Defending energy infrastructure in the age of Mythos

The Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) has released its first five-year strategic plan, following the broader national cybersecurity strategy. It’s coming at a time when the energy cybersecurity landscape is changing quickly, in some cases faster than operators can realistically keep up.

Prioritized Recovery for Object Storage: Restore what matters most, first!

When you need to recover an S3 bucket or Azure Blob container, you probably don't need all of it back at once. Your app config files, your latest data partitions, your active transaction logs — those need to be online now. Last year's holiday party photos — well, they can follow.

NIST CSF 2.0: What's new in the Cybersecurity Framework

NIST CSF 2.0 expands the Cybersecurity Framework into a broader, risk-based model centered on governance, making leadership accountable for cybersecurity as an enterprise risk. It introduces a sixth core function, enhances supply chain and privacy integration, and improves usability for organizations of all sizes. Profiles, tiers, and new implementation resources help align security efforts with business objectives and evolving threat landscapes.

Eliminate organization-wide credential risk

Many critical tools — social platforms, finance apps, and AI tools — can't be put behind SSO, leaving credentials shared over Slack, stored in spreadsheets, and reused across accounts. In this video, we walk through how 1Password extends identity security beyond SSO, giving teams like Marketing and Finance simple, secure access to shared credentials — while IT and Security gain the visibility, control, and auditability they need. Because attackers don't care about org charts, and now, neither do your security controls.

Navigating the Post-Mythos Landscape with Bitsight

The rise of AI-driven vulnerability discovery using Anthropic's Claude Mythos, as well as similar tools from Google and OpenAI, is completely changing the calculus of cyber risk. The number of vulnerabilities is exploding. The time it takes for exploits to appear is shrinking. The patching cadences and scan intervals, assessments and risk registers that many organizations still rely on are rapidly becoming ineffective.

Why API Discovery Is the First Step to Securing AI

AI risk doesn’t live in the model. It lives in the APIs behind it. Every AI interaction triggers a chain of API calls across your environment. Many of those APIs aren’t documented or tracked. That’s your real exposure. Shadow API discovery gives you visibility into those hidden endpoints, so you can find them before attackers do. If you don’t know which APIs your AI relies on, you can’t secure the system.

FedRAMP Leveraged vs Agency ATO Authorization Paths

FedRAMP is the information security framework used by the United States government, and it’s required for any cloud service provider hoping to work with the government in a way that handles sensitive information. If you’re a cloud service provider and you want to become FedRAMP-authorized, how do you do it? Unfortunately, this is a more difficult question to answer than a lot of people wish.

Why MFA is the Foundation of VPN Security

VPNs have long been considered the backbone of secure remote access, especially as organizations shifted to distributed work environments. By encrypting data in transit, they create a secure tunnel between users and corporate systems. On the surface, this appears sufficient to protect sensitive business operations and internal resources. However, encryption alone does not guarantee security. VPNs do not verify who is accessing the network, only that the connection is valid.