Security Boulevard

BodySnatcher (CVE-2025-12420) exposes a critical agentic AI security vulnerability in ServiceNow. Aaron Costello's deep dive analyzes interplay between Virtual Agent API and Now Assist enabled in this exploit.

The post BodySnatcher (CVE-2025-12420): A Broken Authentication and Agentic Hijacking Vulnerability in ServiceNow appeared first on AppOmni.

The post BodySnatcher (CVE-2025-12420): A Broken Authentication and Agentic Hijacking Vulnerability in ServiceNow appeared first on Security Boulevard.

ColorTokens is proud to announce that its Xshield Enterprise Microsegmentation Platform™ has achieved a FedRAMP® Moderate Authority to Operate (ATO), a significant milestone that underscores our commitment to delivering secure, resilient, and mission-ready cybersecurity solutions for the U.S. Federal Government. FedRAMP (the Federal Risk and Authorization Management Program) is the U.S. government’s gold standard for cloud security. Achieving a Moderate ATO means that Xshield has successfully met […]

The post ColorTokens Achieves FedRAMP® Moderate ATO for Xshield™ appeared first on ColorTokens.

The post ColorTokens Achieves FedRAMP® Moderate ATO for Xshield™ appeared first on Security Boulevard.

Forty years ago, The Mentor—Loyd Blankenship—published “The Conscience of a Hacker” in Phrack.

You bet your ass we’re all alike… we’ve been spoon-fed baby food at school when we hungered for steak… the bits of meat that you did let slip through were pre-chewed and tasteless. We’ve been dominated by sadists, or ignored by the apathetic. The few that had something to teach found us willing pupils, but those few are like drops of water in the desert.

This is our world now… the world of the electron and the switch, the beauty of the baud. We make use of a service already existing without paying for what could be dirt-cheap if it wasn’t run by profiteering gluttons, and you call us criminals. We explore… and you call us criminals. We seek after knowledge… and you call us criminals. We exist without skin color, without nationality, without religious bias… and you call us criminals. You build atomic bombs, you wage wars, you murder, cheat, and lie to us and try to make us believe it’s for our own good, yet we’re the criminals...

The post 1980s Hacker Manifesto appeared first on Security Boulevard.

CyRC discovered critical Wi-Fi vulnerabilities in ASUS & TP-Link routers allowing network disruption via single malformed frame. CVE-2025-14631 patched.

The post CyRC advisory: Vulnerability in Broadcom chipset causes network disruption and client disconnection on wireless routers appeared first on Blog.

The post CyRC advisory: Vulnerability in Broadcom chipset causes network disruption and client disconnection on wireless routers appeared first on Security Boulevard.

Critical Broadcom chipset flaw lets attackers crash Wi-Fi networks without authentication. Learn if your router is affected and how to patch it.

The post Key learnings from the latest CyRC Wi-Fi vulnerabilities appeared first on Blog.

The post Key learnings from the latest CyRC Wi-Fi vulnerabilities appeared first on Security Boulevard.

Italian authorities have fined Internet security company Cloudflare $16.3 as a result of the content delivery network specialist's refusal to block access to pirate sites on its 1.1.1.1 DNS service.

The post Cloudflare Says ‘Non C’è Modo’ (No Way) In Defiance of Italy Piracy Shield Law appeared first on Security Boulevard.

Discover why business email remains mission-critical infrastructure, and how governance, automation, and AI integration future-proof it.

The post Email is Not Legacy. It’s Infrastructure. appeared first on Security Boulevard.

Explore how Russia's efforts to control the probiv market highlight the challenges of data leaks, insider threats, and the conflict between control and security.

The post Russia’s Crackdown on Probiv Data Leaks May Have Fed the Beast Instead appeared first on Security Boulevard.

Driving Passwordless Adoption with FIDO and Biometric Authentication
madhav
Tue, 01/13/2026 - 06:13

For decades, passwords have been the default mechanism for securing digital access. They are deeply embedded in enterprise systems and workflows, yet they were never designed to withstand today’s threat landscape.

Cybersecurity

Sarah Lefavrais | IAM Product Marketing Manager
More About This Author > The Passwordless Imperative

For decades, passwords have been the default mechanism for securing digital access. They are deeply embedded in enterprise systems and workflows, yet they were never designed to withstand today’s threat landscape.

Passwords are easy to steal, easy to reuse, and costly to manage at scale. Despite years of awareness training and layered defenses, credential-based attacks remain one of the most common causes of security breaches. At the same time, password resets continue to consume a disproportionate share of IT support resources, slowing productivity across the organization.

These challenges have pushed enterprises toward a turning point. Regulatory bodies increasingly call for phishing-resistant authentication. Cyber-insurance providers scrutinize identity controls more closely. Business leaders demand stronger security without operational friction. And employees, accustomed to unlocking personal devices instantly, expect the same simplicity at work.

Taken together, these pressures make one conclusion unavoidable: passwords are no longer fit for purpose. Moving beyond them is no longer a question of innovation, but of necessity.

However, necessity alone does not guarantee success.

Where Passwordless Initiatives Often Stall

Many organizations recognize the urgency of going passwordless. They invest in modern authentication technologies, launch pilot programs, and define clear security objectives. Yet despite these efforts, initiatives frequently lose momentum during deployment.

This is rarely because the security model itself is insufficient. More often, it is because the user experience has not been fully considered.

When new authentication methods introduce friction, uncertainty, or unfamiliar behaviors, users hesitate. They worry about losing access, being slowed down during critical tasks, or having to change long-standing habits. Even small inconveniences can lead to resistance or workarounds, weakening adoption over time.

At the same time, organizations cannot afford to lower their security standards. Phishing remains highly effective precisely because it targets human behavior. Enterprises therefore face a dual requirement that is difficult to balance.

The real challenge is not choosing between stronger security and user adoption. It is delivering authentication that significantly increases security while remaining simple enough to be adopted naturally, at scale.

This is where the combination of FIDO standards and biometrics fundamentally changes the dynamics of passwordless authentication.

Why FIDO and Biometrics Unlock Adoption

FIDO2 addresses the core weaknesses of passwords by eliminating shared secrets altogether. Instead of relying on something that can be guessed or stolen, authentication is based on public-key cryptography. No reusable credential exists for attackers to phish, replay, or compromise.

Biometrics complete this security model by removing friction from the user experience. A fingerprint or facial recognition gesture is intuitive, familiar, and already embedded in everyday digital behavior. There is nothing to remember, nothing to type, and nothing to retrieve.

Together, FIDO and biometrics deliver what enterprises have long sought but rarely achieved: stronger security that feels easier than passwords. Authentication becomes faster, more reliable, and more natural, encouraging consistent use rather than resistance.

With the support of Thales, organizations can deploy FIDO and biometric authentication across multiple form factors to adapt to different people, roles, and environments. Whether authentication is delivered through hardware-based security keys with the SafeNet eToken Fusion Bio , and SafeNet IDPrime FIDO Bio Smart Card , or mobile applications with the Mobile Protector, the experience remains consistent: phishing-resistant security combined with effortless user interaction.

Industry Use Cases: Passwordless That Fits the Real World Banking and Financial Services

Banking environments are characterized by frequent authentication, strict regulatory oversight, and a mix of modern and legacy systems. Employees move constantly between applications, making long login cycles a drain on productivity, while sensitive activities such as transaction approval and digital signing demand the highest level of assurance. In this context, biometric-based FIDO authentication enables fast, phishing-resistant access for daily workforce workflows, while hardware-based methods combining modern passwordless standards with certificate-backed authentication support regulated operations.

At the same time, banks face growing pressure on the consumer side to fight online fraud and account takeover. Passwords are no longer sufficient to protect digital banking customers. By introducing passkeys based on FIDO standards, banks can offer their customers a passwordless experience secured by device-bound cryptographic credentials. Consumers can authenticate using the biometrics on their smartphones, such as fingerprint or facial recognition, or choose hardware security keys with built-in fingerprint verification for higher-assurance use cases. This approach dramatically reduces phishing risk while delivering a seamless, modern digital banking experience.

Manufacturing and Industrial Environments

Manufacturing and industrial organizations rely on frontline workers who frequently access shared desktops and critical systems containing sensitive operational data. In these environments, authentication must be fast, reliable, and secure, without introducing friction that slows down operations.

FIDO-based biometric authentication using hardware security keys is particularly well suited to these scenarios. Workers can authenticate instantly by inserting a USB token and verifying their fingerprint, gaining secure access to applications and systems without passwords. Because authentication is device-bound and phishing-resistant, access remains secure even in shared workstation environments. This approach enables quick shift transitions, protects sensitive industrial data, and ensures that strong authentication does not disrupt productivity on the factory floor.

Government and Public Sector

Public-sector organizations must meet high assurance requirements while supporting diverse user populations and long technology lifecycles. Employees often require access to both modern cloud services and legacy or regulated systems, sometimes alongside physical access controls.

In this environment, FIDO and biometric authentication enable agencies to modernize without breaking existing workflows. Biometric-based FIDO authentication provides intuitive, phishing-resistant access to modern applications, while hardware authenticators that combine FIDO with PKI continue to support legacy use cases such as certificate-based authentication, digital signing, and regulated system access. This hybrid approach allows government organizations to adopt modern passwordless standards while preserving critical PKI investments, enabling a secure and gradual transition toward a future-ready identity model.

When Security and Adoption Move Together

When authentication aligns with how people actually work, security stops being perceived as a barrier. Users authenticate naturally. IT teams regain efficiency. Compliance becomes easier to enforce and demonstrate.

Passwordless authentication succeeds when strong security and easy adoption reinforce each other. That balance is what makes FIDO and biometric authentication sustainable at scale.

Now is the time to move beyond passwords in practice, not just in strategy.

• Explore how biometric security keys, smart cards, and mobile authentication solution enable phishing-resistant, passwordless access across your organization.
• Explore All Thales FIDO authenticators options
• Contact an identity expert

studio THALES BLOG Driving Passwordless Adoption with FIDO and Biometric Authentication

January 13, 2026

The post Driving Passwordless Adoption with FIDO and Biometric Authentication appeared first on Security Boulevard.

Overview Recently, NSFOCUS CERT detected that Apache issued a security bulletin to fix the Apache Struts external entity (XXE) injection vulnerability S2-069 (CVE-2025-68493); Because the XWork component of Apache Struts does not perform effective validation when parsing XML configuration, attackers can inject external entities by constructing malicious XML data to read sensitive server files, perform […]

The post Apache Struts External Entity (XXE) Injection Vulnerability S2-069 (CVE-2025-68493) appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..

The post Apache Struts External Entity (XXE) Injection Vulnerability S2-069 (CVE-2025-68493) appeared first on Security Boulevard.

Are Your Non-Human Identities at Risk? Where cybersecurity concerns are front and center for organizations across many sectors, the question of how to manage Non-Human Identities (NHIs) and secrets cannot be overlooked. Machine identities, often composed of an encrypted password, token, or key, play an indispensable role in interconnected digital environments. Yet, the approach to […]

The post How empowered are your secret management protocols? appeared first on Entro.

The post How empowered are your secret management protocols? appeared first on Security Boulevard.

How Can Organizations Build Cybersecurity Confidence with Agentic AI? What if there was a way to seamlessly integrate cybersecurity protocols into the very fabric of your organization without compromising on efficiency? Agentic AI fuels this potential, redefining how Non-Human Identities (NHIs) and their secrets are managed securely across industries like financial services, healthcare, and DevOps. […]

The post Can Agentic AI meet future cybersecurity demands? appeared first on Entro.

The post Can Agentic AI meet future cybersecurity demands? appeared first on Security Boulevard.

The Importance of Secure Management of Non-Human Identities (NHIs) Are machine identities, or Non-Human Identities (NHIs), truly as secure as they should be within your organization? Many businesses across various industries grapple with understanding and properly managing these digital passports that permeate their systems, and this lack of clarity can lead to significant security risks. […]

The post Why feel reassured by advanced secrets management? appeared first on Entro.

The post Why feel reassured by advanced secrets management? appeared first on Security Boulevard.

What Makes Smart NHIs the Key to Advanced Threat Detection? How can organizations ensure their systems are shielded from invisible threats? One crucial element is the efficient management of Non-Human Identities (NHIs). While we delve into the complexities of NHIs, it’s vital to grasp their strategic role in threat detection and mitigation. The Anatomy of […]

The post How smart are the latest NHIs in threat detection? appeared first on Entro.

The post How smart are the latest NHIs in threat detection? appeared first on Security Boulevard.

Session 8C: Hard & Firmware Security

Authors, Creators & Presenters: Vasudev Gohil (Texas A&M University), Matthew DeLorenzo (Texas A&M University), Veera Vishwa Achuta Sai Venkat Nallam (Texas A&M University), Joey See (Texas A&M University), Jeyavijayan Rajendran (Texas A&M University)

PAPER
LLMPirate: LLMs for Black-box Hardware IP Piracy

The rapid advancement of large language models (LLMs) has enabled the ability to effectively analyze and generate code nearly instantaneously, resulting in their widespread adoption in software development. Following this advancement, researchers and companies have also begun integrating LLMs across the hardware design and verification process. However, these highly potent LLMs can also induce new attack scenarios upon security vulnerabilities across the hardware development process. One such attack vector that has not been explored so far is intellectual property (IP) piracy. Given that this attack can manifest as rewriting hardware designs to evade piracy detection, it is essential to thoroughly evaluate LLM capabilities in performing this task and assess the mitigation abilities of current IP piracy detection tools. Therefore, in this work, we propose LLMPirate, the first LLM-based technique able to generate pirated variations of circuit designs that successfully evade detection across multiple state-of-the-art piracy detection tools. We devise three solutions to overcome challenges related to integration of LLMs for hardware circuit designs, scalability to large circuits, and effectiveness, resulting in an end-to-end automated, efficient, and practical formulation. We perform an extensive experimental evaluation of LLMPirate using eight LLMs of varying sizes and capabilities and assess their performance in pirating various circuit designs against four state-of-the-art, widely-used piracy detection tools. Our experiments demonstrate that LLMPirate is able to consistently evade detection on 100% of tested circuits across every detection tool. Additionally, we showcase the ramifications of LLMPirate using case studies on IBEX and MOR1KX processors and a GPS module, that we successfully pirate. We envision that our work motivates and fosters the development of better IP piracy detection tools.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – LLMPirate: LLMs For Black-box Hardware IP Piracy appeared first on Security Boulevard.

Security researchers with GreyNoise say they've detected a campaign in which the threat actors are targeting more than 70 popular AI LLM models in a likely reconnaissance mission that will feed into what they call a "larger exploitation pipeline."

The post Attackers Probing Popular LLMs Looking for Access to APIs: Report appeared first on Security Boulevard.

By 2026, cybersecurity programs will no longer be evaluated on how many frameworks they “support,” but on whether they can produce defensible decisions at the business's operating speed.

The post The Top Security, Risk, and AI Governance Frameworks for 2026 appeared first on Security Boulevard.

via the comic artistry and dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Jumping Frog Radius’ appeared first on Security Boulevard.

New research reveals how AI agents are transforming retail search. Survey of 6,000 shoppers shows agentic commerce reshaping product discovery. Read the report.

The post Why 38% of Consumers Now Use AI to Shop Online & What Retailers Need to Know appeared first on Security Boulevard.

Learn how to detect and prevent Account Takeover (ATO) attacks. Expert guide for CTOs on credential stuffing, MFA bypass, and enterprise single sign-on security.

The post Account Takeover (ATO) Attacks Explained: Detection, Prevention & Mitigation appeared first on Security Boulevard.