opentext

As hundreds of vendors descend on San Francisco for the RSAC 2026 Conference, the sheer volume of news can be overwhelming. To help you navigate the noise, SecurityWeek is providing a daily digest of the most significant announcements. Below is our curated roundup of essential product and service updates, along with reports from the first day of the event. A roundup of announcements from the days leading up to the conference is also available. Acalvio has released 360 Deception, a cyber deception framework designed to break AI-driven attack automation. By incorporating 360 Deception into their existing tech stack, organizations will be able to disrupt AI-driven threat campaigns and expose malicious intent before compromise occurs. 360 Deception makes cyber defense dynamic and extends it to real assets. The platform creates a high-uncertainty environment that exposes attackers early by disrupting the stable ground truth that automated attack tools depend on. Application security startup Apiiro announced that it is expanding the power of its AI coding security agent, Guardian Agent, with a new capability to identify security and compliance risks before code is ever written, called AI Threat Modeling. Apiiro AI Threat Modeling generates architecture-aware threat models from specs and tickets, enabling teams to identify and fix risks before code is written. By identifying risks earlier, teams can reduce rework, avoid late-stage delays, and keep development moving without adding new security bottlenecks. Arctic Wolf announces new Aurora platform and agentic SOC Arctic Wolf announced the availability of the new Aurora Superintelligence Platform, designed to accelerate the adoption of AI across cybersecurity. Built on a transformative agentic framework called the Swarm of Experts, the platform helps IT and security teams rapidly and confidently adopt Agentic AI to solve the trust and reliability challenges that have slowed adoption in cybersecurity. Arctic Wolf also announced the availability of the new Aurora Agentic SOC. Built on the Aurora Superintelligence Platform, the Aurora Agentic SOC combines Arctic Wolf’s Concierge Experience with turnkey agentic AI. Arctic Wolf also announced a partnership with cloud security firm Wiz to deliver a new integration between Wiz solutions and the Aurora Superintelligence Platform. ArmorCode, in partnership with the Purple Book Community, released The State of AI Risk Management 2026, highlighting a growing “confidence gap” between perceived AI security readiness and actual operational risk. Based on a survey of more than 650 cybersecurity leaders, the report reveals that while 90% of organizations claim visibility into their AI footprint, 59% admit or suspect shadow AI is operating outside of governance processes. At the same time, 70% report vulnerabilities introduced by AI-generated code already making their way into production environments. Astrix has expanded its platform with a four-method AI agent discovery architecture and a real-time policy engine designed to give security teams full visibility and control over AI agents running across the enterprise. Discovery is handled through four complementary approaches: direct integrations with AI platforms, non-human identity fingerprinting to surface shadow agents authenticating via credentials, telemetry ingested from existing endpoint and network sensors, and a bring-your-own-service option for homegrown or non-standard deployments. A new Agent Policies feature lets security teams define allow, flag, and block rules scoped by user, department, platform, and resource type, evaluated before an agent action executes. BeyondTrust has expanded capabilities across its Pathfinder Platform to deliver a unified approach to securing AI agent coworkers that operate alongside users, as well as autonomous AI workloads executing at scale across cloud and SaaS environments. New capabilities include endpoint privilege enforcement for AI coworkers, AI agent discovery and risk analysis, and secrets management for autonomous agents. The company also announced new threat research from BeyondTrust Phantom Labs, which found that the majority of enterprises are running shadow AI agents with privileged access that security teams cannot see or govern. Black Duck has announced the general availability of Black Duck Signal, an application security solution designed to secure AI-generated code and agentic development workflows. Signal delivers AI-native security designed to reason, validate, and remediate risk at the speed and scale of modern development. Built on an agentic architecture powered by multiple best-in-class LLMs and enhanced by Black Duck’s Context AI, Signal brings contextual security reasoning directly into development workflows. Broadcom has announced Symantec CBX (Carbon Black XDR), a cloud-based platform that merges capabilities from its Symantec and Carbon Black product lines into a single XDR solution. The platform combines Symantec’s prevention, Adaptive Protection, data security, Cloud SWG, and Incident Prediction features with Carbon Black’s EDR technology, providing coverage across endpoints, networks, and data. CBX uses AI to correlate signals across those attack surfaces into high-confidence incidents, and includes an Incident Prediction capability that attempts to forecast an attacker’s next four to five moves. Symantec CBX is expected to be available later this year. Cloud Security Alliance launches CSAI Foundation The Cloud Security Alliance (CSA) has established CSAI, a dedicated 501(c)3 non-profit foundation focused exclusively on AI security and safety, with a stated mission of securing the agentic control plane (covering identity, authorization, orchestration, runtime behavior, and trust assurance for autonomous AI agent ecosystems). CSAI builds on CSA’s existing AI Safety Initiative and will operate six programs: an AI Risk Observatory for threat intelligence and CVE tracking specific to agentic AI; best practices guidance covering identity-first controls, runtime authorization, and privilege governance for non-human actors; education and credentialing including three new TAISE certification tracks; a CxO collaboration program for enterprise security executives; and a global assurance program. Cisco has introduced agent discovery in Identity Intelligence, agentic IAM capabilities in Duo, and Model Context Protocol policy enforcement with adaptive risk protection in Secure Access. These features enable registration of agents mapped to human owners, fine-grained task-based permissions, and routing of tool traffic through an MCP gateway for full visibility and governance. Cisco also released ‘AI Defense: Explorer Edition’ for self-serve red teaming of models and applications, including dynamic adversarial testing against prompt injection and jailbreaks. In addition, the company launched the open-source DefenseClaw framework for automated scanning, inventory, and sandboxing of agent skills and assets, as well as an Agent Runtime SDK for embedding policy enforcement at build time across major frameworks. Commvault announced an expanded integration with Microsoft Security to better connect threat detection with trusted recovery. The new integration uses Microsoft Sentinel, Microsoft Security Copilot, and the Commvault Cloud platform to streamline resilience operations and enable real-time data insights, helping organizations move quickly from identifying a threat to validating and restoring clean data faster with greater confidence. ConductorOne announced its AI Access Management product extension, a unified control plane for managing access to AI tools, agents, and MCP connections across the enterprise. The platform enables organizations to accelerate AI adoption while maintaining full visibility, policy enforcement, and compliance. Cribl has introduced background detection for Cribl Guard, an AI-driven capability that continuously scans in-flight logs, traces, and events to identify previously unknown patterns of PII, secrets, and regulated data. The detection model runs entirely within Cribl Workers, meaning sensitive data is analyzed inside the customer’s own infrastructure rather than being sent to an external service. When a new pattern is detected, findings are surfaced in the Cribl interface with full event context, and security teams can convert a finding into an active Guard rule in a single action. CrowdStrike announced new platform innovations that extend AI agent discovery, shadow AI governance, and runtime threat detection directly from the endpoint – the point of AI execution – to every surface where AI agents operate across SaaS, browser, and cloud environments. CrowdStrike also announced that its Falcon Next-Gen SIEM now ingests and correlates Microsoft Defender for Endpoint telemetry, enabling Microsoft endpoint customers to modernize security operations without deploying additional sensors. CrowdStrike also unveiled native Falcon Onum real-time data pipelines, federated search across third-party data stores, third-party intelligence integration, and its Query Translation Agent. CyberProof announced the availability of CyberProof Defense Center (CDC) Reveal360, a centralized visibility hub that delivers continuous insights into enterprise security posture, service performance, and operational outcomes to help teams understand what their security program is delivering. CDC Reveal360 brings together threat, defense, exposure, and asset estate data from across cloud and security ecosystems into configurable, persona-aligned workspaces that evolve as the environment changes. Dataminr launched Dataminr for Cyber Defense, an agentic AI solution designed to move the SOC from reactive triage to predictive intelligence. By fusing internal telemetry with external signals, the solution autonomously investigates and financially quantifies risk. Dropzone AI has introduced AI Threat Hunter, a new autonomous agent designed to continuously and proactively search for security threats across an organization’s environment without increasing workload. The tool automates complex threat hunting processes, analyzing large datasets, investigating anomalies, and integrating across security platforms. By reducing the time needed to conduct investigations, the AI Threat Hunter expands SOC capabilities, allowing human analysts to focus on higher-value strategic work while improving overall security visibility and response. Fenix24 has debuted Argos99, its asset intelligence and resiliency platform, now available as a standalone SaaS offering. Originally developed by Fenix24’s recovery teams during real-world breach restoration efforts, Argos99 ingests and correlates telemetry from more than 60 cloud and on-prem data sources to deliver real-time visibility into an organization’s assets, how they operate, and how they depend on one another. Argos99 was built from hundreds of real-world incident response engagements to address that exact problem. The platform was reverse engineered by the Fenix24 team using insights gained from breach restoration efforts to both dramatically accelerate ransomware recovery and provide critical resiliency intelligence for organizations who want to invest in their cyber resiliency in advance of an attack. Flashpoint is announcing three new capabilities designed to connect threat intelligence more directly to asset risk and operational workflows. The first is a threat-informed External Attack Surface Management (EASM) module that continuously discovers internet-facing assets and automatically maps them to Flashpoint’s vulnerability intelligence. The second is an in-platform Priority Intelligence Requirements (PIRs) feature that lets teams formally tie alerts, investigations, and reporting to defined business risk priorities. The third is a new anonymous browser within Flashpoint Managed Attribution that provides an isolated environment for investigating underground forums, suspicious links, and threat actor activity. Forcepoint and F5 announced a new alliance to help enterprises secure AI across its lifecycle—from foundational data discovery and classification through runtime protection and continuous assurance. Forcepoint’s AI-native Data Security Posture Management (DSPM) data discovery and classification capabilities combined with F5 AI Red Team and F5 AI Guardrails functionality in the F5 Application Delivery and Security Platform (ADSP) will provide runtime protections for AI applications, APIs, models, and agents help organizations operationalize AI safely while maintaining control and visibility over sensitive enterprise data. Forescout unveils network segmentation capabilities and publishes report Now available within the Forescout 4D Platform, Forescout’s new agentless, cloud-native network segmentation capabilities help organizations model and validate zones based on device identity, function, behavior, and risk. Forescout also published its 2026 Riskiest Connected Devices Report, which shows that network infrastructure now surpasses traditional endpoints in overall risk. Among the topline findings, financial services now has the highest average device risk of any industry — more than three times that observed in retail and significantly higher than government and healthcare. Geordie AI has released a new solution for managing AI agent risk through context engineering. Geordie’s new remediation suite, named Beam, assesses risk and continuously feeds mitigation back to the agent using context-based controls. Google Cloud is debuting a suite of AI-powered security innovations designed to transition organizations toward an ‘Agentic SOC’. These updates integrate frontline threat intelligence directly into autonomous AI agents to automate complex investigation and response tasks. Illumio is delivering new enhancements to Illumio Insights to expand how lateral movement risk is exposed and mitigated, anchored by the introduction of Network Posture. By further enriching its AI security graph, Illumio now delivers system-wide, real-time visibility across hybrid, multi-cloud, and OT environments, surfacing end-to-end attack paths and showing where risk must be prioritized and mitigated. Intel 471’s Cyber Threat Exposure Bundle brings together three core capabilities (Attack Surface Exposure, Third-Party Exposure and Brand Exposure) into a single, intelligence-driven solution on the Verity471 platform. With this unified approach, security teams can close visibility gaps across complex external environments and turn high-fidelity threat intelligence into clearly prioritized remediation actions. The solution continuously discovers internet-facing assets, monitors vendors, detects brand impersonation and applies intelligence-led prioritization by enabling streamlined remediation and more proactive threat management. Keeper Security has officially launched KeeperDB, a new vault-embedded database access capability that enables secure, policy-controlled database interactions directly from the Keeper Vault. KeeperDB enables developers, database administrators and security teams to work with sensitive data through a unified interface that simplifies workflows while maintaining strict access governance. KeeperDB broadens KeeperPAM with a vault-native interface that unifies database session management within the zero-trust and zero-knowledge platform. By embedding database access directly into the Vault, KeeperDB helps reduce credential sprawl, standardize database access workflows and strengthen audit readiness across cloud and on-prem environments. Kiteworks has released Compliant AI, a governance layer that enforces attribute-based access control (ABAC), FIPS 140-3 validated encryption, and tamper-evident audit logging on every AI agent interaction with regulated data, independent of the underlying model, prompt, or agent framework. Controls are applied at the data access layer via four checkpoints: agent authentication, ABAC policy evaluation at the operation level, FIPS 140-3 encryption in transit and at rest, and full audit logging fed directly into the organization’s SIEM. The product ships with three Governed Agent Assists: a Folder Operations Assist for navigating and managing folder hierarchies, a File Management Assist for handling the full data lifecycle in line with retention and disposal requirements, and a Forms Creation Assist for generating governed data collection forms from natural language. Lumu announced new capabilities to its flagship NDR solution. Lumu Defender now extends Continuous Compromise Assessment beyond the network to include endpoints, cloud environments, and user behaviors. Lumu continuously confirms whether an organization is compromised by observing live network activity and validating it against known malicious infrastructure. By linking confirmed malicious communications to identities, endpoints, cloud services, and email, Lumu delivers real-time Continuous Compromise Assessment across the environment. NVIDIA has explained how the new NVIDIA OpenShell runtime is being built to provide tools for controlling autonomous agents in an infrastructure policy layer, adding security in the environment, rather than the model or application layer. Currently in early preview, the OpenShell runtime is being developed as organizations are rapidly defining their strategies for long-running AI agents such as OpenClaw. Instead of relying on behavioral prompts, OpenShell enforces constraints on the environment the agent runs in, so security policies are out of reach of the agent — they’re applied at the system level. Operant AI releases Agent ScopeGuard and launches partnership program Operant AI has released Agent ScopeGuard, a new capability within its Agent Protector product that enforces operational boundaries for AI agents at runtime, blocking out-of-scope actions before they execute. ScopeGuard enforces boundaries at the infrastructure level using GPU-accelerated processing, evaluating every agent action against a defined policy in real time. Security teams can configure per-agent scope policies specifying which data sources, APIs, workflows, and data types each agent is authorized to access or modify. Operant AI also launched an AI Infrastructure Ecosystem Partnership Program, through which the company will integrate its runtime security capabilities directly into the inference stacks of AI infrastructure providers. OmniTrust (formerly Integrity Security Services) has officially launched as an independent entity and unveiled its Trust Lifecycle Management (TLM) platform. The platform unifies device lifecycle management, identity lifecycle management, and TrustAI, a framework for the identity, authorization, and monitoring of autonomous AI models and agents. New global research from OpenText and the Ponemon Institute — titled “Managing Risks and Optimizing the Value of AI, GenAI & Agentic AI” — found that while more than half of organizations have fully or partially deployed gen-AI, fewer than one in five have reached AI maturity (defined as fully deployed AI in cybersecurity with security risks assessed). In addition, fewer than half have a risk-based governance strategy in place to manage what they have already built. Palo Alto Networks introduces new security innovations Palo Alto Networks introduced a new set of security innovations designed to help enterprises safely deploy agentic AI and scale AI‑driven workflows. The company announced Prisma Browser for Business, an AI‑enabled workspace for small businesses that lets teams safely use apps and AI tools from any device while blocking AI‑driven threats; Prisma AIRS 3.0, a new platform designed to secure the full agentic AI lifecycle; Agentic SASE enhancements to Prisma SASE; and Next-Generation Trust Security (NGTS) capabilities to automate certificate lifecycle management and support post-quantum readiness. Qualys has introduced Agent Val into its Enterprise TruRisk Management platform. The new agentic AI layer uses TruConfirm to safely validate exploitability of high-risk exposures directly in production environments, incorporating business context and asset criticality. It then feeds confirmed results back into the platform to prioritize remediation and apply mitigations such as isolation when patching is not possible. After mitigation, Agent Val re-validates to confirm the exploit path is closed. RapidFort has partnered with Nutanix to integrate its software supply chain security capabilities into the Nutanix Kubernetes Platform, enabling enterprises to run secure, compliant Kubernetes environments without slowing development. The combined solution delivers hardened, near-zero CVE container images and automated vulnerability remediation, helping organizations reduce risk while maintaining speed across hybrid and multicloud environments. By extending security across the entire software lifecycle, the partnership allows enterprises to proactively manage vulnerabilities, strengthen compliance, and safely support modern workloads such as AI and generative AI at scale. RSA has added a deploy-anywhere capability to its ID Plus identity and access management platform. The sovereign deployment supports private cloud, multi-cloud, on-premises, and air-gapped environments while delivering unified authentication, SSO, access control, and identity governance. It provides end-to-end phishing-resistant passwordless authentication with offline options, along with RSA Mobile Lock, Risk AI, and Help Desk Live Verify to counter advanced threats and bypass attacks. Rubrik announced its Semantic AI Governance Engine (SAGE), a real-time AI governance engine that enables safe, scalable AI agent deployment with semantic policy interpretation and integrated remediation. SAGE removes the AI agent governance bottleneck by enabling real-time, intent-based control at scale. The company also announced a new integration that combines Microsoft’s identity threat detection with Rubrik’s automated identity rollback and recovery capabilities, helping organizations respond faster to identity-based attacks. SandboxAQ, the $5.75 billion Google spinoff focused on AI and quantum, announced new capabilities on its AQtive Guard platform. These newly added capabilities are designed to help organizations identify and track AI systems in use, apply guardrails, and reduce risks (such as prompt injection, data leakage, and unintended system actions) as these systems become part of day-to-day workflows. SentinelOne launched a new set of AI security capabilities focused on two fronts: securing AI and using AI to automate investigations and response. The updates include giving enterprises visibility and control over autonomous agents, AI red teaming, and one-click, agentic investigations that can analyze threats and trigger remediation in real time. SentinelOne also introduced these capabilities for on-prem and air-gapped environments, enabling highly regulated organizations to adopt AI-driven security. Snyk has unveiled Snyk Agent Security, a new solution designed to secure autonomous AI agents from development through production. The suite addresses shadow AI risks by providing automated discovery, risk intelligence, and policy enforcement within the developer workflow. Key features include the general availability of Evo AI-SPM and new red-teaming tools to protect AI-native applications against prompt injection and data leakage. SOCRadar launched its new AI Agent Marketplace, an integrated hub where organizations can browse, purchase, and deploy specialized autonomous AI agents tailored for specific cybersecurity tasks and use cases in the SOCRadar Extended Threat Intelligence Platform. This includes phishing detection, brand abuse protection, and dark web monitoring. SOCRadar also introduced Identity and Access Intelligence capabilities to its Extended Threat Intelligence Platform to bridge the gap between internal identity security and external exposure. The new capabilities are designed to secure identity blind spots such as credential exposures detected in third-party SaaS environments, dark web marketplaces, and collaboration platforms. Spektion has expanded its platform to perform continuous runtime exposure management. It collects six categories of execution data, including execution state, privilege level, network exposure, blast radius, embedded component vulnerabilities, and pre-CVE weakness patterns, then ranks all exposures by observed exploitability in the specific environment. The platform provides visibility into AI agents, MCP servers, AI-generated executables, custom applications, and embedded libraries that lack CVE coverage, while filtering out non-executing vulnerable software. It also enables early identification of zero-day exploit patterns. Sublime Security announced the general availability of its Autonomous Detection Engineer (ADÉ), an end-to-end AI agent that detects threats and automatically creates or improves detection coverage. ADÉ can run end-to-end without analyst intervention – from picking up a newly reported threat to generating and accepting a high-confidence detection. Other new features include full coverage for spam and graymail, increased transparency, and detection labels. Sysdig has launched runtime security for AI coding agents, enabling organizations to safely adopt autonomous development tools. Sysdig provides the real-time visibility organizations need to monitor agent behavior and identify risky activity across cloud and development environments. Sysdig’s purpose-built runtime detections for AI coding agents help organizations safely adopt agentic tools by identifying risky or suspicious behaviors, such as the installation of new AI coding agents, attempts to open sensitive files or bypass unauthorized credential access, risky command-line arguments that weaken safeguards, and dangerous activity, including reverse shells, binary tampering, and persistence mechanisms. Torq released Agentic Builder, an extension of its AI SOC Platform designed to transform natural language descriptions of security goals into production-grade AI agents and workflows. By shifting the ‘cognitive load’ of engineering from humans to machines, the tool allows security teams to automate complex tasks, including alert triage, investigation, and response. The platform further ensures operational reliability by using the Torq Socrates orchestrator to test, validate, and continuously auto-calibrate these agents against real-world data and evolving threats. Upwind has developed a three-stage pipeline for real-time identification and blocking of malicious prompts sent to large language models. A lightweight classifier first filters incoming traffic to detect LLM-bound requests in under one millisecond with 99.88% accuracy. Identified prompts then undergo semantic analysis using the Nvidia nv-embedcode-7b-v1 model via NIM microservices, achieving 94.53% detection accuracy for prompt injections and indirect jailbreaks in under 0.1 milliseconds. High-risk or uncertain cases escalate selectively to the NVIDIA Nemotron-3-Nano-30B model with NeMo Guardrails for final validation, delivering overall precision near 95% while preserving sub-millisecond end-to-end latency and low cost at production scale. Versa announced early access for Versa Secure Enterprise Browser, a browser-native security capability integrated into the VersaONE Universal SASE Platform that enforces identity-aware, posture-aware, and data-aware policies directly within the browser session. Built on Chromium, it protects employees accessing SaaS, web, and AI applications by governing actions such as file uploads, data copying, and AI tool usage. Versa has also announced a new cloud-delivered capability that extends SSE to inspect and secure inbound internet traffic, collaboration with Intel for AI-driven security, networking, and analytics, and integration between Versa Secure SD-WAN and Zscaler Internet Access. Vorlon has released ‘The Agentic Ecosystem Security Gap: 2026 CISO Report’, a survey of 500 US security leaders that surfaces a troubling contradiction at the heart of enterprise security. Organizations are more confident, more tooled, and more breached than ever, with 99.4% reporting at least one SaaS or AI ecosystem incident in 2025 despite widespread claims of strong or comprehensive protection. The report points to a gap in security architecture, where existing tools lack visibility into the runtime layer of AI agents, integrations, and data movement across the ecosystem. Wiz unveils AI Application Protection Platform and Red Agent Wiz (now part of Google Cloud) launched its AI Application Protection Platform (AI-APP) to secure every layer of AI applications (infrastructure, data, access, models, agents, and applications) from code to runtime. Wiz AI-APP brings together visibility, risk analysis, and runtime protection into a single, graph-powered platform. Wiz also unveiled Red Agent, an AI-powered attacker that acts as a sophisticated security researcher, but with AI speed and scale. Zenity announces AI agent security and OpenClaw security framework Zenity announced two product updates focused on securing AI agents: a new continuous, contextual security model designed to track how risk evolves across agent interactions, and an open-source security framework for OpenClaw that lets developers inspect prompts, evaluate tool use, and analyze outputs before execution.

New OpenText capabilities enhance enterprise defense with AI across identity, data, and apps OpenText announced new cybersecurity capabilities designed to help enterprises embed AI into everyday security operations and enforce governance and compliance at scale. OpenText Cybersecurity unifies defenses across identity, data, applications, SecOps, and forensics, putting AI directly in the flow of work through OpenText Core Threat Detection and Response for behavioral analytics, OpenText Core Identity Foundation for advanced access protection and permission settings, and OpenText Application Security Aviator for auto-remediation during application testing. Along with OpenText Data Privacy and Protection for advanced encryption, these advanced new cybersecurity capabilities in CE 25.4 strengthen compliance with built-in controls (GDPR, HIPAA, PCI DSS) and ensure enterprise AI runs on security that is adaptive, governed, and trusted. “Enterprises want to harness the speed of AI without sacrificing security,” said Muhi Majzoub, OpenText EVP, Security Products. “To keep pace with AI’s velocity, we are giving security and IT teams the tools to work faster, smarter, and with greater confidence That is why we are closing the loop in application security and data, unifying identity across complex environments, and expanding managed detection and response with compliance readiness.” New innovations include: Get AI ready with simplified identity and access for hybrid environments – With OpenText Core Identity Foundation, organizations can unify identity and access across on-premises, cloud, and legacy environments without costly infrastructure overhauls. SaaS-based zero trust controls and enforces least-privilege access by managing all the edge identity stores across disparate environments as part of the Identity-as-a-Service (IDaaS) vision. Put AI in context with secure software delivery powered by AI auto-remediation – Development teams can fix vulnerabilities in minutes instead of days with OpenText Application Security Aviator 25.4. Automated, validated code fixes reduce security debt and embed protection directly into DevSecOps workflow through the Fortify Command Line Interface (fcli). Secure, governed, compliant with proactive threat detection and built-in compliance – OpenText Core Threat Detection and Response bring behavioral analytics into the SOC. OpenText Data Privacy and Protection is advanced encryption service that protects sensitive data at rest, in transit, and as it feeds AI. And if you’d like to gain expert help, OpenText Managed Security Services can bring Managed Extended Detection and Response (MxDR) and PCI-DSS attestation services to help security teams detect threats faster, respond in real time, and meet regulatory requirements with less operational overhead. For organizations seeking expert support, OpenText Managed Security Services can bring Managed Extended Detection and Response (MxDR) and PCI-DSS attestation services to help security teams detect threats faster, respond in real time, and meet regulatory requirements with less operational overhead.

Week in review: Cisco ASA zero-day vulnerabilities exploited, Fortra GoAnywhere instances at risk Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: How Juventus protects fans, revenue, and reputation during matchdays In this Help Net Security interview, Mirko Rinaldini, Head of ICT at Juventus Football Club, discusses the club’s approach to cyber risk strategy. Juventus has developed a threat-led, outcomes-driven program that balances innovation with protections across matchdays, e-commerce, and digital platforms. Review: Practical Purple Teaming Practical Purple Teaming is a guide to building stronger collaboration between offensive and defensive security teams. The book focuses on how to design and run effective purple team exercises that improve detection and response and strengthen trust between teams. Building a stronger SOC through AI augmentation In this Help Net Security interview, Tim Bramble, Director of Threat Detection and Response at OpenText, discusses how SOC teams are gaining value from AI in detecting and prioritizing threats. By learning what “normal” looks like across users and systems, AI helps surface anomalies that rules-based methods often miss. Attackers exploited critical Fortra GoAnywhere flaw in zero-day attacks (CVE-2025-10035) CVE-2025-10035, a perfect CVSS 10.0 vulnerability in the Fortra GoAnywhere managed file transfer solution, has apparently been exploited in zero-day attacks before the patch was released on September 15, 2025. Malicious GitHub pages lure MacOS users into installing Atomic infostealer MacOS users looking to download popular software such as LastPass, 1Password, After Effects, Gemini, and many others are in danger of getting saddled with the Atomic infostealer instead, LastPass has warned. SonicWall adds rootkit removal capabilities to the SMA 100 series SonicWall has released new firmware for its Secure Mobile Access (SMA) 100 series appliances, adding file-checking capabilities that help users remove known rootkit malware. After Shai-Hulud, GitHub tightens npm publishing security Attackers are constantly finding ways to take over accounts and push malicious packages to the npm registry, the (GitHub-operated) online repository for JavaScript and Node.js packages. Kali Linux 2025.3 brings improved virtual machine tooling, 10 new tools OffSec has released Kali Linux 2025.3, the most up-to-date version of its popular penetration testing and digital forensics platform. Libraesva ESG zero-day vulnerability exploited by attackers (CVE-2025-59689) Suspected state-sponsored attackers have exploited a zero-day vulnerability (CVE-2025-59689) in the Libraesva Email Security Gateway (ESG), the Italian email security company has confirmed. SolarWinds fixes critical Web Help Desk RCE vulnerability (CVE-2025-26399) SolarWinds has fixed yet another unauthenticated remote code execution vulnerability (CVE-2025-26399) in Web Help Desk (WHD), its popular web-based IT ticketing and asset management solution. Cisco ASA zero-day vulnerabilities exploited in sophisticated attacks A widespread campaign aimed at breaching organizations via zero-day vulnerabilities in Cisco Adaptive Security Appliances (ASA) has been revealed by the US, UK, Canadian and Australian cybersecurity agencies. Cybercriminals are going after law firms’ sensitive client data Regardless of their size, all law firms hold valuable data, including client communications, financial records, and confidential legal strategies. That data has never been more at risk. Cybercriminals are targeting law firms by exploiting vulnerabilities, weak passwords, outdated systems, and untrained staff. U.S. Secret Service takes down network of devices threatening government officials The U.S. Secret Service has broken up a network of electronic devices spread across the New York tristate area that officials say posed an imminent threat to national security. The devices were being used to launch telecommunications attacks and to send threats targeting senior government officials. The fight to lock down drones and their supply chains Drones have already shown their impact in military operations, and their influence is spreading across the agricultural and industrial sectors. Given their technological capabilities, we need to be aware of the risks they bring. Cybersecurity AI (CAI): Open-source framework for AI security Cybersecurity AI (CAI) is an open-source framework that helps security teams build and run AI-driven tools for offensive and defensive tasks. It’s designed for anyone working in security, including researchers, ethical hackers, IT staff, and organizations that want to use AI to find vulnerabilities, test defenses, and improve their security. New framework sets baseline for SaaS security controls Managing security across dozens or even hundreds of SaaS apps has become a major headache. Each tool has its own settings, permissions, and logs, and most third-party risk processes only look at the vendor’s overall security, not the app itself. That leaves gaps you have to close on your own, often with limited visibility and extra work for both your team and procurement. Cisco fixes IOS/IOS XE zero-day exploited by attackers (CVE-2025-20352) Cisco has fixed 14 vulnerabilities in IOS and IOS XE software, among them CVE-2025-20352, a high-severity vulnerability that has been exploited in zero-day attacks. Microsoft spots LLM-obfuscated phishing attack Cybercriminals are increasingly using AI-powered tools and (malicious) large language models to create convincing, error-free emails, deepfakes, online personas, lookalike/fake websites, and malware. More recently, Microsoft Threat Intelligence spotted and blocked an attack campaign delivering an LLM-obfuscated malicious attachment. European Windows 10 users get an additional year of free security updates Windows 10 users in the European Economic Area (EEA) will be able to receive extended security updates until October 14, 2026, without having to pay for them or to back up their settings, apps, or credentials to the Microsoft cloud. AI needs ethics to avoid real-world harm In this Help Net Security video, Brittany Allen, Senior Trust and Safety Architect at Sift, explores how the rise of AI agents is creating new fraud risks. She explains how these agents, while designed to assist users, can unintentionally help fraudsters by carrying out tasks without recognizing malicious intent. Building AI responsibly from day one In this Help Net Security video, David Hardoon, Global Head of AI Enablement at Standard Chartered, discusses the role of ethics and safety in AI development. How agentic AI is changing the SOC In this Help Net Security video, David Norlin, CTO of Lumifi, explores the role of agentic AI in the security operations center (SOC). He explains what agentic AI is, how it can enhance cybersecurity workflows by automating repetitive tasks, and why accountability and careful implementation are critical. Gartner: Preemptive cybersecurity to dominate 50% of security spend by 2030 By 2030, preemptive cybersecurity solutions will account for 50% of IT security spending, up from less than 5% in 2024, replacing standalone detection and response (DR) solutions as the preferred approach to defend against cyberthreats, according to Gartner. Nosey Parker: Open-source tool finds sensitive information in textual data and Git history Nosey Parker is an open-source command-line tool that helps find secrets and sensitive information hidden in text files. It works like a specialized version of grep, focused on spotting things like passwords, API keys, and other confidential data. APIs and hardware are under attack, and the numbers don’t look good Attackers have a new favorite playground, and it’s not where many security teams are looking. According to fresh data from Bugcrowd, vulnerabilities in hardware and APIs are climbing fast, even as website flaws hold steady. The shift shows how attackers are adapting to infrastructure, going after the hidden systems that keep businesses running. Cybersecurity jobs available right now: September 23, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. Infosec products of the month: September 2025 Here’s a look at the most interesting products from the past month, featuring releases from: Absolute Security, Blackdot Solutions, Catchpoint, Cynomi, DataLocker, Gigamon, Lookout, Nagomi Security, Neon Cyber, QuSecure, Relyance AI, Secure Code Warrior, and Teleport.

Building a stronger SOC through AI augmentation In this Help Net Security interview, Tim Bramble, Director of Threat Detection and Response at OpenText, discusses how SOC teams are gaining value from AI in detecting and prioritizing threats. By learning what “normal” looks like across users and systems, AI helps surface anomalies that rules-based methods often miss. Bramble explains that the greatest value comes from human-AI collaboration, with automation providing insights and analysts applying the judgment and context needed for action. Where exactly are SOCs seeing the most immediate and tangible value from AI? Can you share a real-world example where AI meaningfully improved detection or response? SOCs are buried in billions of events every day, and if they only look for specific, known signatures, they will miss unknown threats. Attackers often operate within the bounds of what looks “normal,” using valid credentials, familiar workflows and lateral movement that blends in. This is where AI delivers immediate value: spotting subtle deviations in behavior that indicate something may be wrong, even when traditional rules don’t alert. Applied this way, AI doesn’t just scan for known threats; it’s learning and establishing what’s normal for each user, system or workload, and flagging meaningful deviations from that baseline. For example, if a user who typically accesses a few documents suddenly begins downloading large volumes of sensitive content or starts using tools they’ve never interacted with before, AI can flag that activity as anomalous, even in the absence of known indicators. For SOC teams, the payoff is speed, clarity and scale. Rather than combing through low-fidelity alerts or relying on fixed rules, analysts get a prioritized view of high-risk behavior based on what truly deviates from the norm. This approach is especially valuable for lean teams, surfacing what matters faster so humans can focus on validating intent and taking action. Which SOC functions are best suited for AI? For example, alert triage, anomaly detection, threat hunting, or incident response? Are there any use cases where AI has consistently underperformed compared to traditional methods or human analysts? AI is strongest in areas where scale, speed and noise overwhelm humans. Anomaly detection is a prime example: by continuously learning what normal behavior looks like across users, systems and workflows, AI can surface subtle deviations that rules or signatures may miss. Combining these insights with risk scoring and correlation of behavioral and binary signals offers analysts higher-quality threat threads by automating aspects of threat hunting and alert triage. This can reduce false positives, freeing up analysts to instead focus on deeper, higher-value investigations. Where AI underperforms is typically dependent on how it is applied. For example, supervised machine learning models trained on labeled data excel at classifying activity that is known to be malicious but fail to detect novel threats. In this context, unsupervised machine learning models that continuously learn from new behaviors are more suitable for adapting to new situations and finding advanced novel threats such as those from insiders. A human adversary with valid credentials may appear legitimate, unless the system is constantly updating its understanding of what’s “normal.” That’s why constantly evaluated, self-learning models are so important. They provide useful AI outputs even as behaviors continually shift. At the same time, human judgment is still required in the SOC, especially when it comes to intent. While AI can highlight the “what” and “when” of a situation, humans still need to answer the “why” to determine whether activity is malicious or legitimate. How concerned should SOC teams be about attackers poisoning models or using adversarial inputs to evade AI-driven defenses? Have you encountered real-world examples of this yet? Model poisoning and adversarial inputs are risks. Any system that relies on data can be manipulated. Attackers have already shown they can manipulate SIEM thresholds or train spam filters to infiltrate systems, and we can expect AI tools to be next. The right approach is to incorporate AI as just one piece of a multilayered defense. AI has transformative capabilities in the SOC, but it should not be treated as infallible. For example, high-stakes actions such as quarantining content or suspending a user account should still involve human oversight. As with any control, overreliance is the biggest vulnerability; the goal is to combine AI’s speed and pattern detection with human decision-making and context. AI agents offer promise for detecting and remediating threats. Human oversight will be required while agentic AI approaches establish the trust necessary to be allowed to operate completely autonomously. In practice, how do you see the relationship between human analysts and AI evolving in the SOC? Are there specific tasks where humans still must remain in the loop, no matter how advanced the AI becomes? The relationship between analysts and AI focuses less on replacement and more on augmentation. Threat actors today are often deliberate, moving slowly and patiently, sometimes over weeks or months, and leaving only faint traces of their presence. AI is essential for catching these signals early enough to respond. Even so, humans will always remain central to security operations, as they bring context that AI cannot replicate. They understand business priorities, risk tolerance, and the broader impact of an incident. Put another way, human creativity will be at the center of threat campaigns for the foreseeable future, aided increasingly by AI tools. Maintaining human-machine partnerships is essential to detecting these threats. The best outcomes result when AI reduces the noise. Instead of forcing analysts to sift through billions of events, AI can provide a prioritized list of the riskiest behaviors and explanations of why they were flagged. This gives humans the space to focus on investigations, response and strategy, not just triage. For SOC teams considering AI investments, what practical steps should they take to ensure successful deployment and measurable outcomes? The biggest misconception is that AI can be dropped into any environment and instantly deliver results. For behavioral analytics, as an example, successful deployment requires baselining: understanding what normal behavior looks like across your organization so AI systems can reliably detect what is abnormal. Without that baseline, results will fall short. Rather than being a panacea, LLMs offer specific value in summarizing activity, putting it in context and offering recommendations. Applied generically, LLMs deliver questionable value and can even obscure results. A practical approach to incorporating AI is starting small and targeted. Rather than applying AI everywhere at once, security teams should begin with high-signal areas like identity and access data that are most related to threats of concern. From there, it can become easier to expand into additional telemetry sources and begin layering machine learning across multiple dimensions. Just as important is establishing a measurement strategy. Teams need to set goals from the start, such as reducing false positives by a set percentage or cutting mean time to detect by a defined interval. These benchmarks ensure that AI investments are tied to outcomes that matter, from performance metrics to analyst productivity and SOC efficiency. Finally, implementation is successful when it fits seamlessly with existing teams. AI should blend into the analyst workflow, not add friction. Whether it’s helping junior analysts prioritize alerts or enabling faster handoffs during triage, successful deployments treat AI as a force multiplier that simplifies analyst work rather than replacing it.

AI can’t deliver without trusted, well-governed information While enterprise IT leaders recognize the transformative potential of AI, a gap in information readiness is causing their organizations to struggle in securing, governing, and aligning AI initiatives across business, according to a survey conducted by the Ponemon Institute. Who is the final authority for setting your organization’s AI strategy? (Source: Ponemon Institute) 73% of CIOs, CISOs, and other IT leaders believe reducing information complexity is key to AI readiness. “Without trusted, well-governed information, AI can’t deliver on its promise,” said Shannon Bell, Chief Digital Officer, OpenText. Information complexity impedes readiness While AI is a high priority, the research underscores a key gap, that most organizations lack the information readiness to deploy AI securely. The report also found that while IT and security leaders remain confident in the ROI of AI, it is difficult to adopt, secure, and govern. As this gap widens, information management is becoming the connective tissue between enabling innovation and maintaining trust. 73% say reducing complexity is essential for a strong security posture, with unstructured data among the top contributors to complexity. To address data security risks in AI, 46% of respondents say they are developing a data security program and practice. Just 43% are very or highly confident in their ability to measure ROI on securing and managing information assets. Major barrier to AI investments Leaders are optimistic about the value AI can deliver, but readiness is low. Many organizations still lack the security, governance, and alignment needed to deploy AI responsibly. 57% of respondents rate AI adoption as a top priority, and 54% are confident they can demonstrate ROI from AI initiatives. However, half say it’s difficult to reduce AI security and legal risks. Despite being a priority, the top governance challenge is insufficient budget for investments in AI technologies. 31% of respondents say there is insufficient budget for AI-based technologies. This is followed by 29% of respondents who say there is not enough time to integrate AI-based technologies into security workflows, 28% of respondents who say IT and IT security functions are not aligned with the organization’s AI strategy and 28% of respondents say their organizations can’t recruit personnel experienced in AI-based technologies. GenAI is gaining traction, with a third having adopted it, and another 26% planning to in the next six months. Top GenAI use cases include security operations, employee productivity, and software development. Less than a quarter have adopted agentic AI and only 16% will adopt it in the next six months. Less than a third of those rate agentic AI as highly important to their business strategy. How organizations achieve AI readiness The research also revealed best practices for achieving AI readiness based on responses from the organizations that have invested in AI. These include: Protect sensitive data exposure: Organizations should know where sensitive data resides, who can access it, and how it is used. Strong access controls, data classification policies and anomaly detection tools can help reduce exposure. Implement responsible AI practices: A comprehensive approach includes data cleansing and governance, validating AI inputs and outputs, employee training, and regular model bias checks to ensure AI is used safely and ethically. Strengthen encryption: Encryption should be applied to data in storage, transit and during AI processing. This ensures that sensitive information remains protected throughout the AI lifecycle.