The AI you can't see: Bringing third-party shadow AI into the risk picture
As AI supply chains become more interconnected, continuous visibility must be the basis of third-party risk management.
Articles mapped to MITRE ATT&CK techniques. Select a technique to view matching articles.
370 articles found
As AI supply chains become more interconnected, continuous visibility must be the basis of third-party risk management.
As enterprises transition from debating artificial intelligence adoption to actively deploying it, AI governance has become a more complex challenge.
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible ...
The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.
Lattice Semiconductor has released version 5.0 of its Lattice Sentry solution stack, adding post-quantum cryptography (PQC) to its platform firmware resilien...
The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next.
A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and noth...
The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsi...
Security researcher has disclosed a heap buffer overflow vulnerability in AnyDesk Linux version 8.0.
Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still require...
In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sig...
Empire Market co-creator Raheim Hamilton was sentenced to 40 years in prison for running a dark web marketplace linked to $430 million in illegal trades. The...
On Wednesday I spent a day fishing, on a small boat out of Gloucester, MA. We caught many cod (none of which we could keep), and a bunch of hake and mackerel...
As reported by Security Affairs, Hunt.io's analysis of the BraZetsu initial access broker reveals that its underlying infrastructure continued to evolve and ...
Anthropic’s OSS Scanner is a new, free service that uses the company’s strongest AI models to find security vulnerabilities in open-source software. Maintain...
Chainguard leads the eliminate-the-problem lane with hardened zero-CVE images, Sonatype the block-at-ingestion lane, and Scribe/Lineaje the provenance-attest...
The quantum threat is becoming an increasing concern for security leaders, but many may be mistaking protection at their website’s front door for quantum rea...
Hunt.io traced BraZetsu ‘s infrastructure and found that hosting patterns and certificate data remained useful after published IOCs became outdated.
I timed an attacker once. From registering a domain to having it delegated, certificated and serving a live credential-harvesting page took under 24 minutes,...
Snyk is the best developer-platform SCA, Sonatype the repository-firewall powerhouse, and Socket the malicious-package specialist the CVE-scanners aren’t. Tw...