Dec 19, 2025 - Jeremy Snyder - A recent posting by Dr. Chase Cunningham from Ericom Software on LinkedIn took an interesting view on web application firewalls, most commonly known as a WAF.

WAF’s Must Die Like the Password and VPN’s

Here at FireTail.io, we are also not fans of a WAF. Why? We do not believe that a WAF will catch most modern attacks. WAFs are fundamentally based on firewall (perimeter defense) structures that are designed to keep attackers out based on where they are coming from, where they are going to, and what they are trying to access. A simple search for bypassing a WAF returns quite a lot of results:

Bypass WAF, 1.28M results

Dr. Cunningham’s post shares some interesting opinions and statistics on WAFs:

* “WAFs are antithetical to the move to Zero Trust”
* “According to most innovators and experts, the pattern and rule-based engine used by WAFs are not aligned with current security needs.”
* “Ponemon conducted research at that time to probe the market for issues with WAF solutions, and more than 600 respondents made their point clear: WAFs aren’t helping.”

The Ponemon WAF research referenced also included some eye-opening statistics:

* While 66% of respondent organizations consider the WAF an important security tool, over 40% use their WAFs only to generate alerts (not to block attacks)
* 86% of organizations experienced application-layer attacks that bypassed their WAF in the last 12 months.
* Managing WAF deployments are complex and time-consuming, requiring an average of 2.5 security administrators who spend 45 hours per week processing WAF alerts, plus an additional 16 hours per week writing new rules to enhance WAF security.
* The CapEx and OpEx for WAFs together average $620K annually. This includes $420K for WAF products, plus an additional $200K annually for the skilled staffing required to manage the WAF.

SUMMARY OF WAF FAILURES FROM DR. CHASE CUNNINGHAM

If you wanted the tl;dr version of what Dr. Cunningham had to say, it’s this:

> In other words, WAFs are not stopping attacks, require continuous configuration and intensive management and security human capital, and are more expensive than other better-suited technologies.

WHAT IS A BETTER APPROACH THAN USING A WAF THEN?

This is where our view may both overlap with and also differ from from Dr. Cunningham’s. Dr. Cunningham speaks of the model of Web Application Isolation (WAI), whereby an application is effectively public on the Internet, but only behind a required authentication controller, and then creates a secure tunnel.

Our view on this is two-fold:

* For public or consumer applications, this can work. But it requires an immediate control for authorization. Too often, developers assume controlled inputs and no attempts at unauthorized access. But the provisioning of a “secure tunnel” is something that happens already via SSL / TLS, and there’s no need for another “secure tunnel”.
* Applications need to have a security configuration of their own that defines authorization options around various API routes and methods, because the API is both the future of application development paradigms, and the API will become the most frequently attacked surface / vector.

Please contact us if you want to hear more about our view on WAFs for API security.

‍

The post The WAF must die – some interesting thoughts – FireTail Blog appeared first on Security Boulevard.

Originally published at How should Your Business Deal with Email Impersonation Attacks in 2025? by EasyDMARC.

Email impersonation attacks have evolved rapidly with the ...

The post How should Your Business Deal with Email Impersonation Attacks in 2025? appeared first on EasyDMARC.

The post How should Your Business Deal with Email Impersonation Attacks in 2025? appeared first on Security Boulevard.

Originally published at What is Spoofing and a Spoofing Attack? Types & Prevention by EasyDMARC.

Spoofing, in all its forms, makes up the ...

The post What is Spoofing and a Spoofing Attack? Types & Prevention appeared first on EasyDMARC.

The post What is Spoofing and a Spoofing Attack? Types & Prevention appeared first on Security Boulevard.

Recently, Forrester, a globally renowned independent research and advisory firm, released the report “Navigate The AI Agent Ecosystem In China, Forrester Research, October 2025[1].” NSFOCUS was successfully included in this report. In the report, Forrester identified four key technological trends: With the rapid advancement of Artificial Intelligence, AI Agent technology is deepening its application within […]

The post Unlocking New Possibilities for Security Operations: NSFOCUS’s AI Agent Capabilities Recognized by Authoritative Institution appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..

The post Unlocking New Possibilities for Security Operations: NSFOCUS’s AI Agent Capabilities Recognized by Authoritative Institution appeared first on Security Boulevard.

By 2026, vulnerability scanning will no longer be about running a weekly scan and exporting a PDF. Modern environments are hybrid, ephemeral, API-driven, and constantly changing. Tools that haven’t adapted are already obsolete, even if they still have brand recognition. Therefore, we present to you the top 10 Best Vulnerability Scanning Tools for 2026, which […]

The post Best Vulnerability Scanning Tool for 2026- Top 10 List appeared first on Kratikal Blogs.

The post Best Vulnerability Scanning Tool for 2026- Top 10 List appeared first on Security Boulevard.

What Founders Really See When They Try to Scale

The post Building Cybersecurity Companies from Europe appeared first on Security Boulevard.

NetSuite is one of the most widely used cloud ERP platforms in the world. It offers core features for finance, CRM, order management and commerce,...Read More

The post Why NetSuite Customer Portals Fall Short and How to Build Better User Experiences appeared first on ISHIR | Custom AI Software Development Dallas Fort-Worth Texas.

The post Why NetSuite Customer Portals Fall Short and How to Build Better User Experiences appeared first on Security Boulevard.

Discover how AI-driven anomaly detection safeguards post-quantum context streams in Model Context Protocol (MCP) environments, ensuring robust security for AI infrastructure against future threats.

The post AI-Driven Anomaly Detection in Post-Quantum Context Streams appeared first on Security Boulevard.

Learn how to integrate Single Sign-On (SSO) into your applications with this comprehensive developer guide. Includes code examples, flow diagrams, and best practices for secure authentication.

The post How to Integrate SSO: Developer Guide with Code Examples & Flow Diagrams appeared first on Security Boulevard.

Explore biometric mfa for enhanced security. Learn about implementation, benefits, hacking techniques, and how to protect your systems. A must-read for developers.

The post Exploring Biometric Multi-Factor Authentication appeared first on Security Boulevard.

After 25 years defending against man-in-the-middle attacks, a security veteran explains why most AI agents replicate the same architectural risks—creating compliance gaps, opaque decision-making, and zero-trust violations CISOs can’t ignore.

The post AI Agents are Man-in-the-Middle Attacks appeared first on Security Boulevard.

Cisco disclosed that a China-linked hacking group exploited a previously unknown vulnerability in its email security products, allowing attackers to compromise systems that sit at the center of enterprise email traffic. The flaw affected Cisco Secure Email Gateway and Secure Email and Web Manager appliances running AsyncOS and was actively exploited before public disclosure. The […]

The post Chinese Hackers Exploited a Zero-Day in Cisco Email Security Systems appeared first on Centraleyes.

The post Chinese Hackers Exploited a Zero-Day in Cisco Email Security Systems appeared first on Security Boulevard.

Key Takeaways Risk management in banking depends on how effectively information moves through established structures. A persistent challenge is how early emerging signals are recognized, how consistently they’re interpreted across teams, and how directly they inform decisions. AI and advanced analytics are being applied to this layer. This article focuses on that operational edge: where […]

The post Risk Management in Banking: Leveraging AI and Advanced Analytics appeared first on Centraleyes.

The post Risk Management in Banking: Leveraging AI and Advanced Analytics appeared first on Security Boulevard.

How Can Secrets Rotation Enhance Agentic AI Security? Have you ever contemplated the growing complexity of security? With advanced technologies like Agentic AI revolutionize industries, the critical aspect of securing these systems takes center stage. Managing machine identities, or Non-Human Identities (NHIs), is paramount to ensuring robust security across cloud environments. These machine identities encompass […]

The post How does secrets rotation benefit Agentic AI systems appeared first on Entro.

The post How does secrets rotation benefit Agentic AI systems appeared first on Security Boulevard.

How Secure Are Your Non-Human Identities in the Face of Secrets Sprawl? Is secrets sprawl silently jeopardizing your organization’s cybersecurity framework? This pressing question is becoming more common among cybersecurity professionals tasked with safeguarding Non-Human Identities (NHIs). With technology advances and organizations increasingly adopt cloud-based solutions, the management of machine identities and their associated secrets […]

The post What is secrets sprawl and how does it impact NHIs appeared first on Entro.

The post What is secrets sprawl and how does it impact NHIs appeared first on Security Boulevard.

How Do Non-Human Identities Enhance Cybersecurity? What role do Non-Human Identities (NHIs) play in strengthening cybersecurity frameworks? With data management experts and cybersecurity specialists delve deeper into Agentic AI, the management and security of NHIs have become imperative. This elevated importance stems from the ability of NHIs to bridge gaps in security, particularly within cloud […]

The post Why is least privilege important for NHIs in Agentic AI appeared first on Entro.

The post Why is least privilege important for NHIs in Agentic AI appeared first on Security Boulevard.

If you look at the headlines, the story is about Artificial Intelligence. But if you look at the architecture, the story is about APIs.

The reality of modern tech is simple: You can’t have AI security without API security.

As we move rapidly from simple chatbots to autonomous agents, the way we secure our infrastructure must evolve. That is why we are thrilled to announce the release of the 4th Edition of AI & API Security For Dummies, Salt Security Special Edition.

We have rebuilt this guide to address the seismic shift in the threat landscape. While it still covers the essentials of API discovery and protection, this new edition features a brand-new focus on Chapter 6: Securing the AI-Powered World.

Here is a look at the new concepts we are introducing in this edition and why they matter for your security strategy.

The "Nervous System" of AI

In the new edition, we introduce a core analogy to help visualize the risk: Think of a powerful AI model like a brilliant brain in a jar.

It has incredible capabilities, but it is useless in isolation. It needs a way to see, hear, and act. APIs are the "nervous system" that connects that brain to the real world. Whether you are using a customer service bot or an internal coding assistant, every request is packaged into an API call.

If that nervous system is compromised, the brain, no matter how smart, becomes dangerous.

Securing the "Agentic Action Layer"

The most exciting update to this edition is our deep dive into the Agentic AI Action Layer.

We are moving past the era where a human prompts a bot and gets text back. We are entering a world of Agent-to-Agent (A2A) communication, where multiple specialized AI agents collaborate via APIs to autonomously fulfill complex requests.

Imagine a "Travel Agent AI" talking to a "Flight Agent AI" and a "Hotel Agent AI" to book a trip. These agents use interfaces like Model Context Protocols (MCP) to share context and data.

Securing this web of interactions is critical. As we explain in the book, a vulnerability in just one agent’s API could compromise the entire workflow, allowing attackers to hijack the "action" layer of your enterprise.

New Threats for a New World

With new architecture comes new attack vectors. The 4th Edition details exactly how attackers are exploiting the unique nature of LLMs, including:

• Prompt Injection: How attackers use "social engineering for AIs" to bypass safety guidelines and trick models into revealing sensitive data.
• Model Poisoning: How attackers spam APIs with biased or malicious data to corrupt the model’s learning process.
• Resource Consumption: How a single complex query to a Generative AI model can be used to launch an application-layer Denial of Service (DoS) attack, driving up massive cloud bills.

Mastering API Posture Governance

With great power comes great need for governance. Chapter 3 of the new guide focuses heavily on API Posture Governance, ensuring that your APIs are secure, reliable, and compliant throughout their lifecycle.

This is critical for AI workloads. A simple misconfiguration in an API could accidentally expose massive datasets to an LLM. We discuss how to achieve full visibility into your API landscape, including "Shadow" and "Zombie" APIs, and implement the right controls to stop data exposure before it happens .

The Fundamentals Still Apply

While the AI updates are exciting, this guide remains the definitive resource for foundational API security. We cover:

• The OWASP API Security Top 10: Including deep dives on BOLA (Broken Object Level Authorization).
• API Discovery: How to find and inventory the "Zombie" and "Shadow" APIs lurking in your network.
• Runtime Protection: Why "shifting left" isn't enough and why you need to stop attacks in real-time.

Get Your Copy Today

The AI revolution is actually an API revolution. Ensure your organization is ready for the Agentic future.

If you want to learn more about Salt and how we can help you, please contact us, schedule a demo, or visit our website. You can also get a free API Attack Surface Assessment from Salt Security's research team and learn what attackers already know.

The post The Agentic Era is Here: Announcing the 4th Edition of AI & API Security For Dummies appeared first on Security Boulevard.

RegScale this week added an open source hub through which organizations can collect and organize compliance data based on the Open Security Controls Assessment Language (OSCAL) framework. Announced at the OSCAL Plugfest conference, the OSCAL Hub provides a central repository that makes it simpler for more organizations and government agencies to embrace a framework that..

The post RegScale Open Sources OSCAL Hub to Further Compliance-as-Code Adoption appeared first on Security Boulevard.

Session 6C: Sensor Attacks

Authors, Creators & Presenters: Zizhi Jin (Zhejiang University), Qinhong Jiang (Zhejiang University), Xuancun Lu (Zhejiang University), Chen Yan (Zhejiang University), Xiaoyu Ji (Zhejiang University), Wenyuan Xu (Zhejiang University)

PAPER
PhantomLiDAR: Cross-Modality Signal Injection Attacks Against LiDAR

LiDAR is a pivotal sensor for autonomous driving, offering precise 3D spatial information. Previous signal attacks against LiDAR systems mainly exploit laser signals. In this paper, we investigate the possibility of cross-modality signal injection attacks, i.e., injecting intentional electromagnetic interference (IEMI) to manipulate LiDAR output. Our insight is that the internal modules of a LiDAR, i.e., the laser receiving circuit, the monitoring sensors, and the beam-steering modules, even with strict electromagnetic compatibility (EMC) testing, can still couple with the IEMI attack signals and result in the malfunction of LiDAR systems. Based on the above attack surfaces, we propose the alias attack, which manipulates LiDAR output in terms of Points Interference, Points Injection, Points Removal, and even LiDAR Power-Off. We evaluate and demonstrate the effectiveness of alias with both simulated and real-world experiments on five COTS LiDAR systems. We also conduct feasibility experiments in real-world moving scenarios. We provide potential defense measures that can be implemented at both the sensor level and the vehicle system level to mitigate the risks associated with IEMI attacks.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – PhantomLiDAR: Cross-Modality Signal Injection Attacks Against LiDAR appeared first on Security Boulevard.

Executive Summary Modern cyber adversaries no longer depend on loud malware, obvious exploits, or easily identifiable indicators of compromise. Instead, they leverage legitimate credentials, trusted tools, and native system functions to operate silently within enterprise environments. These attacks are deliberately designed to resemble normal business activity, rendering traditional detection methods ineffective. Behavioral Threat Analytics (BTA)

The post Beyond Rules and Alerts: How Behavioral Threat Analytics Redefines Modern Cyber Defense appeared first on Seceon Inc.

The post Beyond Rules and Alerts: How Behavioral Threat Analytics Redefines Modern Cyber Defense appeared first on Security Boulevard.