Generative AI | Breaking Cybersecurity News | The Hacker News

Generative AI has quietly become a part of the SaaS ecosystem that businesses use every day. Platforms like Zoom, Slack, Microsoft 365, and Salesforce now have AI assistants. You can use these tools to do things like write summaries of meetings or perform routine tasks. A recent  survey found that 95% of U.S. businesses now use generative AI. This is a big increase from last year. But this quick growth of AI features is making security leaders worried. Sensitive information could be leaked or used in the wrong way if there aren't enough controls in place. Shadow AI and Its Far-Reaching Risks When employees use AI apps without the knowledge or approval of IT, it creates shadow AI . This is akin to the shadow IT problem of unsanctioned cloud apps, but now with AI services. The unauthorized use of AI platforms can unknowingly expose organizations to data privacy issues, compliance violations, and even disinformation risks. We're already seeing these risks play out. Samsung engin...

When generative AI tools became widely available in late 2022, it wasn't just technologists who paid attention. Employees across all industries immediately recognized the potential of generative AI to boost productivity, streamline communication and accelerate work. Like so many waves of consumer-first IT innovation before it—file sharing, cloud storage and collaboration platforms—AI landed in the enterprise not through official channels, but through the hands of employees eager to work smarter. Faced with the risk of sensitive data being fed into public AI interfaces, many organizations responded with urgency and force: They blocked access. While understandable as an initial defensive measure, blocking public AI apps is not a long-term strategy—it's a stopgap. And in most cases, it's not even effective. Shadow AI: The Unseen Risk The Zscaler ThreatLabz team has been tracking AI and machine learning (ML) traffic across enterprises, and the numbers tell a compelling story. In 2024 ...

There's a war raging in the heart of every developer. On one side, you have the id: the impulse-driven creative force that wants to code at the speed of thought and would prefer to deploy first and ask questions later. On the other side, there's the superego, which wants to test every line of code and would push a release by a month if it meant catching one extra bug.  Experienced developers know how to act as a referee between these two forces and find the right balance between speed and security. But inexperienced or overworked devs often put their id in the driver's seat, which leads (among other things) to accidentally leaking developer secrets. These secrets include things like API and SSH keys, unencrypted credentials, and authentication tokens. Calling developer secrets "the keys to the kingdom" is something of a cliche, but it's tough to think of another phrase that accurately captures the unique power of this data. Unfortunately, the people who most appreciate the pow...

The cybersecurity community has been buzzing about JPMorgan Chase CISO Pat Opet's open letter to third-party suppliers since its release right before RSA. This candid assessment from the security leader of one of the world's largest financial institutions has struck a chord, particularly his observations about SaaS security. Opet didn't mince words: " SaaS models are fundamentally reshaping how companies integrate services and data—a subtle yet profound shift eroding decades of carefully architected security boundaries ." This statement encapsulates a reality that security professionals have been grappling with—the traditional security perimeter has dissolved, replaced by a complex web of interconnected SaaS applications, each with their own configurations, access controls, and data sharing capabilities. Let's break down the key issues highlighted in Opet's letter and explore practical solutions. The New SaaS Security Challenges OAuth Vulnerabiliti...

Security and compliance professionals are no strangers to complexity. From staying ahead of ever-evolving threat landscapes to navigating an expanding web of regulatory requirements, the day-to-day demands often feel like a game of whack-a-mole. Enter AI copilots—powerful tools that, when used thoughtfully, can dramatically streamline operations and supercharge your security and compliance programs. While much of the hype around AI focuses on futuristic capabilities, the real magic today lies in using these tools to augment existing workflows. Think of copilots not as replacements for security teams, but as force multipliers—always-on assistants that help reduce toil, improve consistency, and enable teams to focus on higher-value initiatives. AI Copilots in Action: Security & Compliance Use Cases AI copilots are no longer just experimental toys. Here are a few ways forward-thinking security teams are using generative AI tools—like OpenAI's custom GPTs and Google's Gemini Gems...

The rapid adoption of SaaS solutions, accelerated by trends such as remote work, cloud computing, big data, and Generative AI (GenAI) has brought significant benefits to organizations. However, this transformation also introduces new attack surfaces and unique challenges for security teams, who must now consider how they can secure the intricate web of SaaS usage across their organization.  Today, the SaaS security landscape is characterized by several key themes and issues: Credential Theft and Stuffing: This trend is fueled by dark web marketplaces where breached credentials are bought, sold, and traded, making it easy for attackers to carry out credential stuffing attacks. Shadow SaaS: The explosion of unauthorized SaaS apps has led to a rise in employees inadvertently exposing sensitive data. Trial or demo accounts are a main source of shadow SaaS.  SaaS Sprawl: In 2023, the average number of SaaS apps used by a business reached 473. Our numbers indicate an increase ...