Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Passkeys now protects billions of accounts, redefining how the world signs in through stronger, more secure authentication without a password. Yet this global movement runs deeper than most realize. While passkeys implements thoroughly scrutinized standards developed by the FIDO Alliance in collaboration with the W3C, global adoption, however, is driven by a central layer that extends beyond the open standards, one that remains little-researched, varies by implementation, and it is often misunderstood.

Small businesses can’t afford to wait when it comes to securing their business. Still, cybersecurity can be complex, and any entrepreneur will tell you that there’s already a lot to keep track of when starting and running a company. For small businesses dealing with limited (or nonexistent) IT and security teams, it’s important that their cybersecurity tools are both simple to use and efficient.

Unsanctioned SaaS and shadow IT are problems every organization deals with. When procuring a new SaaS tool is a few clicks, an email, and a credit card away, it’s never been easier for unsanctioned apps to increase across the business. Often, this is outside IT’s line of sight, outside security controls, and outside standard provisioning/deprovisioning processes.

Email is one of the most common ways for teams to share information. Emails are used to send contracts and share reports across teams. Client data is transferred back and forth every day. It’s a common activity in many organizations and is often trusted by default. For MSPs, email creates a different kind of responsibility. As they manage multiple client environments, a single email sent in the wrong direction can expose sensitive information and cause problems for clients.

Choosing safe, healthy open source dependencies shouldn’t require jumping between tools or piecing together context from multiple places. Developers and AppSec teams need package health signals exactly where security decisions already happen. This is why we’re bringing Snyk Advisor data into security.snyk.io.

When a leading insurance and asset management company was impacted by a third- party data breach, it needed to act quickly and decisively to notify affected customers. Kroll’s elite breach notification, monitoring and call center services enabled the company to provide tailored information and support to more than 2.5 million people in just four months, as well as delivering in-depth tracking and reporting for complete visibility and assured regulatory compliance.

If you ask most organizations how they protect their APIs, they point to their WAF (Web Application Firewall). They have the OWASP Top 10 rules enabled. The dashboard is green. They feel safe. But attackers know exactly how your WAF works, and, more importantly, how to trick it. We recently worked with a major enterprise customer, a global leader in healthcare technology, who experienced this firsthand.

The modern internet-facing attack surface is dynamic, JavaScript-driven, and deeply interconnected with third-party services and identity providers. Accurately securing this environment requires more than passive discovery or lightweight crawling—it requires deep, active crawling that fully simulates real-world browser behavior.

CertBot assumes every server that needs a certificate should also know how to request one, validate domain ownership, handle renewals, and manage failures. This makes sense with a handful of servers. One server, one cert, done. But infrastructures grow. Now you’ve got web farms sharing wildcards, load balancers, mail servers, VPN appliances. The “every server for itself” model doesn’t scale and isn’t sustainable. Even the Let’s Encrypt community knows it.

AI is reshaping business at machine speed. From automating claims to improving customer engagement, organizations are embedding AI into core workflows faster than most security teams can track. As AI systems expand, they introduce a new class of security considerations. AI no longer lives in a single layer of the stack. It runs on cloud infrastructure, processes sensitive data, and operates through a growing network of human and non-human identities.