Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Navigating the Post-Mythos Landscape with Bitsight

The rise of AI-driven vulnerability discovery using Anthropic's Claude Mythos, as well as similar tools from Google and OpenAI, is completely changing the calculus of cyber risk. The number of vulnerabilities is exploding. The time it takes for exploits to appear is shrinking. The patching cadences and scan intervals, assessments and risk registers that many organizations still rely on are rapidly becoming ineffective.

Why we can't have nice things! ...Or can we?

On 7th April 2026, Anthropic published a system card for an AI model we may never be allowed to use: Claude Mythos. This preview demonstrated a significant leap in capability over Anthropic’s previous Claude Model (Opus 4.6), and their Responsible Scaling Policy (RSP) v3.1 led to them making the decision to withhold it from general availability, serving as a "defensive only" asset.

Analyzing the RondoDox Botnet: A DDoS and Mining Threat

A few weeks ago we published the first part of this series where we described the infrastructure used by the RondoDox threat actors to scan and exploit vulnerable systems. In this second post we’ll take a deep dive into the malware that is deployed into vulnerable systems. Specifically, we’ll look at the initial implant used to fetch the RondoDox binary and the binary itself, detailing its behaviour, how it communicates with the Command and Control (C2), and its malicious capabilities.

The Transformation of Third-Party Risk Management from SecurityScorecard

Ready for the future of Third-Party Risk Management (TPRM)? The supply chain is a growing target, but you can fight back. That world is here with the transformative, threat-informed SecurityScorecard TITAN AI Platform. Imagine a world where you go beyond checking compliance boxes by actively mitigating and eliminating risk with continuous, AI-accelerated, and predictive TPRM that allows you to gain visibility and prioritize threats more effectively. Learn more about the TITAN transformation.

5 Themes From a Candid Discussion

The Eskenzi IT Security Analyst & CISO Forum wasn’t a typical security event. This forum was a gathering of CISOs, analysts, and security leaders speaking candidly under Chatham House Rule about what’s actually breaking, what’s working, and where things are heading. Here are 5 key themes that came through loud and clear. None of them were surprising. But together, they paint a pretty stark picture of where security and AI are right now.

How to Build a Security Compliance Audit Process that Works All Year Round

Security compliance audits can feel intimidating, especially if your team has never been through one before. For many organizations, an audit feels like a high-pressure project with a hard deadline, a long list of evidence requests, and a lot of manual work spread across security, IT, legal, and compliance teams. For vendors and companies in highly regulated industries, audits and risk assessments may already be a routine part of doing business.

What Cybersecurity Risks Does CNC Automation Introduce in 2026?

Manufacturing floors are no longer air-gapped environments. As CNC machines connect to networks for automated loading, real-time monitoring, and remote diagnostics, they become potential entry points for cyber attackers targeting industrial operations. Companies like Gimbel Automation are advancing in-machine CNC automation that reduces manual labor and increases throughput. But every connected system, from spindle grippers to pneumatic workholding, needs cybersecurity planning alongside its mechanical engineering.

Exposure as a Competency: How Agentic Exposure Management Can Differentiate High-Performing Teams

In today's fast-paced work environment, the factors that distinguish high-performing teams go well beyond technical skills and traditional leadership. Increasingly, organizations are recognizing "exposure" as a critical competency, one that shapes how teams interact with uncertainty, opportunity, and risk. While exposure has historically been viewed through a financial or risk management lens, it is now emerging as a core driver of organizational agility, innovation, and resilience.

What is Shadow IT?

Shadow IT refers to any technology—including hardware, software, cloud services, SaaS applications, or AI tools—used within an organization without the explicit approval of the IT or security department. Shadow IT is rarely malicious. It is usually the result of employees searching for a means of making their workflows more efficient. When sanctioned corporate tools are perceived as too slow, rigid, or complex, users often "self-serve" by adopting unvetted alternatives to meet their deadlines.