gigamon

Week in review: Cisco ASA zero-day vulnerabilities exploited, Fortra GoAnywhere instances at risk Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: How Juventus protects fans, revenue, and reputation during matchdays In this Help Net Security interview, Mirko Rinaldini, Head of ICT at Juventus Football Club, discusses the club’s approach to cyber risk strategy. Juventus has developed a threat-led, outcomes-driven program that balances innovation with protections across matchdays, e-commerce, and digital platforms. Review: Practical Purple Teaming Practical Purple Teaming is a guide to building stronger collaboration between offensive and defensive security teams. The book focuses on how to design and run effective purple team exercises that improve detection and response and strengthen trust between teams. Building a stronger SOC through AI augmentation In this Help Net Security interview, Tim Bramble, Director of Threat Detection and Response at OpenText, discusses how SOC teams are gaining value from AI in detecting and prioritizing threats. By learning what “normal” looks like across users and systems, AI helps surface anomalies that rules-based methods often miss. Attackers exploited critical Fortra GoAnywhere flaw in zero-day attacks (CVE-2025-10035) CVE-2025-10035, a perfect CVSS 10.0 vulnerability in the Fortra GoAnywhere managed file transfer solution, has apparently been exploited in zero-day attacks before the patch was released on September 15, 2025. Malicious GitHub pages lure MacOS users into installing Atomic infostealer MacOS users looking to download popular software such as LastPass, 1Password, After Effects, Gemini, and many others are in danger of getting saddled with the Atomic infostealer instead, LastPass has warned. SonicWall adds rootkit removal capabilities to the SMA 100 series SonicWall has released new firmware for its Secure Mobile Access (SMA) 100 series appliances, adding file-checking capabilities that help users remove known rootkit malware. After Shai-Hulud, GitHub tightens npm publishing security Attackers are constantly finding ways to take over accounts and push malicious packages to the npm registry, the (GitHub-operated) online repository for JavaScript and Node.js packages. Kali Linux 2025.3 brings improved virtual machine tooling, 10 new tools OffSec has released Kali Linux 2025.3, the most up-to-date version of its popular penetration testing and digital forensics platform. Libraesva ESG zero-day vulnerability exploited by attackers (CVE-2025-59689) Suspected state-sponsored attackers have exploited a zero-day vulnerability (CVE-2025-59689) in the Libraesva Email Security Gateway (ESG), the Italian email security company has confirmed. SolarWinds fixes critical Web Help Desk RCE vulnerability (CVE-2025-26399) SolarWinds has fixed yet another unauthenticated remote code execution vulnerability (CVE-2025-26399) in Web Help Desk (WHD), its popular web-based IT ticketing and asset management solution. Cisco ASA zero-day vulnerabilities exploited in sophisticated attacks A widespread campaign aimed at breaching organizations via zero-day vulnerabilities in Cisco Adaptive Security Appliances (ASA) has been revealed by the US, UK, Canadian and Australian cybersecurity agencies. Cybercriminals are going after law firms’ sensitive client data Regardless of their size, all law firms hold valuable data, including client communications, financial records, and confidential legal strategies. That data has never been more at risk. Cybercriminals are targeting law firms by exploiting vulnerabilities, weak passwords, outdated systems, and untrained staff. U.S. Secret Service takes down network of devices threatening government officials The U.S. Secret Service has broken up a network of electronic devices spread across the New York tristate area that officials say posed an imminent threat to national security. The devices were being used to launch telecommunications attacks and to send threats targeting senior government officials. The fight to lock down drones and their supply chains Drones have already shown their impact in military operations, and their influence is spreading across the agricultural and industrial sectors. Given their technological capabilities, we need to be aware of the risks they bring. Cybersecurity AI (CAI): Open-source framework for AI security Cybersecurity AI (CAI) is an open-source framework that helps security teams build and run AI-driven tools for offensive and defensive tasks. It’s designed for anyone working in security, including researchers, ethical hackers, IT staff, and organizations that want to use AI to find vulnerabilities, test defenses, and improve their security. New framework sets baseline for SaaS security controls Managing security across dozens or even hundreds of SaaS apps has become a major headache. Each tool has its own settings, permissions, and logs, and most third-party risk processes only look at the vendor’s overall security, not the app itself. That leaves gaps you have to close on your own, often with limited visibility and extra work for both your team and procurement. Cisco fixes IOS/IOS XE zero-day exploited by attackers (CVE-2025-20352) Cisco has fixed 14 vulnerabilities in IOS and IOS XE software, among them CVE-2025-20352, a high-severity vulnerability that has been exploited in zero-day attacks. Microsoft spots LLM-obfuscated phishing attack Cybercriminals are increasingly using AI-powered tools and (malicious) large language models to create convincing, error-free emails, deepfakes, online personas, lookalike/fake websites, and malware. More recently, Microsoft Threat Intelligence spotted and blocked an attack campaign delivering an LLM-obfuscated malicious attachment. European Windows 10 users get an additional year of free security updates Windows 10 users in the European Economic Area (EEA) will be able to receive extended security updates until October 14, 2026, without having to pay for them or to back up their settings, apps, or credentials to the Microsoft cloud. AI needs ethics to avoid real-world harm In this Help Net Security video, Brittany Allen, Senior Trust and Safety Architect at Sift, explores how the rise of AI agents is creating new fraud risks. She explains how these agents, while designed to assist users, can unintentionally help fraudsters by carrying out tasks without recognizing malicious intent. Building AI responsibly from day one In this Help Net Security video, David Hardoon, Global Head of AI Enablement at Standard Chartered, discusses the role of ethics and safety in AI development. How agentic AI is changing the SOC In this Help Net Security video, David Norlin, CTO of Lumifi, explores the role of agentic AI in the security operations center (SOC). He explains what agentic AI is, how it can enhance cybersecurity workflows by automating repetitive tasks, and why accountability and careful implementation are critical. Gartner: Preemptive cybersecurity to dominate 50% of security spend by 2030 By 2030, preemptive cybersecurity solutions will account for 50% of IT security spending, up from less than 5% in 2024, replacing standalone detection and response (DR) solutions as the preferred approach to defend against cyberthreats, according to Gartner. Nosey Parker: Open-source tool finds sensitive information in textual data and Git history Nosey Parker is an open-source command-line tool that helps find secrets and sensitive information hidden in text files. It works like a specialized version of grep, focused on spotting things like passwords, API keys, and other confidential data. APIs and hardware are under attack, and the numbers don’t look good Attackers have a new favorite playground, and it’s not where many security teams are looking. According to fresh data from Bugcrowd, vulnerabilities in hardware and APIs are climbing fast, even as website flaws hold steady. The shift shows how attackers are adapting to infrastructure, going after the hidden systems that keep businesses running. Cybersecurity jobs available right now: September 23, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. Infosec products of the month: September 2025 Here’s a look at the most interesting products from the past month, featuring releases from: Absolute Security, Blackdot Solutions, Catchpoint, Cynomi, DataLocker, Gigamon, Lookout, Nagomi Security, Neon Cyber, QuSecure, Relyance AI, Secure Code Warrior, and Teleport.

Infosec products of the month: September 2025 Here’s a look at the most interesting products from the past month, featuring releases from: Absolute Security, Blackdot Solutions, Catchpoint, Cynomi, DataLocker, Gigamon, Lookout, Nagomi Security, Neon Cyber, QuSecure, Relyance AI, Secure Code Warrior, and Teleport. Cynomi simplifies vendor risk management Cynomi’s TPRM provides MSPs and MSSPs with a scalable way to deliver these critical services. By cutting vendor assessment times from 7 – 16 hours down to just 1.5 – 4.5 hours, Cynomi TPRM users can work up to 79% faster. This efficiency directly translates into higher profitability, with margins rising up to 20%. Absolute Security Rehydrate restores compromised endpoints Rehydrate delivers business continuity endpoint restoration through a fully remote, single-click process. When your remote, mobile, and hybrid Windows PCs go down, recovery playbooks ranging from targeted remediations to full OS recovery can be executed across connected devices at enterprise scale. Blackdot Videris Automate uses AI to speed OSINT, risk detection, and decision-making Blackdot Solutions unveiled Videris Automate, a platform that delivers new AI capabilities to automate investigations and screening processes. The launch marks a step-change in how organizations can detect risks, uncover hidden connections, and accelerate decision-making at scale. Catchpoint improves monitoring posture with AI capabilities Catchpoint released two AI-powered capabilities designed to simplify digital resilience for critical applications: Catchpoint Root Cause Analysis (RCA) and Catchpoint Advisor, which improve monitoring posture and bring immediate insights into IT incidents, ending the guesswork. DataLocker boosts data security with DL GO and MySafeConsole DL GO safeguards data with AES-256 XTS (FIPS 197) hardware encryption and fast, familiar biometrics on both major platforms, Windows Hello (Windows) and Touch ID (macOS), with no drivers required. It works online or offline, and can be enrolled into MySafeConsole (individual/SMB) or tied to SafeConsole (enterprise) when centralized management is needed. Gigamon Insights delivers agentic AI for threat detection, compliance, and root-cause analysis Launching with integrations into SIEM and observability platforms from Elastic and Splunk and cloud services from AWS, Gigamon Insights boosts IT productivity by accelerating investigations without manually combing through dashboard data. Analysts can ask questions, query trusted metadata, and receive context-rich insights and recommended actions within the platforms they already use. Lookout’s AI-powered solution combats SMS phishing attacks Lookout Smishing AI uses LLMs to evaluate message intent and context—going beyond indicators like malicious URLs or spoofed senders. This enables organizations to detect and prevent threats that evade conventional security tools. Nagomi Control reveals where organizations are most exposed While CTEM has long provided a framework to identify risk, most cybersecurity programs stop at visibility. Nagomi Control fills this gap by delivering the execution layer of CTEM, enabling teams to automatically act on exposures faster, cut risk at scale, and do it with the stack they already have. Neon Cyber exits stealth with Workforce Cybersecurity Platform Neon Cyber announced its emergence from stealth and unveiled its Workforce Cybersecurity Platform (WCP). The platform offers AI-driven phishing protection at the browser level, visibility and governance for shadow SaaS applications, and behavior-based authentication and compliance management directly in the browser. QuProtect R3 provides encryption visibility across systems By identifying problematic cryptographic configurations before they impact operations, such as expiring certificates, unauthorized certificate authorities or weak encryption protocols, QuProtect R3 prevents security incidents and service disruptions. The platform’s standards-based approach makes it simple to replace weak algorithms, enforce encryption policies and prepare for both AI-driven threats and quantum attacks. Relyance AI Data Defense Engineer secures AI-driven data Relyance AI has released Data Defense Engineer, an AI-native feature that works 24/7 to understand, monitor, and protect thousands of data journeys, learns from every interaction, and autonomously enforces policies at machine speed. Teleport unveils AI-powered summaries for session recordings Teleport released AI Session Summaries, a new capability in Teleport Identity Security that enables customers to summarize insights from thousands of hours of session recordings in minutes. Secure Code Warrior gives CISOs visibility into developer AI tool usage Secure Code Warrior has launched a beta program to expand the AI capabilities of its Trust Agent product. The new offering provides CISOs with security traceability, visibility, and governance over developers’ use of AI coding tools.

New infosec products of the week: September 12, 2025 Here’s a look at the most interesting products from the past week, featuring releases from Cynomi, DataLocker, Gigamon, Lookout, and Relyance AI. Cynomi simplifies vendor risk management Cynomi’s TPRM provides MSPs and MSSPs with a scalable way to deliver these critical services. By cutting vendor assessment times from 7 – 16 hours down to just 1.5 – 4.5 hours, Cynomi TPRM users can work up to 79% faster. This efficiency directly translates into higher profitability, with margins rising up to 20%. DataLocker boosts data security with DL GO and MySafeConsole DL GO safeguards data with AES-256 XTS (FIPS 197) hardware encryption and fast, familiar biometrics on both major platforms, Windows Hello (Windows) and Touch ID (macOS), with no drivers required. It works online or offline, and can be enrolled into MySafeConsole (individual/SMB) or tied to SafeConsole (enterprise) when centralized management is needed. Gigamon Insights delivers agentic AI for threat detection, compliance, and root-cause analysis Launching with integrations into SIEM and observability platforms from Elastic and Splunk and cloud services from AWS, Gigamon Insights boosts IT productivity by accelerating investigations without manually combing through dashboard data. Analysts can ask questions, query trusted metadata, and receive context-rich insights and recommended actions within the platforms they already use. Lookout’s AI-powered solution combats SMS phishing attacks Lookout Smishing AI uses LLMs to evaluate message intent and context—going beyond indicators like malicious URLs or spoofed senders. This enables organizations to detect and prevent threats that evade conventional security tools. Relyance AI Data Defense Engineer secures AI-driven data Relyance AI has released Data Defense Engineer, an AI-native feature that works 24/7 to understand, monitor, and protect thousands of data journeys, learns from every interaction, and autonomously enforces policies at machine speed.

Gigamon Insights delivers agentic AI for threat detection, compliance, and root-cause analysis Gigamon has released Gigamon Insights, an agentic AI application purpose-built for network-derived telemetry that will deliver instant guidance for security and IT operations teams. Launching with integrations into SIEM and observability platforms from Elastic and Splunk and cloud services from AWS, Gigamon Insights boosts IT productivity by accelerating investigations without manually combing through dashboard data. Analysts can ask questions, query trusted metadata, and receive context-rich insights and recommended actions within the platforms they already use. By reducing mean time to resolution and freeing analysts for higher-value work, Gigamon Insights advances the company’s AI vision to help organizations detect previously unseen threats, resolve performance issues faster, and close compliance gaps across hybrid cloud environments. Integrated into the Gigamon Deep Observability Pipeline, Gigamon Insights helps deliver faster investigations and root-cause analysis while maintaining data privacy through a flexible AI architecture that supports private or “bring-your-own” LLMs. Its agentic interface enables security and IT teams to use pre-defined prompts or craft free-form queries to run analyses, generate insights, and take action. At the core of these capabilities is Gigamon Application Metadata Intelligence (AMI), which enriches network-derived telemetry with application-level context, helping to ensure that the insights generated are both trusted and actionable. Accelerating AI threats demand a new approach As cyber adversaries use AI to move faster and exploit blind spots, security, network, and application teams face mounting challenges, compounded by a global shortage of skilled professionals. Traditional log-based tools were not designed to defend against this new wave of AI-powered attacks. According to the 2025 Hybrid Cloud Security Survey of more than 1,000 security and IT leaders, 53% report increased attacks targeting their organization’s LLM deployments, along with a rise in AI-driven ransomware campaigns. “AI continues to raise the stakes for Security and IT teams, requiring new approaches to secure, optimize, and manage networks and applications,” said Sarah Banks, VP, product management at Gigamon. “Network-derived telemetry is the best way to truly know what is happening across hybrid cloud infrastructure. Gigamon Insights uses agentic AI to fuse this source of truth with AI at scale, delivering comprehensive business and technical answers directly into the security, observability and cloud tools our customers already trust.” Advancing the deep observability pipeline, empowering the ecosystem Gigamon Insights builds on the Gigamon Deep Observability Pipeline, which delivers network telemetry, including packets, flows, and application-aware metadata, directly to cloud, security, and observability platforms. This solution helps close visibility gaps in SIEM and cloud tools by combining AI with trusted network data, providing immediate context-rich intelligence to help analysts respond faster and with greater precision. Through the Gigamon agentic interface, analysts can run prompts or craft free-form queries to perform deep investigations, guided troubleshooting, and rapid incident response, equipping junior analysts to perform at the level of seasoned experts while helping teams reduce training costs, accelerate root cause analysis, and strengthen overall threat visibility. Gigamon Insights enables organizations to: Save valuable analyst time by accelerating investigations and reducing mean time to resolution Detect advanced threats such as lateral movement and command-and-control activity, accelerating mean time to resolution (MTTR) Identify compliance gaps (e.g., expired certificates, weak encryption) Validate microsegmentation policies to improve Zero Trust enforcement Maintain continuous visibility across hybrid cloud infrastructure using an independent source of truth Guide troubleshooting activities in real time “As enterprises move toward AI-driven architectures, one constant remains: the foundational value of network-derived telemetry,” said Alan Weckel, analyst, 650 Group. “By pairing network-derived telemetry with generative and agentic AI, enterprises can accelerate time to insight and strengthen outcomes across cybersecurity, application performance, and network operations. That’s why deep observability is indispensable in the AI era, and we strongly support the vision Gigamon is bringing to market.” Flexible AI architecture, full customer control Gigamon Insights combines a telemetry pipeline with a flexible LLM architecture to deliver AI-powered detection and troubleshooting across security, network, application, and cloud domains. Customers can choose private hosted models or integrate with their existing enterprise AI systems, maintaining control over sensitive data while enhancing detection, investigation, and remediation capabilities. This partner-first approach enables organizations to adopt Gigamon Insights by leveraging existing investments in data stores, enterprise LLMs, and operational workflows.