Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Exposure management has outgrown visibility. With 67M+ findings per year, the real challenge is execution at scale. The 2026 Exposure Action Report shows that risk clusters in predictable places, most exposure is operational (not novel), and meaningful risk reduction comes from consolidation, prioritization, and disciplined remediation workflows — not adding more tools.

In a content collaboration and governance market that often gets swept up in hype, it’s refreshing when an analyst focuses on what actually works.

Researchers at Okta warn that a series of phishing kits have emerged that are designed to help threat actors launch sophisticated voice phishing (vishing) attacks that can bypass multifactor authentication. “The most critical of these features are client-side scripts that allow threat actors to control the authentication flow in the browser of a targeted user in real-time while they deliver verbal instructions or respond to verbal feedback from the targeted user,” Okta says.

Lead Analysts: Jeewan Singh Jalal, Prabhakaran Ravichandhiran and Anand Bodke KnowBe4 Threat Labs has detected a sophisticated phishing campaign targeting North American businesses and professionals. This attack compromises Microsoft 365 accounts (Outlook, Teams, OneDrive) by abusing the OAuth 2.0 Device Authorization Grant flow, bypassing strong passwords and Multi-Factor Authentication (MFA).

Security teams are facing an attack surface that changes faster than it can be fully understood. Cloud adoption, Software-as-a-Service sprawl, and continuous delivery cycles have dissolved the traditional perimeter, replacing it with an environment where assets change with little notice. Shadow IT, abandoned infrastructure, expired certificates, and misconfigured services quietly expand exposure, often outside formal ownership.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! Not spooky season right? Well, this is a bit odd

Read Post

Teams sprawl is one of the most overlooked security risks in Microsoft 365 environments. When all your employees can create teams on demand, without approval, naming conventions, or expiration policies, the result is hundreds of ungoverned workspaces with no clear ownership, inconsistent naming, and scattered data. That governance gap creates measurable risk.

What data are your employees feeding into unapproved AI tools? If you can't answer that question, then you might have shadow AI security risks that you don't know about. The Netwrix Cybersecurity Trends Report 2025 found that 37% of organizations have already had to adjust their security strategies due to AI-driven threats, while 30% haven't started AI implementation at all. That gap between how fast AI threats are evolving and how slowly organizations are responding is where shadow AI thrives.

Getting a certificate is the easy part. Getting it onto every server that needs it, in the right format, with the right permissions, and restarting the right services? That’s the part where things fall apart. The CertKit Agent closes that gap, just released from our product roadmap.