Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. Indeed, the disclosures included an actively exploited flaw that allowed attackers to execute commands on affected gateways without signing in. As with any emergency patch, admins had to weigh cutting off or disrupting their users’ access with the risk of delaying a critical security update.

Your site loads in Chrome fine. Then a deploy script, a webhook, or integration calls the same URL and gets this: Python says certificate verify failed: unable to get local issuer certificate. Node says unable to get local issuer certificate, or unable to verify the first certificate. It’s all the same problem. It’s a misconfiguration between your certificate and a trusted root. Either the server isn’t sending it, or the client doesn’t have it.

Researchers pulled real, leaked API keys out of three LLMs using only API output. Here is how AI agents carry secrets from developer laptops into model context, and how to stop them before the model sees them.

When MSPs evaluate MDR services, the conversation usually starts in the same place: Tell me about your SOC and how quickly you respond. Those are good to know, but they don't tell you one thing that determines whether the service works: how much of your clients' environments the provider can see and act on. A SOC that's available 24/7 but only watching half the environment isn't protecting your clients. It's giving your clients a false sense of security.

A local password manager stores your credentials in an encrypted vault on your own device or server. You control your data and backups, but you also manage keys and updates yourself. That works for one person. Teams need role-based access, approvals for sensitive accounts, and logs that show who accessed what.

As AI agents spread across IT environments, organizations struggle to see what agents they have and what data those agents can access. For Cybersecurity Awareness Month, we wanted to share what Netwrix is doing to help IT and security teams improve agentic AI visibility and governance to keep their sensitive data secure. I recently sat down with Jeff Warren, our chief product officer, who has been working through this problem with customers for a while.

For years, identity governance has had a useful shorthand: Every identity needs an owner. This works reasonably well when the identity represents a person. There may be managers, application owners, entitlement owners, data owners and security teams surrounding the identity, but there is still a human being at the center. For example, Sarah in Finance has an identity. The organization determines what Sarah is permitted to access and execute, but Sarah will also be held accountable for her actions.

TL;DR: Active-active runs every node live so traffic distributes across the pool and failover is near-instant, but it forces you to solve multi-writer conflicts through last-writer-wins, vector clocks, CRDTs, or consensus protocols. Active-passive keeps one authoritative primary with an idle standby, trading seconds to minutes of promotion time for predictable behavior, simpler troubleshooting, and lower cost under steady load.

Successful executive leadership goes beyond monitoring employees’ every move; it also needs a clear, factual picture of digital workflows, which apps are being used, and how much work available talent can do. Today, when many organizations are dealing with a shift to hybrid work, soaring software subscription pricing, and new productivity requirements, executive workforce activity and app consumption reporting are helping leaders stay on top of it all.