The Security Boulevard stories enterprise IT leaders actually read.
Volume 342, Issue 1 · 16 articles from 4 issues
Comparison framework for four enterprise SSO vendors based on company stage and pricing.
This guide compares four enterprise single sign-on solutions for different organizational needs.
Okta manages workforce identity at $6-17 per user monthly, Auth0 offers a unified consumer and enterprise platform starting at $150/month, WorkOS provides per-connection pricing at $125 per connection with volume discounts, and SSOJet charges a flat $99 monthly plus $49.50 per connection.
The article distinguishes between overlay solutions that enhance existing authentication systems and full platforms requiring migration, helping teams select based on their current stage and expected growth.
Only 1.3% of AI-discovered vulnerabilities have been exploited, suggesting defenders currently benefit more than attackers.
Despite fears that frontier AI models would enable widespread exploitation, data shows AI-discovered vulnerabilities are not fueling cyberattacks at higher rates than traditionally discovered flaws.
VulnCheck researcher Patrick Garrity analyzed over 1,000 AI-discovered vulnerabilities and found that just 14 (1.3%) were exploited in the wild, matching historical exploitation rates.
The data does not suggest that AI-discovered vulnerabilities are inherently more likely to be exploited than those found through traditional methods. Currently, defenders appear to have the advantage in leveraging frontier AI models to identify and patch flaws before attackers can exploit them, though researchers caution this advantage may shift as more powerful models become widely available.
Enterprise security must shift focus from compliance metrics to business continuity when facing AI-powered cyberattacks.
As frontier AI systems discover vulnerabilities at machine speed, traditional cybersecurity approaches focused on perimeter defense and compliance scores are becoming obsolete.
The article highlights how AI-assisted attackers are compressing attack timelines from months to hours, citing the July 2026 Hugging Face breach as evidence of autonomous AI attacks.
Organizations must implement microsegmentation, restrict lateral movement, and establish breach readiness plans prioritizing material business impact rather than security maturity scores.
Only by architecting digital infrastructure that limits connectivity and reduces AI adversaries' options can enterprises prepare for the inevitable attacks ahead.
Losing a passkey is only serious when the credential is device-bound and no second credential is enrolled.
The outcome of losing a passkey depends entirely on whether it is synced or device-bound.
Synced passkeys reappear automatically when a user signs in to a replacement device with the same Apple or Google account, while device-bound credentials are permanently gone.
Holding multiple credentials is the practical protection against lockout, and the FIDO Alliance recommends enrolling at least two credentials per account. Only users with a single unsynced passkey face real lockout risk.
The article advises organizations to enforce a two-credential minimum and maintain recovery methods that do not depend on a platform provider.
Argues AppSec scanner findings belong in exposure management platforms to add risk context and cut alert fatigue.
Integrating application security scanner data into an exposure management platform supplies risk context that isolated code-scanning tools cannot provide.
The pressure is rising because developers using AI coding assistants commit code three to four times faster while introducing vulnerabilities at ten times the rate.
Consolidating AppSec findings with threat intelligence across cloud, infrastructure, and identity lets teams prioritize remediation and give CISOs business-level metrics.
The five stated benefits are comprehensive vulnerability visibility, streamlined handling of AI security tool findings, better prioritization context, organizational exposure measurement, and coordinated remediation workflows. Originally published on the Tenable blog.
IDC survey of 539 organizations finds 90% say identity management must improve to handle agentic AI risk.
An IDC survey of 539 North American organizations documents growing trouble managing machine identities as AI agents multiply.
Some 90% of respondents believe their identity management practices need improvement to address agentic AI risk, and 58.7% say substantial changes or a complete overhaul are required.
Organizations now risk holding more machine identities than human accounts, yet only 26.7% have deployed dynamic role-based access controls that support AI systems.
Weak governance around credential verification, task-scoped access, and identity lifecycle management leaves agents over-permissioned or still active long after their task ends. The survey frames agent identity as an emerging major security exposure.
Survey of 300 IT and security pros finds 79% had an incident in the past year tied to a known vulnerability.
A survey of 300 IT and cybersecurity professionals found 79% of respondents work at organizations that suffered a security incident in the past 12 months involving an already-known vulnerability.
More than half of those organizations had known about the flaw for at least 30 days before the incident occurred.
Only 25% can automate remediation workflows directly inside their security platforms, leaving the rest dependent on manual processes.
Competing priorities, slow approval workflows, and labor-intensive procedures are the main barriers to fast remediation. Experts argue automation is now essential because exploit development outpaces human patching speed.
Clarifies the distinctions among DDoS testing, stress testing, and penetration testing engagements.
The piece separates three overlapping categories of DDoS-related testing services.
DDoS testing is the umbrella term for authorized, controlled attacks that evaluate how infrastructure responds.
DDoS stress testing focuses on capacity limits, measuring how much traffic a service can withstand before performance degrades.
DDoS penetration testing instead targets bypassing defenses by finding weaknesses in mitigation controls.
Because vendor terminology is inconsistent, the author advises buyers to focus on the specific objectives of an engagement rather than its label.
AI-powered vulnerability detection is driving unprecedented software security flaw counts in 2026, nearly doubling last year's totals.
Artificial intelligence capabilities are fueling an unprecedented spike in detected software vulnerabilities, with 45,207 security flaws logged between January and late July 2026-approaching the entire prior year's total.
Major technology corporations report record patch volumes as AI tools expose previously hidden code defects at unprecedented scale.
While attackers are also leveraging AI to accelerate exploitation timelines from 72 hours to 24 hours, current data shows no corresponding surge in active breaches, suggesting defensive AI deployments are successfully catching and fixing vulnerabilities faster than malicious actors can weaponize them.
Four research reports show AI has deep system access at most enterprises but almost no effective governance.
The piece reviews four major research reports on how enterprise security leaders govern AI systems.
A standout finding is that 71% of CISOs say AI already has access to core business systems, yet only 16% say that access is governed effectively.
The reports surface a structural problem: the teams deploying AI are usually not the teams accountable for securing it.
Nearly 70% of enterprises are already running AI agents in production.
The collective conclusion is that enterprise AI security depends on controlling access, clarifying ownership, and funding accountability structures, not just on technical risks like prompt injection or hallucination.
A complete sender inventory is critical before publishing SPF records to avoid silent authentication failures.
Organizations should audit SPF records before publication by building a complete sender inventory, reviewing existing DNS records, confirming monitoring readiness and aligning stakeholders.
An incomplete record can silently exclude legitimate senders, breaking email flow and creating compliance gaps that surface only after delivery problems appear.
DMARC aggregate reports should be reviewed within 48 to 72 hours after publishing to identify any missed senders, ensuring proper email authentication across multi-vendor environments.
Businesses can counter rising threats with MFA, zero trust, email security, endpoint protection and training.
Organizations face escalating cyber threats but have several proven defenses available. Multi-factor authentication blocks over 99.9% of automated attacks.
Zero trust architecture requires continuous verification and reduces breach costs by $1.76 million. Email security depends on real-time scanning combined with staff training on phishing tactics.
Advanced endpoint protection monitors device behavior and maintains centralized logging so security teams can investigate incidents effectively.
Modern software depends on nested packages that create hidden security risk beyond direct dependencies.
Transitive dependencies, meaning packages pulled in indirectly, often bypass normal approval processes and change outside a team's control.
Dependency risk spans code quality, trust relationships and ecosystem change rates. Key controls include dependency inventories, SBOMs, SCA scanning, version pinning and repository trust restrictions.
Organizations should prioritize packages near trust boundaries such as authentication and cryptography, treat dependency changes as controlled modifications with testing, and establish clear ownership for remediation decisions.
CISOs use NIST SP 800-171 Rev 3 to build unified mappings that satisfy multiple compliance frameworks at once.
Organizations managing multiple cybersecurity frameworks without integrated mapping face significantly higher audit costs and more compliance findings.
NIST SP 800-171 Rev 3's 110 security requirements map directly to CMMC 2.0 practices, and systematic mapping reduces multi-standard compliance costs by 35% to 50%.
Converging requirements across CMMC 2.0, FedRAMP, ISO 27001 and others demand proactive governance architectures rather than siloed reactive programs.
One aerospace supplier saved $340,000 by discovering its existing SIEM could satisfy new logging requirements through configuration changes alone.
Black Hat researchers unveiled three passkey attack families that bypass authentication logging and sync.
Black Hat USA 2026 researchers disclosed three passkey attack families showing that authentication systems around passkeys, not the keys themselves, are the weak point.
SpecterOps' 'Pass-the-Passkey' exploited Windows 11 logging and Entra ID validation gaps to harvest and replay WebAuthn assertions and impersonate admins; Microsoft patched the logging flaw but Entra ID gaps remain open.
Palo Alto Networks' 'Golden Pass-ta-key' can recover the master secret protecting all of a user's synced Google Password Manager passkeys with no rotation option, while Dirk-jan Mollema showed malware can abuse Windows Hello for Business keys without fresh biometric verification-urgent given Microsoft's push to auto-enable passkeys for Entra ID users.
An analysis argues Meta's teen-safety settlement is really an unsolved age-verification problem in disguise.
This analysis argues Meta's $12.1-17.1 billion child-safety settlement-about 0.6% of annual revenue-is financially survivable but exposes a deeper technical problem: accurately identifying users under 18 at scale.
Meta must implement seven teen protections, from usage limits to non-personalized feeds, all of which depend on age verification, yet facial age-estimation technology carries roughly 2.5-year average errors at critical age boundaries.
Australia's under-16 ban saw 85% of banned users evade it via VPNs despite 5 million-plus deleted accounts, and New Mexico separately requires Meta to build an under-13 prediction model, illustrating how safety mandates become identity infrastructure problems.
More from Security Boulevard · All IT section newsletters · This week