Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Cyber Awareness/Data Privacy Week 2025 has once again come and gone, and provides a stark reminder to take a closer look at your organization’s approach to cybersecurity. This annual event is not only a call to action for IT professionals but also a critical learning opportunity for everyday office workers. With cyber threats evolving daily, safeguarding your organization’s data is everyone’s collective responsibility.

The rapid rise of generative AI (genAI) applications is reshaping enterprise technology strategies, pushing security leaders to reevaluate risk, compliance, and data governance policies. The latest surge in DeepSeek usage is a wake-up call for CISOs, illustrating how quickly new genAI tools can infiltrate the enterprise. In only 48 hours, Netskope Threat Labs observed a staggering 1,052% increase in DeepSeek usage across our customer base.

Unfortunately, storing, saving, and backing up our files is not a 100% guarantee that our files will remain secure forever. We may accidentally delete our accounts, forget passwords to old backups, or worse, experience data loss due to corruption, hardware failure, or cyberattacks. It’s not just our personal files that we must keep in mind.

Berachain is a novel blockchain created to solve consensus mechanism incentive misalignment. For traditional Proof of Stake (PoS) blockchains, users have to lock their assets in order to participate in the security model and earn staking rewards. This results in incentive misalignment as the projects building on these blockchains want activity and volumes – this competes with the native security mechanism of staking which requires assets to be locked up.

Early in the cyberattack kill chain, reconnaissance enables attackers to assemble critical network information to plan a tailored attack strategy. In this phase, adversaries aim to map out networks and their users, and locate system vulnerabilities, without setting off alarms. Proactive monitoring and early detection of this activity can disrupt attackers in their tracks and lower the risk of a breach.

Since 2018, Astra has been at the forefront of proactive cybersecurity. Trusted by over 800 global organizations in 70+ countries, we’ve conducted over 3,000 pentests and reported 2 million+ vulnerabilities. Combining automation with nearly half a century of collective human expertise makes Astra security more intuitive, accessible, and effective. Last year, our AI-powered pentest platform uncovered nearly 5,500 vulnerabilities per day.

Recently, I started working with my children's school to enhance their online safety measures and develop a digital mindfulness course in collaboration with their digital literacy lead. This experience highlighted the fact that our schools are not only expected to provide safe places of learning but also extend that safety into the digital spaces.

Nearly half (46%) of businesses observed an increase in deepfakes and generative AI-related fraud last year, a new report from AuthenticID has found. Additionally, phishing attempts increased by 76% in 2024, and more than 90% of cyberthreats were driven by social engineering. The report also noted a rise in workplace-related fraud, including employee impersonation and account takeover.

In today’s flexible and fast-paced digital environment, email still remains the backbone of communication for many organizations. Employee email accounts are chock-full of sensitive information from intellectual property to customer data, which makes securing email servers crucial. Data leakage and unauthorized access not only disrupt operations and cost time and money to fix, but they can also damage an organization’s reputation.

This article provides details on how Bitsight TRACE addressed CVE-2024-23897, an arbitrary file read vulnerability that affects Jenkins, a well-known open-source automation server. It includes technical details, common pitfalls, and decisions made since the CVE disclosure until now. The investigation of CVE-2024-23897 is an example of how we can obtain the target instance version but not solely rely on it to classify an instance as vulnerable. First, we go deep to understand the vulnerability.