The Security Boulevard stories enterprise IT leaders actually read.
Volume 341, Issue 4 · 20 articles from 3 issues
MFA blocks the overwhelming majority of account compromises, but effectiveness varies sharply by factor type.
Microsoft research cited in the article shows MFA reduces account compromise risk by 99.22%. Effectiveness varies by method: SMS codes and push notifications remain exposed to prompt bombing and phishing, while FIDO2 security keys and passkeys provide cryptographic, phishing-resistant protection.
Bypass techniques appear in roughly 14-18% of documented incidents and generally target human-approvable factors rather than the authentication concept itself.
The recommendation is to deploy MFA universally as a baseline and prioritize phishing-resistant methods for sensitive systems. The article is syndicated from the MojoAuth blog.
Outlines five CMMC assessments defense contractors should run to find gaps before certification.
The article details five essential CMMC compliance assessments for defense contractors handling Controlled Unclassified Information.
The assessments cover NIST SP 800-171 Rev 3 control implementation, technical validation, supply chain risk management, continuous monitoring, and organizational governance.
Common deficiencies flagged include incomplete System Security Plans and misconfigured security policies.
Proactive organizations are said to achieve roughly 40% faster certification timelines than reactive ones.
A comprehensive Level 2 assessment typically takes 8-12 weeks and costs between $75,000 and $250,000.
Guide to designing passkey recovery flows, since private keys never leave the authenticator and cannot be reset.
Passkey recovery works nothing like a password reset because private keys never leave the authenticator.
Google reports over 1 billion passkey sign-ins across 400 million accounts, each of which needs a recovery strategy that does not fall back to passwords.
The article identifies four lockout causes: lost devices, switching ecosystems, single-credential accounts, and stale credentials, and names registering a second passkey as the strongest defense.
Relying parties should log five diagnostic fields at enrollment, including AAGUID, backup eligibility and state flags, transports, and creation date, and adopt the WebAuthn Signal API so users never pick a dead credential.
For high-assurance accounts, recovery must be as strong as the original authentication.
Enterprises must adopt fuzed identity intelligence to address risks spanning employees' personal and corporate digital footprints.
Traditional identity security focuses on corporate accounts in isolation, but employees' personal digital identities-including personal emails, social profiles, and exposed credentials-create interconnected enterprise risk.
Fuzed identity intelligence links disparate identity elements across personal and professional domains to provide comprehensive context about individuals.
Attackers already view targets holistically; defenders must adopt similar perspectives to identify when external exposures create internal vulnerabilities and collapse criminal aliases into attributable actors.
Argues MCP traffic needs hybrid post-quantum cryptography and agent-to-agent trust before quantum decryption arrives.
The article examines security weaknesses in the Model Context Protocol as AI systems become more agentic.
It warns that adversaries already run Store Now, Decrypt Later campaigns, capturing encrypted enterprise AI traffic to decrypt once quantum computers mature.
MCP's dynamic, real-time design is called out as especially exposed to schema manipulation and cross-agent poisoning attacks.
Recommendations include hybrid post-quantum cryptography layered with classical encryption, NIST-approved algorithms under FIPS 203 and 204, and agent-to-agent trust frameworks instead of user authentication alone.
A three-phase roadmap covering assessment, hybrid transition, and full post-quantum migration is offered as the preparation path.
Weak customer identity drives both breach costs and lost revenue, with passkeys addressing each at once.
Poor customer identity management costs organizations twice over, in breach expense and in abandoned transactions.
IBM's 2025 breach report puts credential-based breaches at an average $4.67 million with roughly 292 days to contain, the longest detection window of any attack vector.
FIDO Alliance research finds 47% of consumers are likely to abandon a purchase or sign-in when they cannot remember a password. Compromised credentials start 22% of all breaches and 88% of web application attacks.
Phishing-resistant authentication such as passkeys reduces breach risk while improving conversion by removing password friction.
Agentic pentesting runs from $119 per month to $4,000 per test, but hidden costs often exceed the headline price.
Agentic pentesting uses four pricing models: per-engagement, flat subscription, consumption-based and per-finding hybrid. Published prices start around $119 monthly or $4,000 per test, though consumption tools generally require custom quotes.
True cost extends well beyond the sticker price to include false-positive triage, retests, untested coverage gaps and tool sprawl. Organizations should measure value as cost per unit of proven coverage over a full year rather than per individual test.
Continuous agentic models often deliver superior assurance despite higher cumulative spending.
Data breaches cost far more than regulatory fines, averaging $4.44 million globally in 2025.
IBM research shows breach expenses extend beyond fines to investigation costs, legal fees, system restoration, lost revenue and reputational damage. Hidden costs such as lost productivity, employee diversion from projects and customer churn significantly affect the total.
Organizations must understand their data landscape and implement robust protection practices to mitigate risk.
Faster detection and containment reduce overall financial impact. Prevention through data minimization and security controls proves more economical than recovery after the fact.
FireMon argues policy control is essential for zero trust in an AI-accelerated threat landscape.
As AI systems rapidly discover vulnerabilities and expose attack paths, organizations face growing complexity across firewalls, cloud controls and segmentation policies.
FireMon contends that visibility alone cannot ensure control; security teams need policy validation, continuous monitoring and evidence of alignment with business intent.
The article identifies five needs: prioritizing reachable risk over vulnerability volume, managing policy complexity across hybrid environments, automating change with governance, validating zero trust effectiveness, and providing executive accountability.
Policy management is positioned as the control plane that reduces exposure while maintaining compliance.
DDoS protection failures stem from misconfiguration rather than missing products, in two opposite failure modes.
Most DDoS protection gaps result from misconfiguration rather than architectural flaws or vendor choice. Under-mitigation lets attack traffic through because of incomplete scope coverage, exposed origins or narrowly applied rules.
Over-mitigation causes self-inflicted outages by blocking legitimate users as aggressively as real attackers.
Security teams should test protection in both directions, map actual exposure, validate thresholds against real traffic data, and verify that rate-limit incrementors are keyed to per-client attributes rather than destinations.
Five DDoS trends show enterprise defenses were sized for a threat environment that no longer exists.
The article identifies five DDoS trends reshaping how defenses must be built.
Hyper-volumetric attacks hit record scale, with 700 incidents exceeding 1 Tbps in Q1 2025 alone, overwhelming infrastructure designed on older assumptions.
At the other extreme, precision Layer 7 attacks against APIs and application logic stay invisible to detection logic tuned for bandwidth and packet rate.
AI-powered botnets now adapt to evade defenses, APIs have become the main unprotected surface, and geopolitical actors use DDoS as cover for coordinated intrusions.
Testing found 68% of identified faults rated severe or critical, supporting the conclusion that most enterprise protections are sized for a threat environment that no longer exists.
Machine identities vastly outnumber humans in enterprises; agent identity, passkey adoption, and OAuth 2.1 status clarified.
Machine identities outnumber human ones by 109:1 in average enterprises, with AI agents as the fastest-growing category.
The article distinguishes genuine 2026 authentication changes-primarily agent identity management-from recycled trends like passkeys (shipping since 2022) and OAuth 2.1 (still in draft status).
While 68% of organizations deploy passkeys and 88% report agent security incidents, only 28% achieved full passwordless authentication and 21.9% treat agents as independent identities.
Recommendations include treating agents as distinct credentials, implementing OAuth 2.1 security practices now without waiting for ratification, and supporting passkeys alongside other authentication methods.
Enterprises must adopt post-quantum cryptography to protect AI data from future quantum decryption.
MCP deployments face quantum computing risk through store-now-decrypt-later attacks, where adversaries collect encrypted traffic today to decrypt once quantum computers mature. Standard TLS relying on RSA and ECC will become vulnerable to Shor's algorithm.
Organizations should implement hybrid cryptography combining classical AES-256 with NIST-standardized algorithms such as ML-KEM, adopt zero-trust security policies, and build cryptographically agile architectures that allow algorithm updates without system overhauls.
The article includes practical compliance checklists and argues that agility, not any single protocol, is the real protection.
A practical GDPR audit checklist for scaling companies whose data has become fragmented across systems.
As organizations grow, privacy management gets harder because data spreads across many systems and platforms.
A GDPR compliance audit looks past written policies to test consistency across people, processes, and technology.
Key audit areas include data inventories, verifying the legal basis for processing, updating privacy notices, third-party vendor risk, access controls, retention policies, data subject request handling, and security control evaluation.
The article frames GDPR compliance as a business-critical governance issue rather than a purely legal one, since gaps expose customer data and invite regulatory action.
Regular audits help growing firms build durable privacy frameworks and catch emerging risks early.
Dan Lohrmann lays out concrete frameworks for turning AI ethics principles into day-to-day organizational practice.
Dan Lohrmann examines practical frameworks for putting ethical AI principles into operation. He highlights the CLEAR prompting framework, covering concise, logical, explicit, adaptive, and reflective use of generative AI, alongside the C2V2 governance framework for data management.
The article argues human accountability must stay central to AI-driven decisions, citing lawsuits against Meta and Workday over AI bias in employment decisions.
Organizations are urged to treat AI outputs as preliminary drafts requiring verification, keep humans in the loop, and put safeguards in place against proprietary data exposure.
It closes with five core questions organizations should answer to assess their AI ethics maturity.
CISOs face growing personal liability as attestation requirements outpace midmarket governance infrastructure.
Formal attestation requirements under frameworks like CMMC and SEC disclosure rules are pushing personal liability onto security leaders.
The article highlights a disconnect in midmarket organizations, which face enterprise-level compliance expectations without the matching governance infrastructure.
CISOs are increasingly expected to formally attest that standards are met, yet many lack documented risk ownership and repeatable processes to back those assertions.
AI adoption compounds the problem by introducing opaque risks that are hard to audit or predict. Before signing off, leaders need documented risk ownership, acceptance processes, audit trails, continuous control visibility, and functional governance structures.
Cloud security is now central to federal operational readiness and national defense, demanding zero trust architecture and deep visibility.
Federal agencies must treat cloud security as a mission imperative rather than an IT compliance exercise. Multi-cloud architectures and containerized workloads have expanded attack surfaces beyond what traditional security approaches can cover.
Mature zero trust implementation requires comprehensive, real-time visibility across users, devices, applications, data, networks, and analytics.
FedRAMP High and Impact Level 5 authorizations validate that security solutions meet rigorous federal standards for protecting sensitive information.
Unified cloud-native application protection platforms can move agencies from reactive risk management to proactive threat prevention while preserving strict data isolation requirements.
MFA, passwordless authentication, and SSO solve different login problems and work together in enterprise security stacks.
The article clarifies that MFA, passkeys, and SSO are not competing alternatives but complementary layers in enterprise authentication.
MFA verifies the account owner at login time, passkeys eliminate shared password secrets to prevent phishing and credential theft, and SSO federates one identity across multiple applications.
Organizations should implement all three as part of a mature security stack, with the identity provider enforcing MFA and passkey policies upstream before SSO assertions reach applications.
NIST post-quantum cryptography standards provide mandatory baselines to defend AI infrastructure against harvest-now-decrypt-later threats.
Adversaries are currently collecting encrypted AI training data and model weights to decrypt once quantum computers become viable, creating an urgent need for quantum-resistant security.
NIST has finalized post-quantum cryptography standards including ML-KEM, ML-DSA, and SLH-DSA as mandatory baselines for quantum-resistant infrastructure.
Organizations should implement a hybrid cryptographic approach that layers classical algorithms with post-quantum encryption to protect sensitive data without requiring complete architectural overhauls.
The Model Context Protocol, despite 78% adoption, presents significant security vulnerabilities that must be addressed through PQC implementation and AI-driven anomaly detection.
How UK SMEs can author portable log-based detections once in Sigma and deploy them across multiple SIEM backends.
Sigma rules give smaller UK organizations a structured way to write log-based security detections that port across SIEM platforms.
Sigma is described as a detection authoring layer rather than a replacement for foundational logging and telemetry work, letting teams write once and translate to backends such as Microsoft Sentinel or Splunk.
The recommended approach starts with high-value behaviors like identity abuse and PowerShell misuse, backed by disciplined testing, version control, and tuning to keep alerts actionable.
Consistent log field normalization and mapping detections to MITRE ATT&CK techniques are treated as prerequisites. Rules should be managed as code with a clear promotion and monitoring workflow.
More from Security Boulevard · All IT section newsletters · This week