Posts of last few hours

Obsidian Security has announced its Runtime Policy Decision Engine, giving security teams centralized control over AI agent actions before they run. Building on Obsidian’s extensive AI agent discovery and governance coverage, the engine uses context about who is behind an agent, its access and the third-party applications involved to allow or block actions, or require human approval where supported. Context from your apps, identity systems and your own labels feeds one Policy Decision Engine; each … More →

The post Obsidian expands AI agent security with runtime policy enforcement appeared first on Help Net Security.

“Security policy management” is one shelf holding two different products: network security policy management (NSPM) firewall rulebases, segmentation intent, change automation and written-policy lifecycle the documents people sign and auditors demand. Our roster spans both, so this countdown declares the lane on every entry and ranks within the honest frame: rulebase engines first by estate […]

The post Top 10 Best Security Policy Management Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Audit management software is graded by a brutal metric: the spreadsheet-reversion point the moment auditors flee the platform back to Excel. The 2026 rankings reward fieldwork ergonomics, evidence automation that pulls control tests from systems rather than people, and the committee-pack mile where most tools quietly fail. AuditBoard takes 1; ServiceNow and Workiva complete the […]

The post Top 10 Best Audit Management Software in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Security ratings grade organizations from the attacker’s side of the fence exposed services, patch cadence, breach signals and the grades now move real money: insurance pricing, vendor gates, board narratives. Two honesty notes shape this countdown: NormShield is Black Kite’s former name (one company, counted once), and Mastercard announced RiskRecon’s wind-down, making it a migration […]

The post Top 10 Best Security Ratings Services in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Your security perimeter now includes every vendor with an API key, and TPRM tooling decides whether that truth lives in a spreadsheet or a signal. The 2026 rankings reward platforms that fuse the two lenses outside-in ratings for continuous truth, questionnaires for control depth and automate the reassessment triggers between them. OneTrust takes #1; SecurityScorecard […]

The post Top 10 Best Third-Party / Vendor Risk Management (TPRM) Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Compliance automation turned certification from an archaeology project into a plumbing project: connectors pull evidence from cloud, HRIS, and device stacks continuously, and audits review live data instead of screenshot folders. One honest count note up front: our source list named ten brands, but Tugboat Logic was absorbed into OneTrust, so we rank nine platforms […]

The post Top 10 Best Compliance Automation Software (SOC 2 / ISO 27001) in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Microsoft has released security updates for a Windows Active Directory vulnerability that allows an authorized attacker to execute code over a network. Tracked as CVE-2026-119948, the flaw was disclosed on November 10, 2026, and affects multiple Windows desktop and server versions. Microsoft rates it Important, with a CVSS 3.1 base score of 7.5. The CVE […]

The post Windows Active Directory RCE Vulnerability Allows Attacker to Execute Code Over a Network appeared first on Cyber Security News.

Fortinet has warned about a critical flaw in FortiClient that lets a remote attacker run code on a user’s computer. The attacker only needs the user to visit a malicious website. The bug is tracked as CVE-2026-121529 and carries a CVSS score of 9.1. Fortinet published the advisory on November 10, 2026. The flaw is […]

The post Critical Fortinet2Shell Vulnerability Enables RCE Attacks in FortiClient with FortiPAM Enabled appeared first on Cyber Security News.

In this Help Net Security interview, Aurimas Bakas, CEO of Copla, talks about what the EU Cyber Resilience Act‘s reporting duties mean for manufacturers. He explains why companies need a register of every product version still in use, why boards focus on CE marking while reporting obligations started in September 2026, and how to define the moment a company becomes aware of an exploited flaw. He also covers what CISOs should ask suppliers, and how … More →

The post The Cyber Resilience Act clock doesn’t stop for weekends appeared first on Help Net Security.

In this Help Net Security video, Ken Leeser, CISO at Y Meadows, explains how security leaders can get more protection out of a flat budget. He argues a frozen budget gives teams a reason to cut waste and simplify their security stack. The first step is an inventory of every tool and what it costs, including renewals and storage fees. Next, teams should map those tools against attacker techniques using frameworks like MITRE ATT&CK, and … More →

The post A CISO’s guide to trimming waste from a flat security budget appeared first on Help Net Security.

Forty-five percent of surveyed IT service management providers in the EU took more than three months to apply critical patches to critical systems, according to ENISA’s 2026 assessment of cybersecurity in the Union. Attackers can turn a newly disclosed flaw into a working attack within days, and sometimes within hours or minutes. Those providers run systems for other organizations, so a slow patch at one becomes exposure for the customers that depend on it, and … More →

The post EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch appeared first on Help Net Security.

Nearly half of security teams at organizations with 5,000 or more employees close or deprioritize vulnerability findings without fully verifying them, ProjectDiscovery found, and the reason they give is time. Here’s the catch. Among teams that skip full verification, 57% say at least three out of four findings they do check turn out to be real. If most of what you look at is genuine, there’s not much reason to think the stuff you didn’t … More →

The post Nearly half of big firms shelve or close vulnerability findings they haven’t confirmed appeared first on Help Net Security.

Research has tied three seemingly unrelated espionage campaigns to a single supplier of Chinese-nexus tooling, which it tracks as CopperDragon. It may act as a “digital quartermaster,” supplying tools to several China-nexus actors, including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. The clusters, named SilentDelivery, OceanGate and DarkWire, hit telecommunications providers, government bodies, military entities, research […]

The post China-Linked CopperDragon Malware Framework Targets Critical Infrastructure Across Europe, Asia, and Latin America appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.