Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The Cost of Manual Remediation Processes in a Regulated World

Security teams don’t need more alerts, they need fewer bottlenecks. In most organizations, remediation still runs on manual effort: ticket chasing, asset tagging, SLA tracking, endless email threads. It’s slow, fragmented, and risky for each organization. According to Seemplicity’s 2025 Remediation Operations Report, 91% of organizations face remediation delays, with the top two most common causes being collaboration and communication challenges (31%) and manual processes (19%).

Exploited! SysAid On-Prem XML External Entity Vulnerability (CVE-2025-2775)

SysAid has patched a critical XML External Entity (XXE) flaw that lets unauthenticated attackers turn a routine /mdm check-in request into full administrator compromise—and, when chained with a newly disclosed command-injection bug, into remote code execution (RCE). The vulnerability, tracked as CVE-2025-2775, affects all SysAid On-Prem deployments up to 23.3.40 and is now fixed in 24.4.60.

Top Attack Surface Management (ASM) Software Solutions to Watch in 2025

Organizations are increasingly recognizing that threats can emerge from various external-facing assets, including web applications, cloud infrastructure, APIs, and even shadow IT. This necessitates a robust Attack Surface Management (ASM) strategy, supported by specialized software solutions.

Precision in Machine Identity: Securing the NHIs That Matter

Imagine walking into your next board meeting and saying, “We need to secure all the non-humans.” You can probably picture the reactions: furrowed brows, confused glances—not exactly a solid foundation for fostering an effective identity and access management (IAM) strategy. But lately, there’s been a lot of discussion about all-encompassing terms like non-human identity (NHI).

If you can't patch perfectly, patch programmatically

In every quarterly security report we’ve ever released, we consistently find that threat actors primarily exploit old vulnerabilities, often fixed months, if not years, prior. The prevalence of zero-day exploits pales in comparison to these well-known, outdated vulnerabilities. This reality underscores our repeated advice: regularly and swiftly patch your software to yield significant returns on your security work investment.

APIs: The Invisible Backbone of Digital Transformation

APIs: The Invisible Backbone of Digital Transformation In today's app-driven economy, APIs (Application Programming Interfaces) have become the foundation for innovation and connectivity. A10's security experts Carlo Alpuerto and Jamison Utter explore the explosive growth in API development and adoption across industries. These powerful interfaces now power everything from financial services and retail experiences to transportation systems, IoT devices, autonomous vehicles, and smart city infrastructure.

#213 - Building cybersecurity products with Jonathan Haas, Product at Vanta

On this episode of the Cybersecurity Defenders Podcast we speak with Jonathan Haas, Product at Vanta, about building cybersecurity products. Jonathan’s work focuses on making security compliance faster and more accessible, helping teams move from months-long processes to efficient workflows that take just days. Before Vanta, he was the co-founder and CEO of cybersecurity startup ThreatKey, and before that he held key roles at Snapchat, DoorDash, and Carta, where he built and refined compliance systems during times of rapid growth.

Brivo Access: How To Create a Schedule Exception

In Brivo Access, a schedule automates access control, eliminating the need for manual unlocking or locking of doors at specific times. A schedule exception temporarily changes the access permissions defined by the regular schedule. Exceptions are usually applied to specific dates or date ranges, such as holidays, special events, or temporary closures. Explore the future of security and smart technology with Brivo. Our content delves into innovative solutions that empower businesses and individuals to create safer, more connected environments.

CVE-2025-31650 - Apache Tomcat DoS Risk via HTTP Priority Header

The Apache Software Foundation has disclosed a high-severity vulnerability in Apache Tomcat that could let attackers exploit improperly handled Priority headers in HTTP/2 to cause a denial of service (DoS). Tracked as CVE-2025-31650, this flaw stems from improper input validation, specifically when the server handles malformed Priority headers in HTTP/2, resulting in memory leaks and potential OutOfMemoryExceptions.