Salt Security announced a major expansion of its platform’s connectivity fabric with two new strategic integrations: the Salt Databricks Connector and the Salt Netlify Collector. These additions reinforce Salt’s “Universal Visibility” strategy, ensuring that security teams can capture deep API context from every corner of the enterprise, whether it’s a legacy on-premise server, a modern edge deployment, or the rapidly evolving Agentic AI Action Layer.

Securing the Agentic AI Action Layer at the Source. As enterprises rush to build Agentic AI, platforms like Databricks have become the operating system for AI workloads. While generalist security tools (CNAPPs) can scan Databricks infrastructure for misconfigurations, they remain blind to the actual behavior of the AI agents running inside.

The new Salt Databricks Connector bridges this gap, providing a dedicated API security discovery engine for Databricks environments. It specifically targets the “Agentic Action Layer,” identifying the Model Context Protocol (MCP) servers and AI agents that connect proprietary data models to the outside world.

The platform is easy to use, connecting in minutes without requiring complex instrumentation or manual configuration, while also providing action-layer visibility by instantly mapping which APIs and data sources internal AI agents are accessing, insight that traditional infrastructure scanners typically miss. At the same time, it enables unified governance, allowing teams to apply the same rigorous security policies to their AI workloads that they already enforce for their traditional APIs.

“Databricks is where the enterprise brain lives, but until now, we have not been able to see what the hands, the AI agents, are actually touching,” said Eric Schwake, Cybersecurity Director at Salt Security. “Generalist tools can tell you if your S3 bucket is open, but only Salt can tell you if an AI agent inside Databricks is actively leaking PII through an unmonitored API. We are turning the lights on in the agentic action layer.”

Rapid Support for the Modern Edge. Alongside AI visibility, Salt is addressing the fragmentation of modern web architectures. The new Salt Netlify Collector brings feature-parity traffic collection to decoupled frontend applications and Jamstack architectures.

Built to support major enterprise deployments, this collector demonstrates Salt’s agility and ability to rapidly build and deploy collectors as the market evolves. As organisations decouple their frontends and push logic to the edge, standard gateways are often bypassed. Salt ensures security travels with the code.

• Universal Reach: Extends Salt’s best-in-class traffic analysis to Netlify’s edge network.
• Rapid Adaptation: Showcases Salt’s flexible architecture, allowing the platform to support modern Content Delivery Networks (CDNs) and edge runtimes as fast as developers adopt them.

The Salt Databricks Connector and Netlify Collector are available immediately as part of the Salt Illuminate platform.

The post Salt Security Expands “Universal Visibility” with Specialized API Security for Databricks and Rapid Edge Support for Netlify appeared first on IT Security Guru.

More than half of UK employees retain access to company spreadsheets they no longer need, leaving sensitive business data exposed long after people change roles or leave organisations, according to new research from privacy technology company Proton.

The study, based on a survey of 250 small and medium-sized businesses (SMB) in the UK, found that 64% still had access to files that should no longer be available to them. In some cases, this includes documents containing financial information, client data, salary details, or internal planning material.

With around 16.9 million people working for SMBs across the UK, the findings suggest that millions of current and former employees could still have access to sensitive company data without their employers’ knowledge.

The research highlights a growing gap between the critical role spreadsheets play in daily business operations and the poor governance of their access. Spreadsheets are now widely used as informal systems of record, with 64% of respondents using them for project management, 47% for financial reporting, and 45% for managing client or customer data.

Despite this reliance, access controls remain weak. Nearly four in ten respondents (39%) said they had shared spreadsheets using “anyone with the link” permissions, while 20% said they only review who has access to their spreadsheets once a year. Manual offboarding processes remain common: 44% of access removals are handled manually, while just 36% are automated.

Proton says this combination of link-based sharing and manual offboarding helps explain why access often persists long after an employee leaves.

“Spreadsheets are often treasure troves of sensitive data, from financial and strategic planning information to HR and client data,” said Patricia Egger, head of security at Proton. “Yet they’re not handled like other high-risk data. When someone leaves a company, access to shared spreadsheets is often nobody’s problem. Links stay active, permissions aren’t reviewed, and data remains accessible without anyone noticing.”

Confusion over cloud security and data use

The study also found widespread misunderstanding about how secure cloud-based spreadsheets really are. Two-thirds of respondents (67%) believe their Google Sheets files are private and accessible only to intended viewers, while almost a quarter said they were unsure what information Google can or cannot access.

There is similar uncertainty around encryption and provider access, particularly with Microsoft. Almost a quarter of UK respondents said they were unsure whether Microsoft could view spreadsheet content.

Uncertainty also extends to data use. More than a third (34%) of respondents believe spreadsheet data could be used to train AI models, and 84% said they would find that concerning.

Personal and work accounts are being mixed

Nearly half of respondents (45%) admitted to opening work spreadsheets using personal cloud accounts, while 46% said they had accessed personal spreadsheets using work accounts. Security researchers warn that this blurring of personal and professional data increases the risk of accidental data leakage, unauthorised access, and compliance failures, particularly where sensitive financial or customer data is involved.

The UK is among the most spreadsheet-reliant countries

Proton compared its UK findings with results from other countries, including the US and France. While lingering access in the UK (64%) was slightly lower than in the US (67%), it was significantly higher than in France (40%).

The UK also showed the highest levels of uncertainty about provider access and encryption, particularly for Microsoft-hosted spreadsheets. Proton noted that these risks are amplified by European data sovereignty concerns, as data hosted by foreign cloud providers may fall under legal regimes outside a company’s control.

Everyday tools, enterprise-level risk

The findings point to a broader problem: spreadsheets are increasingly used to run core business processes, but without the governance, visibility, or controls normally applied to more formal business systems. Researchers say this creates a growing blind spot for SMBs, particularly as collaboration tools, consumer cloud accounts, and AI services become more deeply embedded in everyday work.

“Most of these risks don’t come from malicious behaviour,” Egger added. “They come from everyday process gaps; manual offboarding, weak defaults, and a lack of visibility into who can still access what.”

The post More than half of former UK employees still have access to company spreadsheets, study finds appeared first on IT Security Guru.

Keeper Security has announced instant account switching and passkey enhancements across its mobile applications and browser extension. This update is said to be available across all major web browsers including iOS, Android and the Keeper Browser Extension. 

The instant account switching enables users to securely toggle between multiple Keeper accounts on the same device or web browser without logging out, white still upholding strict enterprise security controls. Users managing workflows from personal, family and business accounts can do so seamlessly across platforms without risking security.

Craig Lurey, CTO and Co-founder of Keeper Security, said: “Security and usability must work together, especially as users operate across devices and environments. With seamless account switching now available across mobile apps and browser extensions, Keeper is simplifying day-to-day access while maintaining the policy enforcement and protections organisations rely on.”

Keeper’s new updates facilitate the switching of accounts directly from the login screen or account menu. Switching occurs immediately without forcing a re-authentication when a session is still active on the backend. If it is disabled or if organisational policies require verification, a prompt to authenticate will appear before accessing another account. All enterprise controls remain enforced, including role-based access controls, device verification, multi-factor authentication and audit logging. 

In this update, Keeper also announced performance and usability improvements, embedded autofill cloud sync and improved search surfaces. In addition, passwordless adoption is said to be continuously advanced with conditional passkey creation that enables supported logins to be upgraded to passkeys automatically in the background. Once completed, users will be notified. 

These new updates follow Keeper’s recent JetBrains Extension launch that offers JetBrains Integrated Development Environment (IDE) users a smooth and reliable way to manage secrets within their development workflows.

The post Keeper Introduces Instant Account Switching and Passkey Improvements appeared first on IT Security Guru.

Next month, the annual Most Inspiring Women in Cyber Awards will take place at The BT Tower, London, celebrating some of the industry’s most inspirational – and oftentimes unsung – women.

Sponsored by Fidelity International, BT, Plexal and Bridewell, and proudly supported by industry-leading diversity groups WiTCH, WiCyS UK&I and Seidea, the 2026 event is set to be bigger than ever. To make sure everyone has had the chance to nominate, we’ve extended the nomination deadline until the 16th January 2026, 5pm GMT. 

For now, it’s time to introduce our 2026 judges, who have the exceptionally hard task of picking this year’s top 20 and five ones to watch… 

• Yasemin Mustafa, Director of the Cyber Security Portfolio at BT 
• Adam Haylock, Head of Global Cyber and Information Security Department at Fidelity International 
• Rebecca Taylor, Co-Author of Co-Author of Securely Yours: An Agony Aunts’ Guide To Surviving Cyber, and Threat Intelligence Knowledge Manager and Researcher at Sophos
• Adaora Uche, GRC Lead at THG (representing Seidea) 
• Joanne Elieli, Cyber Lead and Litigation Partner at Stephenson Harwood LLP
• Diane Gilbert, Senior Lead for Programmes at Plexal 
• Yvonne Eskenzi, Co-Founder of Eskenzi PR and Founder of The Most Inspiring Women in Cyber Awards
• Jennifer Cox, Director of Solutions Engineering, EMEA and APAC, at Tines (representing WiCyS UK&I)
• Hannah Arnold, London Ambassador for WiTCH – Women in Tech & Cyber Hub

The Gurus spoke to some of our judges about the 2026 awards and what they’re looking for in a good application. 

Adaora Uche, GRC Lead at THG 

Why are initiatives like this so important?

Initiatives like this matter because visibility changes possibility. Cybersecurity is still an industry where many women don’t see themselves reflected in leadership, technical authority, or decision-making roles. By intentionally spotlighting women who are doing impactful work, we challenge outdated perceptions of who belongs in cyber and what success looks like.

Beyond recognition, these initiatives create role models, momentum, and community. They validate the work women are already doing – often quietly and behind the scenes, and help open doors for others who are earlier in their journeys. Representation is not just symbolic, it is a powerful driver for inclusion, retention, and long-term change in our industry.

Why should people nominate?

People should nominate because inspiration often goes unrecognised unless someone speaks up. So much impactful work in cybersecurity happens behind the scenes. Particularly in governance, risk, privacy, and security leadership, where success often looks like problems prevented, risks mitigated, or the right questions being asked early. This kind of impact does not always attract attention, but it is critical.

A nomination is more than an accolade; it is an act of recognition and encouragement. It tells someone that their work matters, that they are seen, and that their journey can inspire others. Nominating also helps broaden the narrative of cybersecurity by showcasing diverse paths, backgrounds, and contributions that might otherwise go unnoticed.

What makes an ‘inspiring woman’ in cyber in your eyes?

First and foremost, I believe every woman in cybersecurity is inspiring. Simply showing up each day to help make the digital world safer, often in complex, high-pressure environments, is truly heroic.

An inspiring woman in cyber creates impact while lifting others as she progresses. She may be a technical expert, a strategist, a leader, or an educator, but what sets her apart is purpose, resilience, and a commitment to making the space better than she found it. She does not just respond to challenges, she anticipates them, questions the status quo, and contributes to safer, more ethical, and more inclusive digital environments.

She does not need to dominate the room to lead. Her credibility comes from consistency, thoughtfulness, and sound judgement. It also stems from her unwavering commitment to building systems and teams that are secure, resilient, and future-ready. Importantly, she uses her voice, whether in boardrooms, classrooms, or communities to share knowledge, mentor others, and make cybersecurity more accessible and human.

Adam Haylock, Head of Global Cyber and Information Security Department at Fidelity International 

Why are initiatives like this so important?

I often find myself in meetings counting the number of male versus female attendees. Too often, there are only one or two women in the room, surrounded by many more men.

In cyber, many men take for granted that they don’t have to overcome that initial sense of standing out before even contributing to the discussion or holding their ground. While we are making some progress in addressing the gender imbalance, initiatives like this are vital in keeping the spotlight on an issue that still matters deeply. They help encourage more women to put themselves forward, particularly where they may previously have hesitated, and to feel recognised and valued for the outstanding work they do, inspiring others along the way. 

Why should people nominate?

Nominations reinforce the value that female talent brings to our field. Diversity of thought, approach and communication is critical in cyber, a discipline that is as much about culture and behaviour as it is about technology.

Recognising and celebrating female talent strengthens that value proposition, especially when nominations come from male colleagues who see first-hand, and rely on, the expertise and impact that women bring to our teams.

What makes an ‘inspiring woman’ in cyber in your eyes?

Being in the minority in any environment can create invisible barriers and perceptions that are difficult to overcome. For me, an inspiring woman in cyber – a male-dominated field – is someone willing to step outside her comfort zone, try new things, take risks, and learn from setbacks.

Standing out in a male-dominated environment requires real courage, and that courage is inspiring in itself. We need more visible role models like this to attract more women into cyber and to show that it is a field where they can thrive, feel valued, and build rewarding careers.

Rebecca Taylor, Co-Author of Securely Yours: An Agony Aunts’ Guide To Surviving Cyber, and Threat Intelligence Knowledge Manager and Researcher at Sophos

Why are initiatives like this so important?

Initiatives like the ‘Most Inspiring Women in Cyber Awards 2026’ are so important because they shine a light on women who are accomplishing amazing things in an industry that is still largely male-dominated. Recognising these achievements in an inclusive and safe way helps ensure women feel seen, valued, and celebrated for their expertise and impact.

Beyond individual recognition, these initiatives also create visible role models. Seeing women celebrated for their achievements inspires others to enter the field, stay in the industry, and aim higher. It helps challenge outdated stereotypes, builds confidence, and fosters a stronger sense of community and belonging.

Ultimately, celebrating women in cyber isn’t just about awards – It’s about changing culture. It encourages equity, boosts morale, and helps build a more diverse, inclusive, and resilient cybersecurity industry for everyone.

Why should people nominate? 

People should nominate because recognition matters! Nominating is a powerful way to celebrate women who are accomplishing amazing things and making a real impact. Remember that a nomination (let alone a win!) can boost confidence, open doors to new opportunities, and remind someone that their work truly matters. Get those entries in!

What makes an ‘inspiring woman’ in cyber in your eyes?

In my eyes, an ‘inspiring woman in cyber’ is someone who brings others with them into the conversation. They lift people up, share knowledge, and create space for others to learn, grow, and feel they belong. They want to leave a positive footprint, not just through their work, but through the way they support and encourage those around them.  They are a role model, someone who shows what’s possible and inspires others to follow their own path in cyber with confidence and purpose.

It isn’t about money, job titles, or seniority. It’s about impact. An inspiring woman is thriving in what they do, and you can see that they genuinely love their work. That passion is contagious and motivating to others.

Joanne Elieli, Cyber Lead and Litigation Partner at Stephenson Harwood LLP at Stephenson Harwood LLP

Why are initiatives like this so important? 

Initiatives like this are instrumental in recognising and celebrating the achievements of women in cybersecurity, helping to raise their visibility and inspire others. These initiatives encourage diversity, challenge stereotypes, and can empower the women being recognised to stay and advance in the field. By providing networking opportunities and driving positive industry change, initiatives like this can also help to create a more inclusive and innovative cyber sector.

Why should people nominate? 

Nominating women in the cyber industry is a meaningful way to recognise and celebrate their expertise, dedication, and achievements. Formal nominations help to bring the contributions of our exceptional women to light, ensuring they receive the appreciation they deserve. This visibility can inspire other women and girls to pursue careers in cybersecurity, which in turn fosters a more diverse and inclusive industry.

What makes an ‘inspiring woman’ in cyber in your eyes?

An inspiring woman in cyber, in my eyes, is someone who demonstrates exceptional skill and dedication to her work while also uplifting and supporting others in the industry. She is passionate about solving complex problems and is eager to learn and adapt in a rapidly changing industry. Beyond her technical abilities, she actively shares her knowledge, mentors others, and advocates for diversity and inclusion. Her resilience in overcoming challenges and her willingness to break new ground make her a role model for both current and future generations in cybersecurity.

Jennifer Cox, Director of Solutions Engineering, EMEA/APAC, at Tines

Why are initiatives like this so important?

Women’s representation in cybersecurity still has a lot of ground to cover, and initiatives like this shine a light on those who are making an impact both technically and culturally. Recognition not only celebrates achievement but also helps change perceptions;  it shows the next generation that there’s space for them here, no matter their background or neurotype. When we platform diverse voices, we accelerate innovation and make our industry stronger, more inclusive, and more human.

Why should people nominate?

Nominating someone is a simple but powerful act of allyship and pride. Many brilliant women in cyber are so focused on lifting others up or doing the hard, often invisible work that they rarely stop to celebrate themselves. A nomination says, “I see you, I value what you’re doing, and you’re shaping this industry.” You never know who might need that encouragement to keep going or step into an even bigger role, and for other women just starting their cybersecurity careers visibility of these trailblazers and their capabilities is key.

What makes an ‘inspiring woman’ in cyber in your eyes?

For me, an inspiring woman in cyber is someone who leads with both competence and compassion. She’s technically grounded, but she also uses her voice and position to make space for others; especially those whose stories aren’t often heard. She’s authentic, curious, resilient, and not afraid to challenge the norm. Above all, she shows that success in cybersecurity isn’t about fitting a mould; it’s about rewriting it so more people can belong.

 

—

You can nominate here. 

The post Most Inspiring Women in Cyber 2026: Meet The Judges appeared first on IT Security Guru.

In Formula 1, milliseconds matter… and so does security. Keeper Security has helped Atlassian Williams F1 Team tighten its cyber defences, revealing how the iconic racing team is using KeeperPAM to protect its data, systems and global operations without taking its foot off the accelerator.

Announced on 13 January 2026, a new case study from Keeper Security details how Atlassian Williams F1 Team has overhauled its privileged access strategy using KeeperPAM, a unified, cloud-native Privileged Access Management (PAM) platform built on zero-trust and zero-knowledge principles. With terabytes of sensitive telemetry and performance data generated every race weekend, any breach, whether trackside or back at base, could be race-ending.

Unlike many organisations, Atlassian Williams F1 Team’s infrastructure isn’t parked in one place. It’s constantly on the move, travelling across more than 20 countries each season. From airports and paddocks to garages and headquarters, the team needed cybersecurity that could keep pace with a relentless global schedule without adding friction.

“We travel to more than 20 countries each season, and every week we’re in a new location,” said James Vowles, Team Principal, Atlassian Williams F1 Team. “Our infrastructure isn’t sitting safely in a single building – it’s traveling with us. That means we have to be secure wherever we are, from airports to garages to our HQ at Grove. With Keeper, we can build that fortress around our operations.”

KeeperPAM delivered that protection by putting zero trust at the heart of access control. Through role-based access, privileged session monitoring and automated provisioning, the platform allows Atlassian Williams F1 Team to enforce least privilege while keeping engineers and staff moving at racing speed.

The team has also streamlined operations by funnelling all privileged connections through a single platform, giving security teams better visibility and faster reaction times when something looks off.

“We now have a single platform where all of our connections go through,” said Harry Wilson, former Head of Information Security, Atlassian Williams F1 Team. “We can apply policies, monitor usage and generate alerts when something unexpected happens. Doing that on our server estate was critical to us.”

KeeperPAM brings together enterprise password management, secrets management, privileged session management, endpoint privilege management, secure remote access and dark web monitoring into one cloud-native platform. By replacing legacy tools with a single solution, Keeper Security says organisations gain real-time visibility, automated least-privilege enforcement and AI-driven threat detection, helping them spot threats before they cross the finish line.

For Atlassian Williams F1 Team, flexibility was just as important as control. Engineers occasionally need elevated access, but only when it’s genuinely required  and never longer than necessary.

“There are times when employees need local admin rights on a case-by-case basis,” added Wilson. “With Keeper, we can grant that access in real time and remove it automatically, which gives us confidence that privileged access is always controlled and temporary.”

Keeper Security believes modern PAM needs to work quietly in the background, more like a finely tuned race engine than a heavy braking system.

“Modern PAM has to do more than secure credentials. It has to automate provisioning, rotate secrets and eliminate standing privileges – all without burdening IT teams,” said Craig Lurey, CTO and Co-founder, Keeper Security. “That’s why we designed KeeperPAM to replace complexity with automation, freeing organisations like Atlassian Williams F1 Team to focus on what they do best.”

By centralising all credentials within a zero-knowledge environment, Atlassian Williams F1 Team has eliminated plaintext exposure while automating the provisioning and deprovisioning of privileged access. The result is lower operational overhead for IT teams and fewer roadblocks for engineers pushing performance innovation.

With KeeperPAM in place, Atlassian Williams F1 Team can now operate securely on any device, on any network, anywhere in the world. In a sport where marginal gains make all the difference, cybersecurity has become another competitive edge, helping the team stay secure, agile and firmly in the race.

The post Keeper Security puts Atlassian Williams F1 Team in pole position on cybersecurity appeared first on IT Security Guru.

BreachForums, one of the most well-known English-language cybercrime forums, has reportedly suffered a data breach, exposing user information after the site was taken offline once again.

As reported by The Register, a database linked to the forum was leaked online, potentially revealing account details, private messages and metadata on close to 325,000 accounts. However, security researchers caution that while the leak may attract attention, its intelligence value and authenticity remain uncertain.

Michael Tigges, Senior Security Operations Analyst at Huntress, said the dataset should be treated with caution.

“This data leak, while potentially useful for authorities and security professionals researching adversarial activities, is ultimately of limited forensics use,” he said.

“While the database leak may be legitimate, the integrity is called into question as it was derived from another cybercrime group, ShinyHunters.”

He added that such leaks are sometimes used to infer links between threat actors, but warned that datasets may be incomplete, selectively modified, or deliberately misleading.

“The reliability of the information must be highly scrutinised, as it may not be legitimate data or could be altered to disguise or prevent disclosure of information,” Tigges said.

Criminal trust continues to erode

The breach is likely to further undermine confidence in BreachForums among cybercriminals, following a series of takedowns and reappearances over recent years.

Gavin Knapp, Cyber Threat Intelligence Principal Lead at Bridewell, said the platform’s turbulent history has already damaged its credibility.

“Criminals are likely questioning its credibility and losing trust in it, and it’s often referred to as a potential honeypot for law enforcement,” Knapp said.

Knapp noted that the real-world impact of the leak depends largely on the operational security (OPSEC) practices of individual users.

“The data leak is obviously a problem for legitimate accounts used for crime, as opposed to sock-puppet accounts used by researchers or law enforcement,” he said.

“However, the impact depends on whether users exposed information that could be linked back to a real-world identity, such as unique email addresses or reused passwords.”

He added that the same risks apply to investigators and researchers who may also face exposure if poor OPSEC was used, and that it remains unclear how current or complete the leaked data is.

Limited underground reaction

Despite the publicity surrounding the breach, reaction within cybercrime communities appears muted.

Michele Campobasso, Senior Security Researcher at Forescout, said responses across underground forums have been limited or dismissive.

“On one of the XSS forum forks following the takedown, some users responded with sarcasm,” he said.

“In other underground forums and communities where we have access, we found no reaction on the topic.”

This lack of engagement may reflect growing scepticism among threat actors toward long-running forums, many of which are viewed as compromised or unreliable.

Disputed links to ShinyHunters

The breach has also prompted speculation around the involvement of the ShinyHunters extortion group, although responsibility remains disputed.

Campobasso said that while there is no conclusive evidence linking ShinyHunters to the leak, the claim is not implausible given recurring references to a figure known as “James” across multiple iterations of the shinyhunte[.]rs website.

Cached versions of the site show repeated mentions of “James”, including defacement messages, accusations from other group members, and a manifesto attributed to the same pseudonym. Linguistic patterns in the text suggest possible French influence, although Campobasso cautioned against drawing firm conclusions.

“It is possible that either the data leak was performed by James, or that someone is attempting to frame them in order to disrupt their reputation within the cybercriminal ecosystem,” he said.

A familiar pattern

Ultimately, the BreachForums incident highlights a recurring issue within cybercrime communities: instability, internal conflict and declining trust.

For defenders, the breach reminds them that leaked criminal datasets should be treated carefully, validated rigorously and never assumed to be complete or accurate, even when they appear to offer rare insight into adversary activity.

The post BreachForums Data Leak Raises Fresh Questions Over Credibility appeared first on IT Security Guru.

This week, Keeper Security the launch of its JetBrains extension, offering JetBrains Integrated Development Environment (IDE) users a secure and seamless way to manage secrets within their development workflows. By integrating directly with the Keeper Vault, developers can replace hardcoded secrets with vault references and execute commands using injected credentials, ensuring sensitive data remains protected at every stage of development. 

Secure secrets management protects the credentials, API keys, tokens and certificates that applications rely on to function safely. When these secrets are mishandled, such as being stored in plaintext, hardcoded into source code or shared insecurely, they become easy targets for attackers. The Keeper JetBrains extension eliminates these risks by allowing developers to store, retrieve and generate secrets from the Keeper Vault without leaving their IDE.

Unlike standalone plug-ins or external vault tools that rely on third-party servers, the Keeper JetBrains extension operates within a zero-knowledge architecture, ensuring all encryption and decryption occur locally on the user’s device. Integrated natively with Keeper Secrets Manager and KeeperPAM®, it brings enterprise-grade privilege controls directly into the developer’s workflow to deliver strong security without slowing down development. 

“Modern software development demands security at every layer,” said Craig Lurey, CTO and Co-founder of Keeper Security. “Integrating Keeper into JetBrains ensures developers can apply secure-by-design principles from the start, eliminating hardcoded credentials and strengthening the integrity of the software supply chain.”

The Keeper JetBrains extension provides a range of powerful capabilities, including secrets management that allows users to save, retrieve, and generate secrets directly from the Keeper Vault. It also supports secure command execution by enabling applications to run with secrets safely injected from the vault. In addition, the extension offers logging and debugging tools, giving users access to logs and the ability to enable debug mode for full operational transparency, and it supports cross-platform use across Windows, macOS, and Linux environments.

The JetBrains extension builds on Keeper’s broader KeeperPAM® platform, an AI-enabled, cloud-native privileged access management solution that unifies password, secrets, connection and endpoint management under a zero-trust, zero-knowledge framework. 

 

The post Keeper Security Launches JetBrains Extension appeared first on IT Security Guru.

A cyber attack on shared IT systems used by several London councils has resulted in the theft of personal data relating to thousands of residents, raising renewed concerns about the resilience of local government cyber security and the risks posed by interconnected public-sector infrastructure.

Kensington and Chelsea Council confirmed that sensitive personal information was accessed during the incident, which also disrupted services across neighbouring boroughs. The attack prompted swift intervention from the National Cyber Security Centre (NCSC) and the Metropolitan Police, underlining the seriousness of the breach.

Cyber security leaders warn that the incident reflects a broader and accelerating threat to public-sector organisations. Darren Guccione, CEO and co-founder of Keeper Security, noted that this is the second significant cyber incident affecting a UK local authority in less than two months, highlighting how persistently councils are being targeted.

“Councils and other arms of government remain high-value targets for cybercrime because they hold extensive sensitive personal data and operate interconnected, often legacy, systems that are both attractive to attackers and difficult to defend at scale,” Guccione said. He added that the frequency of these attacks suggests adversaries are shifting away from opportunistic intrusion towards sustained and sophisticated campaigns designed to exploit systemic weaknesses and undermine public trust.

The technical characteristics of the attack have also raised alarm among experts. Graeme Stewart, head of public sector at Check Point, said the incident shows “all the signs of a serious intrusion”, citing multiple boroughs being taken offline and internal warnings instructing staff to avoid emails from partner councils.

“That’s classic behaviour when attackers get hold of credentials or move laterally through a shared environment,” Stewart said. “Once they’re inside one part of the network, they can hop through connected systems far faster than most councils can respond.”

Stewart added that the rapid shutdown of services suggests authorities feared escalation into encryption or large-scale data theft. “Councils hold incredibly sensitive material – social-care files, identity documents, housing records. If attackers got near that, the fallout wouldn’t stay local,” he warned.

The incident has also highlighted the risks created by shared and centralised IT platforms across local government. Dray Agha, senior manager of security operations at Huntress, described such environments as a “double-edged sword”.

“While shared systems are efficient, the breach of one council can instantly compromise its partners, crippling essential services for hundreds of thousands of residents,” Agha said. He stressed the need to move beyond purely cost-driven IT strategies and towards segmented, resilient architectures capable of containing attacks before they spread.

For residents affected by the breach, the immediate concern is how their personal information may be misused. Chris Hauk, consumer privacy advocate at Pixel Privacy, urged individuals to remain vigilant for phishing and fraud attempts, while calling on the council to provide tangible support.

“People that have had their data exposed should stay alert for phishing schemes and other scams,” Hauk said. He added that Kensington and Chelsea Council should offer free credit monitoring to affected residents, noting that government bodies frequently expect private-sector organisations to do the same following similar breaches.

Transparency will be critical in limiting long-term harm, according to Paul Bischoff, consumer privacy advocate at Comparitech. He called on the council to clarify what types of personal data were compromised as quickly as possible.

“Until then, victims cannot make informed choices about how to protect their personal information and finances,” Bischoff said. He noted that attackers have already published a proof pack containing sample stolen documents – a common tactic used by ransomware groups to substantiate their claims and apply pressure. “Based on our research into hundreds of ransomware attacks, the vast majority of these claims are legitimate,” he added.

At a policy level, Guccione pointed to the UK Government’s recently launched Cyber Action Plan, which includes more than £210 million in funding and the creation of a new Government Cyber Unit to improve coordination and resilience across public services.

“The plan is a positive development in recognising the cross-government nature of this challenge,” he said, but warned that central initiatives must be matched by action at the organisational level. He urged public-sector bodies to accelerate adoption of identity-centric security models, enforce stronger access controls, segment networks to limit lateral movement and implement continuous monitoring.

“Only by elevating cybersecurity from a technical afterthought to a core governance priority can public services reduce their exposure to increasingly persistent attacks and maintain citizens’ trust in the digital services they rely on,” Guccione said.

As investigations continue, the incident is expected to intensify scrutiny of cyber maturity across UK local authorities, many of which continue to deliver critical digital services under tight budgets and complex operational constraints.

The post London council cyber attack exposes personal data and highlights risks of shared public-sector IT appeared first on IT Security Guru.

Critical thinking and media literacy are now seen as essential skills for young people, yet many schools lack the resources to teach them, according to new research with teachers, commissioned for BBC Bitesize. Over half of teachers say they need more support to help pupils identify misinformation, as teens increasingly struggle to separate fact from fiction online, a challenge linked to rising anxiety levels.

To bridge this gap, BBC Bitesize is launching Solve the Story, a six-part media literacy series designed to equip students, teachers, and schools with practical tools to tackle misinformation and disinformation. Premiering in schools on 5 January 2026, the series forms part of the Bitesize Other Side of the Story initiative and will help teenagers question what they see online, verify sources, spot fakes, and understand how misleading narratives spread.

The roll-out comes amid mounting evidence that young people are struggling to manage the sheer scale and sophistication of online content. According to research commissioned by the BBC involving more than 400 teachers, critical thinking is now considered the single most important skill for young people, yet one in three teachers say it is difficult to teach, citing lack of time, resources and curriculum pressure.

More than half of the teachers who took part in the research said they need more support in helping pupils recognise misinformation, and that media literacy is not covered well enough in the current curriculum. Teachers also warn that students are already “outpacing adults” online, with the rate of digital change widening the skills gap in the classroom. The research also suggests that parents echoed this concern, as many felt their own digital skills were already outdated.

For young people, the effect of misinformation reaches far beyond the classroom as the impact is emotional as well as educational. New findings from this year’s Bitesize Teen Summit with Radio 5 Live, suggests that two thirds of teenagers worry about fake news and online misinformation, causing confusion and contributing to rising levels of stress and anxiety.

Patricia Hidalgo, Director of BBC Children’s and Education said: “In today’s digital landscape, media literacy isn’t a luxury, it’s a necessity. Solve The Story will help schools to equip young people with the critical thinking tools they need to navigate online content confidently, verify what they see, and protect their mental well‑being. This series is a vital next step towards empowering students and supporting educators in tackling misinformation, as we take Other Side of the Story into classrooms.”

Available to schools and on the BBC Bitesize website, Solve the Story uses a six-part mystery series in which characters must apply media literacy skills to uncover the truth, by analysing sources, questioning assumptions, identifying deepfakes, challenging viral claims and spotting bias. Each episode is paired with a “how-to” guide offering clear, practical steps for teachers and resources for classroom use.

Hundreds of schools up and down the country have already signed up to take part in the January launch, signalling strong demand for classroom-ready tools to help pupils navigate online misinformation. The first episode will be shown in schools on 6 January, with new episodes released weekly until the finale event in February.

Solve the Story is the first content series created for us in schools from the Bitesize Other Side of the Story, that was launched in 2021 to help students navigate the online world and be more critical of the information they consume. Bitesize Other Side of the Story provides articles, videos, quizzes and other resources and workshops in secondary schools that to help students be more curious about the news and information they see and share online. It also equips them with the tools to be create content responsibly, stay safe online and avoid scams, be more aware of different types of media, think more critically and become more positive digital citizens.

The BBC commissioner for Solve The Story is Andrew Swanson.

The video content can be found https://www.bbc.co.uk/bitesize/groups/c4gqzw1kxn6tand Other Side of The Story can be found https://www.bbc.co.uk/bitesize/groups/c0rx3447znvt

 

TEACHER CASE STUDY

Amy, English Teacher, Manchester

“CRIMINALS USE THAT KIND OF MISINFORMATION TO LURE VULNERABLE KIDS IN BY SHOWING THEM A GLAMOROUS LIFESTYLE”

Amy, an English teacher at a secondary school in Manchester, sees first-hand how quickly misinformation online shapes what her students believe. One of the most alarming examples is how many genuinely think glamorous “prison freestyle” videos on social media are accurate depictions of real life.

“They really believe that’s what prison is like,” she says. “The videos make it look easy or exciting. Criminals use that kind of misinformation to lure vulnerable kids in by showing them a glamorous lifestyle and telling them crime can get them there. That’s what scares me the most.”

But the prison clips are just one part of a much bigger issue. Amy says many of her pupils are convinced they’re “too smart” to be tricked by anything online.

“They’ll laugh at obviously fake AI videos and say, ‘that’s so AI’, but underneath that is a belief that they can’t be fooled. If I tell them something isn’t real, they argue back. They think teachers don’t understand technology, and they automatically trust what they see online more than what we tell them.”

She has seen conspiracy theories spill directly into schoolwork.

“We’ve had essays referencing ‘the matrix’ and huge conspiracy theories, because they’ve come from influencers like Andrew Tate. Those opinions really appeal to them because they’re presented as ‘facts’. It’s frightening how quickly those ideas embed.”

Challenging this isn’t always straightforward.

“Teenagers don’t want to believe anything that contradicts what they’ve seen on TikTok or YouTube. Sometimes they push back so hard that it becomes something we pick up with safeguarding, simply because it needs a wider team around it. Mentors and form tutors help us challenge the misinformation as a team.”

Social pressures add another layer.

“Their friendship groups feel like they span the whole internet, so the biggest fear is embarrassment. Anything taken out of context can spread quickly, and at our school the fear of parents seeing them do something they shouldn’t is huge. The consequences feel enormous to them.”

Amy says traditional critical-thinking lessons aren’t enough on their own.

“We teach those skills in English, but once they’re at home, school doesn’t exist. They need practical tools that match the world they’re actually living in.”

That’s why she believes Solve the Story could make a real difference.

“They love short-form content, and this format suits their attention span. If teachers show it to them, it will help them stop and question things instead of just accepting whatever they scroll past. They won’t look for it themselves, so teacher buy-in is essential, but once it’s in front of them, it will click.”

Amy sees media literacy as part of her duty of care.

“Some understand the problem, so they can’t push back on what their children are watching. It falls to us to teach them how to protect themselves. They need these skills more than ever.”

The post BBC Bitesize Launches Media Literacy Series To Help Teens Separate Fact From Fiction Online appeared first on IT Security Guru.

Remote-first companies are no longer an exception. What began as a temporary response to global disruption has evolved into a long-term operating model for startups, scaleups, and even established enterprises. Distributed teams, cloud-based tools, and borderless hiring have unlocked flexibility and talent access—but they have also introduced new cybersecurity and compliance challenges.

One often-overlooked factor in managing these risks is business structure. How a company is legally formed, governed, and registered plays a critical role in determining its cybersecurity responsibilities, regulatory exposure, and ability to respond to incidents. For remote-first companies, structure is not just a legal formality—it is a foundational element of cyber resilience.

Business Structure Shapes Compliance Obligations

Every company operates within a legal framework that defines its obligations around data protection, record keeping, and reporting. These obligations vary significantly depending on whether a business is incorporated, operating as a sole trader, or functioning through informal arrangements.

A formally structured business is more likely to have clearly defined accountability. Directors, officers, and data controllers are identified, which matters when regulators assess responsibility after a data breach. In contrast, loosely structured or improperly registered businesses often struggle to demonstrate who is responsible for cybersecurity decisions, policies, and failures.

For remote-first companies handling customer data across multiple jurisdictions, clarity of structure becomes essential. Regulators typically look first at the legal entity when determining which laws apply and who must answer for compliance failures.

Cybersecurity Policies Depend on Legal Identity

Cybersecurity compliance is not just about technical controls; it also involves policies, contracts, and governance. Business structure influences all three.

Employment contracts, contractor agreements, and vendor relationships must align with the company’s legal identity. A properly formed company can implement standardized security policies, data processing agreements, and incident response protocols. These documents are often required under regulations such as GDPR, even for small or remote-first businesses.

Without a clear structure, remote-first teams may rely on informal tools, shared accounts, or undocumented processes—practices that significantly increase security risk. Legal formation helps enforce separation between personal and business systems, reducing exposure when devices are lost, compromised, or misused.

Cross-Border Teams Increase Risk Without Structure

Remote-first companies frequently operate across borders, hiring talent wherever skills are available. While this offers strategic advantages, it also introduces complexity around data residency, access controls, and jurisdictional compliance.

A defined business structure helps anchor these complexities. It establishes a primary legal home for the company, which regulators and partners use as a reference point. For example, many founders choose company formation in UK because it provides a clear corporate framework, predictable regulatory standards, and alignment with international data protection norms—factors that simplify compliance planning for distributed teams.

Without such anchoring, companies may unintentionally violate local data laws or struggle to demonstrate compliance during audits or investigations.

Incident Response and Liability Management

Cyber incidents are not a matter of if, but when. How a company is structured affects how effectively it can respond to breaches and limit damage.

A properly incorporated business can:

• Appoint responsible officers for data protection and security
• Maintain incident response plans tied to legal obligations
• Communicate with regulators, clients, and partners through formal channels
• Access insurance products that require clear legal status

In contrast, poorly structured businesses often face delayed responses, unclear communication, and increased liability. Regulators may impose heavier penalties when they believe negligence stems from inadequate governance rather than technical failure.

Investor and Partner Expectations

Cybersecurity is now a core concern for investors, enterprise clients, and strategic partners. Due diligence processes increasingly examine not just security tools, but governance and legal structure.

Remote-first companies with clear formation, documented policies, and defined accountability are viewed as lower risk. This can affect access to funding, partnerships, and enterprise contracts. Conversely, informal or ambiguous structures raise red flags, especially when sensitive data or regulated industries are involved.

Structure Enables Security Maturity

Cybersecurity maturity develops over time. Early-stage companies may rely on basic controls, but as operations scale, expectations increase. Business structure enables this progression by providing a framework for:

• Assigning roles and responsibilities
• Budgeting for security investments
• Auditing systems and processes
• Demonstrating compliance to third parties

Remote-first companies that delay proper structuring often find themselves retrofitting compliance under pressure—an expensive and risky approach.

Final Thoughts

Remote-first work is here to stay, but it demands a more deliberate approach to cybersecurity. Technical tools alone are not enough. Legal and organizational structure underpins everything from policy enforcement to regulatory compliance and incident response.

For remote-first companies, business structure is not an administrative afterthought. It is a strategic decision that shapes how securely and sustainably the organization can operate in a digital, distributed world. By aligning structure with cybersecurity obligations early, companies position themselves to scale with confidence rather than react under crisis.

The post Why Business Structure Matters for Cybersecurity Compliance in Remote-First Companies appeared first on IT Security Guru.

We’re on the edge of something interesting in the industry right now, and it’s the transformation of the modern SOC.

We Know the Problem

Everyone knows that security operations centres are faced with too much, too hard, and too fast – not to mention too confusing. We know the stats: thanks to the cyber talent crunch, limited resources, and a ton of new attacks (thanks, bots and AI), 40% of alerts get ignored. Even worse, 61% of security teams admit to ignoring alerts that later proved to be critical incidents.

We’ve Dipped Our Toe in the Solution

The simple answer is “figure out how to get less alerts.” Check. Reducing noise is key. But once you do, is the problem solved?

No, but you’re on the right track. The next step is where the transformation really takes place, and where the industry is looking to go next. We’ve talked noise reduction, but now, what we need when we’ve only got a few (ish) alerts is to know is which one of those is worth our time? If we can only get to five a day, which ones should we be going after? And what determines what comes next on our roster?

Let’s Go All the Way

The answer is risk. You need to prioritise those remaining few (hundred) alerts by risk, which is a multifaceted project, then streamline remediations based on which ones present the biggest, most immediate, or most impactful threat.

Reducing noise is a good start, but it’s only that. Here’s where we jump off, and how to build a risk-first alert pipeline that analysts trust. And that will truly have the power to transform the SOC.

First, Let’s Talk Noise Reduction

Before we jump to the conclusion, let’s orient ourselves and look at where we’ve come from.

Nobody Can Function with Alert Fatigue

Faced with an average of 83 different tools from 29 different vendors, SOCs are forced to wade through deluges of data to find the rare, true positive needle in a haystack.

It doesn’t come easy, and SOCs waste most of their time looking. That’s why it’s so important to, before anything else can get better, cut the noise. Prophet Security, an AI SOC Platform company, does a great job of explaining the process of reducing alert fatigue, but then adds this insightful conclusion: “Do not chase volume alone. Reducing alert count without measuring risk impact creates blind spots.”

Cutting Down Alerts? It’s a Good Start

And this is the jumping off point. Having fewer alerts is, well, good. But those still have to be actioned on and someone has to decide which comes first. Typically, SOCs make that decision based on severity scores. It’s the way the industry does things, it’s the way we’ve always done things.

But these days, security no longer exists in a vacuum and “how big a deal” a certain exposure is really doesn’t matter if it isn’t a big deal to the business. Today, all security priorities are intrinsically tied to business objectives – it’s about time! – which means that the alerts that represent the biggest overall business risk are the ones that need to be taken care of first.

So, how do you do that?

Determining Risk to the Business: The Real Metric

We’ve carried the ball halfway down the court, and now it’s time to sink it in. To really help SOCs out, any sort of automated SOC tool needs to do more than cut down on noise. It needs to tell you what to do with the alerts that are left, and tie those decisions transparently to:

• Asset criticality. Is this a moderate severity vuln on a database holding cardholder information? That’s huge. Or is it a critical vulnerability on a stale on-premises database that holds no secrets? Not as big of a deal.
• How likely is this to be exploited? Are there currently strong security controls surrounding this asset, blocking any potential attacks? We can wait on the fix, then. Are there zero policies in place, meaning all an attacker has to do is compromise this one weakness and they’re in? Put that higher on the list.
• Risk to the business. If this vulnerable system goes down, what’s the worst that can happen? Is it a SCADA system or an API connecting highly regulated data? Priority one. Is it a retired server that’s been languishing in the digital corner? You get the point.

Looking at these other angles shows why simple severity scores won’t cut it. They say nothing of the context around the exposure; what it’s putting at risk, how real that risk might be, the impact if that risk becomes a real threat or gets exploited.

All these things need to be taken into account by your automated SOC tool if it’s going to do more than give you more puzzles to solve. SOCs have enough on their plates; these types of answers should come standard.

So, what’s the technology that can get it done?

A Modern, Risk-First Alert Pipeline

When looking for the right AI SOC platform, it needs to be one that will do this sort of math for you, not take out a bunch of alerts, hand you the rest, and say “good luck.”

That’s why you want one with a modern, risk-first alert pipeline. This sounds like a bunch of security-ish buzzwords strung together with hyphens, but it’s really where the magic takes place.

Can AI Help? Yes.

But first, does AI help? In 2025, you don’t have to ask. Yes, artificial intelligence helps in this whole process. Like with most technologies, applying AI, generative AI, machine learning, agentic AI, natural language processing, and everything AI can move the needle significantly; but only when used in the right way.

Building Out Alerts by True Risk

Here’s what a risk-first alert pipeline looks like in action:

1. Upstream Filtering: AI agents, especially agentic AI agents, ingest alerts and analyse them (early in the pipeline, or at the source). They filter out false positives here, leaving less mess to work with downstream.
2. User Behaviour: Helps filter out false positives by comparing normal baselines to existing identity and session activity.
3. Contextual Enrichment: Using only the alerts that aren’t marked duplicates or false positives, autonomous AI agents get to work. They gather and correlate data from all relevant sources (SIEMs, cloud logs, identity platforms, EDR) to build the beefed-up attack story and deliver SOCs alerts they can use. Right away.
4. Contextual Reasoning: You can’t chase dynamic threats with static rules. Agile, agentic AI agents “think” on the spot (using LLMs and domain-specific data) to make conclusions about the evidence, ask investigative questions, and come up with next steps.
5. Blended Scoring: The ultimate, prioritised list should be one where multiple factors have been taken into account: severity (yes), context (SIEMs, EDR, etc.), behavioural analytics (does surrounding system behaviour deviate from the norm?), and confidence scoring (how “right” the AI thinks its reasoning is, so SOCs know what they’re working with). All AI-based decisions should be transparent and auditable to boost trust; no “black box” scoring.

The result is that you get your alerts not only thinned out, but organised by order of importance to the business, not an arbitrary security scoring chart. Don’t misunderstand; severity needs to be factored in, too. It just can’t be the only factor.

The Benefit of a Risk-First Alert Model

With a risk-first alert model, SOCs can place their limited resources where it counts, instead of chasing down alerts that may not have been the best use of company time.

This means that security teams look really good when presenting to boards at the end of the year, and that non-security board members can immediately grasp why SOCs did what they did, how that positively impacted the business, and where their money was going.

And, most importantly, be happy with it.

The post From noise to signal: Building a risk-first alert pipeline that analysts trust appeared first on IT Security Guru.

Private aviation’s typical buyer used to be straightforward: corporate executive, mid-50s, established wealth. That profile is still prominent, but it’s changing fast.

Buyers under 45 now account for 29% of pre-owned private jet transactions, nearly double their share from a decade ago, according to Jetcraft’s 2025 market report. These younger buyers are also spending more: averaging $25 million per transaction, 31% higher than their older counterparts. Many have made fortunes in technology, entertainment, and finance. Others inherited substantial wealth earlier than previous generations as part of what wealth advisors call the Great Wealth Transfer: $90 trillion in assets moving from baby boomers to younger generations over the next two decades.

What they want looks somewhat different from what their predecessors wanted. The question is whether aviation’s traditional sales infrastructure can adapt.

Sergey Petrossov, the Managing Partner of Aero Ventures, believes his company is at the forefront of this change.

“By solving for the two biggest pain points, lack of information and slow delivery, we believe Aero Ventures will become the hub where the world’s most discerning aviation clients begin and manage every major ownership decision,” he told Sherpa Report.

The firm’s AI-driven platform targets those pain points by providing instant valuations and ownership cost simulations, tools addressing buyers who expect immediate access to data whether they’re 35 or 65.

The Productivity-First Buyer

Remote work reshaped how younger high-net-worth individuals approach aviation. A 2025 survey found 81% of affluent 18-35 year-olds work remotely. That demographic enters private aviation younger than previous generations, prioritizing functional amenities like high-speed connectivity, wellness features, and productivity tools.

They want jets functioning as airborne offices. The Gulfstream with mahogany paneling matters less than whether the Wi-Fi handles video conferences reliably.

George Galanopoulos, CEO of Luxaviation UK, described the shift in a recent interview with Inflight. “Millennials, broadly those in their 30s and early 40s, now account for more than half of our business jet charter clients. These are clients who value efficiency over formality, digital access over legacy prestige, and experiences that feel personal.”

Different Entry Points, Different Expectations

Aviation buyers arrive at ownership through varied paths. Some build relationships with brokers over years through charter programs or fractional ownership, developing industry connections and understanding pricing dynamics through long-term advisory relationships. Others enter aviation suddenly and without established broker networks, spurred on by a company sale, inheritance, or rapid business growth.

The challenge emerges when buyers accustomed to digital platforms for other major purchases encounter aviation’s traditionally relationship-driven sales model. It may feel like they are purchasing eight-figure assets with less immediately accessible information than they’d get researching a $50,000 car.

Sergey Petrossov sees the disconnect. “Today, most aircraft sales require weeks of back-and-forth, incomplete information, and outdated valuations,” he told Sherpa Report.

His assessment reflects broader industry data: aircraft transactions still averaged 207 days from listing to closing in 2024.

Platform Access Without Commitment

Aero Ventures’ AI-driven platform was designed to address information asymmetry. Users can access aircraft valuations, ownership cost simulations, and market comparables without engaging brokers initially. The model mirrors what successful real estate platforms like Zillow have done for real estate: provide enough data for buyers to explore options independently before committing to transactions.

The platform generates instant fair market values using AI-based systems tracking transaction data and market comparables. Users can model scenarios like flying 200 hours annually versus 400 hours to understand total cost implications. The system tracks inventory levels and absorption rates across aircraft types, showing whether current conditions favor buyers or sellers.

“Rather than trying to take the human out of the process, the Marketplace serves as an entry point for engagement, letting clients ‘window shop’ and experiment with different ownership scenarios,” Petrossov explained to Sherpa Report.

The concept offers an alternative entry point for buyers who prefer preliminary exploration before advisory engagement. Some buyers want immediate broker consultation. Others prefer researching independently first. Both paths ultimately lead to human expertise for transaction execution.

Maintaining Human Expertise

Aircraft transactions involve bespoke financing, maintenance status assessments, regulatory compliance across jurisdictions, insurance considerations. Automated valuations provide starting points, but closing deals requires interpreting data through operational expertise.

All buyers, regardless of how they enter the market, recognize multimillion dollar purchases demand human expertise at some stage. The question is when that expertise enters the process.

Aero Ventures positions its platform as complementing rather than replacing advisory relationships. The firm targets “qualified buyers and sellers, typically focused on aircraft in the ten million dollar and above range,” according to Petrossov.

Aviation sales have evolved to serve buyers through multiple channels: traditional broker relationships built over years, digital platforms providing immediate data access, or hybrid models combining both.

Platform tools might appeal to buyers entering aviation without established broker networks. Traditional advisory relationships continue serving buyers who value long-term consultation and discretion. The industry is accommodating both approaches rather than replacing one with the other.

Aviation’s relationship-driven culture persists because transactions remain complex enough that human expertise adds genuine value. For Petrossov and Aero ventures, the hope is that digital tools enhance that expertise and reshape how buyers access it.

The post Sergey Petrossov’s Aero Ventures Addresses Aviation’s Younger, Tech-Focused Buyer Demographic appeared first on IT Security Guru.

As automated attack networks grow larger and more sophisticated, security teams are struggling to keep pace with a surge in malicious bot activity that is reshaping the DDoS threat landscape

In December 2025, Solana experienced one of the largest DDoS attacks in history, with traffic peaking at 6 Tbps. Although the attack continued over more than a week, Solana reported zero network down time. Had the attack succeeded, it could have scammed everyday retail investors out of millions.

Absorbing such a high volume of requests can’t be handled by instituting simple rate limits or perimeter controls, which raises questions about what effective DDoS protection looks like heading into 2026.

One big issue businesses have to tackle is the extent to which automated traffic has become normalised in the modern internet, blurring the line between legitimate and potentially dangerous. Let’s unpack these issues to understand how DDoS protection needs to evolve in this new traffic reality.

Bot Traffic at Record Levels

Automated traffic now makes up more than half of all web traffic. One recent report found that at the start of 2025, non-AI bots alone were responsible for roughly 50% of all HTML requests, and during peak periods, bot traffic exceeded human traffic by up to 25 percentage points.

Whether friendly or malicious, bot traffic behaves similarly at a technical level. It comes with high-frequency requests and not much deviance in interaction patterns. This creates a dilemma for defenders. If they block or apply rate-limiting too aggressively, they risk breaking core services such as APIs, integrations, mobile apps, and background processes that depend on legitimate, automated access to backend systems.

What’s more, malicious actors can “hide” among the noise of normal automation, making early-stage DDoS activity harder to detect.

Modern DDoS Attacks Are Multi-Layered

Modern DDoS attacks are multi-vector, meaning they hit multiple layers of the stack at once. Typically, this involves pairing a network flood (Layer 3) with an application layer or HTTP/API flood (Layer 7).

Traditional DDoS protection mainly covers the network layer, which deals with raw volume. However, attacks on the application layer do not require much volume to do damage. They trigger expensive backend work in the form of repeated page loads, authentication flows, and other operations that exhaust resources and slow down or break the application.

It’s worth noting that volumetric network-layer attacks are still extremely common, mainly because they are cheap to launch and still effective for stressing the target environment at the perimeter.

What’s Breaking and Why Defenders Are Struggling

One of the main challenges for defenders today when addressing the DDoS issue is establishing a reliable baseline of “normal” traffic. Automated traffic makes up an increasing proportion of overall activity, making the baseline noisy, repetitive, and non-human, which are the same characteristics traditionally used to spot malicious behaviour.

The main pain point is tuning protections in a way that blocks attack signatures without generating a high number of false positives. Overly aggressive rules risk blocking real users, while conservative tuning gives attackers room to operate.

Another detection bottleneck is that not all DDoS attacks today aim to take services fully offline. An increasingly common tactic is cost-exhaustion or “economic” DDoS, usually targeting applications. These attacks aim to silently degrade performance and drive up infrastructure costs. They are difficult to detect, because they often stay within normal-looking traffic patterns.

Then there is the dilemma of where to deploy defences. For many organisations, DDoS protection only focuses on absorbing or filtering raw traffic volume at the network layer. But as DDoS attacks are evolving into multi-vector campaigns, it may be time to consider solutions that tackle all layers of the stack.

What Effective DDoS Protection Looks Like Today

Effective DDoS protection today starts with how attacks are detected. High request rates should not be the only metric. Detection must shift toward behaviour-based analysis, examining how requests behave over time, how they interact with specific endpoints, and whether patterns deviate from expected usage for that service.

Detection alone is not enough. Mitigation is what actually matters when handling DDoS attacks, and it must be automatic and fast. In this context, automated mitigation means to rate-limit, challenge, or block abusive traffic in real time, with the goal of maintaining service even when an attack is unfolding.

Effective protection requires visibility and controls across all layers. Network-layer protection is typically handled by ISPs, cloud providers, or dedicated DDoS mitigation services designed to scale quickly under load.

To address application- and API-layer attacks, organisations must deploy controls closer to the application itself, where request context and behaviour are visible. This is commonly done through application delivery controllers, web application firewalls (WAFs), API gateways, or integrated WAAP platforms that sit in front of critical services.

Bot traffic has become the dominant form of internet activity, which changes the dynamics of how DDoS attacks are executed and defended against. At the same time, DDoS attacks remain easy to launch and increasingly common, with over 8 million recorded in the first half of 2025 alone.

For many organisations, even short disruptions can impact availability, performance, and user trust. As we move into 2026 and beyond, it’s clear that DDoS can no longer be treated as a secondary risk. It is a core availability challenge that requires modern, layered defences built to withstand today’s traffic reality.

The post DDoS Protection Faces Fresh Challenges As Bot Traffic Reaches New Peak appeared first on IT Security Guru.

As Santa starts his travels, experts are warning that his arrival could bring with it a range of cyber risks, from scams to insecure gadgets.

Whilst Santa prefers to deliver via chimney, most cybercriminals are looking for backdoors. In some cases, hackers prefer to deliver malicious communications via email. Worryingly, in 2025, scams are not just more common, they’re often harder to spot. Earlier this month, researchers from the team at Check Point detected 33,502 Christmas-themed phishing emails in the first two weeks of December, along with more than 10,000 fake advertisements being created daily on social media channels. Many mimic festive promotions, while others push fake Walmart or Home Depot deals, fraudulent charity appeals, and urgent delivery notices.

Why is this time of year so popular for cybercriminals? Ian Porteous, Regional Director, Security Engineering, UK & Ireland at Check Point Software, notes that “Cybercriminals love Christmas just as much as shoppers do, but for all the wrong reasons. This time of year, people are more exposed due to the sheer volume of digital interactions – shopping online, sending e-cards, and grabbing festive deals. That makes it the perfect opportunity for scammers.”

Which other types of attacks should consumers look out for?

Javvad Malik, Lead CISO Advisor at KnowBe4, highlighted a range of common festive scams that consumers should be alert to during the Christmas period. He warned that these include “fake courier messages – like texts from Royal Mail, DPD, Evri etc”, often claiming “we tried and failed to deliver” or asking recipients to “pay a small fee to release it”. Malik also pointed to deals that are too good to be true, such as “ridiculous savings, 90% off named brands”, as well as gift card scams and urgent favour requests, typically appearing as “a WhatsApp or email from your boss or family member usually”. Other tactics include charity scams involving “fake charities trying to pull at heartstrings during the season of giving”, fraudulent shopping emails claiming “your payment failed” or that “your Black Friday order couldn’t be processed”, and holiday job or side hustle offers that require victims to “pay an upfront fee for training or admin”, which in some cases can result in individuals unknowingly becoming money mules.

“Digital security at Christmas starts with prevention,” adds Ian Porteous from Check Point. “Staying alert and cautious online can make all the difference – protecting your personal information and ensuring a stress-free festive season.”

Javvad Malik from KnowBe4, urges consumers to ask the following questions before taking action:

• Was I expecting this?
• Is this how we normally do it?
• Is this invoking an emotional response?
• Is it time-sensitive (rushing me)?
• Have I checked it somewhere else?

 

The post Cyber Experts Warn of Increased Consumer Scams This Festive Season appeared first on IT Security Guru.

Once again, it’s predictions season. We spoke to experts from across the cybersecurity industry about what the future of cyber may look like as we head into 2026. From AI ethics and API governance to the UK’s Cyber Security and Resilience Bill and exponentially increasing threats, there’s set to be a big shake up to the industry next year (again). What it means to be cyber resilient, against a tide of increased threats, is, once again, changing.

So, let’s hear what the experts thing:

Rising Ransomware

Rebecca Moody, Head of Data Research at Comparitech:

“Even with a couple of weeks to go, ransomware attacks have increased significantly from 2024 to 2025. According to our statistics, 2024 saw 5,621 attacks, while 2025 has already seen 7,042 – a 25 percent year-on-year increase.

I expect the level of ransomware attacks to remain high throughout 2026 as hackers continue to exploit vulnerabilities, target key infrastructure, public services, and manufacturers, and seek to steal large quantities of data in the process. 

If 2025 has taught us anything, it’s that hackers see third-party service providers as the perfect target because they not only give them potential access to hundreds of companies through one source but also enable large-scale data breaches. Key examples include the recent attack on Marquis Software Solutions which has seen one of the largest data breaches of 2025 (1.35 million and counting) and has affected hundreds of banks and credit unions, and Clop’s Oracle zero-day vulnerability exploit which has seen over 100 companies affected to date. 

While companies are going to want to make sure they’re on top of all the key basics (carrying out regular backups, patching vulnerabilities as soon as they’re flagged, providing employees with regular training, and making sure systems are up to date), 2026 will hopefully bring increased awareness of the vulnerability companies face through the third party services they use. Although utilising third parties for various services is essential for a lot of organisations, it’s crucial these organisations are vetting and testing the software they’re using (where possible). Even with the most robust systems in place, this is irrelevant if the third parties they’re using aren’t adhering to the same standards.”

Compliance, Industry Guidance and Regulations

Jamie Akhtar, CEO and Co-Founder of CyberSmart: 

“The cyber market and its regulatory landscape are shifting quickly and organisations are starting to feel the pressure of a more demanding regime. This will continue throughout 2026. As the Cyber Resilience Bill comes into force, it brings with it mandatory adoption of the Cyber Assessment Framework across critical sectors. The scope of regulation expands as the definition of Relevant Managed Service Providers is broadened, placing managed service providers (MSPs) directly in the regulatory spotlight. This change introduces new duties around incident reporting, baseline security controls and formal assurance, meaning that both service providers and their customers must operate with far greater transparency and discipline. The CyberSmart 2025 MSP survey saw that this was already starting to happen. 77% of MSPs reported that their businesses’ security capabilities were already coming under greater scrutiny by prospects and customers. This suggests that MSP customers are more aware than ever of the importance of good cyber credentials in a potential partner – and this will only continue.”

Bill Dunnion, CISO at Mitel, said: 

“The future of cybersecurity lies in thinking like the adversary. Traditional defensive postures, firewalls, monitoring, and compliance checklists, are no longer sufficient against threats that move faster and learn continuously. Offensive security practices such as red teaming, threat hunting, and penetration testing will evolve from optional exercises to essential functions of risk management.

The guiding principle is simple: what you don’t know can hurt you. Proactively testing systems exposes blind spots before attackers do. The next generation of programs will combine structured frameworks, such as NIST and ISO, with continuous offensive assessments to create dynamic, adaptive defence ecosystems.

Mature organisations will recognise that compliance does not equal security. Instead, they will integrate continuous testing into their operations, utilising real-world attack simulations to enhance defences and quantify risk in business terms. The result is smarter, faster decision-making that results in better protection.”

Quantum Computing

Daniel dos Santos, Senior, Director, Head of Research at Forescout:

“[I predict that there will be] escalating attacks on unmanaged devices. Edge devices such as routers and firewalls, as well as IoT in the internal network such as IP cameras and NAS are all becoming prime targets for initial access and lateral movement, with a growing number of zero-days and custom malware. These devices are usually unmanaged and unagentable, so organisations need to invest in other forms of visibility, threat detection and incident response based mainly on network signals. This will ensure they can proactively mitigate the growing risk from these devices, detect when attacks leverage them and respond to those quickly to prevent them from becoming major incidents.

Growing number of hacktivist attacks. Most organisations have a threat model based on defending against cybercriminals and state-sponsored actors. Hacktivists until recently were treated as a “nuisance” because of their focus on DDoS and simple defacements. Now these groups have been growing in number and sophistication – targeting critical infrastructure at alarming rates. This will extend into 2026 and organisations need to ensure their threat models include these groups too.

Starting the migration to post-quantum cryptography (PQC). 2025 was the year when commonly used technologies, from web browsers to SSH servers, started implementing post-quantum cryptography. 2026 will be the year when organisations will need to inventory their network assets and understand what is already supporting the technology, what isn’t and what are the timelines to migrate. Especially in government, financial services and critical infrastructure, the migration to PQC will soon move from “something we should think about” to “we need to act now”. Organisations will need tools that can automatically and continuously inventory their network assets, since it’s not realistic to expect hundreds of thousands of devices to be manually checked.”

Simon Pamplin, CTO – Certes:

“If we’re talking about cyber challenges for 2026, I think the thing businesses really need to get their heads around is the widening gap between the pace of quantum-age cryptography and the speed at which most organisations update their production systems. Attackers don’t need a working, large-scale quantum computer right now to cause trouble. Many of them are already quietly collecting encrypted data, sticking it in storage, and waiting for the day they can crack it. That turns anything with a long shelf life, financial records, personal data, IP, into a liability on a timer. 

The problem is that too many organisations still behave as though the encryption they use today will protect them forever. It won’t. Shifting to post-quantum cryptography is  potentially challenging and slow to deploy, and most businesses massively underestimate how many of their legacy systems, third-party integrations and data flows rely on algorithms that simply won’t stand up to what’s coming. 

So, preparation has to begin before the threat is fully realised. Quantum computing isn’t some distant sci-fi concept anymore; it’s getting close enough that organisations can’t ignore it. Start by working out where your sensitive data actually goes, sort out the long-life data first, and separate out your truly critical data streams so one weak spot doesn’t bring the whole lot down. PQC isn’t something you bolt on, it’s a phased transition, and the ones who start early won’t be the ones panicking later.”

Darren Guccione, CEO and Co-Founder of Keeper Security:

“The quantum era will usher in extraordinary innovation and unprecedented risk. In 2026, business leaders will be faced with the reality that preparing for the post-quantum future can no longer wait.

“Harvest now, decrypt later” attacks are already underway as cybercriminals intercept and archive encrypted traffic for future decryption. Large-scale quantum computers running Shor’s algorithm will shatter existing encryption standards, unlocking a time capsule of sensitive data. From financial transactions and government operations to information stored in cloud platforms and healthcare systems, any data with long-term value is at risk.

While the timeline for practical use of quantum computers capable of breaking public-key cryptography remains uncertain, business leaders must take action now. Regulators worldwide are urging enterprises and public-sector organisations to inventory cryptographic systems, prepare for migration and adopt crypto-agile, quantum-resistant strategies.

In 2026, expect the conversation around quantum risk to shift from theoretical to tactical. Organisations will begin treating encryption not as a background control, but as a measurable component of operational resilience. Discussions once limited to cryptographers will move into boardrooms and procurement teams, as leaders demand visibility into how long their data can remain secure under existing models. The focus will broaden from purely technical readiness to governance, understanding where every key, certificate and encryption method is deployed across the enterprise and how quickly each can be replaced.

Forward-looking organisations will also start piloting hybrid cryptography that blends classical and post-quantum algorithms, testing performance, integration and cost. These early implementations will surface new challenges around key management, compatibility and standardisation, driving broader collaboration between governments, technology providers and enterprises.”

Experts at KnowBe4 said:

“Q-Day, the day when quantum computers become sufficiently capable of cracking most of today’s traditional asymmetric encryption, will likely happen in 2026. The security of these systems has never been more important. Organisations must strengthen human authentication through passkeys and device-bound credentials while applying the same governance rigor to non-human identities like service accounts, API keys and AI agent credentials.”

Agentic AI and Deepfakes

Ruth Azar-Knupffer, Founder at VerifyLabs.AI:

“By 2026, deepfakes will continue to be an accepted part of everyday life, like it is today. Not all of them will be harmful. Satire, memes and creative uses of AI will continue to entertain and even inform, but the real risk lies in how easily the same technology can be misused. We will see a sharp rise in deeply personal scams, impersonation and online abuse that feels more convincing than anything we have experienced before, because it looks and sounds real.

The impact will go far beyond financial loss. Deepfakes will increasingly damage relationships, reputations and mental well-being, eroding trust between people and in the information we consume. In an age where seeing is no longer believing, society will be forced to rethink what trust looks like online.

This shift will redefine digital literacy. It will no longer be enough to know how to use technology; people will need the confidence to question it. Verification, context and authenticity will become everyday considerations, not specialist concerns. Those who adapt will navigate AI with resilience, while those who don’t risk becoming overwhelmed by doubt and deception. Trust won’t disappear, but it will have to be rebuilt on new foundations, built on ones that recognise both the power and the limits of artificial intelligence.”

Eric Schwake, Director of Cybersecurity Strategy at Salt Security:

“Agentic AI will create a fundamental shift in how internal systems behave. As autonomous agents begin acting on behalf of users and applications, they will trigger a surge in internal API calls that far exceeds traditional human-driven traffic patterns. The impact will not be felt at the perimeter first. It will surface deep inside the stack, where shadow interfaces, legacy services, MCP servers and automation endpoints sit without the instrumentation needed to distinguish noise from legitimate business activity. Security teams will discover that their monitoring models, built for predictable and comparatively low-volume interactions, cannot interpret agent-generated activity. This will accelerate the move toward context-aware runtime protection and real-time behavioural baselining rather than static rules or credential checks.

As this shift unfolds, discovery will become the single most important capability in the API security budget. AI agents do not wait for formal onboarding processes before invoking new endpoints. They identify and call whatever interfaces appear relevant, whether sanctioned or not. In response, CISOs will transition from periodic inventory exercises to continuous, automated discovery across the entire API fabric. Visibility will need to extend into MCP infrastructures, internal endpoints and interfaces generated dynamically by agentic workflows. The guiding principle is straightforward: security cannot exist where visibility does not.”

James Moore, Founder & CEO of CultureAI:

As we move into 2026, the biggest risk isn’t AI itself, rather it’s the blind spots organisations still have around how their people and their tools are actually using it. Almost everybody is now using AI platforms, often without knowing what data those tools retain or how it’s used. With an abundance of AI comes an abundance of data loss. I predict three major threat shifts that will define 2026:

1. The rise of invisible AI usage, especially in everyday SaaS.

What people think of as ‘AI tools’ is too narrow. An AI app is any SaaS application that takes data and passes it into a model. Most organisations haven’t even scratched the surface of understanding that. I believe that embedded AI features within SaaS apps, beyond common AI tools like ChatGPT or Copilot, could contribute to enterprise data-loss incidents next year.

2. Legacy controls will continue to fail, not because they’re bad, but because they weren’t built for this problem.

 To solve AI data-loss, you have to understand the contents of every request going to an AI app. DLPs and CASBs simply weren’t built for that. You can’t just turn those apps off and block them all and hope for the best.

3. Agentic AI will create a new class of blind spots.

I expect that we will see the emergence of AI agents that act, browse, and make API calls independently. When AI starts taking actions on your behalf, you move from securing human behaviour to securing autonomous behaviour. Most organisations aren’t remotely ready for that.

However, I also believe that 2026 will be the year that enterprises unlock AI at scale. This can only be done if they treat usage as a governance and enablement problem, not a blocking problem. Our job isn’t to scare people away from AI. It’s to give them the visibility and control to use it safely, at speed. The organisations that win in 2026 will be the ones that move to the top-right quadrant: high adoption and high security, not one or the other.”

Simon Gooch, Field CIO & SVP Expert Services at Saviynt:

“AI is forcing organisations to rethink what identities are critical to manage and if they have the right tools and approaches to ensure they are able to support their organisation’s AI and technology transformation priorities. Identity has always been central to protecting systems and data, but AI is altering how we think about this construct. There is a growing realisation that identity is the single most critical currency of all technology transactions and having an integrated technology, security and identity strategy that is designed to this reality is key. In the new reality of our evolving tech ecosystem we’re no longer solely dealing with employees, partners, providers, privileged users and non-human constructs; we’re entering a world where automated processes, bots and AI agents hold access, make decisions and interact across networks, systems, supply chains and organisations. The adoption of AI-powered capabilities is happeing at a pace that the reality and implications of which is still not well understood. Often, organisations are still in a phase of discovering and testing what they can deliver, yet each deployment introduces a new point of possible risk. The result is an expanding and increasingly complex set of identity security challenges.

This shift has pushed identity out of the back office and into the heart of business operations, risk management and long-term planning. The difficulty, of course, is that most organisations are still managing legacy systems, hybrid environments and thousands of human identities while preparing for an AI-driven future, not to mention the non-human identities they already rely on. Identity security must now not only protect AI agents, but also harness AI itself if it’s to keep pace.

Amid all this change, we’re watching identity security evolve from a compliance exercise to a core security discipline, and now into an essential enabler for business transformation and AI adoption. Security and business leaders alike are working at pace to manage and govern human, non-human and AI agent identities in a way that is both resilient and scalable.”

Dipto Chakravarty, Chief Technology Officer at Black Duck:

“The traditional approach to vulnerability management and security testing will certainly be disrupted, primarily driven by the increasing adoption of AI in cybersecurity. The old software world is gone, giving way to a new set of truths defined by AI. AI will significantly alter how organisations identify and mitigate vulnerabilities, becoming both a tool for attackers and defenders. Threat actors will leverage AI to automate and scale attacks, while defenders will use AI to enhance detection and response capabilities. Organisations will need to invest in AI-driven vulnerability scanning and predictive analytics to stay ahead of emerging threats. AI-powered security tools will enable security teams to analyse vast amounts of data, identify patterns, and predict potential threats before they materialise. The role of AI in AppSec will be transformative, and organisations that fail to adapt risk being left behind. As AI continues to evolve, it’s essential for security leaders to prioritise AI-driven security measures and invest in the necessary skills and technologies to stay ahead of the threats.”

Next Generation Hackers

Anthony Young, CEO at Bridewell, said:

“Unfortunately, it’s unlikely that 2025’s headline breaches are not the peak, they’re the warning signs. As we move into 2026, the legacy of these cuts will continue to degrade organisations’ defensive posture. We’ll likely see fewer, but far more impactful, attacks focused on shared platforms, third-party suppliers and critical infrastructure.

Cybersecurity is now facing the same kind of social and economic pressures that drive crime in the physical world. When times get tough and oversight weakens, the barrier to entry for malicious activity falls. If we continue underinvesting in resilience and accountability, we risk normalising cyber aggression as a form of expression or protest.

Many organisations have been forced to delay modernisation, freeze hiring and reduce investment in defensive capabilities. The result is fewer defenders, slower detection, and weakened resilience, just as adversaries become more aggressive and technologically advanced.

This new wave of attackers doesn’t always fit the traditional profile. We’re seeing a generation that grew up online, with access to open-source data, leaked credentials and automated tools that make disruption easy. What’s changed is the lack of deterrence. In online communities, the reputational rewards of causing chaos often outweigh the perceived risk by these individuals of getting caught.”

The post We Asked the Experts: 2026 Predictions appeared first on IT Security Guru.

Keeper Security, the provider of zero-trust and zero-knowledge cybersecurity software protecting passwords and passkeys, infrastructure secrets, remote connections and endpoints, had reflected on 2025 as a year of meaningful growth. Amid an increase in credential-based attacks, rapid AI adoption and the operational demands of hybrid environments, Keeper strengthened its Privileged Access Management (PAM) platform, expanded its global footprint and conducted industry research that shaped how organisations approach identity-first defence.

 

“This year’s results reflect the relentless dedication of our global team and the trust placed in us by the thousands of organisations that rely on Keeper to secure their most sensitive systems and data,” said Darren Guccione, CEO and Co-founder of Keeper Security. “We’re proud of what we accomplished together and deeply grateful to our customers, partners and employees for propelling Keeper to its position as a leader in identity and access management.”

 

A Turning Point for Privileged Access

One of the year’s defining moments was Keeper’s debut in the Gartner® Magic Quadrant for Privileged Access Management. The recognition aligned with the evolution of KeeperPAM®, which brought enterprise password management, secrets management, connection management, zero-trust network access, remote browser isolation and endpoint privilege controls into a unified, cloud-native platform.

 

Organisations globally adopted KeeperPAM to modernise privileged access with zero-trust and zero-knowledge security that doesn’t carry the complexity associated with legacy PAM tools. Throughout the year, Keeper advanced its platform with cutting-edge capabilities. Endpoint Privilege Manager enables precise, just-in-time elevation while reducing the risks associated with local admin rights. Keeper Forcefield, which is the only product of its kind in the industry, protects against memory-based attacks on Windows machines.

 

Keeper also expanded visibility and control over privileged sessions through KeeperAI, built on a Sovereign AI framework, which enables real-time, agentic AI threat detection and response, ensuring that high-risk sessions are automatically terminated and all user activity is analysed and categorised. As teams began using AI in operational and development workflows, Keeper added support for the Model Context Protocol (MCP) within Keeper Secrets Manager. Keeper’s integration allows customers’ third-party AI tools, such as local or cloud-based assistants, to securely retrieve or manage secrets stored in their vault without compromising Keeper’s zero-knowledge security architecture.

 

Platform enhancements, such as bidirectional One-Time Share, improved biometric login with passkeys, a WearOS smartwatch app, a QR-code WiFi records and refinements to mobile and vault experiences, reflected Keeper’s ongoing commitment to balancing usability with continuous security improvements. Keeper also deepened integrations across the cybersecurity ecosystem, including new connections with CrowdStrike Falcon® Next-Gen SIEM, Google Security Operations and Microsoft Sentinel, helping organisations incorporate privileged access telemetry into broader detection and response workflows. The company’s commitment to strong encryption was reaffirmed by achieving FIPS 140-3 validation of its cryptographic module.

 

“2025 was a pivotal year for our engineering teams as we advanced our unified privileged access platform and delivered capabilities that measurably strengthen our customers’ defences,” said Craig Lurey, CTO and Co-founder of Keeper Security. “With KeeperAI, we moved real-time threat detection directly into privileged sessions. We expanded endpoint protection, modernised secure connections and continued to harden secrets management and zero-trust access across the platform. These improvements are the result of focused, disciplined engineering and constant feedback from customers. We’ve built a PAM platform that’s fast, scalable and secure by design, and we’re just getting started.”

 

Global Growth and Recognition

Keeper’s platform evolution translated into substantial global growth. The company surpassed four million paid users, with strong adoption across North America, Europe and the Asia-Pacific region. Growth in Japan was particularly notable, where Keeper tripled annual recurring revenue and expanded its footprint across finance, telecommunications, manufacturing and the public sector.

 

Keeper strengthened its global distribution network through its upscaled Partner Programme, adding new reseller and distributor relationships across the United States, Canada, France, Spain, Singapore, Japan, Australia and New Zealand. The company also enhanced its public-sector presence, earning placement on the CISA Continuous Diagnostics and Mitigation (CDM) Approved Product List, joining the Secure by Design Pledge and welcoming experienced security leaders including Chief Information Security Officer Shane Barney, Federal Advisory Board member David Epperson and Chief Revenue Officer Tim Strickland.

 

Keeper’s contributions across product innovation, identity security and research were recognised by industry analysts and award programmes throughout the year. In addition to Keeper’s debut on the Gartner Magic Quadrant, Enterprise Management Associates (EMA) highlighted Keeper for deployment ease, architecture and customer satisfaction. GigaOm named Keeper the Overall Leader in its Password Management Radar Report for the fourth consecutive year and KuppingerCole recognised Keeper as an Overall Leader in its 2025 Leadership Compass Report for Non-Human Identity Management. Keeper also received honours from the Computing Security Awards, Cybersecurity Excellence Awards, Fortress Cybersecurity Awards, Global InfoSec Awards and the Globee Awards, alongside consumer-focused recognition from Newsweek, CHIP (DE) and Connect Professional.

 

Industry Research Provides Data-Driven Insights

Keeper continues to invest in research that explores the challenges and realities for modern security teams. Keeper’s insight report, Navigating a Hybrid Authentication Landscape, examined how organisations are balancing passwords, passkeys and hybrid identity environments as authentication systems evolve. Securing Privileged Access: The Key to Modern Enterprise Defence detailed the motivations and challenges associated with scaling PAM programmes including cloud adoption, operational maturity and the impact of privileged access on overall risk. Perspectives gathered directly from security professionals at three major industry trade shows informed Identity, AI and Zero Trust: Cybersecurity Perspectives from Infosecurity Europe, Black Hat USA and it-sa Expo&Congress, offering a multi-region view into how identity and AI are shaping the next phase of security strategy.

 

The AI in Schools: Balancing Adoption With Risk study, conducted for Keeper’s Flex Your Cyber initiative, provided essential data on how educational institutions are managing AI cybersecurity in learning environments – highlighting concerning gaps in access controls and security awareness. The public service initiative is designed to support students, families and educators in learning about cybersecurity. It provides accessible resources to help communities navigate emerging digital risks and strengthen foundational security habits, aligning with Keeper’s broader mission to advance identity security across both enterprise and consumer environments.

 

Identity Security on the Global Stage

Keeper’s partnership with Atlassian Williams Racing continued to bring identity security into high-performance environments where data integrity and split-second decision-making are essential. Keeper and Williams extended their multi-year agreement this year, reinforcing a shared commitment to securing the data, systems and competitive insights that power modern Formula 1 operations.

 

Highlighting the authenticity of the partnership, the team implemented KeeperPAM to protect sensitive engineering and performance information across trackside and distributed environments, helping safeguard critical systems relied upon by race engineers, strategists and support teams. Co-branded content released throughout the season, featuring drivers Carlos Sainz and Alex Albon, Team Principal James Vowles and Keeper CTO and Co-founder Craig Lurey, helped introduce identity security concepts to a global Formula 1 audience in an accessible and engaging way.

 

Keeper was proud to support the team through a standout season. In 2025, Atlassian Williams Racing earned fifth place in the Constructors’ Championship, marking a significant step forward in the team’s resurgence. The included two podium finishes, with drivers Albon and Sainz securing eighth and ninth place in the Drivers’ Championship respectively, demonstrating consistent performance and momentum throughout the year.

 

Looking to the Year Ahead

Keeper enters 2026 focused on helping organisations secure every user, device and connection through a unified, zero-trust and zero-knowledge vault. Building on a year of meaningful innovation, global growth and expanded research, the company will continue advancing AI-driven capabilities, strengthening privileged access controls and supporting customers as identity security becomes increasingly important to both individuals and organisations worldwide.

 

“As we look ahead to 2026, we remain committed to advancing zero-trust cybersecurity and empowering organisations to defend against modern threats with confidence,” said Guccione. “Identity sits at the centre of every attack surface, and Keeper is uncompromising in our efforts to protect it. We will continue delivering innovative capabilities that strengthen privileged access, simplify security for users and teams, and ensure our customers can operate with confidence as cyber threats grow more frequent and sophisticated, backed by the power of AI.”

The post A year of Keeper Security! appeared first on IT Security Guru.

Government data has been stolen in a cyberattack, though officials say the risk to individuals remains low, according to a UK minister. The incident has prompted an ongoing investigation and renewed warnings from cybersecurity experts about the long-term risks of state-linked digital espionage.

Trade Minister Chris Bryant confirmed the breach in an interview with BBC Breakfast, saying officials moved quickly once the issue was identified. “An investigation is ongoing,” Bryant said, adding that the security gap was “closed pretty quickly.” While a Chinese affiliated group is suspected, Bryant cautioned that investigators “simply don’t know as yet” who was responsible.

The compromised systems are understood to relate to visa-related data. Government officials have emphasized that there is no indication of immediate harm to individuals, but cybersecurity specialists say such incidents should not be minimized, particularly when a nation-state actor may be involved.

Anna Collard, security awareness advocate at KnowBe4, warned that the implications often extend far beyond the initial breach. “While the government has described the risk to individuals as ‘low’, incidents like this still matter,” she said. “When state-level actors are suspected, the objective is often long-term intelligence rather than immediate harm. That makes transparency, strong oversight, and timely communication critical. Attribution in cyber incidents is complex, but this is another reminder that government systems are high-value targets. And even with attribution aside, what matters is public trust. Citizens expect their data to be handled with the highest level of care, especially when it involves sensitive information like visas.”

Chris Hauk, consumer privacy advocate at Pixel Privacy, said government data breaches often reveal underlying security weaknesses. “Government data breaches are always concerning, even when the government assures us that the possibility of risks to individuals is low,” he said. “Such a breach indicates that either the government systems were not properly configured or kept updated, or similar issues exist in third party systems. Even if individuals’ data has not been immediately exposed, compromises of government systems can lead to additional intelligence gathering or targeted attacks against public servants and citizens.” Hauk added that this incident fits a broader pattern of suspected Chinese-linked cyber operations that are likely to continue.

Nathan Webb, principal consultant at Acumen Cyber, noted that even incomplete identity data can be highly valuable. “Even partial identity data can be correlated across other breaches and used to create more convincing targeted attempts against individuals,” he said. Webb explained that determining the true impact of a breach is difficult because attackers may already hold related data from other sources. He added that if Chinese nation-state actors are involved, the attack was likely targeted and sophisticated, making strong patching strategies and continuous vulnerability scanning essential.

Other experts highlighted the strategic nature of such intrusions. Dray Agha, senior manager of security operations at Huntress, said, “This intrusion is likely an espionage operation aimed at building intelligence profiles, understanding policy deliberations, or mapping government networks. The real risk isn’t immediate financial harm to citizens, but rather long-term erosion of national security and diplomacy. This incident should be a stark reminder that state-affiliated cyber operations are primarily about persistent, strategic intelligence gathering, not just immediate, disruptive attacks.”

Dan Panesar, chief revenue officer at Certes, emphasized that speed alone does not define success in responding to breaches. “When a suspected nation-state actor steals government data, the risk is not defined by how quickly a gap was closed, but by what data was accessible during that window,” he said, warning that sensitive information may already have been quietly copied before detection.

As the investigation continues, the incident highlights that government systems remain prime targets and that maintaining public confidence depends on strong defenses, clear communication, and accountability.

The post UK Government Data Stolen in Cyberattack appeared first on IT Security Guru.

Keeper Security has announced the appointment of two new additions to its federal team, with Shannon Vaughn as Senior Vice President of Federal and Benjamin Parrish, Vice President of Federal Operations. Vaughn will lead Keeper’s federal business strategy and expansion, while Parrish will oversee the delivery and operational readiness of Keeper’s federal initiatives, supporting civilian, defence and intelligence agencies as they modernise identity security to defend against pervasive cyber threats.

Vaughn brings more than two decades of private sector, government and military service, with a career focused on securing sensitive data, modernising federal technology environments and supporting mission-critical cybersecurity operations. Prior to joining Keeper, Vaughn served as General Manager of Virtru Federal, where he led business development, operations and delivery for the company’s federal engagements. During his career, he has held multiple senior leadership roles at high-growth technology companies, including Vice President of Technology, Chief Product Owner and Chief Innovation Officer, and has worked closely with U.S. government customers to deploy secure, scalable solutions.

“Federal agencies are operating in an elevated environment with unprecedented cyber risk. Next-generation privileged access management to enforce zero-trust security is essential,” said Darren Guccione, CEO and Co-founder of Keeper Security. “Shannon and Ben bring a unique combination of operational military experience, federal technology leadership and a deep understanding of zero-trust security. They know how agencies operate, how threats evolve and how to translate modern security architecture into real mission outcomes. These exceptional additions to our team will be instrumental as we expand Keeper’s role in securing the federal government’s most critical systems, personnel and warfighters.”

Vaughn is a career member of the U.S. Army with more than 20 years of service and currently holds the rank of Lieutenant Colonel in the Army Reserves. In addition to his operational leadership, Vaughn is a Non-Resident Fellow with the Asia Program at the Foreign Policy Research Institute, where he contributes research and analysis on the intersection of future technology threats and near-peer adversaries. He has a graduate degree from Georgetown University and undergraduate degrees from the University of North Georgia and the Department of Defence Language Institute.

To support execution across federal programs, Parrish oversees the delivery and operational readiness of Keeper’s federal initiatives. Parrish brings extensive experience leading federal operations, software engineering and secure deployments across highly regulated government environments. Prior to joining Keeper, he held senior leadership roles supporting federal customers, where he oversaw cross-functional teams responsible for platform reliability, customer success and large-scale deployments.

Parrish is a retired U.S. Army officer with more than 20 years of service across Field Artillery, Aviation and Cyber operations. His experience includes a combat deployment to Iraq and operational support to national cyber mission forces through the Joint Mission Operations Center. He has supported Department of Defence and Intelligence Community missions, including work with the White House Communications Agency, Joint Special Operations Command, Defence Intelligence Agency and National Reconnaissance Office. Parrish holds a graduate degree in Computer Science from Arizona State University and an undergraduate degree in Computer Science from James Madison University.

In his role at Keeper, Parrish aligns product, engineering, security and customer success teams and works closely with government stakeholders to ensure secure, reliable deployments that meet stringent federal mission, compliance and operational requirements.

“Federal agencies are being asked to modernise faster while defending against increasingly sophisticated, identity-driven attacks,” said Shannon Vaughn, Senior Vice President of Federal at Keeper Security. “I joined Keeper because we are focused on what actually produces tangible cyber benefits: controlling who has access to what, with full auditing and reporting – whether for credentials, endpoint or access management. We are going to win by being obsessive about access control that is easy to deploy and hard to break.”

These appointments come as federal agencies accelerate adoption of zero-trust architectures and modern privileged access controls in response to escalating credential-based attacks. The FedRAMP Authorised, FIPS 140-3 validated Keeper Security Government Cloud platform secures privileged access across hybrid and cloud environments for federal, state and local government agencies seeking to manage access to critical systems such as servers, web applications and databases.

The post Keeper Security Bolsters Federal Leadership to Advance Government Cybersecurity Initiatives appeared first on IT Security Guru.

UK-based AI safety and governance company CultureAI has been named as one of the participants in Microsoft’s newly launched Agentic Launchpad, a technology accelerator aimed at supporting startups working on advanced AI systems. The inclusion marks a milestone for CultureAI’s growth and signals broader industry interest in integrating AI safety and usage control into emerging autonomous AI ecosystems.

The Agentic Launchpad is a collaborative programme from Microsoft, NVIDIA, and WeTransact designed to support software companies in the United Kingdom and Ireland that are developing agentic AI solutions. With more than 500 companies applying, the selected cohort of 13 pioneering organisations represents some of the most forward-thinking solutions shaping the future of AI. The initiative is part of Microsoft’s wider investment in UK AI research and infrastructure, which includes nearly $30 billion committed to developing cloud, AI, and innovation capabilities in the region.

Selected companies in the program receive access to technical resources from Microsoft and NVIDIA, including engineering mentorship, cloud credits via Microsoft Azure, and participation in co-innovation sessions. Participants also gain commercial support, such as marketing assistance, networking opportunities and opportunities to showcase products to enterprise customers and investors.

CultureAI’s inclusion underscores an increasing industry emphasis on safe and compliant AI deployment. The company’s platform focuses on detecting unsafe AI usages, enforcing organisational policies during AI interactions, and providing real-time coaching to guide secure behaviour. This type of AI usage control has drawn interest from sectors with strict data governance and security requirements, including finance, healthcare, and regulated industries.

By working within the Agentic Launchpad cohort, CultureAI gains a strategic opportunity to integrate its usage risk and compliance controls with agentic AI development frameworks — an area where autonomous systems may introduce new vectors for inadvertent data exposure or misuse if not carefully governed.

Agentic AI represents a next stage of artificial intelligence that extends beyond generative tasks like text or image creation toward systems that can plan, act and autonomously execute sequences of decisions. This shift brings potential benefits in efficiency and automation, but also raises new challenges for risk management and governance in production environments.

Experts have noted that while initiatives like the Agentic Launchpad aim to accelerate innovation, they also emphasise robust tooling and ecosystem support to address security, operational governance and compliance in emerging AI applications. In this context, companies specialising in usage control and risk detection, such as CultureAI, might play a growing role as enterprises adopt more autonomous AI technologies.

The inclusion of AI safety-oriented companies like CultureAI in accelerator programmes reflects a broader trend in the industry toward embedding governance and risk mitigation into the core of AI development cycles. As agentic AI systems begin to move from laboratories into real-world use cases, particularly in sensitive or regulated domains, ensuring safe interaction with data and policy compliance may become a key differentiator for enterprise adoption.

“This recognition reflects the urgency organisations face today,” said James Moore, Founder & CEO of CultureAI. “AI is now embedded across everyday workflows, and companies need a safe, scalable way to adopt it. Our mission is to give them that confidence — through visibility, real-time coaching and adaptive guardrails that protect data without slowing innovation.”

The post CultureAI Selected for Microsoft’s Agentic Launchpad Initiative to Advance Secure AI Usage appeared first on IT Security Guru.

Salt Security has unveiled its “12 Months of Innovation” recap, a holiday-inspired look at the company’s product, partnership, and research momentum across 2025. As organisations raced to adopt AI agents, MCP servers and cloud-native architectures, Salt delivered an unmatched innovation “gift” to the industry almost every month, helping security teams keep pace with an expanding API attack surface.

From discovering zombie APIs and blind spots across the API fabric to securing AI agents and protecting MCP actions at runtime, Salt’s 2025 roadmap focused on one goal: giving security teams the visibility and control they need at the API action layer where applications, data, and AI intersect.

“In 2025, APIs didn’t just power applications, they powered AI agents, automation, and entire digital business models,” said Roey Eliyahu, co-founder and CEO at Salt Security. “That shift created massive new risk across the API fabric. Our team responded with a steady drumbeat of innovation across the year, so customers weren’t left defending yesterday’s problems while attackers moved on to tomorrow’s opportunities.”

The 12 Months of Innovation: A Year of Gifts for Security Teams

January – The Year Kicks Off with APIs at the Center
Salt Labs and early-year research showed how quickly API traffic and risk were growing, from zombie and unmanaged APIs to software supply chain vulnerabilities, setting the stage for why 2025 demanded a new approach to securing the API fabric. Security teams saw clearly that legacy tools weren’t built for dynamic, AI-driven environments.

February – A Spotlight on API Reality
Salt published its State of API Security Report and celebrated key industry recognition such as inclusion in top security lists, providing hard data on how fast API risk is growing. For CISOs and boards, the message was simple: API security is no longer a niche problem – it’s a core business issue.

March – Gold Medals & Rising Shadows
Salt’s innovation earned industry awards, including a Gold Globee, even as new blogs and research detailed how compliance pressure, data privacy obligations, and AI-driven attacks were expanding the API attack surface. Excellence and urgency moved in lockstep.

April – A Season of Partnerships & Paradigm Shifts
Salt deepened integrations with leading security platforms, including CrowdStrike, and strengthened protections for MCP server–driven architectures. These partnerships gave customers richer context and made it easier to bring Salt’s API intelligence into existing security workflows, connecting more of the enterprise API fabric into a cohesive defence.

May – The Cloud Era Gets Real
With cloud-native adoption surging, Salt expanded coverage for leading cloud environments and partners, powering posture governance, risk-aware recommendations, and alignment with emerging insurance and regulatory expectations. API security moved squarely into the boardroom.

June – Illuminate Everything
Salt launched Salt Illuminate along with expanded Cloud Connect capabilities, giving customers instant visibility into APIs across complex multi-cloud and hybrid environments. What was previously blind – shadow, zombie, and unmanaged APIs – suddenly came into view across the API fabric.

July – CISOs Sound the Alarm
Research and blogs from Salt Labs highlighted high-profile AI incidents, including conversational AI mishaps like the McDonald’s chatbot breach, and introduced Salt Surface to help organisations directly tackle their exposed API footprint. Visibility turned into prioritised, actionable defence.

August – Autonomous Everything
As organisations embraced autonomous workflows, Salt advanced protections for autonomous threat hunting and AI-driven security use cases, underscoring the inseparability of APIs and AI. The message: you can’t secure intelligent autonomy without securing the APIs – and API fabric – that power it.

September – Securing the AI Agent Revolution
Salt introduced the industry’s first solution to secure AI agent actions across APIs and MCP servers, protecting sensitive operations from prompt injection, abuse, and unintended access. This launch moved AI agent security from theory to practical, enforceable controls at the API action layer.

October – The Blind Spots Strike Back
New Salt data revealed the hidden risks in AI agent deployments and complex API ecosystems. Through detailed vulnerability breakdowns and guidance, Salt gave security and development teams the education and clarity they needed to modernise their security posture and better understand blind spots across their API fabric.

November – Security Starts in Code
Salt launched GitHub Connect and MCP Finder, enabling customers to discover shadow APIs, spec mismatches, and risky MCP configurations directly in code repositories and CI/CD pipelines – before deployment. Shift-left security met shift-right runtime intelligence across the API lifecycle, connecting design, code, and runtime behaviour.

December – Hello, Pepper
Salt closed the year by introducing Ask Pepper AI, a conversational assistant powered by the Salt platform, alongside MCP protection for AWS WAF. Security teams can now ask questions, investigate threats, and operationalise Salt insights in natural language while enforcing protection at the edge for MCP-aware and AI-driven applications.

“Instead of a partridge in a pear tree, security teams got 12 months of very real innovation – spanning discovery, governance, runtime protection, MCP and AI agent security, and now conversational investigation with Ask Pepper AI,” said Michael Callahan, CMO at Salt Security. “This year, customers told us they needed both visibility and speed. Our roadmap delivered both, and the market response has been tremendous. We delivered more API and AI security innovation in 2025 than any other player in our space.”

Looking Ahead to 2026

As organisations move deeper into AI-driven operations, agentic workflows, and API-centric architectures, Salt will continue to invest in securing the API action layer and API fabric – the place where AI, applications, and data intersect.

“In 2026, we expect APIs to become even more tightly woven into autonomous systems and mission-critical workflows,” added Eliyahu. “We’re already building the next wave of innovations so our customers can safely move faster than their adversaries.”

The post Salt Security Unveils its “12 Months of Innovation” appeared first on IT Security Guru.