cybersecurity

If it walks like a duck and quacks like a duck, it’s still not a duck unless it has an application/duck Content-Type header Web design was a lot simpler 20 years ago. You had an invisible table over the whole height and width of the page, a few GIF images, and optionally some HTML. There […]

Invicti recently introduced its groundbreaking Predictive Risk Scoring feature, which can provide accurate security risk predictions even before vulnerability scanning starts. To learn more about Predictive Risk Scoring, visit our blog post here. This feature utilizes a custom-built machine learning model trained on real vulnerability data (not customer data) to estimate site risk levels and

Modern application security must be built in from the outset and reinforced continually throughout the software development lifecycle. Even organizations with mature application development practices need automated tools to successfully and repeatably secure their software in complex, fast-changing environments. Security leaders commonly focus on ensuring software security through runtime protection measures, with major cloud service

DevSecOps is a software development approach that aims to integrate security practices into DevOps processes. Implementing DevSecOps efficiently requires organizations to make security an integral part of software quality by using automated security tools in their CI/CD pipeline. Crucially, the DevSecOps approach to software development offers a way to embed application security into the entire

Imagine you have to check for danger on the other side of an impassable mountain you cannot walk around. What would you do? A low-tech solution would be to tunnel through and have a look. Swing by swing with a pickaxe to break the stone, and then shovel by shovel to haul the broken rock

The NIST cybersecurity framework has been a go-to resource for defining cybersecurity strategies, policies, and activities ever since version 1.0 was published back in 2014. Originally intended specifically for US companies operating critical infrastructure, it soon gained popularity across all industries and is used by CISOs worldwide. February 2024 saw the launch of version 2.0

Important Information   The xz-utils package in versions 5.6.0 and 5.6.1 contains a malicious backdoor that could potentially allow remote access to SSH sessions for remote code execution (RCE) on certain Linux systems under specific circumstances and configurations. It is recommended that all Linux users verify their xz-utils version is earlier than 5.6.0 and downgrade

Focused on detection and response, security leaders might not think of DAST tools as an essential component of their AppSec toolbox. All too often, external vulnerability scanning is only performed during periodic third-party tests, giving you snapshots of your security posture that can be months out of date. What if you could run your own

Some days, it feels like every application and system out there is getting new functionality based on large language models (LLMs). As chatbots and other AI assistants get more and more access to data and software, it’s vital to understand the security risks involved—and prompt injections are considered the number one LLM threat. In his

As the saying goes, it’s tough to make predictions, especially about the future. And yet everyone tries—whether for planning or in the naive hope of not getting caught off-guard this time. While we do have our own modest tradition of end-of-year prediction posts on this blog, we look to the experts to help us make