The State of SaaS Security 2025 Report documents a sharp rise in SaaS-related incidents despite widespread confidence in protections, highlighting misconfigurations, permission issues, and weak continuous oversight as primary drivers. The report urges a shift to continuous monitoring, clear ownership, and governance for AI-enabled integrations to close the gap between perceived visibility and actual security. #AppOmni #Microsoft365
Category: Security Report
This Ponemon Institute report, sponsored by OPSWAT, summarizes survey responses from 612 U.S. IT and security practitioners about file security risks, controls, technologies, and AI adoption. Key takeaways include high incident frequency and cost (average $2.7M), dominant insider and file-visibility risks, concern over macro-based and zero-day malware, and increasing use of CDR, DLP, multiscanning, SBOMs, and AI in defenses. #OPSWAT #PonemonInstitute #MacroBasedMalware #ZeroDay
Latio’s 2025 AI Security Market Report cuts through marketing-driven confusion to map a fragmented AI security landscape, define four primary use-case categories, and explain the specific risks each category addresses. It highlights how VC-fueled hype has blurred vendor distinctions, stresses that tool choice should be guided by an organization’s risk profile, technology stack, and priorities, and includes a practical decision flowchart and vendor market breakdown. #Latio #AI-TRiSM
The GuidePoint / Ponemon 2025 Identity and Access Management (IAM) Maturity Report finds most organizations remain in early-to-mid IAM maturity, with pervasive manual processes, underinvestment in IAM, and 50% of organizations experiencing an identity-based security incident in the prior 12 months. High performers (23% of respondents) show measurable benefits from automation and advanced identity technologies, while adoption growth is strongest for AI, ITDR, ISPM, IGA, and biometric/passwordless approaches. #GuidePoint #PonemonInstitute
Hiya’s State of the Call 2025 analyzes 262.8 billion calls and surveys of 12,003 consumers, 1,802 workers, and 600 IT/security leaders to highlight five major voice-call trends: ongoing reliance on voice, pervasive trust and security issues, a sharp rise in AI-generated deepfakes, measurable financial losses, and gaps in protective investments. The report finds 25% of spam calls in a Q1 honeypot used AI-generated audio, 39% of consumers encountered a deepfake in a recent three-month period, and recommends layered defenses such as branded calling, anti‑spoofing, and AI detection. #Deepfake #Hiya
The 2025 State of Detection Engineering at Elastic summarizes detection engineering work from October 2023 to October 2024, covering real-world incident responses, rule development lifecycles, CI/Detections-as-Code practices, and extensive telemetry and integration enhancements across endpoint, cloud, and SaaS platforms. Key highlights include rapid coverage for the CUPS RCE disclosures, detection and analysis of activity group REF6138 and a DPRK malicious NPM campaign, expansion of kernel and macOS telemetry, an AWS CloudTrail/Okta rule audit (50+ tunings, 40+ new rules, 17 hunting queries), and operational metrics such as processing 500+ malware samples/day with a 99% detection goal. #CUPS #CVE-2024-47076 #REF6138 #ElasticDefend #AWSCloudTrail #Okta #ScatteredSpider #Panix #SWAT #DEBMM #ElasticSecurityLabs #NPM #DPRK
TRM Labs’ Global Crypto Policy Review & Outlook 2025/26 surveys policy developments across 30 jurisdictions, showing stablecoins at the center of regulatory efforts, rising institutional adoption, and clearer rules reducing illicit activity among regulated VASPs. The report highlights critical incidents and coordination gaps—most notably North Korea’s $1.5 billion hack of Bybit—and calls for consistent cross-jurisdictional standards and real-time information sharing to limit exploitation of unregulated infrastructure. #Bybit #NorthKorea
Yubico’s 2025 Global State of Authentication report exposes a large gap between perceived and actual authentication security: employees and organizations rely heavily on passwords and SMS while many lack up-to-date training, and AI-driven attacks are increasing both threat sophistication and user concern. The report urges widespread MFA adoption—especially device-bound passkeys and hardware security keys—supported by education and consistent policies to close vulnerabilities. #Yubico #YubiKey
The 2025 WiCyS Cyber Talent Study, analyzed by skillrex using an N2K diagnostic mapped to the NICE Framework, evaluates 604 WiCyS members and finds the community outperforming peers across most NICE Categories and many Specialty Areas. The report shows a roughly 4‑point composite advantage (~10%), highlights strong leadership and governance capabilities and measurable gains from targeted training, and identifies specific skill gaps to guide future WiCyS programs. #WiCyS #skillrex
Black Duck’s “The Global State of DevSecOps: Balancing AI Usage and Risk in 2025” finds that organizations have achieved high deployment velocity but are accumulating security debt because of manual processes, tool sprawl, and overwhelming false positives that slow development. The report also describes AI as a double-edged sword—widely adopted and improving secure coding for many, yet introducing new risks and shadow-AI governance gaps that demand developer-centric workflow integration and formal AI governance. #BlackDuck #GitHubCopilot
Comcast Business’s 2025 Threat Report analyzes 34.6 billion events (including 19.5B botnet resource-development events, 9.7B drive-by compromises, 4.7B phishing attempts, and 44,069 DDoS events) to map evolving attacker tactics such as proxy abuse, living-off-the-land techniques, and AI-enabled social engineering. It urges organizations to adopt multi-layered, AI-augmented defenses—prioritizing patching, phishing-resistant MFA, proactive threat hunting, and managed 24/7 SOC services—to reduce exposure and build enterprise resilience. #SocGholish #ComcastBusiness
The 2025 State of Cloud Security Report highlights escalating challenges in cloud security, including rising data exposure, vulnerabilities, and attack paths exacerbated by AI adoption. It underscores the importance of managing neglected assets, securing Kubernetes environments, and controlling identity and access to mitigate evolving threats. #OrcaResearchPod #APT29 #Log4Shell #Spring4Shell #KubernetesSecurity #AIvulnerabilities
The 2025 State of Application Security report reveals critical gaps in AppSec practices, highlighting delays in product launches, frequent false positives, and under-resourced teams facing mounting pressure. Organizations are increasingly open to outsourcing AppSec to expert partners like Cypress Data Defense to strengthen security without compromising innovation. #AppSec #OWASPTop10 #CypressDataDefense
The 2025 Norton Cyber Safety Insights Report highlights the increasing interaction of children with AI and the troubling rise of cyberbullying, particularly in the U.S. The report also provides key statistics on cyberbullying perpetrators, AI usage among kids, and practical advice for parents to protect their children online. #Cyberbullying #AICompanionship
The 2025 State of Shadow AI Report reveals the widespread and persistent use of unsanctioned AI applications in enterprises, highlighting critical security risks, especially related to tools like OpenAI and low-security-rated apps such as Jivrus Technologies and Happytalk. It emphasizes the urgent need for real-time discovery, governance, and remediation strategies to manage shadow AI exposure, particularly in small and mid-sized organizations. #ShadowAI #OpenAI #RecoSecurity