SecretPoint: How OneDrive Auto-Sync Turns SharePoint into a Hidden Secrets Vault
Blog Published: 11/14/2025
Written by Itzik Alvas, Entro Security. One in every five exposed enterprise secrets originated from SharePoint. It wasn’t the result of a zero-day or a sophisticated exploit. Instead, the exposure traced back to something far more ordinary — a default OneDrive auto-sync feature si...
An Overview of the EU Cyber Resiliency Act (EU CRA)
Blog Published: 11/18/2025
Originally published by Schellman. The EU Cyber Resilience Act (CRA) sets a new regulatory benchmark for product cybersecurity, impacting manufacturers, importers, and distributors worldwide. In this article, we’ll explain the Act’s scope, key requirements, and timeline to help...
Cloud Security Alliance Introduces New Tool for Assessing Agentic Risk
Press Release Published: 11/13/2025
Capabilities-Based Risk Assessment framework measures key autonomous risk factors DALLAS, TX — November 12, 2025 — The Cloud Security Alliance (CSA) today announced the release of its latest research whitepaper, Capabilities-Based Risk Assessment (CBRA), a groundbreaking framework developed b...
It’s Time to Make Cloud Threat Modeling Continuous
Blog Published: 11/20/2025
If you still run threat modeling as a one-time design activity, you’re missing the whole point of the cloud. Modern environments are elastic, multi-account, API-driven, and (thanks to AI) constantly changing. The attack surface is always reshaping itself. CSA’s new Cloud Threat Modeling 2025 ...
Introducing OpenPCC
Blog Published: 11/13/2025
As AI becomes more powerful and accessible, the stakes around data privacy and protection are higher than ever. For instance, a single employee, seeking to leverage AI’s ability to read and understand a PDF, can easily upload a confidential document to an LLM and, in doing so, mistakenly ex...
Prepare for Q-Day with Hybrid Mode Key Exchange
Blog Published: 11/17/2025
“Store Now, Decrypt Later," or SNDL, attacks are a unique brand of attack that you need to keep top-of-mind in the coming years. Our new publication, A Practitioner’s Guide to Post-Quantum Cryptography, lays out why SNDL is so different. Exploitation may start today and only completes...
Red Teaming Voice AI: Securing the Next Generation of Conversational Systems
Blog Published: 11/20/2025
Originally published by TrojAI. The new security blind spot Voice-driven AI is moving quickly from science fiction to daily reality as we move from GenAI models to more sophisticated applications and agents. Once relegated to smart speakers and novelty gadgets, voice AI now drives ...
Securing Application-to-Application Traffic with AI/AGI/ML-Powered Virtual Firewalls: A Comprehensive Framework for Multi-Cloud, Hybrid, and On-Premises Environments
Blog Published: 11/21/2025
Written by Sunil Gentyala, Lead Cybersecurity & AI Security Engineer, HCLTech. Abstract The proliferation of distributed applications across public cloud, hybrid cloud, private cloud, and on-premises infrastructure necessitates advanced security mechanisms to protect inte...
Implementing CCM: Threat & Vulnerability Management Controls
Blog Published: 11/21/2025
The Cloud Controls Matrix (CCM) is a framework of controls that are essential for cloud computing security. Created by CSA, the CCM aligns with CSA best practices. You can use CCM to assess and guide the security of any cloud service. CCM also provides guidance on which actors within the clo...
Understanding STAR for AI Level 2: A Practical Step Toward AI Security Compliance
Blog Published: 11/19/2025
The landscape of AI governance continues to evolve rapidly, presenting significant challenges for organizations trying to establish robust compliance frameworks. The Cloud Security Alliance (CSA) has introduced an initial version of the STAR for AI Level 2 designation, which leverages ...
How to Measure SOC Efficiency and Performance (Lessons from the Frontlines)
Blog Published: 11/24/2025
Written by Ben Brigida, Expel. This blog is based on a recent session where Ray and I (Ben) discussed the key aspects to measuring security operations center (SOC) effectiveness. Over the years leading SOCs, I've learned that measuring success is one of the toughest challenges we face. A ...
3 Vulnerabilities in Generative AI Systems and How Penetration Testing Can Help
Blog Published: 11/24/2025
Originally published by Schellman. With proven real-life use cases, it’s a no-brainer that companies are looking for ways to integrate large language models (LLMs) into their existing offerings to generate content. A combination that’s often referred to as Generative AI, LLMs enable chat i...
Cloud Security Alliance Announces Availability of STAR for AI Level 2 and Valid-AI-ted for AI
Press Release Published: 11/20/2025
Microsoft and Zendesk recognized as first organizations to achieve STAR for AI Level 2 certification SEATTLE – November 20, 2025 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud ...
The Internet is a Single Point of Failure
Blog Published: 11/21/2025
Resiliency through multicloud looks great on paper, but the reality is far more complex (and expensive). Thanks to Amazon, Microsoft, and Google, my calendar over the past few weeks spiked with members calling to discuss cloud resiliency. Each of these outages was rare, and none of them sha...
MCP Can Be RCE for You and Me
Blog Published: 11/25/2025
Before I get into the meat of this post, I want to emphasize that I am a huge fan of MCP (Model Context Protocol) servers and I believe the technology offers more than enough value to justify its use in the enterprise. But, like everything else on the planet, MCP is a double edged sword. And...
