Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Every CISO managing an API estate has heard of Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA). What is harder to pin down is what these vulnerabilities actually cost the business when they go unaddressed. Board members and finance teams want numbers, not acronyms, and that gap between technical risk and financial risk is where security budgets get lost. BOLA has held the number one spot in the OWASP API Security Top 10 since the list was created in 2019.

Claude Mythos is arguably the strongest cybersecurity model that Anthropic has built. But we know that model capability is only part of what determines how well an AI vulnerability product performs. To test that, we put Anthropic’s Claude Security, which runs on Mythos, and Aikido Code Security Audit head-to-head on the exact same target to see which harness can deliver the best coverage and at what cost. Code Security Audit is part of Aikido’s AI Code Analysis suite.

Most organisations have more cybersecurity tools than they realise. However, having those things isn’t the same as being secure. At some point, someone, like a Board member, insurer or regulator, is going to ask you to demonstrate that your security works. Not just that you have policies in place, but you can detect an attack, respond to it and recover from it. When that moment comes, you’ll want to know the answer. That’s what a cyber maturity assessment is designed to find.

The riskiest thing an AI agent does all day isn’t writing code. It’s shopping. Every few minutes, it reaches out for a package, an AI asset, or a tool, and pulls it in with no real way to check what’s inside. We think the fix is agent immunization: security that lives inside what an agent consumes, builds, and ships, not a wall built around it.

For twenty years, the software security playbook has worked the same way. You find the vulnerability, score it, open a ticket, assign it to a human, wait for the fix, ship the patch, and prove it happened. Every step in that sequence assumes humans can review each fix individually and still keep up. Frontier AI broke that assumption. The exploit window has collapsed from weeks to hours. Attackers reason across your codebase, chain their findings, and ship exploits before a CVE is even published.

In the pharma and biotech sectors, a single data leak doesn’t just trigger regulatory fines. It can wipe out a decade of R&D, hand patented drug formulations to competitors, and instantly derail a clinical trial. Your most valuable assets no longer live safely inside a single corporate network. They constantly move through a fast-paced ecosystem of remote researchers, external laboratories, and Contract Research Organizations (CROs).

Attackers are using a fake Codex download experience to trick macOS users into pasting a malicious command into Terminal. This technique, known as ClickFix, relies on social engineering rather than a conventional malware download: the victim is persuaded to perform the execution step themselves. We analyzed sponsored search results leading to convincing Google Sites pages, a no-code website-building and hosting service provided by Google.

There is a public record of every TLS certificate ever issued for your domain, and anyone can search it. Most people who run infrastructure have never heard of these certificate transparency logs. So I read our own log, and here’s what anyone could learn about CertKit from them.

AI is making social engineering attacks significantly more effective, according to a new report from cyber insurance firm Resilience. These attacks were behind more than 85% of losses in the first half of 2026, compared to less than 20% during H1 2024. “Losses tied to phishing, social engineering, and transfer fraud have climbed from 17.7% of incurred losses in H1 2024 to 85.3% in H1 2026, the single largest increase in the report’s five half-year comparison,” Resilience says.