AI Found Seven FatFs Bugs. Now Someone Has to Fix the Devices
AI uncovered seven FatFs flaws affecting embedded devices. The challenge now is patching millions of systems with no easy fix.
Vulnerability Management
The CVE Stampede Is a Distraction, Finding the Vulns that Matter is the Challenge
With 48,000+ CVEs published annually, the challenge isn't volume. It's finding the vulnerabilities attackers will actually exploit.
Follow Friday: 5 Must-Read Cybersecurity Picks This Week
Discover five must-read cybersecurity articles, videos, and creators every security professional should follow this week.
Federal Agency or Not: How BOD 26-04 Is Coming for your Vulnerability Management Program
CISA's BOD 26-04 tells federal agencies how fast to patch. It's quietly telling everyone else the same thing: through insurance underwriting, vendor contracts, and regulatory alignment.
From CVSS to KEV, CISA Rewrites Federal Patching Priorities
The agency’s new directive replaces blunt severity-driven remediation with a four-factor risk model built around internet exposure, known exploitation, automatability and system control.
AI, Ancient Bugs, Fresh Exploits, and an Overflowing Patch Queue
A trio of fresh flaws highlights the heightened vulnerability of the entire enterprise software stack, as the combination of automated scanning, the availability of exploit code, and patching delays is cited as a factor in the rise of vulnerability exploitation as a preferred entry point.
Highlights from CYBR.HAK.CON. 2026
Among the topics: Cognitive warfare and medical device mayhem.
AI Scanning's Hidden Tax: $128K in Triage Before a Fix
AI security scanners promise to reduce AppSec workload, but Contrast Labs' testing shows they systematically multiply it, turning a $315 API fee into an estimated $128,000 triage burden, before fixing a single vulnerability.
Cognitive Warfare Has Entered the SOC. What it is, How to Respond
Information overload, cognitive warfare, and nonstop digital noise are turning human attention into a vulnerable attack surface.
Pentesting Theater: When the Pentest Report Lands, and the Vulnerabilities Remain
Organizations spend real money on penetration testing and too often walk away afterwards with the same vulnerabilities they started with. The test happened. The report landed. The checkbox got checked. Nothing significant has changed.
The Vulnpocalypse Isn’t Your Problem
But it might be your company’s problem.
From Threat Intel to ‘VulnOps’: Why Level 1 SOC as We Know It Is Heading to Extinction
Traditional security operations: CTI feeds piped into a SIEM, alerts routing into a ticket queue, and analysts triaging the resulting flood is running out of road. A new operational model is emerging in its place, and it doesn’t look much like what most security teams currently have in place.
How to Build a Vulnerability Intelligence Pipeline That Doesn't Rely on NIST's NVD
With NIST's National Vulnerability Database now triaging only a fraction of incoming CVEs, security teams must diversify beyond NVD while rethinking patch SLAs and risk scoring.
NIST Declares “Inbox Zero,” Pulls Back on CVE Enrichment. Now Enterprise Security Teams Must Fill the Gap
An analysis of the National Vulnerability Database's shift to risk-based triage and what it actually means for the people patching systems (first of a two-part analysis)
Mythos and the Making of a Cybersecurity Mental Health Crisis
The AI-driven “vulnerability storm” isn’t just a technical problem—it’s a human breaking point, and the Mythos report’s authors are right to elevate burnout from a side issue to a frontline risk.
Mythos Broke the Clock, Now Defenders Are Racing the Storm
A coalition of cybersecurity heavyweights has issued an emergency playbook for surviving the AI-driven “vulnerability storm” — and it makes clear that speed, automation, and collective defense are now existential requirements.