Every month, we publish a snapshot of the email domains most actively used in fake account creation and related abuse across the websites and apps protected by Castle. The goal is to give fraud and security teams better visibility into the attacker-controlled email infrastructure that rarely appears in public blocklists
The post Fraudulent email domain tracker: November 2025 appeared first on Security Boulevard.
The EU’s Cyber Resilience Act is reshaping global software security expectations, especially for SaaS, where shared responsibility, lifecycle security and strong identity protections are essential as attackers increasingly “log in” instead of breaking in.
The post The Cyber Resilience Act and SaaS: Why Compliance is Only Half the Battle appeared first on Security Boulevard.
AI-enabled cybercriminals are exploiting the holiday shopping season with precision phishing, account takeovers, payment skimming and ransomware, forcing retailers to adopt real-time, adaptive defenses to keep pace.
The post AI Cybercriminals Target Black Friday and Cyber Monday appeared first on Security Boulevard.
AI-powered cyberattacks are rising fast, and AI firewalls offer predictive, adaptive defense—but their cost, complexity and ROI must be carefully justified as organizations weigh upgrades.
The post Are AI Firewalls Worth the Investment? appeared first on Security Boulevard.
AI-generated code is reshaping software development and introducing new security risks. Organizations must strengthen governance, expand testing and train developers to ensure AI-assisted coding remains secure and compliant.
The post Securing AI-Generated Code in Enterprise Applications: The New Frontier for AppSec Teams appeared first on Security Boulevard.
A look at why identity security is failing in the age of deepfakes and AI-driven attacks, and how biometrics, MFA, PAD, and high-assurance verification must evolve to deliver true, phishing-resistant authentication.
The post How AI Threats Have Broken Strong Authentication appeared first on Security Boulevard.
Alan reflects on a turbulent year in DevSecOps, highlighting the rise of AI-driven security, the maturing of hybrid work culture, the growing influence of platform engineering, and the incredible strength of the DevSecOps community — while calling out the talent crunch, tool sprawl and security theater the industry must still overcome.
The post What I’m Thankful for in DevSecOps This Year: Living Through Interesting Times appeared first on Security Boulevard.
Explore the security of passkeys: how they work, their advantages over passwords, potential risks, and best practices for secure implementation in software development.
The post Understanding the Security of Passkeys appeared first on Security Boulevard.
The post CVE-2025-50165: This Windows JPEG Vulnerability Proves Detection Isn’t Enough appeared first on Votiro.
The post CVE-2025-50165: This Windows JPEG Vulnerability Proves Detection Isn’t Enough appeared first on Security Boulevard.
Why Are Non-Human Identities Transformative in Cybersecurity? Have you ever considered how the management of machine identities could revolutionize cybersecurity across various sectors? Non-Human Identities (NHIs) are emerging as a crucial component, providing a much-needed safety net for organizations operating in the cloud. The management of NHIs addresses vital security gaps, especially those created by […]
The post What makes NHIs a powerful tool in cybersecurity? appeared first on Entro.
The post What makes NHIs a powerful tool in cybersecurity? appeared first on Security Boulevard.
Are Machine Identities as Secure as We Think? Where digital rapidly expanding across various sectors—from financial services to healthcare—organizations are compelled to assess the integrity of their security systems, specifically when it involves machine or Non-Human Identities (NHIs). This raises a pressing question: How certain can security professionals be that these NHIs are adequately protected? […]
The post How certain can I be of the security in NHIs? appeared first on Entro.
The post How certain can I be of the security in NHIs? appeared first on Security Boulevard.
Session4A: IoT Security
Authors, Creators & Presenters: Hangtian Liu (Information Engineering University), Lei Zheng (Institute for Network Sciences and Cyberspace (INSC), Tsinghua University), Shuitao Gan (Laboratory for Advanced Computing and Intelligence Engineering), Chao Zhang (Institute for Network Sciences and Cyberspace (INSC), Tsinghua University), Zicong Gao (Information Engineering University), Hongqi Zhang (Henan Key Laboratory of Information Security), Yishun Zeng (Institute for Network Sciences and Cyberspace (INSC), Tsinghua University), Zhiyuan Jiang (National University of Defense Technology), Jiahai Yang (Institute for Network Sciences and Cyberspace (INSC), Tsinghua University)
PAPER
EAGLEYE: Exposing Hidden Web Interfaces in IoT Devices via Routing Analysis [https://www.ndss-symposium.org/wp-con...](https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbEEzMmJxSkNwUUhDUkMteHZraTQ1blZ5Sk0zUXxBQ3Jtc0tuZldzQXZxQXJaOGt0VDU2RGNPdGVSbnMzcWxiTVZ1UmJsTzcyaUlCTFdvbmhoWnZRdWQ0UlJiUEs4ekR1UXNCNF9KQmp4UGxKOG5kMHdBdHBiaWh6ckxFaGphY0JVRDZDQ21jUWcyREx2Qy1XVTJqWQ&q=https%3A%2F%2Fwww.ndss-symposium.org%2Fwp-content%2Fuploads%2F2025-399-paper.pdf&v=qXDD2iiIeCg) Hidden web interfaces, i.e., undisclosed access channels in IoT devices, introduce great security risks and have resulted in severe attacks in recent years. However, the definition of such threats is vague, and few solutions are able to discover them. Due to their hidden nature, traditional bug detection solutions (e.g., taint analysis, fuzzing) are hard to detect them. In this paper, we present a novel solution EAGLEYE to automatically expose hidden web interfaces in IoT devices. By analyzing input requests to public interfaces, we first identify routing tokens within the requests, i.e., those values (e.g., actions or file names) that are referenced and used as index by the firmware code (routing mechanism) to find associated handler functions. Then, we utilize modern large language models to analyze the contexts of such routing tokens and deduce their common pattern, and then infer other candidate values (e.g., other actions or file names) of these tokens. Lastly, we perform a hidden-interface directed black-box fuzzing, which mutates the routing tokens in input requests with these candidate values as the high-quality dictionary. We have implemented a prototype of EAGLEYE and evaluated it on 13 different commercial IoT devices. EAGLEYE successfully found 79 hidden interfaces, 25X more than the state-of-the-art (SOTA) solution IoTScope. Among them, we further discovered 29 unknown vulnerabilities including backdoor, XSS (cross-site scripting), command injection, and information leakage, and have received 7 CVEs.
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.
The post NDSS 2025 – EAGLEYE: Exposing Hidden Web Interfaces In loT Devices Via Routing Analysis appeared first on Security Boulevard.
The post Life in the Swimlane with Pauline Bacot, Senior Product Marketing Manager appeared first on AI Security Automation.
The post Life in the Swimlane with Pauline Bacot, Senior Product Marketing Manager appeared first on Security Boulevard.
Competitive testing is a business-critical function for financial institutions seeking the ideal solutions provider to help optimize their risk management strategies. Don’t get seduced by inflated test results or flowery marketing claims, however. Selecting the right risk solutions could be one of the most important tasks your business ever undertakes – and one of the..
The post Don’t Use a Ruler to Measure Wind Speed: Establishing a Standard for Competitive Solutions Testing appeared first on Security Boulevard.
The cybersecurity landscape is undergoing a profound transformation. Traditional malware, characterized by static code and predictable behaviors, is being eclipsed by a new breed of threats powered by advanced artificial intelligence. A notable example is the emergence of MalTerminal, a malware leveraging OpenAI’s GPT-4 to generate ransomware and reverse shells in real-time. This development marks..
The post The Emergence of GPT-4-Powered Ransomware and the Threat to IAM Systems appeared first on Security Boulevard.
Get details on 4 new AppSec requirements in the AI-led software development era.
The post 4 New AppSec Requirements in the Age of AI appeared first on Security Boulevard.
With disconnected tools creating critical blind spots, your security stack is likely hiding more risk than it exposes. Discover how unifying your security data into a single view uncovers the full risk picture and lets you focus on what matters most.
Key takeaways:What if the biggest risks in your environment aren't the ones you can see — but the ones hiding in the gaps between your security tools?
Security teams have invested heavily in best-of-breed solutions for everything from vulnerability management to identity management to cloud security. But as each tool focuses on its own slice of the attack surface, the real danger lies in everything that falls between them.
Each product generates valuable data, yet none of them reveal how risks connect and compound across domains. That means critical insights slip through the cracks: a low-severity vulnerability tied to a high-privilege identity; a misconfigured cloud asset that provides the missing link in an attack path. These are the hidden relationships attackers exploit, but your siloed tools never surface.
When your visibility is fragmented, your risk picture is incomplete. With fragmented data and no unified understanding of how risks interact, teams are left chasing isolated issues instead of addressing the true business-level threats.
From scattered security data to a connected cyber risk storyEffective risk reduction isn't about adding more tools — it's about making the ones you already have work better together. By breaking down silos and unifying security data into a single source of truth, teams can begin to see the hidden relationships between assets and exposures across the entire attack surface. What may look like a low-priority issue on its own can become a critical weakness when linked to others, forming dangerous attack paths for adversaries.
Reveal your true exposure, one data source at a time, to get a complete picture of your exposure.
With each piece of integrated data — from vulnerability management, endpoint security, identity management, asset management, application security, cloud security and OT security— the picture becomes clearer. Scattered insights evolve into a connected risk story, allowing you to separate the real threats from the noise and prioritize remediation actions with confidence.
Learn moreThe post What You Can’t See Can Hurt You: Are Your Security Tools Hiding the Real Risks? appeared first on Security Boulevard.
Would Your Business Survive a Black Friday Cyberattack?
madhav
Tue, 11/25/2025 - 13:54
Black Friday and Cyber Monday can make or break the year for retailers. Sales soar, carts fill, and data pours in. However, the same things that drive growth for retailers also draw in malefactors. For them, it’s open season.
Cyber War Cloud Security Access Control Application Encryption Tokenization Data Security Insider Threat Thales | Security for What Matters Most
More About This Author >
Black Friday and Cyber Monday can make or break the year for retailers. Sales soar, carts fill, and data pours in. However, the same things that drive growth for retailers also draw in malefactors. For them, it’s open season. Each click, login, or checkout is an opportunity to slip, unnoticed, into systems full of sensitive data.
By the time you notice something is wrong, it may be far too late. So, ask yourself this: if my retail business went offline during Thanksgiving weekend, how long would it take me to recover? How much trust (and money) could I lose?
When Doubt Meets DangerWhen Black Friday and Cyber Monday come around, retailers brace for a storm. Traffic surges and systems struggle to keep afloat. Thales saw retail traffic climb 12% between October and November 2023; a wave big enough to hide almost anything. In that flood, fraudsters slip through and upend your promises of data security in minutes. Even the sharpest monitoring systems can overlook a (seemingly) innocuous login.
On top of that, consumer confidence in retail security is already thin. When asked which sectors they trusted the most, only 5% of respondents to the Thales 2025 Digital Trust Index answered ‘retail’. In the same report, nearly one in five said they have been informed in the last 12 months that their data has been compromised.
Between the customer trust gap and the increasingly sophisticated methods used to gain access, the impact of an attack can be devastating. A slew of breaches, mainly ransomware, hit major UK retailers in 2025, costing millions and causing weeks of operational disruption. When those attacks hit, they didn’t just freeze systems; customers lost faith, and retailers lost business.
Cracks Widen Under PressureThe average eCommerce platform loads 400 resources per site, and much of it, whether a payment gateway, marketing tag, or analytics feed, brings in third party content. Alongside this necessary infrastructure and functionality for customers come the inevitable weaknesses. Each outside integration is another potential entry point for malicious actors.
Thales found that bot attacks now account for 37% of all internet traffic, overtaking human activity for the first time. Legacy systems, patchwork architectures, and inconsistent MFA across customer and staff accounts widen the cracks. Add seasonal staff, stretched IT teams, and a sprinkle of subpar training, and even minor misconfigurations can become serious exposures.
During Black Friday 2023, account takeover (ATO) attacks surged 85%. Retailers already contend with an average of 101,950 bot-related incidents every day, so what do businesses need to understand to protect the bottom line and avoid adding additional risk?
Bots, APIs, and the Rise of RansomwareThe most important aspect of threat to retailers today isn’t bad humans. It’s bad humans using automation.
These aren’t yesterday’s basic bots. Mimicry is their specialty, using AI to imitate human behavior, bypass rate limits, and blend in with normal traffic. Many use residential proxies to seem legitimate, hiding malicious intent behind trusted IP addresses.
Modern shopping experiences are powered by APIs, which makes them a prime target. Thales 2025 data shows 44% of advanced bot traffic now hits APIs. Attackers exploit business logic (discount loops, gift card abuse, fake account creation) by sending valid-looking requests that slip through traditional defenses.
Some of the most damaging attacks combine this human-like subtlety with scale. Thales recorded an application-layer DDoS attack that hit 15 million requests per second against a financial API. In retail, such an assault could mean hours, or even days, of lost revenue. For context, Thales products helped prevent around 30 hours of downtime per retail site during the 2023 holiday season.
Ransomware also remains one of the retail sector’s biggest threats. Bad actors know the losses during downtime can make or break a retailer’s year, and they aren’t afraid to use that as leverage. One successful infection can lock customer data, disrupt logistics, and stop transactions midstream. When the demand for payment comes, it’s too tempting to pay up in exchange for regular operations – and the number of companies doing just that has more than doubled in recent years.
Application Security at the FrontlineGood data management with Thales’ CipherTrust Data Security Platform helps limit these risks. By encrypting and tokenizing sensitive details (particularly payment and loyalty information), data is protected and, crucially, unusable in the event of an attack. Real-time ransomware protection detects unauthorized encryption attempts before they can spread.
This kind of layered defense cannot be underestimated. Today’s websites are like living ecosystems, not static storefronts. JavaScript dependencies, API calls, and client-side integrations are all fraught with invisible risk. Retailers need more than backup plans; they need preventive plans, too.
Client-side threats like Magecart attacks insert malicious code directly into checkout pages and skim card data. When 76% of a retail site’s JavaScript comes from third parties, the attack surface widens dramatically. Continuous monitoring of client-side scripts helps detect unsanctioned changes before they affect customers.
Meanwhile, APIs must be protected with runtime intelligence and behavioral analytics. Adaptive throttling, schema enforcement, and object-level authorization help stop automated abuse without disrupting real users.
The Thales Application Security Platform can halt attacks before they reach APIs, spotting abnormal behavior, blocking bot-driven fraud, and keeping business logic intact while letting legitimate traffic flow uninterrupted.
The Identity Layer Still MattersWhile the problem is certainly bigger than just identity, it’s true that it remains central to the customer experience. Balancing customer safety with customer satisfaction and avoiding dangers, like password over-reliance and reluctance to use MFA, is a delicate act. Complicating the experience for your customers is a gift to attackers. If it’s too hard to jump through the hoops, passwords start looking less like security measures and more like ‘shopping123’. These weak, stolen credentials feed ATO campaigns, which spike during sales events and put revenue at risk.
The Thales OneWelcome Identity Platform helps close the gap with phishing-resistant, passwordless authentication and context-based MFA. It verifies legitimate users without adding friction, adapting automatically to seasonal peaks or changes in user behavior.
At it’s heart, identity protection is about trust. When customers know their data and accounts are safe, they shop with confidence.
Preparing for the SurgeAs AI-driven automation grows, attackers are evolving faster than many defenses. Thales telemetry shows retail sites now face an average of 569,884 AI-driven attacks daily. These systems generate fake identities, automate phishing, and adapt in real time to evade security tools.
To stand up to this, retailers need to understand the risk and adopt a holistic defense posture:
Black Friday and Cyber Monday are both opportunity and danger. Retailers that see cybersecurity as a seasonal necessity pay the price. Those who protect identity, protect data, and shield applications year-round have built the resilience that carries them through (and beyond) the rush.
Cybercriminals don’t take holidays. But with Thales, your customers can.
Schema {November 25, 2025
The post Would Your Business Survive a Black Friday Cyberattack? appeared first on Security Boulevard.
The global telecommunications ecosystem has entered its most dangerous cyber era.As 5G, O RAN, cloud workloads, and massive IoT ecosystems expand, telecom networks have become the number one target for nation-state APTs. Attacks like Salt Typhoon, labeled the worst telecom breach in U.S. history, prove one reality: Traditional enterprise security tools cannot defend networks operating
The post Telecommunications Network Security: Defending Against Nation State APTs with Unified AI Defense appeared first on Seceon Inc.
The post Telecommunications Network Security: Defending Against Nation State APTs with Unified AI Defense appeared first on Security Boulevard.
The conversation about AI security has shifted.
For the past year, the focus has been on the model itself: poisoning data, prompt injection, and protecting intellectual property. These are critical concerns, but they miss the bigger picture of how AI is actually being operationalized in the enterprise.
We are entering the era of Agentic AI. AI is no longer just generating text; it is taking action. Autonomous agents read customer tickets, query databases, update financial records, and trigger workflows.
To do this, they rely on a new, critical piece of infrastructure: Model Context Protocol (MCP) servers.
These servers are the "connective tissue" of the agentic future. They are the bridge between your LLMs and your most sensitive internal systems. And right now, for most security teams, they are completely invisible.
The Rise of the AI Action LayerThis new infrastructure, the ecosystem of MCP servers, agents, and the tools they expose, forms what we call the Agentic AI Action Layer.
It is powerful, flexible, and rapidly multiplying. Developers are spinning up MCP servers to connect copilots to internal tools. Marketing teams are using them to automate campaigns.
But this speed comes with a massive blind spot.
Tech providers and enterprises are largely unprepared for this surge in machine-to-machine interaction. As Gartner notes: "Most tech providers remain unprepared for the surge in agent-driven API usage. Gartner predicts that by 2028, 80% of organizations will see AI agents consume the majority of their APIs, rather than human developers."*
This creates a dangerous gap. If you don’t know where your MCP servers are, what tools they expose, or who configured them, you cannot secure them. You are effectively blind to a major new class of access pathways into your organization.
Introducing Salt MCP Finder Technology: A System of Record for AIToday, we are proud to announce Salt MCP Finder Technology, the industry's first centralized system of record for the Agentic AI Action Layer.
We built MCP Finder Technology to answer the fundamental questions CISOs ask: Where are my MCP servers? What data can they access? Are they secure?
It consolidates discovery from every stage of the lifecycle, external, code, and runtime, into a single, authoritative inventory.
The Salt Discovery Engine: Three Steps to Full VisibilityTo build this complete picture, Salt MCP Finder Technology leverages a unique, three-pronged discovery engine that secures every stage of the lifecycle:
1. External Exposure (Salt Surface): The first step is securing your perimeter. We identify forgotten or zombie MCP servers exposed to the public internet, allowing you to close immediate gaps that attackers could exploit.
2. Code (GitHub Connect): The proactive step. We scan private repositories to find MCP blueprints and shadow integrations before they are deployed. This "shift-left" visibility allows you to catch misconfigurations at the source.
3. Runtime (Agentic AI): The continuous step. We monitor live traffic to observe the actual behavior of AI agents, tool usage, and data flow. This ensures that the runtime environment aligns with your security policy.
By combining these three views, external, code, and runtime, Salt MCP Finder Technology provides the only complete system of record for the Agentic AI Action Layer.
From Discovery to GovernanceVisibility is only the first step. To secure the Agentic AI Action Layer, you need control.
Salt MCP Finder Technology doesn't just list your servers; it governs them. It automatically maps the tools and data sources exposed by each MCP server and evaluates them against a robust set of AI Posture Policies.
For example, you can instantly flag any MCP server that:
This allows you to move from manual, spreadsheet-based tracking to automated, continuous policy enforcement.
Secure the Future of WorkThe shift to agentic AI is as significant as the shift to cloud or mobile. It requires a new approach to security, one that understands the unique language and risks of AI agents.
With Salt MCP Finder Technology, security teams finally get a seat at the table. You can enable your organization to innovate with AI agents, confident that you have the visibility and control to keep them secure.
Don't let the surge of AI agents outpace your security. See the Agentic AI Action Layer with Salt MCP Finder Technology by booking a demo with us today.
If you want to learn more about Salt and how we can help you, please contact us, schedule a demo, or visit our website. You can also get a free API Attack Surface Assessment from Salt Security's research team and learn what attackers already know.
*Source: Gartner Research, Protect Your Customers: Next-Level Agentic AI With Model Context Protocol, By Adrian Lee, Marissa Schmidt, November 2025.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
The post Find the Invisible: Salt MCP Finder Technology for Proactive MCP Discovery appeared first on Security Boulevard.
