Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

At Vanta, our mission is to secure the internet and protect consumer data. The proliferation of AI has made this both more challenging—and more important—than ever before. In our ongoing mission to ensure we safely use AI and demonstrate trustworthy AI practices, we’re excited to announce that Vanta is the first trust management platform to achieve ISO 42001 certification from an ANAB-accredited 42001 assessor. ‍

This blog explores exploitable vulnerabilities meaning by demystifying the concept and explaining what the phrase actually entails – both as a category and in the context of specific threats. Understanding which vulnerabilities can be actively exploited – and learning how to address them – is essential for any organization striving to stay secure.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! Curious no claims on the attack, could that suggest an insider?

A tremendous surge has been seen in the number of systems infected with different types of malicious software over the past few years. Among the various types viruses, worms, and Trojan horses are some of the most well-known. These are often used interchangeably, but the fact is each of these has distinct characteristics and behaviors. Here in this blog, we are going to explain the difference between viruses, Trojan Horses, and worms for effective cybersecurity measures. Let’s begin!

As 9 out of 10 valuable web apps are missing testing, we’re launching new capabilities to help teams know what else, beyond core applications, is likely to require in-depth testing. The new features automatically classify discovered web assets based on attacker reconnaissance techniques and deliver recommendations on where to run DAST, bridging the gap between broad and deep testing across the entire attack surface.

Cloud-Native Application Protection Platforms (CNAPPs) combine tools that scan your code, check your open-source libraries, protect your cloud workloads, and monitor your cloud configurations. But CNAPPs aren’t a silver bullet. They lack external active testing and blackbox cloud asset discovery, two capabilities that can leave exploitable vulnerabilities undetected. CNAPPs depend on APIs and deployment hooks to see what’s running.

Recently, I received an email at work from a company with whom I've had previous interactions. The email lacked context and contained an attachment, immediately raising suspicion. I reported it to our infosec team using the Phish Alert Button (PAB). A short while later, our team confirmed it was indeed a malicious email. Subsequently, the sender organization informed us that they had been compromised, and phishing emails had been distributed from their account.

A new report from Valimail has found that 50% of organizations lack effective protection against email spoofing. Specifically, many organizations have lenient DMARC policies that don’t actually prevent spoofing. DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that helps prevent attackers from spoofing organizations that have the protocol in place.

On April 24, 2025, watchTowr published technical details and a proof-of-concept (PoC) exploit for a critical vulnerability in Commvault Command Center, CVE-2025-34028, which had been disclosed earlier in April. Commvault Command Center is a web-based interface used to manage data protection, backup, and recovery operations across enterprise environments.

The California Consumer Privacy Act (CCPA) is the first comprehensive California data privacy law granting consumers control over how their personal information is collected, used, and shared. It was enacted in 2018 and took effect on January 1, 2020, signaling a national shift in privacy regulations. With increasing emphasis on transparency and accountability, businesses must now adhere to a new standard in consumer data protection California.