Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Most TPRM alerts tell you the same thing: a vendor's score changed. A number moved. Something is different. What they don't tell you is which specific vulnerability caused it, whether it's real, or whether it's already inside your network. That last part is the question that keeps security leaders up at night, and most TPRM programs were never designed to answer it.

From a fast-scaling ransomware operator to a Russian state-sponsored espionage group now experimenting with LLM-powered malware, and a data extortion collective that has weathered arrests without slowing down, these three threat actors span the full spectrum of financially and geopolitically motivated cybercrime. CYJAX breaks down what each group does, why they matter, and what security teams should know.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! Always worrying (for the dependent companies) when such a large consultancy takes a hit.

Most security providers can describe what they should be able to do. Fewer can demonstrate what they actually see, track, and respond to in live environments. That distinction matters more now than it did even a year ago. Attack surfaces have expanded beyond users and endpoints into machine identities, autonomous systems, and internet-facing infrastructure rapidly. At the same time, detection claims have become broader (often without a corresponding increase in observable capability).

Credential sprawl has long been an issue IT and security teams have had to grapple with, and solutions like single-sign-on (SSO) have never been able to contain it completely. Now, AI is accelerating the problem. AI agents need access to credentials at an unprecedented scale, leaving IT and security teams struggling even more to ensure that every credential, across every department, is secure.

Black Hat is where the security industry gathers to compare notes on what works. In recent years, supply chain attacks have been a recurring topic, and the 2026 Verizon Data Breach Investigations Report shows security teams are struggling to find a solution. According to the report, third-party involvement increased by 60% over the last year and now accounts for 48% of all breaches.

Your environment probably already looks like this. Active Directory on-prem, a couple of cloud accounts, SaaS apps the business adopted faster than security could review them, remote laptops, service accounts nobody wants to touch, and a SIEM full of logs that don't yet add up to control. That's where most first Zero Trust projects begin.

GitGuardian is now live on the Kiro Powers marketplace. Install the Power once, and Kiro's agent scans for exposed secrets automatically every time it writes or modifies code that handles credentials.