Enterprise Security | Breaking Cybersecurity News | The Hacker News

In the digital world, the secure exchange of cryptographic keys is the foundation upon which all private communication is built. It's the initial, critical handshake that allows two parties, like a user's browser and a web server, to establish a shared secret and communicate securely over the untrusted expanse of the internet. As the quantum computing era approaches, the very mathematics underpinning our traditional key exchange mechanisms are facing an existential threat. This spurred the development of new, quantum-resistant algorithms. This blog post provides a deep dive into how modern key exchange works, from the trusted classical methods to the emerging post-quantum standards, and explores how Zscaler leverages hybrid key exchange to bridge the gap. The Key Components of Modern Key Exchange At a high level, a secure key exchange protocol must achieve the following: Confidentiality: The established key must be a secret shared only between the two communicating parties. An ea...

The market is flooded with chatbots that summarize requirements, GenAI that drafts policies, and AI assistants that extract provisions from contracts. And these tools undoubtedly make existing workflows better. But when it comes to transformational technology, different is better than better.  These AI for GRC capabilities are the direct result of practitioners and vendors alike asking, "How can AI make our current workflows better?" What they should be asking is "Does AI make a completely new way of operating possible?" Agentic GRC doesn't improve GRC workflows; it replaces them with agents. For something to earn the title agentic, it needs to take an entire workflow, including the decision-making between each step, and execute it from start to finish. Whether teams are ready for the future or not (and they should be), they need to start thinking about their workflows in an entirely new way. Here's a framework for them to do so. Why the Distinction Between AI f...

Enterprise adoption of AI is no longer a future trend; it's a present-day reality. As organizations race to leverage AI for innovations, security teams are grappling with a new, complex, and dynamic attack surface. AI is breaking the operational silos that currently segregate Cloud, SaaS and Endpoint Security; AI is everywhere and it is consuming enterprise data and assets across these channels. Traditional security tools, designed for cloud infrastructure and SaaS applications, are fundamentally ill-equipped to handle the unique risks posed by AI.  AI security posture management (AI-SPM) solutions can provide relief by protecting critical AI assets, but it's important to note that not all AI-SPM solutions are created equal. Many solutions offer only basic posture checks and are focused predominantly on infrastructure and vulnerability management. In addition, most focus solely on Cloud or SaaS, leaving many blind spots when trying to get the full picture of your AI landscape. ...

Why reporting, delivery, and validation have become just as critical as testing itself Pentesting has undergone a fundamental shift over the last 5 years. While the core objective of identifying exploitable weaknesses remains the same, the way results are managed, delivered, and validated has become just as important as the testing itself. Security leaders no longer view penetration tests as one-off engagements that end with a PDF. They expect timely, actionable results that feed into their broader vulnerability management and remediation programs. For pentest teams, this shift has exposed a growing gap between how testing is performed and how outcomes are operationalized. Why Traditional Pentest Delivery Is Breaking Down Historically, pentest results have been delivered as static reports, often disconnected from vulnerability scanners, ticketing systems, and remediation workflows. This creates a challenge as the data becomes siloed from other security data and is not aligned int...

Deepfakes aren't just viral clips or political media anymore — they're appearing in enterprise workflows where a camera feed is treated as proof: onboarding, account recovery, remote hiring, privileged access, and partner verification. That shift forces security teams to ask not just, "Does this look fake?" but, "Can we verify in real time that the capture is authentic and the channel isn't compromised — without disrupting the workflow?" A new benchmark from Purdue University addresses that question. Instead of testing detectors on clean, lab-style samples, Purdue evaluated tools on real incident content pulled from social platforms — the kind of compressed, low-resolution, post-processed material that tends to break models tuned to ideal conditions. What Purdue tested — and why it matters Purdue built its benchmark around the Political Deepfakes Incident Database (PDID), which focuses on deepfake incidents circulating on X/Twitter, YouTube, TikTok, and Instagram. Real-world distri...

AI is everywhere. What began as machine learning and evolved into novelty technology applications has rapidly progressed into a significant component of daily life and enterprise strategy. It influences how our businesses plan, code, implement, and protect our most sensitive assets. Among its most transformative applications is its growing role in identity and access management (IAM) . The Expanding Influence of AI in Identity Security Within identity security, AI is reshaping how we define a mature IAM program. What once required manual reviews, repetitive decision-making, and active triage is now increasingly supported by intelligent automation. AI streamlines operations, reduces human bottlenecks and errors, and strengthens security postures through robust, context-driven assistance and automation. The Strength of Predictive AI Modern identity programs lean heavily on predictive analytics—AI capabilities that run continuously in the background to analyze behaviors, support auto...

Browser extensions have evolved over the years into powerful productivity platforms to streamline workflows, integrate business tools, and optimize how work is done. Now in the age of AI, extensions are once again evolving to enable advanced automation and data-driven decision-making directly in the browser. And as these extensions continue to mature, so will the cyberattacks. Today's extension-based attacks do not discriminate; they target every traditional browser, including Chrome, Edge, Firefox, and more, as well as the new AI-powered browsers like ChatGPT's Atlas and Perplexity's Comet. They adapt to each environment's security nuances. Most enterprises assume that if they secure one browser, it's enough.  The reality is that cross-platform extension threats are becoming increasingly common, and organizations must take broader vigilance. In this article, you'll learn why leveraging a Secure Enterprise Browsing (SEB) platform is critical for organizations to keep up with tod...

AI SOC Agents are going through a hype cycle. If we're going by Gartner's Hype Cycle for Security Operations, 2025 , this technology is still an "Innovation Trigger", but it's at the cusp of "Peak of Inflated Expectations". Every vendor claims their solution will revolutionize security operations. Every conference features another keynote promising autonomous defense. And every CISO is being asked whether AI will replace their security team. At Redis, implementing AI in the SOC has been more of a measured journey. The model is more of a hybrid SOC, so there's a combination of external service providers as well as internal resources. In this case, Prophet Security is currently proving themselves alongside a more traditional MDR provider.  But let's take a step back.  The Tipping Point for AI Adoption within the SOC Considering an AI solution for Redis' SOC came down to the confluence of three drivers.  On an individual level, there was more value from AI tools an...

The browser has quietly become the most critical application in the enterprise — and the most targeted. With SaaS, cloud, and hybrid work redefining IT boundaries, browsers now handle proprietary data, credentials, and business workflows. Yet legacy security tools like firewalls, antivirus, and EDR were never designed to defend this new digital front line. The shift from being an ancillary tool to becoming the main location of work means legacy security solutions, such as firewalls, antivirus, VDI, etc., are not equipped to provide the necessary level of protection needed to secure today's organizations. The browser, once an afterthought, is now the weak link that legacy defenses simply can't secure.  This article examines the modern browser exploitation playbook and details why legacy tools alone are no match for today's cybercriminals. By adopting a Secure Enterprise Browser (SEB), enterprises can complement their existing security tools, shore up their weak link, and future-p...

For most of its history, the Security Operations Center (SOC) has been a privilege of the few. Building one meant millions in technology spend and round-the-clock analyst coverage. Unsurprisingly, for years, SOCs were a privilege of the few -  large enterprises and organizations with high-risk profiles, where budgets and scale justified the investment. Everyone else was left with partial coverage or had to outsource. That reality is changing. AI has flipped the SOC equation. What was once out of reach for all but the largest enterprises is now accessible and affordable for nearly every company that needs one. The risk every company faces By now, almost any 9-year-old knows that cyberattacks threaten every company . It's no longer just banks and financial giants in the crosshairs. Over the past decade, cyberattacks have expanded into every sector, from e-commerce sites to research institutes to local hospitals. Recent data from the 'VikingCloud 2025 SMB Threat Landscape' repo...