SecurityScorecard Weekly Brief: The Cyber Risk and Policy Edition - Amanda Smith

In this week’s Weekly Brief: The Cyber Risk and Policy Edition, SecurityScorecard’s Director, Public Sector Channel Amanda Smith breaks down why the U.S. war with Iran is more than just what takes place on the physical battlefront. In 2026, as conflict unfolds in the Middle East, the digital battlefield has a direct impact on the homeland and U.S. critical infrastructure, too. “It's a global digital confrontation that hits a lot closer to home than a lot of people realize.”

Escalate unacknowledged login alerts with PagerDuty and Jira

What happens when a suspicious login fires and the user doesn't respond? This Tines flow handles it automatically, escalating to PagerDuty in minutes. Escalate alerts which users have not responded to shows you how to build a smart, automated response workflow that checks in with your user first — and only escalates if they don't reply in time. No more manual follow-ups, no missed alerts slipping through the cracks.

ASP.NET Core Privilege Escalation Vulnerability (CVE-2026-40372)

Microsoft has released an emergency out of band update for.NET to address a critical security vulnerability affecting ASP.NET Core applications. The issue, tracked as CVE-2026-40372, relates to improper verification of cryptographic signatures within the ASP.NET Core Data Protection framework. The vulnerability was introduced as a regression in earlier.NET 10 releases and has prompted the release of.NET 10.0.7 to mitigate risk.

How to Identify and Reduce Excessive Permissions in AI Workloads

Your CIEM report came back clean this morning. Every AI agent in the cluster is exercising its granted permissions — no idle roles, no service accounts with broad scope and a handful of API calls behind them, nothing that looks obviously over-provisioned. The dashboard is green, and by the diagnostic your tool was built on, it should be.

How Hackers Get In: What Is a Vulnerability? (Containers Explained)

A vulnerability is a weakness in software—and in containerized environments, even one small flaw can open the door. From buggy code to outdated images and misconfigurations, risk can exist at every layer of the stack. And if a vulnerability is already known… attackers often already know how to exploit it. In this video, we break down: Next up: What is a CVE?

How to Detect Phishing Before It Happens: Moving Beyond User Awareness

By the time a phishing email lands in an inbox, the attacker’s infrastructure has already been live for hours. That’s not a hypothetical. Zimperium’s 2024 research found that 60% of newly created phishing domains receive a TLS certificate within the first two hours of registration. The site is credentialed, hosted, and ready before most security teams have any signal it exists.

AI Threat Detection for Financial Services: Detecting AI-Driven Fraud and Data Exfiltration

A Tier 1 bank’s security architecture already spends heavily on detection. On one side sits the financial surveillance stack — fraud scoring platforms processing thirty thousand transactions an hour, AML monitoring watching money movement patterns, DLP engines scanning data in transit, payment anomaly detection tuned by a decade of production signal.

What Is Generative AI Security? Key Risks and How to Fix Them

Generative AI security is the practice of protecting the data that flows into AI systems, and the outputs those systems produce, from leaks, attacks, and unauthorized access. Every organization using AI today has the same blind spot. Sensitive data enters an AI pipeline, and most security teams have no visibility into where it goes next. An employee pastes a customer record into ChatGPT. A developer submits code containing API keys to an AI debugging tool.

Top 10 Governance, Risk, and Compliance (GRC) Software Solutions

Governance is breaking. Not because companies care less about risk, but because modern infrastructure moves faster than the controls designed to govern it. In 2026, governance has to keep up with cloud-native architectures, AI adoption, API sprawl, and the explosion of machine identities across production environments.