Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Access control has become significantly more complex as enterprises adopt cloud platforms, AI applications, and distributed workforces. A user’s identity alone is no longer enough to determine whether they should access sensitive data. Factors such as device posture, data sensitivity, location, and business context all influence the right decision. This shift is driving widespread adoption of attribute-based access control, a model that evaluates multiple attributes before granting access.

AI DLP (artificial intelligence data loss prevention) is a category of data protection that inspects the prompts and file uploads an employee sends to a generative AI tool, before that content reaches the model, which is what separates it from file-based or network-based DLP.

FedRAMP has long been one of the more complex certifications you can achieve, but the rewards are well worth the effort. Validating your company's information security is a huge benefit, and on top of that, working with the government on sensitive contracts is a lucrative business venture. We do our best to explain various aspects of FedRAMP in plain English, to make it easier to figure out what your goals should be and where you should place your efforts.

Every AI approval a security team makes feels reasonable in isolation. A security architect signs off on a generative AI writing tool for marketing. An engineering lead spins up an agent to triage support tickets. A finance team connects a copilot to its planning software. Individually, none of these decisions looks risky.

Top tips is a weekly column where we highlight what's trending in the tech world and share practical ways to navigate these shifts. This week, we're looking at spear-phishing: how cybercriminals weaponize social engineering, why your natural instinct can act as a security blind spot, and practical steps to verify suspicious requests before you take action. I would like to make a confession: I’m a well-versed tech expert, but I almost fell for a phishing scam.

Most organizations experience a strange DNS problem at some point: The same domain name means something different depending on who's asking for it. For example, a single internal app, workspace.company.com, might need to serve a locked-down instance to finance, a live staging build to engineering, and a stable production build to support — all under one domain and from the same DNS server.

GHE.com introduces migration, identity, and integration changes.– Some GitHub data may still be processed outside the chosen region.– ta residency still needs a separate backup and recovery strategy. For many enterprises, GitHub is now one of the most important parts of the DevOps ecosystem, where teams manage repositories, pull requests, issues, workflows, GitHub Actions, security alerts, project data, and other metadata that keeps software delivery moving.

KEEP helps organisations large and small to achieve both Cyber Essentials (CE) and Cyber Essentials Plus (CE+), alongside some of the more stringent standards such as SOC2, though for this insight we will focus on how to ‘pass’ CE+. As you may be aware IASME introduced the Danzell v3.3 standard in mid 2026, which included a number of critical changes that aimed to set the bar ‘higher’ for an organisation who applied for a CE+ assessment.

On August 20, we detected two popular Rust crates from the same maintainer, append-only-vec (4M downloads) and arrayref (244M downloads), were compromised. The attacker added a malicious dependency on a package called proc-macro1, which downloads a remote payload during the build and executes it on the developer's machine.