Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CMMC enforcement is here. With DFARS clauses 7021 and 7025 now active across the defense industrial base (DIB), contractors face enforceable obligations that extend beyond prime contractors to every tier of the supply chain. While primes have received significant attention, subcontractors encounter distinct challenges in managing CMMC risk from pre-award decisions through contract execution and ongoing compliance maintenance.

Most security teams are being asked to "enable AI" before they have any real sense of which tools are safe to use. That gap is costing them. Cyberhaven's research found that the majority of AI tools in active enterprise use today fall into high or critical risk categories, and more than 80% of enterprise data flowing into AI is going to those risky tools, not to platforms built with serious security in mind. To help security teams cut through the noise, we built the Cyberhaven AI App Risk Checker.

The automotive industry is changing faster than ever, with smarter factories, connected vehicles, digital supply chains, and software-driven everything. But as the industry accelerates into this new era, something else is racing alongside it: cyber threats. Over the past year, Bitsight Threat Intelligence data has shown a sharp rise in ransomware activity targeting companies across the auto ecosystem. And what’s striking is how often the same names keep appearing.

Today, we’re launching System Prompt Hardening, Mend.io’s new capability that defends the hidden instructions that control how your AI systems behave. Unlike user-facing prompts, system prompts live behind the scenes, and when attackers manipulate them, the result can be data leaks, policy bypasses, or unsafe model behavior. System prompt hardening stops those attacks at the source and gives security, engineering, and risk teams a practical, auditable way to secure AI in production.

Law firm economics are unforgiving. According to the Clio Legal Trends Report, the average attorney bills only 2.5 hours per 8-hour workday. When IT systems fail, that already-thin margin disappears entirely. Consider a 20-attorney firm with average billing rates of $350 per hour.

OAuth and OpenID Connect are the backbone of modern cloud-native identity and access management. From SaaS platforms and internal APIs to Kubernetes microservices, these protocols are responsible for verifying who is allowed to access what. When a vulnerability appears in a widely used authentication library, the impact can cascade across entire application ecosystems.

Most security teams cannot confidently answer a simple question: who has access to which cloud resources right now? Human identities and accounts now span across thousands of services, subscriptions, and SaaS platforms. The result is a vast, decentralized environment riddled with “unknown unknowns” that security teams cannot fully map, and that traditional security controls weren’t designed to address. Attackers count on these identity blind spots.

If your identity governance program feels like a relic from a simpler time, you’re not alone. Traditional identity governance and automation (IGA) was built for a world where job titles told the whole story. A software engineer was a software engineer; a sales rep was a sales rep. Assigning access was intended to be as simple as slotting people into predefined roles.

CCPA used to audit your policies and paperwork. Then came the Sephora settlement, and things moved to logs, runtime, and network reports. The company’s privacy policy said it didn’t sell consumer data. California’s AG ran the site, watched the cookies and pixels fire, and found that in reality, they did. Healthline followed in 2025. Then Disney in 2026. Different companies, common findings. Data gets collected and shared with third parties via tags. GPC gets ignored.

In 2024, Recorded Future’s Fraud Intelligence Report found over 11,000 e-commerce domains actively running payment page skimmers, a nearly 300% increase from the year before. The majority of those merchants had no client-side monitoring in place.Most of them were processing payments through legitimate, PCI-certified processors. Some of them were almost certainly SAQ-A-EP merchants who believed their processor’s compliance covered their risk. It doesn’t.