises are building and deploying, not just the tools employees use. This includes hardening systems and enforcing runtime protections with vulnerability detection across models and pipelines, adversarial red team testing, and securing against common and evolving threats like prompt injection, data poisoning, and unsafe use of sensitive information.Get the report—stay ahead of enterprise AI riskThe ThreatLabz 2026 AI Security Report provides a data-backed view into how AI is being used across enterprise environments, where security teams are drawing the line, and where risk is emerging. Beyond the findings highlighted here, the full report examines top AI applications and vendors, regional usage patterns, and reveals ThreatLabz expert predictions for AI security in 2026—along with additional insights and guidance throughout.    Download the full report to explore the data, insights, and recommendations shaping the next phase of enterprise AI security.

The post AI is Now Default Enterprise Accelerator: Takeaways from ThreatLabz 2026 AI Security Report appeared first on Security Boulevard.

When enforcing Zero Trust architectures at your organization, data masking and synthetic data generation should be at the foundation of your data layer’s security.

The post How data masking & synthesis support Zero Trust appeared first on Security Boulevard.

AI agents are booking travel at scale. Learn how to enable agentic commerce, stop agent hijacking and loyalty fraud, and protect your revenue.

The post AI Agents Are Booking Travel: How Businesses Can Enable Revenue & Minimize Risk appeared first on Security Boulevard.

At first glance, an email address ending in .eu.org looks trustworthy. It feels institutional, maybe even official. Many people implicitly associate it with Europe, nonprofits, or established organizations.

That assumption is wrong more often than you might expect.

Because the domain looks legitimate, it has become attractive to fraudsters.

The post You see an email ending in .eu.org. Must be legit, right? appeared first on Security Boulevard.

Teleport unveils an agentic identity framework that secures AI agents without passwords, replacing static credentials with cryptographic, zero-trust identities to reduce breach risk.

The post Teleport Launches Framework to Secure Identities of AI Agents appeared first on Security Boulevard.

Momentum is building in the fight against botnets, as network operators and law enforcement ramp up crackdowns on botnet infrastructure, malware, and bulletproof hosting providers. While major takedowns show progress, cybercriminals are still adapting — learn more in this latest edition of the Botnet Spotlight.

The post Botnet Spotlight: Pressure rises on botnets — but the fight is far from over appeared first on Security Boulevard.

The clock on digital trust is about to speed up — and many organizations are not prepared for what comes next.

Related: The Google Bazel tool outage

TLS certificates — the quiet backbone of secure online communication — are headed … (more…)

The post STRATEGIC REEL: Certificate expiration is speeding up — outpacing legacy management first appeared on The Last Watchdog.

The post STRATEGIC REEL: Certificate expiration is speeding up — outpacing legacy management appeared first on Security Boulevard.

In today’s digital world, our private information is more accessible than ever. The benefits of the internet pose a significant threat to our privacy and security. Doxxing is one such threat, which means publicly revealing private, sensitive, or identifying information about an individual without their consent. This information includes home addresses, emails, phone numbers, workplaceRead More

The post What It Doxxing? How It Happens, and How to Stay Safe? appeared first on EncryptedFence by Certera - Web & Cyber Security Blog.

The post What It Doxxing? How It Happens, and How to Stay Safe? appeared first on Security Boulevard.

Encryption doesn’t guarantee privacy—key ownership does. This article explains how cloud-stored encryption keys let third parties unlock your data, exposing the hidden risks behind “secure” services like BitLocker and Gmail.

The post He Who Controls the Key Controls the World – Microsoft “Often” Provides BitLocker Keys to Law Enforcement appeared first on Security Boulevard.

Cyber fusion centers make zero-trust more effective by improving visibility, automating response, and shrinking the window for attacks.

The post Why Cyber Fusion Centers and Zero-Trust Work Better Together appeared first on Security Boulevard.

January 2026 was a wake-up month for enterprise security teams. In a single week, CERT-In released three high-severity advisories exposing critical flaws across SAP, Microsoft, and Atlassian, the very platforms that run finance systems, identity layers, developer pipelines, and collaboration tools inside most enterprises. These weren’t theoretical bugs. One Windows vulnerability was already being exploited […]

The post Critical CERT-In Advisories – January 2026: SAP, Microsoft, and Atlassian Vulnerabilities appeared first on Kratikal Blogs.

The post Critical CERT-In Advisories – January 2026: SAP, Microsoft, and Atlassian Vulnerabilities appeared first on Security Boulevard.

What SOC teams need to monitor, triage, and contain when clawdbot-like agentic AI assistants. Includes detection signals, triage questions, and a containment playbook.

The post Clawdbot-Style Agentic Assistants: What Your SOC Should Monitor, Triage, and Contain appeared first on D3 Security.

The post Clawdbot-Style Agentic Assistants: What Your SOC Should Monitor, Triage, and Contain appeared first on Security Boulevard.

Mitigate shadow IT and data sprawl with a modern, data-first MSSP approach. Learn how Cavelo helps you gain visibility, reduce risk, and strengthen client trust.

The post How MSSPs Can Help Clients Mitigate Shadow IT and Data Sprawl with Cavelo appeared first on Security Boulevard.

Session 10B: Ransomware

Authors, Creators & Presenters: Kevin van Liebergen (IMDEA Software Institute), Gibran Gomez (IMDEA Software Institute), Srdjan Matic (IMDEA Software Institute), Juan Caballero (IMDEA Software Institute)

PAPER
all your (data)base are belong to us: Characterizing Database Ransom(ware) Attacks

We present the first systematic study of database ransom(ware) attacks, a class of attacks where attackers scan for database servers, log in by leveraging the lack of authentication or weak credentials, drop the database contents, and demand a ransom to return the deleted data. We examine 23,736 ransom notes collected from 60,427 compromised database servers over three years, and set up database honeypots to obtain a first-hand view of current attacks. Database ransom(ware) attacks are prevalent with 6K newly infected servers in March 2024, a 60% increase over a year earlier. Our honeypots get infected in 14 hours since they are connected to the Internet. Weak authentication issues are two orders of magnitude more frequent on Elasticsearch servers compared to MySQL servers due to slow adoption of the latest Elasticsearch versions. To analyze who is behind database ransom(ware) attacks we implement a clustering approach that first identifies campaigns using the similarity of the ransom notes text. Then, it determines which campaigns are run by the same group by leveraging indicator reuse and information from the Bitcoin blockchain. For each group, it computes properties such as the number of compromised servers, the lifetime, the revenue, and the indicators used. Our approach identifies that the 60,427 database servers are victims of 91 campaigns run by 32 groups. It uncovers a dominant group responsible for 76% of the infected servers and 90% of the financial impact. We find links between the dominant group, a nation-state, and a previous attack on Git repositories.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – all your (data)base are belong to us: Characterizing Database Ransom(ware) Attacks appeared first on Security Boulevard.

Authentication determines who gets in and who stays out. Getting this right means fewer breaches, less downtime, and stronger trust with customers.

The post Top Authentication Methods for Preventing Data Breaches appeared first on Security Boulevard.

What Is CVE-2026-21962? CVE-2026-21962 is a critical (CVSS 10.0) vulnerability in the Oracle HTTP Server and the WebLogic Server Proxy Plug-in for Apache HTTP Server and Microsoft IIS. An unauthenticated attacker with HTTP access can exploit this flaw by sending crafted requests to the affected proxy components and bypass security controls. Successful exploitation can result […]

The post Imperva Customers Protected Against CVE-2026-21962 in Oracle HTTP and WebLogic appeared first on Blog.

The post Imperva Customers Protected Against CVE-2026-21962 in Oracle HTTP and WebLogic appeared first on Security Boulevard.