Talos intent-based detection: Stopping the scrapers that legacy tools can't see

Cybersecurity tools and procedures were designed to provide full defence against predictable threats that followed patterns that would raise alarms. Familiar CAPTCHAs, IP blocks, browser checks, browser fingerprinting, and login restrictions would provide a protective layer for businesses to ensure only genuine users were using their website, or app, or API responsibly. This layer of cybersecurity used to distinguish human from bot.

Fast, Secure, Resilient: Modernizing Application Security at Scale

Software release cycles are now too fast for traditional security tools. Rapid iterations and reliance on open-source and cloud-native tech increase vulnerabilities, challenging AppSec teams to keep up. Attackers are taking advantage, targeting applications and exploiting misconfigurations, excessive permissions, and vulnerable plug-ins.

What AppSec Teams Need to Prepare for in 2026 #applicationsecurity #appsec #aisecurity

Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.

AI is Actively LEAKING Your Data (And You Don't Know It) #apisecurity #airisks #dataprotection #ai

AI agents don't think. They pattern-match. Critical to understand: Generative AI (ChatGPT, Claude, etc.) does NOT reason like humans. It: The API Security problem: When you give an AI agent access to an API, it will: AI agents can't reason. They recreate patterns based on weights. You need to be very careful: data in, data out. Practical example: text User: "Show me the account balance for user" AI agent → calls GET /api/account/123 API → returns { balance: 5000, name: "John", SSN: "123-45-6789" } AI agent → outputs EVERYTHING to user (including SSN!)

Veracode and Palo Alto Networks: Unify Application Risk from Code to Cloud

Software development has entered a new era. Applications are built and deployed faster than ever, powered by cloud-native architectures, open-source software, and AI-assisted development. But this speed has introduced a new challenge: a dramatically expanded attack surface and a fragmented security model that struggles to keep up.

Introducing Moltworker: a self-hosted personal AI agent, minus the minis

The Internet woke up this week to a flood of people buying Mac minis to run Moltbot (formerly Clawdbot), an open-source, self-hosted AI agent designed to act as a personal assistant. Moltbot runs in the background on a user's own hardware, has a sizable and growing list of integrations for chat applications, AI models, and other popular tools, and can be controlled remotely. Moltbot can help you with your finances, social media, organize your day — all through your favorite messaging app.

INETCO team shares fraud predictions for 2026

From real-time payment (RTP) scams to account takeovers to card testing, Visa reports that 98% of merchants experienced one or more types of fraud in 2025. No wonder it has gone down in history as the year these crimes exploded in scope. So what does 2026 have in store? According to the INETCO Team, the coming months will see payment fraud evolve like never before — into something more autonomous and far harder for banks and payment processors to detect using traditional approaches.

Why API Security Is No Longer an AppSec Problem - And What Security Leaders Must Do Instead

APIs are one of the most important technologies in digital business ecosystems. And yet, the responsibility for their security often falls to AppSec teams – and that’s a problem. This organizational mismatch creates systemic risk: business teams assume APIs are “secured,” while attackers exploit logic flaws, authorization gaps, and automated attacks in production. As Tim Erlin noted recently, “These are not exploits of a specific vulnerability, but abuse of an API.”