Cyberthreats are evolving, and unpatched vulnerabilities remain one of the biggest security risks for organizations. According to IBM’s 2024 Cost of a Data Breach Report, organizations that fail to patch known vulnerabilities face an average loss of $4.45 million per incident. Cybercriminals actively exploit outdated firmware and misconfigurations in network devices, making network vulnerability scanners an essential security tool.

Jenkins is an open-source automation server that is widely used for continuous integration (CI) and continuous delivery (CD) in software development. It is an automated engine that builds, tests, and deploys the application so that development teams can routinely integrate code changes in a way that ensures the software is deployable. Created as the Hudson project in 2004, Jenkins has grown to become an infinitely extensible and customizable tool hosting an enormous ecosystem of plugins.

At a recent Sydney luncheon, Trustwave sat down with a room of senior security leaders to dig into the evolving role of red and purple team testing in a modern technical security assurance program. The discussion was led by Trustwave's Craig Searle, Director of Consulting & Professional Services in Pacific at Trustwave and TJ Acton, Director of SpiderLabs Testing, Pacific. More than 20 Sydney-area security professionals attended the event at Restaurant Huberts.

Private repos leak plaintext secrets 8x more often than public ones. Learn why internal codebases are the biggest blind spot in your secrets management strategy.

Shifting left in security, or integrating security early in the software development lifecycle (SDLC), can help your organization save time and money. By identifying and addressing potential security flaws early, organizations can reduce the likelihood of vulnerabilities being exploited in production applications. This proactive approach is more cost-effective and time-efficient, as it prevents the accumulation of technical debt and minimizes the need for extensive rework or redesign.

On March 19th, 2025, we discovered a package called os-info-checker-es6 and were taken aback. We could tell it was not doing what it said on the tin. But what's the deal? We decided to investigate the matter and initially hit some dead ends. But patience pays off, and we eventually got most of the answers we sought. We also learned about Unicode PUAs (No, not pick-up artists). It was a roller coaster ride of emotions!

Year after year, we continue to see increases in phishing and business email compromises (BEC), and the costs associated with these incidents are growing, too. The LevelBlue Security Operations Center (SOC) found that BEC attacks made up 70% of the total incidents investigated during the second half of 2024. Of these incidents, 96% of them involved one or more phished users.