Endpoint Security | Breaking Cybersecurity News | The Hacker News

A security leader at a global finance company told us recently that his team discovered three times more AI tools running in their environment than IT had approved. Nobody had smuggled them in. Employees had simply pointed agents at their work, and the agents brought their own tools with them. That conversation is not unusual. It is the conversation. Over the past year, in customer discussions across finance, healthcare, manufacturing, and government, the same four struggles come up so consistently that we have started treating them as the shape of the problem itself. Every company effectively hired a second workforce this year, human workers and agentic workers side by side, and the agentic workers never went through onboarding. No handbook, no scoped credentials, no acceptable-use policy they can actually read. Here is what teams are struggling with, what our research says about why, and what closing each gap actually requires. Struggle one: "I can't tell you what age...

Attackers prefer the path of least resistance. Why break in when you can log in? That is what makes working credentials so valuable. A leaked password, token, or API key does more than reveal sensitive data; it offers a way in. No vulnerability or privilege escalation chain necessary. If the credential is valid, the attacker can simply use it, and the session will look like ordinary activity. This shifts the questions from "where can attackers break in?" to "where do usable keys tend to accumulate? Increasingly, the answer is the developer laptop: one of the most instrumented machines most companies own, and one of the easiest places for credentials to go unnoticed. The endpoint is watched for malware, behavior, posture, and configuration. But a valid plaintext credential is something else: a door an attacker may not need to force. A fully patched fleet can still have usable keys scattered across its devices, enough to turn one foothold into something much larger....

New Bitdefender research reveals that 97.7% of respondents now use endpoint detection and response (EDR). That number might seem high compared to commonly accepted market penetration estimates, particularly for mid-market organizations. But it is further confirmation that the vast majority of businesses have already upgraded their endpoint protection. This is hardly surprising. The conversation in enterprise security is no longer just about blocking malware or stopping known threats. It is about "proving" that an organization can detect, investigate, and respond to modern attacks before they escalate into operational disruption, financial loss, or reputational damage. This shift was driven by a new reality: endpoint protection alone is no longer enough. The laggards, typically mid-market organizations with lean IT and security teams, are now realizing this. Threat actors are AI-enabled, more evasive, and increasingly successful at bypassing traditional defenses. At the...

For years, cybersecurity has operated on a simple premise: detect malware, stop the attack. That model is starting to break down. Attackers are no longer relying primarily on malicious files or obvious payloads. Instead, they're increasingly turning to what already exists inside your environment — trusted tools, native binaries, and legitimate administrative utilities. These are used to move laterally, escalate privileges, and maintain persistence, often without triggering traditional security alerts. The problem? Most organizations don't recognize this exposure until after the damage is already done. To better understand how this risk manifests in real environments, Bitdefender offers a complimentary free Internal Attack Surface Assessment — a practical, low-friction way to uncover where trusted tools may be working against you. Here's what's really happening inside modern environments — and why attackers prefer to use your own tools against you. 1. Attacks Are Designed Not to ...

How session cookie theft bypasses MFA — and what you can do about it When you check into a hotel, you show your ID at the front desk. The clerk verifies who you are, maybe checks a secondary piece of information, and hands you a key card. From that point on, that key card is what gets you into your room. It doesn't matter that you proved your identity at check-in. What matters is who has the key. Your applications work the same way. When a user logs into a web application — entering their password, completing an MFA challenge — the application issues them a session token, typically stored as a cookie in their browser. That token is their key card. Every subsequent request the user makes, the application checks for the token, not the credentials. If the token is valid, access is granted. And if someone steals that token? They get in, too. No username required. No password required. No MFA prompt. They simply ...

While working on the Transparent Tribe's vibeware research, we have encountered two distinct camps, the optimists and the skeptics. What makes the current dialogue unique is that both sides can be right at the same time. There is, however, a clear operational reason why we encounter "AI attacks" primarily on professional social media feeds rather than within our own telemetry logs. In this article, we analyze the factors explaining why Skynet is not here yet, and how, much like a shark, AI does not need to be innovative to be dangerous. LLM Architecture Bias LLMs are mathematically optimized to predict the most likely outcome, while hacking is the art of identifying the statistical anomaly. LLMs are designed to predict the most statistically probable next token. They are excellent at the average, but poor at the exceptional. A hacker, by contrast, is a practitioner of statistical anomaly, actively seeking the low-pro...

Vulnerability management is the continuous process of identifying, assessing, prioritizing, and addressing security weaknesses across systems, applications, and infrastructure. It extends beyond periodic scanning; it includes validating findings, understanding exposure in real-world environments, and tracking remediation over time. Effective vulnerability management combines asset visibility, vulnerability intelligence, and operational context to determine which flaws present actual risk rather than theoretical exposure. Modern IT environments further complicate the process of vulnerability management. Hybrid IT infrastructure, third-party dependencies, and internet-facing services increase the attack surface while generating large volumes of vulnerability data. Security teams must balance operational constraints, such as out-of-support legacy systems and uptime requirements, with the need to quickly reduce exposure. As a result, vulnerability management is no longer limited to coun...

According to research by IBM, organizations use an average of 83 separate security solutions. It is hardly surprising that 52% of security professionals identify complexity as the biggest impediment to effective operations. For IT and security leaders in mid-market organizations, who know they have gaps in security coverage, this challenge can feel particularly difficult to solve. At Bitdefender , we see this challenge play out consistently across mid-market environments. Most organizations have the fundamentals in place, such as Endpoint Protection Platforms (EPP), email filtering, and patch management. However, many are not fully realizing the capabilities of these existing tools. This creates security gaps and, when combined with a lack of preventative exposure management controls, severely limits visibility across attack surfaces. Maximize Your ROI: Exploit Underused Tools Many mid-market organizations already have powerful Endpoint Detection and Response (EDR) in place as part...