Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Cato DEM Root Cause Analysis: Find What's Slowing Down Your Applications

Oct 19, 2026 By Cato Networks In Cato Networks
When users report slow application performance, where do you start troubleshooting? The Wi-Fi, ISP, network, or application itself? With Cato Digital Experience Monitoring (DEM), IT teams can move beyond guesswork and identify the root cause of performance issues using evidence from across the user-to-application path. In this demo, a user reports slow Zoom performance at a branch location. Watch how Cato DEM Root Cause Analysis investigates the issue, examines latency, jitter, and packet loss, and identifies the branch wireless LAN as the source of the slowdown. See how Cato DEM helps IT teams.
View Video
nucleus

There's Something Missing in the Discussion About AI in Vulnerability Management

Oct 19, 2026 By John Morton In Nucleus
The platform determines what is known. AI helps determine what it means. Technology solution providers across virtually every industry are racing to add AI, in some fashion, to their offerings. Vulnerability management providers aren’t immune, either. They’re racing just as fast as the rest of them, sometimes faster. These vendors are embedding copilots, assistants, and agents powered by technologies like Anthropic Claude, OpenAI GPT, and Google Gemini.
Read Post
teleport

5 Lessons from Watching an AI Agent Swarm Self-Organize

Oct 19, 2026 By Ben Arent In Teleport
This summer, we launched Identity Security for AI. That post described an upcoming wave of attacks and security challenges unique to Large Language Models (LLMs) and agentic workflows. As the traditional MITRE ATT&CK framework reached its limits, Google DeepMind published TRAIT&R, a taxonomy of rogue AI tactics and routines closely modeled after MITRE ATT&CK.
Read Post
1Password

5 signs that standing privileges are putting systems at risk

Oct 19, 2026 By Gabriel Avner In 1Password
In most organizations, standing privileges don’t show up all at once. They accumulate quietly. A role is added “temporarily.” A contractor needs broad access to finish a project. A service account gets oversized permissions because no one has time to fine-tune them. None of these choices seem harmful in the moment, but over time they build into a privilege surface that’s far too large to monitor and far too easy to misuse.
Read Post
cyberhaven

AI Agent Intent Drift and the Case for Data Lineage

Oct 19, 2026 By Franklin Nguyen In Cyberhaven
An AI support agent picks up a customer case, signs in with valid credentials, works on it in only approved systems, and closes it. I would reasonably predict that if someone were to review this workflow, it would likely come back clean, with no policy rule violation. But if we were to take a closer look, we might find that the agent did more than just close the case.
Read Post
sophos

Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion

Oct 19, 2026 By Andrew Bonwell In Sophos
Traditional business email compromise (BEC) is often thought of as a mailbox problem: a stolen account, unauthorized access to email, forwarding rules, and (sometimes) outgoing mail impersonating the compromised user. But more recent incidents show how far beyond “email only” these intrusions can extend once an attacker gains control of a cloud identity.
Read Post
sophos

ConnectWise Cloud Backup application abused in cross-tenant token sweep

Oct 19, 2026 By Sophos X-Ops In Sophos
Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants On October 15, 2026, Sophos X-Ops researchers identified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants.
Read Post
exabeam

Access Isn't Trust: A Behavioral Risk Framework for People, Service Accounts, and AI Agents

Oct 19, 2026 By Exabeam In Exabeam
Risk in the agentic enterprise spans people, service accounts, and AI agents. All three act with legitimate credentials, so access controls alone can’t show whether their activity is safe. A behavioral risk framework applies one model to every actor: Verify expected behavior before access goes live, observe activity once it does, analyze behavior for risk and drift, and improve detection coverage over time.
Read Post
cloudflare

Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities

Oct 19, 2026 By Cloudflare Access In Cloudflare
The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. Indeed, the disclosures included an actively exploited flaw that allowed attackers to execute commands on affected gateways without signing in. As with any emergency patch, admins had to weigh cutting off or disrupting their users’ access with the risk of delaying a critical security update.
Read Post
certkit

Unable to get local issuer certificate, explained

Oct 19, 2026 By Todd H. Gardner In CertKit
Your site loads in Chrome fine. Then a deploy script, a webhook, or integration calls the same URL and gets this: Python says certificate verify failed: unable to get local issuer certificate. Node says unable to get local issuer certificate, or unable to verify the first certificate. It’s all the same problem. It’s a misconfiguration between your certificate and a trusted root. Either the server isn’t sending it, or the client doesn’t have it.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.