STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 745 to 756 of 6838 threat reports

Computer Software/Engineering1 month ago

How One Kubernetes YAML File Can Compromise Your Entire Google Cloud Organization

A critical security vulnerability in Google Kubernetes Config Connector (KCC) allows attackers with limited Kubernetes namespace access to escalate privileges and gain complete control over entire Google Cloud organizations. The attack, dubbed ConfigConfusion, exploits a confused deputy problem where KCC's organization-level service account executes IAM changes requested by users who lack corresponding Google Cloud permissions. Attackers can submit a single YAML IAMPolicyMember resource to grant themselves roles/owner privileges across the entire organization, effectively bypassing all authentication controls without ever possessing Google Cloud credentials. This vulnerability highlights the growing risks of infrastructure-as-code systems where authorization gaps between Kubernetes RBAC and cloud provider IAM create unprecedented privilege escalation pathways, particularly as organizations increasingly adopt GitOps workflows and multi-cloud architectures.

Critical impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Retail Industry1 month ago

Autonomous AI Agents Execute Massive Credit Card Theft Campaign

A Chinese threat actor deployed autonomous AI agents to orchestrate a massive payment card theft operation, compromising over 119 websites and stealing more than 600,000 credit card records. The campaign, active since July 2026, utilized three AI frameworks - Strix for vulnerability scanning, Cairn for exploitation, and Hermes for orchestration - to systematically target online retailers. Major victims included Fortune 500 companies across hospitality, aviation, and retail sectors. The attackers deployed payment skimmers through various injection methods and implemented destructive cleanup procedures that wiped source data after exfiltration, causing operational disruptions. This incident represents a paradigm shift toward AI-powered cybercrime, demonstrating how autonomous systems can execute complex attack chains at unprecedented scale and speed. The low operational cost of $25 per target and minimal human oversight signal a new era where sophisticated attacks become accessible to less skilled threat actors, fundamentally changing the threat landscape.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Telecommunications1 month ago

September 2026: State-Sponsored Groups Target Network Management Infrastructure

The September 2026 InfraTrust Pulse report revealed a concerning escalation in attacks targeting network infrastructure management systems, with 158 security advisories covering 1,699 vulnerabilities across 17 vendors. Attackers successfully exploited critical flaws in Cisco Secure Firewall Management Center (CVE-2026-20079), Cisco Identity Services Engine (CVE-2026-76460), and SonicWall SMA 1000 appliances before vendors could patch them. State-sponsored groups including Sandworm and ransomware gangs like Qilin chained these vulnerabilities to gain root access, deploy tunneling tools, harvest credentials, and establish persistent control over enterprise network infrastructure. This incident represents a strategic shift where threat actors are bypassing individual network devices to compromise the centralized management platforms that control entire network fabrics, amplifying their impact across organizations' critical infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(high)

Read report

Computer Software/Engineering1 month ago

WordPress Under Siege: CVE-2026-87902 Exploitation Analysis

Threat actors began exploiting CVE-2026-87902, a critical WordPress path traversal vulnerability with a CVSS score of 9.2, within hours of patch release on September 22, 2026. The unauthenticated flaw allows remote code execution through path traversal attacks targeting the get_page_template() function, enabling attackers to include malicious PHP files outside theme directories. Initial reconnaissance activity escalated to active payload delivery within 24 hours, with attackers writing executable shell commands to /tmp directories on vulnerable WordPress installations running versions before 7.1.2. This incident highlights the accelerating weaponization timeline for critical web application vulnerabilities, as attackers now exploit high-severity flaws within hours rather than days or weeks. The widespread nature of WordPress deployments and the unauthenticated attack vector amplify the risk landscape significantly.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

Computer/Network Security1 month ago

Check Point Security Gateway Under Attack: Critical VPN RCE Vulnerability Exploited in the Wild

Check Point confirmed active exploitation of CVE-2026-85102, a critical pre-authentication remote code execution vulnerability in its Security Gateway VPN certificate-handling functionality, beginning September 12, 2026. Threat actors used anonymizing infrastructure including VPNs and proxies to hide their locations while exploiting the flaw. The Dutch NCSC had previously warned of imminent exploitation on September 10. A second zero-day vulnerability, CVE-2026-93616, affecting the Management web service has been exploited since July 23, allowing script execution and Java class loading. CISA added both flaws to its Known Exploited Vulnerabilities catalog with a September 25 remediation deadline. This incident highlights the persistent targeting of VPN infrastructure by sophisticated threat actors, reflecting the broader trend of exploiting network perimeter security solutions that became critical during remote work adoption and continue to serve as high-value attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Software/Engineering1 month ago

How Attackers Hijacked a Trusted Developer Domain for ClickFix Campaigns

In September 2026, the commonly used placeholder domain third-party.com began serving ClickFix attacks targeting Windows users through a fake Cloudflare verification page. The attack copied malicious PowerShell commands to victims' clipboards, instructing them to execute the commands manually to bypass traditional security measures. Unlike reserved documentation domains like example.com, third-party.com was a registrable domain that had been referenced in thousands of code repositories and official documentation from trusted sources like Chromium and W3C. The attack represents a sophisticated supply chain threat that exploits developers' trust in documentation examples and demonstrates how attackers can weaponize commonly referenced infrastructure domains. While the payload servers were inactive during investigation, the incident highlights the risks of using non-reserved domains as placeholders in production code and documentation.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(high)

EExfiltration(low)

IImpact(low)

Read report

Banking/Mortgage1 month ago

RemControl Android Banking Malware: New MaaS Platform Targets Europe and Canada

In September 2026, cybersecurity researchers discovered RemControl, a new Android malware-as-a-service (MaaS) platform targeting banking users across Europe and Canada through sophisticated phishing campaigns. The malware impersonates the popular TVTap IPTV application via fake Google Play pages and malvertising campaigns, deploying over 30 banking overlays to steal credentials from financial institutions across Italy, France, Spain, Poland, Portugal, and Canada. RemControl employs advanced evasion techniques including VPN services to block Google Play Protect scans, accessibility service abuse for remote device control, and dynamic C2 infrastructure rotation via Telegram channels. This incident highlights the continued evolution of mobile banking trojans, particularly the integration of AI-assisted development and sophisticated anti-detection mechanisms. The malware's ability to dynamically receive new targets and perform real-time device manipulation represents a significant escalation in mobile banking threats, coinciding with increased regulatory focus on mobile security frameworks.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Telecommunications1 month ago

MikroTrick Vulnerability Chain Compromises MikroTik Routers Without Authentication

In September 2026, attackers exploited the MikroTrick vulnerability chain (CVE-2026-67279 and CVE-2026-86060) to gain full administrative control of internet-exposed MikroTik routers without passwords or SSH keys. The attack combined an SSH state-machine flaw that bypassed authentication with an argument-injection vulnerability in RouterOS login process. Evidence shows active exploitation began September 2, 2026, one day before patches were released, with attackers creating privileged accounts and exfiltrating configuration data from compromised devices. This incident highlights the growing threat to network infrastructure devices as nation-state actors and cybercriminals increasingly target routers and edge devices for persistent access and lateral movement capabilities.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Computer Software/Engineering1 month ago

First-Ever Terraform Registry Supply Chain Attack: North Korean Hackers Deploy Sophisticated Go Malware

In September 2026, cybersecurity researchers discovered North Korean threat actors using HashiCorp's Terraform Registry to distribute Go-based malware for the first time. The attackers published four malicious packages across Terraform providers and Go modules, accumulating over 1,600 downloads before detection. The malware employed sophisticated dual command-and-control channels using blockchain dead drops and Slack APIs, with execution triggered only during specific cryptographic operations to avoid detection. This campaign represents an expansion of the previously identified Graphalgo operation, demonstrating DPRK actors' continued evolution of supply chain attack vectors beyond traditional npm and PyPI repositories. This incident highlights the growing sophistication of state-sponsored supply chain attacks as threat actors diversify their distribution channels to target infrastructure-as-code and cloud-native development workflows, making detection and prevention increasingly challenging for organizations.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Computer Software/Engineering1 month ago

GitLab Email Token Flaw Enables Supply Chain Attacks Through CI/CD Pipeline Compromise

In September 2026, Aikido Security disclosed a critical vulnerability in GitLab's email-based issue creation feature that allows attackers to impersonate users and execute unauthorized code commits. The flaw stems from GitLab's private email addresses for filing issues, which contain non-expiring tokens that can be exploited by anyone who obtains them. Attackers can use these leaked addresses to commit code patches to any branch the user has access to, including main branches, and trigger CI/CD jobs that execute with the victim's permissions. The attack bypasses IP restrictions and two-factor authentication, potentially compromising entire development pipelines and supply chains. This incident highlights the growing sophistication of supply chain attacks targeting developer infrastructure and CI/CD environments. As organizations increasingly rely on automated development workflows and DevOps practices, vulnerabilities in platforms like GitLab pose significant risks to software integrity and organizational security posture.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Banking/Mortgage1 month ago

ClickFix Attack Analysis: When Your Logo Becomes the Weapon

ClickFix represents a sophisticated social engineering technique that leverages trusted brand logos and familiar verification prompts to deceive victims into executing malicious commands on their own systems. Unlike traditional malware campaigns, ClickFix attacks require no code injection or exploit delivery - instead, they manipulate users into becoming the attack vector themselves by mimicking legitimate CAPTCHA screens, brand verification pages, and system prompts. These campaigns adapt dynamically to victim operating systems, delivering tailored instructions for Windows or macOS environments, making detection through traditional signature-based methods ineffective. This attack method exemplifies the current shift toward human-centric attack vectors that bypass traditional security controls by exploiting psychological manipulation rather than technical vulnerabilities. As organizations increasingly deploy sophisticated endpoint protection and network security tools, threat actors are pivoting to techniques that leverage the weakest link in most security architectures - human trust and recognition patterns.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Financial Services1 month ago

Microsoft Takes Down EvilTokens: How AI-Powered Phishing Services Threaten Enterprise Identity Security

In September 2026, Microsoft successfully disrupted EvilTokens, a sophisticated phishing-as-a-service (PhaaS) platform operated by threat actor Storm-2992. The AI-powered cybercrime service facilitated device code phishing attacks targeting Microsoft 365 accounts, compromising over 12,000 inboxes across 10,000+ organizations worldwide. Microsoft seized 50 websites and disabled 150+ domains, while UK authorities arrested two suspects. EvilTokens distinguished itself by automating device code authentication abuse at scale, using AI to craft tailored phishing lures, analyze compromised inboxes for high-value targets, and streamline business email compromise campaigns sold for $1,500 upfront plus $500 monthly via Telegram. This incident highlights the alarming evolution of phishing-as-a-service platforms leveraging AI to democratize sophisticated attacks. As threat actors increasingly weaponize legitimate authentication mechanisms and AI capabilities, organizations face unprecedented challenges in defending against automated, scalable identity-based attacks that bypass traditional security controls.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

1...61 62 63 64 65...570

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

How One Kubernetes YAML File Can Compromise Your Entire Google Cloud Organization

Autonomous AI Agents Execute Massive Credit Card Theft Campaign

September 2026: State-Sponsored Groups Target Network Management Infrastructure

WordPress Under Siege: CVE-2026-87902 Exploitation Analysis

Check Point Security Gateway Under Attack: Critical VPN RCE Vulnerability Exploited in the Wild

How Attackers Hijacked a Trusted Developer Domain for ClickFix Campaigns

RemControl Android Banking Malware: New MaaS Platform Targets Europe and Canada

MikroTrick Vulnerability Chain Compromises MikroTik Routers Without Authentication

First-Ever Terraform Registry Supply Chain Attack: North Korean Hackers Deploy Sophisticated Go Malware

GitLab Email Token Flaw Enables Supply Chain Attacks Through CI/CD Pipeline Compromise

ClickFix Attack Analysis: When Your Logo Becomes the Weapon

Microsoft Takes Down EvilTokens: How AI-Powered Phishing Services Threaten Enterprise Identity Security

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

How One Kubernetes YAML File Can Compromise Your Entire Google Cloud Organization

Autonomous AI Agents Execute Massive Credit Card Theft Campaign

September 2026: State-Sponsored Groups Target Network Management Infrastructure

WordPress Under Siege: CVE-2026-87902 Exploitation Analysis

Check Point Security Gateway Under Attack: Critical VPN RCE Vulnerability Exploited in the Wild

How Attackers Hijacked a Trusted Developer Domain for ClickFix Campaigns

RemControl Android Banking Malware: New MaaS Platform Targets Europe and Canada

MikroTrick Vulnerability Chain Compromises MikroTik Routers Without Authentication

First-Ever Terraform Registry Supply Chain Attack: North Korean Hackers Deploy Sophisticated Go Malware

GitLab Email Token Flaw Enables Supply Chain Attacks Through CI/CD Pipeline Compromise

ClickFix Attack Analysis: When Your Logo Becomes the Weapon

Microsoft Takes Down EvilTokens: How AI-Powered Phishing Services Threaten Enterprise Identity Security

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?