Author, Creator & Presenter: Adam Shostack, Shostack + Associates
Our thanks to USENIX Security '25 (Enigma Track) (USENIX '25 for publishing their Creators, Authors and Presenter’s tremendous USENIX Security '25 (Enigma Track) content on the Organizations' YouTube Channel.
The post USENIX Security ’25 (Enigma Track) – Risk Is Not A Hammer, And Most Hazards Aren’t Nails appeared first on Security Boulevard.
Microsoft addresses 83 CVEs including two vulnerabilities that were publicly disclosed prior to a patch being released.
Microsoft patched 83 CVEs in its March 2026 Patch Tuesday release, with eight rated critical and 75 rated as important. Our counts omitted one CVE (CVE-2026-26030) assigned by GitHub.
This month’s update includes patches for:
Elevation of privilege (EoP) vulnerabilities accounted for 55.4% of the vulnerabilities patched this month, followed by remote code execution (RCE)vulnerabilities at 20.5%.
Important CVE-2026-21262, CVE-2026-26115 and CVE-2026-26116 | SQL Server Elevation of Privilege VulnerabilityCVE-2026-21262, CVE-2026-26115 and CVE-2026-26116 are EoP vulnerabilities affecting Microsoft SQL Server. Each of these flaws received a CVSSv3 score of 8.8 and were rated as important. While each of these were assessed as “Exploitation Less Likely” according to Microsoft’s Exploitability Index, CVE-2026-21262 was publicly disclosed as a zero-day. While no exploitation has been reported by Microsoft, a successful exploit of any one of these three flaws would result in an attacker gaining SQL sysadmin privileges.
Important CVE-2026-26127 |.NET Denial of Service VulnerabilityCVE-2026-26127 is a denial of service (DoS) vulnerability affecting.NET 9.0 and 10.0 on Windows, Mac OS and Linux. It received a CVSSv3 score of 7.5 and was rated as important. According to Microsoft, this vulnerability was publicly disclosed prior to patches being made available. Although it was publicly disclosed, Microsoft assesses that exploitation is unlikely for this DoS vulnerability.
.NET updates this month also include patches to address CVE-2026-26131, an important severity EoP vulnerability for.NET 10 installations on Linux.
Important CVE-2026-24287, CVE-2026-24289 and CVE-2026-26132 | Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-24287, CVE-2026-24289 and CVE-2026-26132 are EoP vulnerabilities in the Windows Kernel. Each was assigned CVSSv3 scores of 7.8 and rated important. A local, authenticated attacker could exploit these vulnerabilities in order to gain SYSTEM privileges. While Microsoft reports no evidence of exploitation, it did assess CVE-2026-24289 and CVE-2026-26132 as “Exploitation More Likely.” Including these three CVEs, six EoPs affecting Windows Kernel have been patched so far in 2026.
Important CVE-2026-26118 | Azure MCP Server Tools Elevation of Privilege VulnerabilityCVE-2026-26118 is an EoP vulnerability in Azure Model Context Protocol (MCP) Server. An attacker could exploit this vulnerability by sending a crafted input to a vulnerable Azure MCP Server that accepts user-provided parameters. Successful exploitation would grant an attacker to elevate privileges using an obtained managed identity token.
MCP, an open standard introduced in 2024 by Anthropic, is used to allow large language models (LLMs) to connect to external data and tools. For more information on MCP, please check out our FAQ blog on Model Context Protocol (MCP) and Integrating with AI for Agentic Applications as well Tenable Research’s AI Security blog examining web flaws in MCP servers.
Critical CVE-2026-26110 and CVE-2026-26113 | Microsoft Office Remote Code Execution VulnerabilityCVE-2026-26110 and CVE-2026-26113 are RCE vulnerabilities affecting Microsoft Office. Both received CVSSv3 scores of 8.4 and were rated as critical. A local, unauthenticated attacker could exploit these vulnerabilities to achieve local code execution. Microsoft notes that the preview pane is an attack vector for these flaws and both CVEs were assessed as “Exploitation Less Likely.”
Tenable SolutionsA list of all the plugins released for Microsoft’s March 2026 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.
For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.
Get more informationJoin Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
The post Microsoft’s March 2026 Patch Tuesday Addresses 83 CVEs (CVE-2026-21262, CVE-2026-26127) appeared first on Security Boulevard.
Google knows a lot about you. Here's how to check your Google Search history and how to prevent future tracking.
The post How to see your Google Search history (and delete it) appeared first on Security Boulevard.
Organizations often prioritize patching vulnerabilities based on severity scores, assuming that lower-rated issues pose limited risk. In practice, attackers frequently exploit vulnerabilities that remain unpatched in real environments, regardless of their official severity rating. New reporting from The Hacker News highlights that the Cybersecurity and Infrastructure Security Agency (CISA) has added multiple vulnerabilities affecting products
The post CISA Warns SolarWinds and Ivanti Vulnerabilities Are Actively Exploited appeared first on Seceon Inc.
The post CISA Warns SolarWinds and Ivanti Vulnerabilities Are Actively Exploited appeared first on Security Boulevard.
Critical infrastructure organizations continue to face sustained pressure from nation-state cyber operations. Airports, financial institutions, and software companies represent high-value targets because of the operational and economic disruption that a successful intrusion can create. New reporting from SecurityWeek details how an Iranian advanced persistent threat group conducted cyber intrusions against organizations, including a U.S. airport,
The post Iranian APT Hack Targets US Airport Bank and Software Company appeared first on Seceon Inc.
The post Iranian APT Hack Targets US Airport Bank and Software Company appeared first on Security Boulevard.
In the evolving digital economy, adopting a prevention-first strategy for cloud workflows is essential. This article explores the importance of preemptive security measures to protect sensitive operations from breaches, detailing steps for organizations to enhance their security posture.
The post Prevention is the Only Cloud Security Strategy That Works appeared first on Security Boulevard.
AI makes it easy to find executive PII online. Security teams must reduce digital exposure before attackers use AI to surface sensitive data.
The post AI Just Made Executives the Easiest Targets on the Internet appeared first on Security Boulevard.
The AI tools built into your security stack are making decisions at a scale no human team can match. They're classifying data, scoring risk, triggering enforcement and shaping your program's posture without a line of policy being manually written. That's the promise of AI-powered security. But it also raises a question most vendors haven't been willing to answer: how do you know the AI doing that work is governed responsibly?
ISO 42001 is the answer the industry has been building toward. Published by the International Organization for Standardization in December 2023, it's the world's first international standard for AI management systems. It doesn't certify a product. It certifies that an organization's approach to developing and deploying AI, including the policies, controls, risk assessments and oversight mechanisms in place, meets a globally recognized standard.
What ISO 42001 actually requiresThis isn't a checkbox audit. Certification under ISO 42001 requires an independent third-party assessment across 38 distinct controls organized into nine areas: data governance, model development, operations, security, ethics, accountability, transparency, incident response and continuous improvement. Every AI system MIND deploys has been evaluated for how it handles data quality and lineage, how it approaches adversarial testing, how it responds to incidents and how it maintains transparency with the organizations that rely on it.
The standard also requires continuous improvement. This isn't a milestone you reach and file away. It's a framework that evolves alongside the AI itself, with ongoing monitoring, documentation and governance cycles built into how we operate. That's a meaningful commitment, and one that most AI-powered vendors in this space have not made.
Why being first in data security mattersNot all AI carries the same risk. A recommendation algorithm that misclassifies a product is inconvenient. An AI system that misclassifies sensitive data in your environment, or generates false positives that erode analyst trust, has real consequences: regulatory exposure, missed incidents and the slow erosion of confidence in the program itself.
Data security tools operate on the most sensitive information in the enterprise. Intellectual property, customer records, regulated data, the files that could become a breach headline if they reach the wrong destination. The AI that governs how that data is discovered, classified and protected needs to be held to a higher standard than tools operating in lower-stakes contexts.
Achieving ISO 42001 first in data security isn't symbolic. It reflects what we believe responsible AI in this space should look like, and it sets a bar we'd encourage the rest of the industry to meet.
What this means for your programFor security leaders managing risk and reporting to leadership, this certification changes a specific conversation. When you're asked how the AI in your security stack is governed, what it's been audited against and who holds it accountable, ISO 42001 gives you a clear and verifiable answer. Not a vendor's word for it. An independent third-party assessment against an internationally recognized standard.
We've seen how the absence of AI governance frameworks creates friction, not just internally, but with auditors, regulators and boards who are increasingly asking these questions. The certification doesn't just reflect MIND's commitment to responsible AI. It gives the security leaders who rely on us something concrete to stand behind in those conversations.
That's what Stress-Free DLP looks like in 2026: not just automation that works, but automation you can trust, explain and defend. If you're ready to see how MIND's certified platform fits into your data security program, we'd be glad to show you.
The post MIND is the first data security company to achieve ISO 42001 certification appeared first on Security Boulevard.
When using a hardware token-based certificate, it is important to download and install the SafeNet Authentication Client to sign the certificate of Sectigo code signatures. I have installed this several times in the case of developers and organizations, and one thing never fails: your code signing certificate will not work unless you have installed the… Read More How to Download and Install SafeNet Authentication Client for Sectigo Code Signing Certificates?
The post How to Download and Install SafeNet Authentication Client for Sectigo Code Signing Certificates? appeared first on SignMyCode - Resources.
The post How to Download and Install SafeNet Authentication Client for Sectigo Code Signing Certificates? appeared first on Security Boulevard.
Organizations invest heavily in advanced cybersecurity technologies such as endpoint detection, identity access management, zero trust architecture, and continuous monitoring. However, a significant number of security incidents still originate from physical security weaknesses rather than purely digital vulnerabilities. Such often overlooked threats are piggybacking attacks. It is a social engineering and physical access attack technique […]
The post How Piggybacking Attacks Threaten Organizational Security? appeared first on Kratikal Blogs.
The post How Piggybacking Attacks Threaten Organizational Security? appeared first on Security Boulevard.
Panda Technology embraced the Acronis Integrations Technology Ecosystem. By adopting Acronis Cyber Protect Cloud and integrating it with their PSA, RMM, security and identity systems, Panda Technology built a centralized operating environment where key workflows now run automatically. Panda Technology COO and Co-founder Joshua Aaronson explains a more than 600% improvement in troubleshooting time.
The post How Panda Technology transformed its operations with Acronis integrations appeared first on Security Boulevard.
Learn how to detect anomalous prompt injections in quantum-secured AI pipelines using lattice-based cryptography and behavioral AI analysis for MCP environments.
The post Anomalous Prompt Injection Detection in Quantum-Secured AI Pipelines appeared first on Security Boulevard.
Led by Balderton Capital, with participation of Uncorrelated Ventures and existing investors IRIS and Y Combinator, the $18M Series A financing will accelerate our mission to multiply the impact of security teams through full-lifecycle offensive security.
The post Escape raises $18M Series A to replace legacy scanners with AI agent-driven discovery, pentesting, and remediation appeared first on Security Boulevard.
This blog is perhaps a little bit more like an ad, so if you don’t want to check the ads, consider not reading it.
a very cyber image (Gemini)But this year at RSA 2026, I’m speaking on three topics: securing AI, using AI for SOC, and sharing lessons about how Google applies AI and other technologies to D&R.
Here are these 3 fun things!
First, I’m doing a presentation on governing shadow AI agents. Believe it or not, this presentation was created mostly before OpenClaw became a thing (but updated for it!). So you may be surprised how well the content aged (think wine!) Attend this if you are struggling with shadow AI, specifically shadow agents at work.
Shadow Agents: A Pragmatist’s Guide to Governing Unsanctioned AI — [STR-W08]
It is not the APT! The new threat is the “shadow AI agents” employees already use for work, leaking data and making decisions. Banning them is a losing game. This session will offer a better way: turn this organic behavior into a catalyst for secure progress. Learn to discover, assess, and channel unsanctioned agents into a formal strategy that empowers a team rather than force it underground.
The second is probably the most detailed discussion about how we use AI for detection and response at Google. You probably read our blogs and listen to our talks (especially this), but this time we are revealing a lot more interesting details about the machinery and also how we arrived at the state we’re in. I promise you this will be fun! And detailed too.
This Is How We Do It: Building AI Agents for Cybersecurity and Defense — [PART3-M07]
Presenters will share the playbook for building and scaling AI agents in cybersecurity. Attendees will learn four core lessons: Building trust with the team, prioritizing real problems, measuring value, and establishing solid governance foundations for the agentic SOC.
Finally, the third isn’t a presentation but a discussion that would help you understand the real state of AI in security operations / SOC. This would not be about the slides, but about sharing lessons on what works and what doesn’t.
AI in SecOps: Sharing Lessons Learned for Adoption Maturity — [CXN-R05]
Attendees in this peer-led discussion will share stories from the AI-powered SOC trenches. Explore real adoption journeys from manual processes to autonomous agents. Share practical use cases on analyst retraining, workflow auditing, malware analysis, remediation automation, RAG pipelines and more. Trade notes on what’s working, what’s breaking, trust gaps, AI hallucinations, and career redesign.
All in all, join me for securing AI and Shadow Agents, learning from Google about detection and response, and comparing the state of practice of AI in the SOC.
See you there!
P.S. Yes, we will also be podcasting from the show.
Related:
RSA 2025: AI’s Promise vs. Security’s Past — A Reality Check”
My Really Fun RSA 2026 Presentations! was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.
The post My Really Fun RSA 2026 Presentations! appeared first on Security Boulevard.
How Do Non-Human Identities Navigate the Complexities of Cybersecurity? Where artificial intelligence and cloud technologies are reshaping industries, how can organizations ensure their cybersecurity measures keep pace? For professionals across financial services, healthcare, travel, and tech-heavy fields like DevOps and Security Operations Centers (SOC), the key lies in effective management of Non-Human Identities (NHIs). These […]
The post How to feel empowered by your NHIs and AI appeared first on Entro.
The post How to feel empowered by your NHIs and AI appeared first on Security Boulevard.
How Can Non-Human Identities Bolster AI Governance Frameworks? What role do Non-Human Identities (NHIs) play in fortifying AI governance frameworks? With industries increasingly lean into artificial intelligence, the importance of managing machine identities becomes paramount. This is especially true for organizations operating in cloud environments, where the interplay between AI and NHIs deeply influences data […]
The post What assurances do AI governance frameworks offer appeared first on Entro.
The post What assurances do AI governance frameworks offer appeared first on Security Boulevard.
Are Your Machine Identities Secure? Have you ever wondered about the invisible workforce within your systems? These are not your typical employees but rather Non-Human Identities (NHIs), commonly referred to as machine identities in cybersecurity. Understanding and managing these identities is crucial, where machines often outnumber human workers. The Importance of Securing Non-Human Identities NHIs […]
The post Are scalable secrets management systems more effective appeared first on Entro.
The post Are scalable secrets management systems more effective appeared first on Security Boulevard.
Team Awareness Kit (TAK) and its Android variant, the Android Tactical Assault Kit (ATAK), are situational awareness platforms used across the military—dismounted infantry, vehicle commanders, air crews, SOF operators. If you need a common operating picture in the field, TAK is probably running somewhere in your stack. But there’s a problem that’s easy to overlook...
The post Secure Identity for TAK/ATAK at the Tactical Edge appeared first on Strata.io.
The post Secure Identity for TAK/ATAK at the Tactical Edge appeared first on Security Boulevard.
Salesforce GraphQL exploit exposed misconfigured guest data in Experience Cloud. Learn how it happened and how to prevent exposure.
The post What is the Salesforce GraphQL Exploit and What You Should Do appeared first on AppOmni.
The post What is the Salesforce GraphQL Exploit and What You Should Do appeared first on Security Boulevard.
A practitioner's breakdown of AEO, GEO, and AIO. Learn where these terms originated, how they differ from traditional SEO, and how B2B companies use them to generate leads and grow revenue in 2026.
The post AEO vs GEO vs AIO: What These Terms Actually Mean and Why Your Business Needs to Care appeared first on Security Boulevard.
