Supply Chain Security | Breaking Cybersecurity News | The Hacker News

Employees are increasingly using personal AI tools, AI-powered extensions, and emerging agentic browsers to accelerate their work. But unlike sanctioned AI platforms, these tools operate inside the browser runtime, where neither CASBs, SWGs, EDRs, nor DLP solutions have visibility. This has quietly turned the browser into an unmanaged AI execution environment, giving way to a new threat known as shadow AI. Shadow AI isn't just the latest buzzword; it's a serious risk that leaves organizations vulnerable to data loss, cyberattacks, compliance violations, and more.  What is Shadow AI? Shadow AI refers to GenAI-powered tools, browser extensions, and browsers that workers use on their own, without any company vetting or guidance. Different from shadow IT, where unsanctioned apps or devices slip through the cracks, shadow AI lives directly in the browser.  For example, employees might use their personal Claude accounts to work with sensitive company data or work on important pr...

After decades of frustration, downstream users are about to get laws and regulations passed to force upstream IoT manufacturers to produce more secure IoT devices. This seems like a good thing, however, we are about to see an enactment of how new laws and regulations work to the advantage of big companies and to the disadvantage of small companies, eventually driving the latter out of business. As presented by Ruchir Sharma in his excellent book [1] , regulations tend to favor large companies for two reasons: (1) large companies can afford the necessary resources to conform to the new laws and regulations and (2) large companies have the necessary resources to shape the new laws and regulations to favor themselves. Although these may be well-intentioned, initially, the eventual result is that smaller companies are forced out of business and only the large companies survive. Are we about to see this scenario play out for IoT device manufacturers? That is the subject of this paper. The...

Patching and updating is pretty much baked-in to the thinking, standards, and coming legislation of the device security community. Yet  isolation via partitioning  is another viable approach for security, and it comes with many advantages. Patching The primary advantage of patching and updating known vulnerabilities is that the vulnerabilities are usually permanently fixed. Hence the fix is demonstrable for standard and legal compliance. Some problems with this approach are: Modern IoT device firmware has tens, hundreds, even thousands of components, and components routinely come with dozens of their own dependencies [1] . Finding vulnerabilities in components of an SBOM is not an easy process. There are several databases, and component identification is not consistent [1] Achieving 100% complete and accurate SBOMs is still an elusive goal [1] . A high percentage of vulnerabilities in components are not exploitable [1] . Fixing non-ex...