New CSA research shows mature AI governance accelerates responsible AI adoption, boosts security confidence, and enables agentic AI at scale.
The post CSA Study: Mature AI Governance Translates Into Responsible AI Adoption appeared first on Security Boulevard.
As we head into 2026, I am thinking of a Japanese idiom, Koun Ryusui (行雲流水), to describe how enterprises should behave when facing a cyberattack. Koun Ryusui means “to drift like clouds and flow like water.” It reflects calm movement, adaptability, and resilience. For enterprises, this is an operating requirement. Cyber incidents are no longer isolated disruptions. They are recurring tests […]
The post Containing the Inevitable: What Cyber Leaders Must Prepare for in 2026 appeared first on ColorTokens.
The post Containing the Inevitable: What Cyber Leaders Must Prepare for in 2026 appeared first on Security Boulevard.
Dec 19, 2025 - Jeremy Snyder - A recent posting by Dr. Chase Cunningham from Ericom Software on LinkedIn took an interesting view on web application firewalls, most commonly known as a WAF.
WAF’s Must Die Like the Password and VPN’s
Here at FireTail.io, we are also not fans of a WAF. Why? We do not believe that a WAF will catch most modern attacks. WAFs are fundamentally based on firewall (perimeter defense) structures that are designed to keep attackers out based on where they are coming from, where they are going to, and what they are trying to access. A simple search for bypassing a WAF returns quite a lot of results:
Bypass WAF, 1.28M results
Dr. Cunningham’s post shares some interesting opinions and statistics on WAFs:
* “WAFs are antithetical to the move to Zero Trust”
* “According to most innovators and experts, the pattern and rule-based engine used by WAFs are not aligned with current security needs.”
* “Ponemon conducted research at that time to probe the market for issues with WAF solutions, and more than 600 respondents made their point clear: WAFs aren’t helping.”
The Ponemon WAF research referenced also included some eye-opening statistics:
* While 66% of respondent organizations consider the WAF an important security tool, over 40% use their WAFs only to generate alerts (not to block attacks)
* 86% of organizations experienced application-layer attacks that bypassed their WAF in the last 12 months.
* Managing WAF deployments are complex and time-consuming, requiring an average of 2.5 security administrators who spend 45 hours per week processing WAF alerts, plus an additional 16 hours per week writing new rules to enhance WAF security.
* The CapEx and OpEx for WAFs together average $620K annually. This includes $420K for WAF products, plus an additional $200K annually for the skilled staffing required to manage the WAF.
SUMMARY OF WAF FAILURES FROM DR. CHASE CUNNINGHAM
If you wanted the tl;dr version of what Dr. Cunningham had to say, it’s this:
> In other words, WAFs are not stopping attacks, require continuous configuration and intensive management and security human capital, and are more expensive than other better-suited technologies.
WHAT IS A BETTER APPROACH THAN USING A WAF THEN?
This is where our view may both overlap with and also differ from from Dr. Cunningham’s. Dr. Cunningham speaks of the model of Web Application Isolation (WAI), whereby an application is effectively public on the Internet, but only behind a required authentication controller, and then creates a secure tunnel.
Our view on this is two-fold:
* For public or consumer applications, this can work. But it requires an immediate control for authorization. Too often, developers assume controlled inputs and no attempts at unauthorized access. But the provisioning of a “secure tunnel” is something that happens already via SSL / TLS, and there’s no need for another “secure tunnel”.
* Applications need to have a security configuration of their own that defines authorization options around various API routes and methods, because the API is both the future of application development paradigms, and the API will become the most frequently attacked surface / vector.
Please contact us if you want to hear more about our view on WAFs for API security.
The post The WAF must die – some interesting thoughts – FireTail Blog appeared first on Security Boulevard.
Originally published at How should Your Business Deal with Email Impersonation Attacks in 2025? by EasyDMARC.
Email impersonation attacks have evolved rapidly with the ...
The post How should Your Business Deal with Email Impersonation Attacks in 2025? appeared first on EasyDMARC.
The post How should Your Business Deal with Email Impersonation Attacks in 2025? appeared first on Security Boulevard.
Originally published at What is Spoofing and a Spoofing Attack? Types & Prevention by EasyDMARC.
Spoofing, in all its forms, makes up the ...
The post What is Spoofing and a Spoofing Attack? Types & Prevention appeared first on EasyDMARC.
The post What is Spoofing and a Spoofing Attack? Types & Prevention appeared first on Security Boulevard.
Recently, Forrester, a globally renowned independent research and advisory firm, released the report “Navigate The AI Agent Ecosystem In China, Forrester Research, October 2025[1].” NSFOCUS was successfully included in this report. In the report, Forrester identified four key technological trends: With the rapid advancement of Artificial Intelligence, AI Agent technology is deepening its application within […]
The post Unlocking New Possibilities for Security Operations: NSFOCUS’s AI Agent Capabilities Recognized by Authoritative Institution appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..
The post Unlocking New Possibilities for Security Operations: NSFOCUS’s AI Agent Capabilities Recognized by Authoritative Institution appeared first on Security Boulevard.
By 2026, vulnerability scanning will no longer be about running a weekly scan and exporting a PDF. Modern environments are hybrid, ephemeral, API-driven, and constantly changing. Tools that haven’t adapted are already obsolete, even if they still have brand recognition. Therefore, we present to you the top 10 Best Vulnerability Scanning Tools for 2026, which […]
The post Best Vulnerability Scanning Tool for 2026- Top 10 List appeared first on Kratikal Blogs.
The post Best Vulnerability Scanning Tool for 2026- Top 10 List appeared first on Security Boulevard.
What Founders Really See When They Try to Scale
The post Building Cybersecurity Companies from Europe appeared first on Security Boulevard.
NetSuite is one of the most widely used cloud ERP platforms in the world. It offers core features for finance, CRM, order management and commerce,...Read More
The post Why NetSuite Customer Portals Fall Short and How to Build Better User Experiences appeared first on ISHIR | Custom AI Software Development Dallas Fort-Worth Texas.
The post Why NetSuite Customer Portals Fall Short and How to Build Better User Experiences appeared first on Security Boulevard.
Discover how AI-driven anomaly detection safeguards post-quantum context streams in Model Context Protocol (MCP) environments, ensuring robust security for AI infrastructure against future threats.
The post AI-Driven Anomaly Detection in Post-Quantum Context Streams appeared first on Security Boulevard.
Learn how to integrate Single Sign-On (SSO) into your applications with this comprehensive developer guide. Includes code examples, flow diagrams, and best practices for secure authentication.
The post How to Integrate SSO: Developer Guide with Code Examples & Flow Diagrams appeared first on Security Boulevard.
Explore biometric mfa for enhanced security. Learn about implementation, benefits, hacking techniques, and how to protect your systems. A must-read for developers.
The post Exploring Biometric Multi-Factor Authentication appeared first on Security Boulevard.
After 25 years defending against man-in-the-middle attacks, a security veteran explains why most AI agents replicate the same architectural risks—creating compliance gaps, opaque decision-making, and zero-trust violations CISOs can’t ignore.
The post AI Agents are Man-in-the-Middle Attacks appeared first on Security Boulevard.
Cisco disclosed that a China-linked hacking group exploited a previously unknown vulnerability in its email security products, allowing attackers to compromise systems that sit at the center of enterprise email traffic. The flaw affected Cisco Secure Email Gateway and Secure Email and Web Manager appliances running AsyncOS and was actively exploited before public disclosure. The […]
The post Chinese Hackers Exploited a Zero-Day in Cisco Email Security Systems appeared first on Centraleyes.
The post Chinese Hackers Exploited a Zero-Day in Cisco Email Security Systems appeared first on Security Boulevard.
Key Takeaways Risk management in banking depends on how effectively information moves through established structures. A persistent challenge is how early emerging signals are recognized, how consistently they’re interpreted across teams, and how directly they inform decisions. AI and advanced analytics are being applied to this layer. This article focuses on that operational edge: where […]
The post Risk Management in Banking: Leveraging AI and Advanced Analytics appeared first on Centraleyes.
The post Risk Management in Banking: Leveraging AI and Advanced Analytics appeared first on Security Boulevard.
How Can Secrets Rotation Enhance Agentic AI Security? Have you ever contemplated the growing complexity of security? With advanced technologies like Agentic AI revolutionize industries, the critical aspect of securing these systems takes center stage. Managing machine identities, or Non-Human Identities (NHIs), is paramount to ensuring robust security across cloud environments. These machine identities encompass […]
The post How does secrets rotation benefit Agentic AI systems appeared first on Entro.
The post How does secrets rotation benefit Agentic AI systems appeared first on Security Boulevard.
How Secure Are Your Non-Human Identities in the Face of Secrets Sprawl? Is secrets sprawl silently jeopardizing your organization’s cybersecurity framework? This pressing question is becoming more common among cybersecurity professionals tasked with safeguarding Non-Human Identities (NHIs). With technology advances and organizations increasingly adopt cloud-based solutions, the management of machine identities and their associated secrets […]
The post What is secrets sprawl and how does it impact NHIs appeared first on Entro.
The post What is secrets sprawl and how does it impact NHIs appeared first on Security Boulevard.
How Do Non-Human Identities Enhance Cybersecurity? What role do Non-Human Identities (NHIs) play in strengthening cybersecurity frameworks? With data management experts and cybersecurity specialists delve deeper into Agentic AI, the management and security of NHIs have become imperative. This elevated importance stems from the ability of NHIs to bridge gaps in security, particularly within cloud […]
The post Why is least privilege important for NHIs in Agentic AI appeared first on Entro.
The post Why is least privilege important for NHIs in Agentic AI appeared first on Security Boulevard.
If you look at the headlines, the story is about Artificial Intelligence. But if you look at the architecture, the story is about APIs.
The reality of modern tech is simple: You can’t have AI security without API security.
As we move rapidly from simple chatbots to autonomous agents, the way we secure our infrastructure must evolve. That is why we are thrilled to announce the release of the 4th Edition of AI & API Security For Dummies, Salt Security Special Edition.
We have rebuilt this guide to address the seismic shift in the threat landscape. While it still covers the essentials of API discovery and protection, this new edition features a brand-new focus on Chapter 6: Securing the AI-Powered World.
Here is a look at the new concepts we are introducing in this edition and why they matter for your security strategy.
In the new edition, we introduce a core analogy to help visualize the risk: Think of a powerful AI model like a brilliant brain in a jar.
It has incredible capabilities, but it is useless in isolation. It needs a way to see, hear, and act. APIs are the "nervous system" that connects that brain to the real world. Whether you are using a customer service bot or an internal coding assistant, every request is packaged into an API call.
If that nervous system is compromised, the brain, no matter how smart, becomes dangerous.
The most exciting update to this edition is our deep dive into the Agentic AI Action Layer.
We are moving past the era where a human prompts a bot and gets text back. We are entering a world of Agent-to-Agent (A2A) communication, where multiple specialized AI agents collaborate via APIs to autonomously fulfill complex requests.
Imagine a "Travel Agent AI" talking to a "Flight Agent AI" and a "Hotel Agent AI" to book a trip. These agents use interfaces like Model Context Protocols (MCP) to share context and data.
Securing this web of interactions is critical. As we explain in the book, a vulnerability in just one agent’s API could compromise the entire workflow, allowing attackers to hijack the "action" layer of your enterprise.
With new architecture comes new attack vectors. The 4th Edition details exactly how attackers are exploiting the unique nature of LLMs, including:
With great power comes great need for governance. Chapter 3 of the new guide focuses heavily on API Posture Governance, ensuring that your APIs are secure, reliable, and compliant throughout their lifecycle.
This is critical for AI workloads. A simple misconfiguration in an API could accidentally expose massive datasets to an LLM. We discuss how to achieve full visibility into your API landscape, including "Shadow" and "Zombie" APIs, and implement the right controls to stop data exposure before it happens .
While the AI updates are exciting, this guide remains the definitive resource for foundational API security. We cover:
The AI revolution is actually an API revolution. Ensure your organization is ready for the Agentic future.
If you want to learn more about Salt and how we can help you, please contact us, schedule a demo, or visit our website. You can also get a free API Attack Surface Assessment from Salt Security's research team and learn what attackers already know.
The post The Agentic Era is Here: Announcing the 4th Edition of AI & API Security For Dummies appeared first on Security Boulevard.
RegScale this week added an open source hub through which organizations can collect and organize compliance data based on the Open Security Controls Assessment Language (OSCAL) framework. Announced at the OSCAL Plugfest conference, the OSCAL Hub provides a central repository that makes it simpler for more organizations and government agencies to embrace a framework that..
The post RegScale Open Sources OSCAL Hub to Further Compliance-as-Code Adoption appeared first on Security Boulevard.
Login