Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Threat researchers recently disclosed a severe vulnerability in a Figma Model Context Protocol (MCP) server, as reported by The Hacker News. While the specific patch is important, the discovery itself serves as a critical wake-up call for every organization rushing to adopt AI. This incident provides a blueprint for a new class of attacks that target the very infrastructure powering the AI Agent Economy. To understand the risk, we must first look at the mechanics of this emerging threat.

Organizations today face a continuous struggle to secure their web applications against threats that constantly evolve in the fast-paced digital landscape. The Web Application Firewall (WAF) serves as a primary line of defense against these threats; however, its management challenges often outweigh its security benefits, resulting in organizations not realizing the full value of their security investment.

If popular TV and movies are to be believed, hackers break into organizations from dark rooms using flashy zero-day exploits (complete with some sort of showy animation), all while techno music blares in the background, culminating in the oh-so-cool announce of “I’m in!” This… is not reality. The unglamorous truth is that breaches usually stem from a series of small mistakes in unremarkable things: A system that was overlooked when implementing a new policy.

In this blog, we will explore Terraform secrets management best practices, ephemeral resources, and some examples of securely orchestrating AWS infrastructure with AWS Secrets Manager.

As artificial intelligence becomes deeply integrated into business operations, organizations have started feeling the pressure to keep up. According to Vanta’s 2025 survey, more than 50% of the organizations report being overwhelmed by the speed of AI adoption and growing compliance obligations. ‍ This issue is aggravated by the fact that AI tools evolve faster than governance policies can adapt, potentially leaving complex gaps for security teams to fill.

The obituary for SIEM has been written more than once. The latest headline from Dark Reading calls it “dying a slow death.” Catchy. But wrong. If you work in a SOC, you already know the need for centralized, contextualized visibility is not going anywhere. What is changing the future of SIEM, is how SIEM delivers it. If you are still thinking of SIEM as a clunky, high-cost log hoarder, you are stuck in the wrong decade.

At Bitsight, one of the responsibilities of the Vulnerability Research team is to develop fingerprinting methods to not only identify exposed services, but also vulnerabilities in those services. When it comes to detecting vulnerabilities, there are increased challenges depending on the complexity of both the vulnerability and the vulnerable service.

Cloudforce One’s mission is to help defend the Internet. In Q2’25 alone, Cloudflare stopped an average of 190 billion cyber threats every single day. But real-world customer experiences showed us that stopping attacks at the edge isn’t always enough. We saw ransomware disrupt financial operations, data breaches cripple real estate firms, and misconfigurations cause major data losses. In each case, the real damage occurred inside networks.

Across the financial sector, compliance teams face rising expectations from regulators and customers alike. Agencies such as the SEC, OCC, FDIC, CFPB, and the European Banking Authority now demand proof of continuous compliance—not point-in-time reports. Yet most financial institutions still depend on spreadsheets, manual command-line checks, and tribal knowledge to validate security controls.

Fighting voice-based phishing needs to be a big part of your human risk management (HRM) plan. KnowBe4 and the HRM industry have been warning about voice-based social engineering and phishing for decades. Some of the biggest and most notable hacks have long been based on it. Stories have often been told of brazen calls that resulted in big hacks.