Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Can We Truly Test Gen AI Apps? Growing Need for AI Guardrails
Unlike traditional software, where testing is relatively straightforward, Gen AI apps introduce complexities that make testing far more intricate. This blog explores why traditional software testing methodologies fall short for Gen AI applications and highlights the unique challenges posed by these advanced technologies.
Beyond Snapshots: The Need For Continuous Penetration Testing
By James Rees, MD, Razorthorn Security Times must change (and always will) and nowhere is this more true than in the realm of technological advancement. Thirty years ago, the technological landscape was vastly different from what we have today and technological change has outpaced Moore’s Law for some time now. Information security must keep pace with these advancements. This has become especially true with the advent of AI.
GitHub Copilot Security and Privacy Concerns: Understanding the Risks and Best Practices
Worried about GitHub Copilot’s security and privacy concerns? Learn about potential risks and best practices to protect yourself and your organization while leveraging AI.
Shining a Light on Shadow AI: What It Is and How to Find It
After speaking to a wide spectrum of customers ranging from SMBs to enterprises, three things have become clear: Add that together, and we get Shadow AI. This refers to AI usage that is not known or visible to an organization’s IT and security teams. Shadow AI comes in many forms, but in this blog we’ll stick to a discussion of Shadow AI as it pertains to applications. Application security teams are well aware that AI models come with additional risk.
Securing the Software Supply Chain in the AI/ML Era
Uncover Critical Gaps in Software Supply Chain Security A recent survey of over 300 global IT executives found that while 23% of organizations experienced software supply chain (SSC) breaches, only 30% prioritize SSC security. Our APAC tech leaders dive into these insights and offer practical solutions to enhance your security posture. Discover the latest trends and effective measures to protect your software supply chain.
PII vs PHI vs PCI: What is The Difference
In this age of digital supremacy, keeping our data safe and respecting privacy are super important. As more and more people and businesses use online platforms, it’s crucial to understand what types of data need that extra layer of protection, especially when it comes to PII vs PHI vs PCI. Understanding the distinctions between PII (Personally Identifiable Information), PHI (Protected Health Information), and PCI (Payment Card Information) is crucial.
AI and LLM Data Security: Strategies for Balancing Innovation and Data Protection
Striking the right balance between innovation using Artificial Intelligence (AI) and Large Language Models (LLMs) and data protection is essential. In this blog, we’ll explore critical strategies for ensuring AI and LLM data security, highlighting some trade-offs.
The EU AI Act: A roadmap for trustworthy AI
As artificial intelligence (AI) continues to revolutionize various sectors, ensuring it is developed and deployed in alignment with ethical standards and fundamental rights is critical for businesses that use it. The European Union's Artificial Intelligence Act (AI Act), formally adopted on March 13, 2024, addresses this critical necessity by establishing a comprehensive and detailed legal framework for AI systems within the EU.
Snyk Code, the only security tool chosen by developers in Stack Overflow's 2024 AI Search and Developer Tools survey
Snyk Code was the only code security tool shortlisted by developers as an AI tool they’ve been regularly using this past year or are looking forward to using next year in Stack Overflow’s recent 2024 AI Search and Developer Tools survey. This underlines Snyk’s dominance as the favorite AI security tool of both developers and security teams and confirms that Snyk Code is providing immense value to developers.
The Impact of AI and Machine Learning on Cloud Data Protection
The momentous rise of AI continues, and more and more customers are demanding concrete results from these early implementations. The time has come for tech companies to prove what AI can do beyond adding conversational chat agents to website sidebars. Fortunately, it’s easy to see how cloud data protection has already benefited from advancements in AI and ML. Headline-grabbing large-language models are also making protecting data in the cloud easier to manage across organizations.
"Better context in a world that's changing quickly": Leading CISOs discuss AI's role in SecOps
Earlier this month, I was thrilled to join forces with the team at Dark Reading for a webinar on the future of AI in security operations. Titled CISO Perspectives: How to make AI an accelerator, not a blocker, the webinar allowed me to take a deep dive into the future role of AI in security with some of the most knowledgeable CISOs on the subject, Mandy Andress of Elastic and Matt Hillary of Drata.
AI in API Security: How Artificial Intelligence Enhances API Protection"
Explore how artificial intelligence is revolutionizing API security by detecting and mitigating threats in real-time. In this video, we discuss the growing importance of AI in safeguarding APIs against malicious attacks and how it helps organizations stay ahead of evolving cyber threats.
How AI Almost Got Me FIRED: Part 3
How many jobs has AI lost me now?...Joking! In this video we show you the AI coding tool Cody, and how to use Gemini Pro 1.5 and Mixtral alongside it. We also show how to spot and fix any vulnerabilities that get generated.
Navigating the AI-powered development era in financial services
Australian and New Zealand financial service institutions (FSIs) are facing pressure to innovate quickly while maintaining robust security and regulatory compliance. Many, like ANZ Bank and Commonwealth Bank, are exploring Generative AI to accelerate software development, but is it a silver bullet?
A developer's best friend: Lessons learned from our canine companions about AI code security
Happy International Dog Day! This official holiday celebrates our furry friends and the joy they bring to our lives! Today is particularly special for all of us at Snyk because of our four-legged mascot, Patch the Doberman. But what exactly does a dog have to do with application security? Here at Snyk, we see the idea of a “guard dog” protecting someone’s home as similar to how AppSec solutions can protect today’s development practices.
Response Accuracy Retention Index (RARI) - Evaluating Impact of Data Masking on LLM Response
As language models (LLMs) in enterprise applications continue to grow, ensuring data privacy while maintaining response accuracy becomes crucial. One of the primary methods for protecting sensitive information is data masking. However, this process can lead to significant information loss, potentially rendering responses from LLMs less accurate. How can this loss be measured?
Deceptive AI: A New Wave of Cyber Threats
As artificial intelligence (AI) technology advances, its influence on social media has become more and more pervasive and riddled with challenges. In particular, the ability for humans to discern genuine content from AI-generated material. Our recent survey conducted with OnePoll on over 2,000 UK workers found that a substantial portion of social media users are struggling to navigate this new digital frontier.
Keeping Financial Services Organizations Secure in an AI World
When we talk about financial services and technology, security and regulatory compliance are always top of mind. And now, Generative AI has entered the chat - one of the most talked-about technologies of recent years. And Financial Services institutions have only begun to scratch the surface of what generative AI can do. The problem is, so have cyber threat actors. In this session from Splunk, and IDC, you’ll hear key insights into how financial services companies are improving their security posture in an AI World, and how those practices can benefit your organizations.
Sysdig's AI Workload Security: The risks of rapid AI adoption
The buzz around artificial intelligence (AI) is showing no sign of slowing down any time soon. The introduction of Large Language Models (LLMs) has brought about unprecedented advancements and utility across various industries. However, with this progress comes a set of well-known but often overlooked security risks for the organizations who are deploying these public, consumer-facing LLM applications.
The Rise of the Machines and the Growing AI Identity Attack Surface
In 1968, a killer supercomputer named HAL 9000 gripped imaginations in the sci-fi thriller “2001: A Space Odyssey.” The dark side of artificial intelligence (AI) was intriguing, entertaining and completely far-fetched. Audiences were hooked, and numerous blockbusters followed, from “The Terminator” in 1984 to “The Matrix” in 1999, each exploring AI’s extreme possibilities and potential consequences.
Bitsight GIA: AI-Powered Asset Mapping and Attribution
Last month, my colleague Arzu Ozbek Akay shared some insights about the impact that Bitsight Groma, our next-generation scanner, is already having on our products. Today, I’m going to follow that up with an update on the momentum we’re seeing with the second core component of our data engine: Bitsight Graph of Internet Assets (GIA). As a quick refresher, GIA uses advanced graph technology and AI models to map assets to specific organizations and build Ratings Trees at a global scale.
Elastic AI Assistant and Attack Discovery integrate with Google Vertex AI to help drive further AI adoption
AI-driven security analytics reduces analyst burnout Most SIEM technologies in today’s market have not kept up with the pace of innovation and place a heavy burden on security analysts to perform manual, labor-intensive tasks in order to maintain defenses. Generative AI is helping security professionals address today’s dynamic threat landscape and prepare for future threats.
Secure, Compliant, Privacy Preserving Analytics/RAG for Data Lakes
Discover how our intelligent data masking solution ensures secure, compliant, and privacy-preserving analytics for your data lakes. Protecto maintains data integrity while empowering your organization to leverage analytics or enable AI/RAG without compromising privacy or regulatory compliance.
Why You Should Stick With Answering Service Instead of AI Answering
Communication is essential in today's fast-paced corporate environment. To keep customers satisfied and loyal, businesses of all sizes need to respond to their queries in a quick and correct manner. Businesses are becoming more and more inclined to replace human operators with automated systems as AI-powered response services become more popular. As found in a Fortune Business Insights study, the global call center AI market size was around $1.60 billion in 2023. It is further estimated to grow from $1.95 billion in 2024 to $10.07 billion by 2032.
The Role of AI and Context in Modern Cybersecurity
Discover how AI and data science techniques are transforming cybersecurity. Oliver Rochford discusses the importance of context in areas like vulnerability prioritisation, alerting, and threat modelling. #AI #Cybersecurity #DataScience.
Why You Should Encourage Your AI/LLMs to Say 'I Don't Know'
In AI and machine learning, providing accurate and timely information is crucial. However, equally important is an AI model’s ability to recognize when it doesn’t have enough information to answer a query and to gracefully decline to respond. This capability is a critical factor in maintaining the reliability and trustworthiness of the entire system.
Fast Forward or Freefall? Navigating the Rise of AI in Cybersecurity
It has been only one year and nine months since OpenAI made ChatGPT available to the public, and it has already had a massive impact on our lives. While AI will undoubtedly reshape our world, the exact nature of this revolution is still unfolding. With little to no experience, security administrators can use ChatGPT to rapidly create Powershell scripts. Tools like Grammarly or Jarvis can turn average writers into confident editors.
DPDP vs. GDPR: Navigating the Complexities of Data Protection Compliance
As data privacy concerns rise globally, regulations like the General Data Protection Regulation (GDPR) in the European Union and the Digital Personal Data Protection (DPDP) Act in India have been established to safeguard personal information. While both frameworks aim to protect individuals’ data, they vary in scope, requirements, and enforcement. In this blog, we’ll explore the similarities and differences between DPDP and GDPR, focusing on key regulatory requirements.
Insights From The SOC
A review of AI-generated malware, and how a SOC might deal with the ever-increasing threat… Theofanis Dimakis, SOC Officer, and Nikolaos Tsompanidis, Threat Detection & Response Expert at Obrela, speaking during the recent CRESTCon Europe event, shared insights from their perspective into detecting malware, including the rising tide of AI variants.
Creating happier and more engaged teams with AI and workflow automation
High stakes, long hours, and a rapidly evolving threat landscape present unique barriers to happiness for security and IT teams. It’s not surprising that 63% of security practitioners report some level of burnout, and 58% of IT professionals feel overwhelmed by the amount of tasks they have to do in a day. Organizations simply can’t afford to ignore these statistics.
Black Hat 2024: AI, AI, and Everything Else
I’m back from another Black Hat! It was great seeing everyone. I put out a message on LinkedIn for people to come find me and, boy, did they. The hallway conversations were so engaging, I was sometimes late getting to the official talks, but I’m getting ahead of myself. AI was everywhere, as we’d expect, but I also sat down to listen to experts on other topics like critical infrastructure, cyber insurance, and the root causes of cybersecurity failure.
Meta's Llama Technology Boosts FoondaMate | Jockey's Innovative Video Processing with LangGraph | Introducing llama-agents - Protecto - Monthly AI News
FoondaMate, a rapidly growing AI-powered study aid known as “study buddy” in Zulu, has become an indispensable resource for middle and high school students in emerging markets. Leveraging the advanced capabilities of Meta’s Llama technology, this virtual assistant provides conversational support via WhatsApp and Messenger, helping students with schoolwork and academic challenges.
A New World in Generative AI with Purple Llama - This Week in AI
Meta has announced the launch of Purple Llama, an umbrella project promoting open trust and safety in generative AI. The project features tools and evaluations designed to enable developers to deploy generative AI models and experiences responsibly in line with best practices outlined in Meta’s Responsible Use Guide.
SearchGPT, Llama 3.1 & GPT-4o Mini - Monthly AI News By Protecto
OpenAI has launched a prototype called SearchGPT, a new AI-driven search tool that integrates advanced AI capabilities with real-time web information. This temporary prototype, currently available to a select group of users and publishers, aims to enhance how people find information online by providing fast, accurate answers with precise citations. The ultimate goal is to gather feedback and refine these features before integrating them into the broader ChatGPT platform.
Securing the Future: Realistic Expectations for AI in Cybersecurity | Razorthorn Security
Discussing the challenges of integrating AI into cybersecurity, Oliver Rochford emphasises the importance of realistic timelines and expectations for AI advancements and their security implications.
The EU AI Act: Ensuring Cybersecurity and Trustworthiness in High-Risk AI Systems
Artificial Intelligence (AI) has come a long way since John McCarthy first coined the term in 1955. Today, as AI technologies become deeply embedded in our daily lives, the potential they hold is immense – but so are the risks to safety, privacy, and fundamental human rights. Recognizing these concerns, the European Union (EU) took a proactive step in 2021 by proposing a regulatory framework aimed at governing AI.
Keeping humans in the loop of AI-enhanced workflow automation: 4 best practices
In today's rapidly advancing technology landscape, the role of people in workflow automation and orchestration is more critical than ever. At Tines, we firmly believe that human oversight should be an integral part of important workflows, ensuring that all decisions are grounded in context and experience. AI in Tines is secure and private by design. This means the platform doesn’t train, log, inspect, or store any data that goes into or comes out of language models.
Building for the Future DevSecOps in the era of AI ML Model Development
Melissa McKay, JFrog Developer Advocate, and Sunil Bemarkar, AWS Sr. Partner Solutions Architect, discuss practical ways to mature your MLOps approach including bringing model use and development into your existing secure software supply chain and development processes. Watch to learn more and get a demo of the JFrog and Amazon SageMaker integration.
Top 7 Practices to Prevent Data Leakage through ChatGPT
Generative AI (GenAI) tools like ChatGPT have already become indispensable across organizations worldwide. CEOs are particularly enthusiastic about GenAI’s ability to let employees “do more with less”. According to the McKinsey Global Survey on the State of AI in 2024, 65% of organizations already use GenAI tools extensively, and Gartner forecasts that this number will reach 80% by 2026.
Zero to 80% Faster - How to Leverage AI to Accelerate Security Reviews
Stop wasting your team's time answering security questionnaires. It's time to supercharge the way you complete security reviews by leveraging AI to unlock unprecedented speed and accuracy. We'll explore proven strategies for fast tracking the way your team completes security questionnaires using advanced AI tools and automation. You'll learn best practices like maintaining a centralized knowledge base and leveraging a public-facing trust portal to get ahead of questions.
How we created the first conversational AI cloud security analyst
In the rapidly evolving landscape of cybersecurity, the need for a robust and intelligent assistant capable of analyzing, summarizing, and reacting to events is paramount. This is why we designed Sysdig SageTM, our large language model (LLM)-based cloud security analyst, to be an expert in cloud detection and response (CDR). Sysdig Sage excels at summarizing complex events and providing clear explanations, which is crucial for identifying and promptly reacting to potential threats.
AI and Security: Addressing the Core Issues in GenAI | Razorthorn Security
Oliver Rocheford shares his insights on the current state of GenAI in cybersecurity. Despite 18 months of development, core issues remain unresolved. Understand why a cautious approach is essential.
CISOs are concerned about new AI pressures - what can they do about it?
The pressure on security teams has never been greater. With an ever-evolving threat landscape, resource constraints, and now the rapid adoption of artificial intelligence (AI) technologies, Chief Information Security Officers (CISOs) are facing unprecedented challenges. This was one of the clear takeaways from our recent report CISO perspectives: separating the reality of AI from the hype, in which 53 CISOs shared their opinions and experiences of AI’s impact on their security operations.
Supercharge domain discovery with AI-powered External Attack Surface Management (EASM)
Modern organizations have sprawling attacks surfaces of known and unknown assets that grow each day. This means understanding and managing your external attack surface is more crucial than ever. But with the vast number of digital assets that organizations need to monitor, accurately identifying every component of your attack surface can seem overwhelming – which is why many turn to External Attack Surface Management (EASM).
How to Securely Use AI in Your Business
Since ChatGPT's launch in November 2022, generative AI-based services have flooded nearly every single sector. While these tools have the potential to greatly increase work productivity, they also introduce risk that organizations may not be aware of. Some companies have taken the hardline approach of banning employee access to AI tools, but following that path runs the risk of leaving you lagging behind your competition.
How AI Almost Got Me FIRED: Part 1
This AI code got me fired!!...Not really! But in this video we show you how AI coding tools like Codeium can greatly help accelerate coding , but how they also come with some downfalls and how you can spot them.
Key Cybersecurity Trends in 2024
Overview of the main cybersecurity trends in 2024: the latest cyber threats, advanced data protection technologies, practical recommendations from experts.
Using GitHub Copilot Chat to Write Secure Code
Watch the full video for more...
The IT Hour | JumpCloud AI 08.09.24
It's time for an update on JumpCloud AI—Lindsey Thompson and Hugh Neale return to tell us what they've been working on and what's new in AI. Join us at 11:30 am ET The #IT Hour hosted by #JumpCloud is a #communityprogram focused on the life of #ITAdministrators. With the ever changing #ITlandscape, having community and professional networking opportunities is very valuable.
The Role of LLMs in Cybersecurity: Ontological Classification Insights | Razorthorn Security
Discover how Large Language Models (LLMs) classify cybersecurity technologies. Oliver Rocheford explains the importance of understanding how LLMs perceive and categorize your company's offerings.
A security expert's view on Gartner's generative AI insights - Part 2
Welcome to the second part of our two-part special on Gartner’s “4 Ways Generative AI Will Impact CISOs and Their Teams” report! If you’ve missed the first part on model composition, you can read it here. Today, we will explore why security specialism matters in an AI security tool, particularly where AI quality is concerned.
NEW in Elastic Security 8.15: Automatic Import, Gemini models, and AI Assistant APIs
Elastic Security 8.15 is now available, enhancing our mission to modernize security operations with AI-driven security analytics. Key features include the brand new Automatic Import to streamline data ingestion and onboarding, support for Google’s Gemini 1.5 Pro and Flash large language models (LLMs), a new set of APIs for the Elastic AI Assistant, on-demand file scans for the Elastic Defend integration, and a redesigned way of pivoting between different contexts.
AI in the enterprise: 3 ways to mitigate AI's security and privacy risks
Artificial Intelligence (AI) has the potential to revolutionize how businesses operate. But with this exciting advancement come new challenges that cannot be ignored. For proactive security and IT leaders, prioritizing security and privacy in AI can’t simply be a box-checking exercise; it's the key to unlocking the full potential of this wave of innovation.
Beyond the Noise: Achieving Accurate API Inventory with AI
The prevalence of APIs in today's digital environment is undeniable. They are crucial for modern applications, enabling seamless communication and data exchange between different software components. The rise of AI and machine learning has further accelerated API adoption, not only for accessing data and resources but also for rapid API development and deployment.
A security expert's view on Gartner's generative AI insights
Snyk’s goal has always been to empower developers to build fast but safely. This is why we created the developer security category and why we were amongst the first advocates of “shifting left.” Now, AI has changed the equation. According to Gartner, over 80% of enterprises will have used generative AI APIs or models, or deployed their own AI model, by 2026.
Introducing our report, CISO Perspectives: Separating the realityof AI fromthe hype
The explosion of AI has ignited both excitement and apprehension across various industries. While AI is undeniably having a positive impact on engineering and customer service teams, cybersecurity and IT practitioners remain cautious. Concerns about data privacy, the inflexibility of disparate tools, and the sensitive nature of many mission-critical workflows—which, more often than not, require some level of human oversight—fuel a deep mistrust of LLMs by these teams.
AI Tools Have Increased the Sophistication of Social Engineering Attacks
The Cyber Security Agency of Singapore (CSA) has warned that threat actors are increasingly using AI to enhance phishing and other social engineering attacks, Channel News Asia reports. The CSA’s report found that cybercriminals are selling tools that automate these attacks, allowing unskilled threat actors to launch sophisticated attacks.
LLM Security: Splunk & OWASP Top 10 for LLM-based Applications
As a small kid, I remember watching flying monkeys, talking lions, and houses landing on evil witches in the film The Wizard of Oz and thinking how amazing it was. Once the curtain pulled back, exposing the wizard as a smart but ordinary person, I felt slightly let down. The recent explosion of AI, and more specifically, large language models (LLMs), feels similar. On the surface, they look like magic, but behind the curtain, LLMs are just complex systems created by humans.
Sentinels of Ex Machina: Defending AI Architectures
The introduction, adoption, and quick evolution of generative AI has raised multiple questions about implementing effective security architecture and the specific requirements for protecting all aspects of an AI environment as more and more organizations begin using this technology. Recent security reports on vulnerabilities that expose Large Language Model (LLM) components and jailbreaks for bypassing prompting restrictions have further shown the need for AI defenses.
Top 10 EdTech Blogs and Trends to Follow in 2024
The world of education technology (EdTech) is constantly evolving, with new tools, platforms, and approaches emerging every year. As an educator or EdTech enthusiast, staying up-to-date with the latest trends and insights is crucial for making informed decisions and providing the best learning experiences for students. From Virtual Team Development Games to immersive simulations, gamification can engage students and make learning more fun and interactive. In this article, I've curated a list of the top 10 EdTech blogs and trends to follow in 2024.
AI Treason: The Enemy Within
tl;dr: Large language models (LLMs) are highly susceptible to manipulation, and, as such, they must be treated as potential attackers in the system. LLMs have become extremely popular and serve many functions in our daily lives. Every reputable software company integrates artificial intelligence (AI) into its products, and stock market discussions frequently highlight the importance of GPUs. Even conversations with your mother might include concerns about AI risks.
AI in cybersecurity 101: Bridging the skills gap
“Four million workers wanted. Immediate start. Must have knowledge, experience and an ability to be in several places at once.” If the cybersecurity industry posted a job ad, it would sound something like this. That is the current reported size of the talent shortage, with “little optimism that the supply will catch up.”
8 Stages of the AI "Emotional Rollercoaster"
Feelings are running hot right now when it comes to generative AI (GenAI). Within the business community, many employees (and execs) are nervous with excitement and anticipation. Others are more fearful and skeptical of how this “thing” will play out, which leads us to an important question: Are enterprises too emotional when it comes to adopting nascent technologies?
MLOps & the Role of GenAI in Securing the Software Supply Chain
Artificial Intelligence and Machine Learning have hit the mainstream – particularly the use of Gen AI and LLMs to help organizations automate manual processes and analyze data at machine speed with dramatic results. How can ML and Gen AI help DevOps teams better secure the software supply chain? As the volume of code grows exponentially, these evolving technologies offer new, more efficient means to secure, deliver and scale software – but with accompanying risks that must be mitigated.
Friday Flows Episode 30: Normalize Alerts with Tines AI and create Cases AI
FRIDAY FLOWS Episode #30 - Normalizing Alerts using Tines AI & Creating Cases In today's episode, Michael Tolan takes us through a workflows where we're leveraging the new Tines AI Action to normalize multiple alerts and create cases in our native Case management. As always, our free Community edition is in the comments and we'd love to hear what you thought of today's episode in the comments.
More Ways GitHub Copilot Makes You Vulnerable
Do these suggestions still give us vulnerable code? Or do they make our code less vulnerable? Today we are putting this to the test.
Strengthen Your Cyber Defense with Microsoft Copilot for Security
Discover how to unleash the full capabilities of your Microsoft Security tools and optimize your Copilot experience with BlueVoyant.
Infosec Europe session: 4 tips for safer AI adoption
AI adoption continues to move at a breakneck speed for businesses across the globe, as shown in a Coatue report comparing AI adoption to early internet adoption and found that AI growth is happening at two times the speed of the former.
AI Governance Belongs In Your Organization
In the modern workplace, GenAI models have become powerful assets due to their ability to introduce efficiency, up level product innovation, and expedite how teams close the gap on competitors. However, these powerful tools also introduce significant risks related to data security and governance. Companies that aren’t actively figuring out how to govern the GenAI they’ve adopted will inevitably be left vulnerable.
