Security News & Regulatory Intelligence

Why Supply-Chain Attacks Keep Working: Lessons from SolarWinds and xz-utils

Two of the most consequential software supply-chain compromises on record share a root cause that most vendor-risk programs still don't test for.

The MOVEit Breach, One Year Later: What It Changed About Vendor Risk

A single zero-day in a widely-used file-transfer product cascaded into one of the largest data-exposure events on record, purely through vendor concentration.

Why MFA Fatigue Attacks Keep Succeeding Against Well-Defended Organizations

Push-notification MFA fatigue — spamming a user with approval requests until they tap 'approve' out of frustration — keeps working against organizations that have already deployed MFA correctly.