Cybersecurity | Breaking Cybersecurity News | The Hacker News

For businesses, compliance with regulations can often appear to be restrictive, and costly and reduce the speed of business. It's still necessary to create an environment that protects not only internal data but also external constituents like partners and customers. Highly regulated industries, such as healthcare and finance, are often faced with a variety of regulations that vary by geography and can carry steep penalties and consequences for noncompliance. Most companies struggle to comply with regulations. In fact, Business Wire estimates that " 71% of companies could potentially fail a cyber audit , which often includes identity management aspects".   What are some key compliance challenges your business may face?  Errors and inconsistencies resulting from repetitive manual processes Complex, evolving regulations that make compliance challenging Siloed environments and processes, often involving incompatible tools, or processes that do not match execution Difficu...

With thousands of endpoints, cloud instances, remote users, and third-party integrations, securing the enterprise has become a massive target. Each change in the IT environment - whether driven by digital transformation, M&A activity, or routine system updates - creates new opportunities for adversaries to leverage. Yet, the network is the backbone of business operations. It must always be available to support production, collaboration, and growth.  In this article, we'll explore the specific challenges large enterprises face when validating their security posture and how leading security teams are evolving their testing strategies to match the scale, speed, and sophistication of large, multi-faceted IT networks.  The Challenges of Validating Enterprise Network Security Enormous attack surface - In large enterprises, the attack surface spans countless assets across on-prem, cloud, and hybrid environments, making comprehensive security validation incredibly complex. Ac...

Identity Is the New Perimeter—And It's Fractured In 2025, identity isn't just a security issue—it's the battleground. And too many organizations are getting caught flat-footed. Organizations today must reckon with complex hybrid environments that contain interconnected endpoints, servers, cloud services, DevOps systems, identity infrastructure, and much more. And with enterprise systems no longer fitting neatly into a single network perimeter, the identities used to interact with these systems have become the new perimeter.  A strong cybersecurity foundation starts with clear visibility that puts risk in content. Identity security is no different. However, in practice, identity management systems are anything but centralized. Building IDs and access to physical offices are handled by one system. Logins to Windows machines are generally managed with Windows domains and Active Directory—but what about Macs and Linux machines? Companies use Okta, Ping Identity, or the equivalent ...

Gone are the days of mass phishing campaigns. Today's attackers are leveraging generative AI (GenAI) to deliver hyper-targeted scams, transforming every email, text, or call into a calculated act of manipulation. With flawless lures and tactics designed to outsmart AI defenses, cybercriminals are zeroing in on HR, payroll, and finance teams—exploiting human vulnerabilities with precision. The Zscaler ThreatLabz 2025 Phishing Report dives deep into the rapidly evolving phishing landscape and uncovers the latest trends, including top phishing targets, real-world examples of AI-driven phishing attacks, and actionable best practices to defend against the next wave of AI-powered phishing threats. Key findings on phishing attacks The ThreatLabz research team analyzed over 2 billion blocked phishing transactions captured across the Zscaler Zero Trust Exchange™ cloud security platform from January 2024 to December 2024 and uncovered several key findings: Phishing is down but is more tar...

Identity-based attacks are the #1 cause of breaches, often exploiting weaknesses in traditional identity platforms. It's time for a proactive approach that addresses these gaps and stops threats before they strike. Identity has become the primary attack surface in cybersecurity. According to Forbes, 75% of cyberattacks leverage identity-based threats. Threat actors gain access using stolen credentials, compromised devices, and deepfake impersonation techniques, often bypassing traditional defenses without detection. Many identity platforms rely on MFA, such as push notifications and one-time passcodes (OTPs), which were once considered secure but are now frequently exploited through phishing, MFA fatigue, and man-in-the-middle attacks. The rise of generative AI has made these threats more effective and more prevalent.  To compensate, organizations have deployed tools like Endpoint Detection and Response (EDR), Network Detection and Response (NDR), and Identity Threat Detection ...

While emerging risks like AI-generated malware capture headlines, the reality of today's threat landscape is more straightforward. Most modern attacks, including ransomware, are backed by manual hacking operations. Attackers carefully navigate systems, using a "Living Off the Land" (LOTL) approach, to exploit legitimate system utilities. To figure out exactly how common these LOTL binaries are, we analyzed 700,000 security incidents from our Bitdefender GravityZone platform along with telemetry data (legitimate usage) from the last 90 days. Security incidents were not simple alerts, but correlated events, and we analyzed the whole chain of commands to identify how frequently attackers are using LOTL binaries. The result? 84% of major attacks (incidents with high severity) involved the use of LOTL binaries. For validation, we also examined our MDR data and found a consistent trend: 85% of incidents involved LOTL techniques. While this was our internal research to suppor...

Data Resilience is No Longer Optional Even in 2025, over half of all businesses suffer devastating data loss from ransomware attacks, configuration errors, or system crashes — yet only 15% of enterprises treat SaaS data backup as a strategic priority. While that number is projected to surge to 75% by 2028 , many organizations today overlook this critical component and risk falling dangerously behind or worse.  Data protection is more than an IT issue, and it takes more than your standard backup solution to reconcile this problem. As threats evolve rapidly, data protection is now an essential strategic priority. Businesses must respond by building resilient, cloud-native backup strategies that ensure data stays protected, available, and uncompromised, no matter the circumstances. Breaking Free from Legacy Constraints with SaaS-Driven Flexibility The modern enterprise landscape has transformed. Hybrid and multi-cloud environments have overcome their once-trendy labels, having b...

The cybersecurity community has been buzzing about JPMorgan Chase CISO Pat Opet's open letter to third-party suppliers since its release right before RSA. This candid assessment from the security leader of one of the world's largest financial institutions has struck a chord, particularly his observations about SaaS security. Opet didn't mince words: " SaaS models are fundamentally reshaping how companies integrate services and data—a subtle yet profound shift eroding decades of carefully architected security boundaries ." This statement encapsulates a reality that security professionals have been grappling with—the traditional security perimeter has dissolved, replaced by a complex web of interconnected SaaS applications, each with their own configurations, access controls, and data sharing capabilities. Let's break down the key issues highlighted in Opet's letter and explore practical solutions. The New SaaS Security Challenges OAuth Vulnerabiliti...