Check the
Latest News.

Blog

Penetration Testing Cadence: Inside the 25x Remediation Gap

Top penetration testing programs close high-risk findings in 10 days; the bottom 10% take 249. Here's what annual-only testing leaves open.

Cadence, Penetration Testing, Remediation Gap

Blog

4 EU Governments Are Still Catching Up on NIS2 Compliance

NIS2 compliance became legally mandatory across the EU in October 2024. Two years later, a survey of 670 business leaders found just 16% of in-scope companies are fully compliant.

Compliance, NIS2

Blog

Security Staffing’s Problem Is Skills, and 60% Agree

For years, one number defined the security staffing conversation: a global headcount gap in the millions. In 2025, ISC2, the organization behind that number, stopped leading with it. Two major surveys, a record year for breach costs, and Europe's own regulator all point at the same reframe: the problem was never how many people you have.

Hiring, Security Staffing, Skills

Blog

MCP Security: 2 CVEs Your Team Can’t Ignore

The NSA doesn't usually publish design guidance on a protocol that's barely 18 months old. It did for MCP, naming eight specific risk categories. Here's what the two CVEs show, what OWASP already has a name for, and what a real internet scan found.

CVE, MCP, Security

Blog

Secrets Sprawl: 6 Patterns to Stop CI/CD Credential Leaks

Secrets sprawl isn't a public-GitHub problem anymore - it lives inside the CI/CD pipelines teams depend on every day. This piece breaks down six operational patterns that separate teams whose pipelines quietly accumulate leaked credentials from teams that actually close the gap.

CI/CD, Leaks, Secrets Sprawl

Blog

Vendor Risk: 5 Signals Your AI Supply Chain Is Exposed

Traditional vendor risk management assumes software is static. AI vendors aren't — models drift, sub-processors multiply, and shadow AI slips in through tools you already approved. Here are five signals your due diligence process is behind.

AI, Supply Chain, Vendor risk