Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In today’s environment—marked by accelerating threats like ransomware, increasingly complex supply chains, and the growing footprint of AI and IoT—managing cyber risk has never been more urgent or more difficult. Our latest research with Sapio Research, The State of Cyber Risk and Exposure 2025, draws on the insights of 1,000 cybersecurity and cyber risk leaders around the world to understand what they are focused on today and what will be keeping them up tomorrow.

BlueVoyant Threat Fusion Cell (TFC) researchers recently investigated a ClickFix attack with unique aspects. The attack began when a user for a UK-based organization navigated to a restaurant’s website for reservations, which they reportedly had used extensively in the past to conduct business meetings and corroborated in the logs.

If your security priorities still center on CVSS scores and device vulnerabilities, you’re missing a significant piece of the risk puzzle. People. Attackers aren’t following your org chart. They’re targeting whoever gives them access. Enter the concept of Very Attacked People (VAPs): individuals in your environment who attract the most persistent, targeted attacks. And they’re not always the CEO or the CISO.

Imagine an online retailer running a promotion: “Spend $100 this month, get a $25 gift card.” It sounds simple encourage loyal shoppers to spend more. But due to a flaw in the app’s logic, a clever user discovers a loophole. They place enough orders to reach the $100 threshold and receive the gift card. Then, they cancel a small order to drop below the threshold only to make a new one that pushes their total back over $100.

As companies invest in cybersecurity to avoid fines and ransomware payouts, criminals are doing the opposite by turning ransomware into a full-blown business. With ransomware as a service (RaaS), cybercriminals are building revenue streams by selling ransomware kits online. This model doesn’t require technical skills or deep knowledge of hacking.

As a security executive, how do you know if your organization can detect a certain attack? A talented, experienced team armed with advanced tooling can certainly generate confidence — but even then, detections can slip through the cracks if not properly codified.

Written in collaboration with: Nikos Makriyannis, and Dorit Dor.

In Part 1, we explored what quantum computing really means for crypto security—and why preparation can’t wait. Now let’s take a closer look at how blockchains like Bitcoin and Ethereum are exposed, and how they’re beginning to adapt.

What does “secure by default” really mean—and is it enough? In this episode of CyberArk’s Security Matters, host David Puner sits down with Scott Barronton, Chief Information Security Officer (CISO) at Diebold Nixdorf, to explore the often-overlooked risks of cloud default settings and how assumptions can lead to vulnerabilities.

It's no longer enough for CIOs to check boxes and tick off compliance milestones. The world has changed — and with it, the data privacy landscape. From the GDPR in Europe to California's CCPA, and now Brazil's LGPD and India's DPDP, the patchwork of privacy laws continues to expand. What was once a series of siloed regional regulations has become a living, breathing global challenge. For CIOs leading enterprises that span borders, staying compliant isn't just about avoiding penalties.