Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Credential harvesting is how attackers collect valid secrets at scale. See how it works, why developer machines are a prime target, and how to find them first.

At CrowdStrike, we conduct extensive red-team testing of agentic systems using diverse models, tools, and adversarial evaluation harnesses designed to probe for containment failures. To date, none of our offensive agents have escaped their intended sandbox boundaries.

Security teams that tighten insider threat controls usually hear about it fast, and not from attackers. Sales reps complain they cannot share a deck with a prospect. Engineers say a blocked upload cost them an afternoon. The business assumes that stopping data loss and staying productive are opposing goals, and every blanket policy that blocks first and asks questions later reinforces that assumption. They do not have to be opposing goals.

Your ERP system doesn't know what a SAML assertion is. Neither does that 15-year-old internal tool running your warehouse floor. But your identity team just rolled out Microsoft Entra ID with conditional access, MFA, and zero trust policies everywhere. That gap is what modern authentication for legacy applications closes.

If you're evaluating multi-factor authentication for a bank, a hospital network, a defense contractor, or a government agency, you've probably already run into smart card authentication. It's the method behind the CAC (Common Access Card) and PIV (Personal Identity Verification) cards federal employees badge in with every day. It's also becoming the default authentication method that regulated industries reach for, once passwords and OTP codes stop being good enough.

On August 4, 2026, a malicious version of keyv was published to npm as keyv@6.0.0, one of a number of npm packages affected across the Keyv and Cacheable ecosystem. The release follows the Mini Shai-Hulud pattern: a trojanized version of a heavily depended-on package, with an install-time hook that reaches cloud and CI credentials. It leaves the compiled library untouched and instead adds a preinstall hook and two files.

The 30-day patch cycle is dead. Most security teams already know this. What they haven’t fully reckoned with is why it died, and what has to replace it. SC Media recently gathered a range of security leaders on exactly this shift, and the picture they described is stark. AI didn’t just add more vulnerabilities to the pile. It collapsed the time between disclosure and exploitation from weeks to hours.