Tag: vulnerability-management
-
The End of Centralized Enrichment: What NIST’s NVD Shift Means for Vulnerability Management
There’s an assumption baked into most vulnerability management programs that nobody ever wrote down, because nobody had to. When a CVE gets published, NVD enriches it. You get a severity score, product mappings, weakness categorization. All the context your tools and workflows need to actually do something. It was just how the system worked. In..…
-
Why CVE grading still matters for vulnerability management
First seen on scworld.com Jump to article: www.scworld.com/native/why-cve-grading-still-matters-for-vulnerability-management
-
AI-Enabled Data Breaches Cost Organizations $6 Million on Average
IBM found AI-enabled breaches cost organizations $6 million on average, exposing gaps in vulnerability management, access controls, and AI governance. The post IBM: AI-Enabled Data Breaches Cost Organizations $6 Million on Average appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-ibm-ai-enabled-data-breach-costs/
-
Google AI Supercharges Chrome Security, Fixing 1,072 Bugs
Google says AI found and helped fix 1,072 Chrome security bugs in two releases, dramatically accelerating vulnerability detection and patching Google’s Chrome Security team published a detailed account of how AI models have transformed their vulnerability management pipeline, and the headline figure is difficult to dismiss: in the last two Chrome releases alone, the team…
-
Multi-patch vulnerability fixes can leave open source exposed
Vulnerability management runs on a shorthand. A CVE shows a linked patch, someone applies it, and the ticket moves to closed. That shorthand covers most open source fixes. A … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/23/research-multi-patch-vulnerability-fixes/
-
Industry reacts to Gold Eagle vulnerability management plan
As AI-discovered software vulnerabilities accumulate at an unprecedented pace, security pros say they hope Gold Eagle creates some order from the chaos. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366645907/Industry-reacts-to-Gold-Eagle-vulnerability-management-plan
-
US Launches Gold Eagle to Coordinate AI-Driven Vulnerability Management
The White House announced Gold Eagle to help accelerate the discovery, prioritization and patching of flaws found by AI First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/us-gold-eagle-ai-vulnerability/
-
UK Govt Pairs Agentic AI Initiative With Cyber Resilience Pledge
NCSC Launches AI Research, Governance and Resilience Measures. The U.K. government unveiled an AI-driven Cyber Shield initiative alongside a Cyber Resilience Pledge signed by 60 organizations, seeking to automate vulnerability management, strengthen governance and improve national resilience as ransomware and AI-enabled threats escalate. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/uk-govt-pairs-agentic-ai-initiative-cyber-resilience-pledge-a-32172
-
Why Frontier AI makes prioritization the most important part of your CTEM program
Frontier AI could drive a 10x surge in vulnerabilities. CTEM helps organizations continuously identify, prioritize, and reduce real cyber risk. Your vulnerability management program was not designed for what is coming next. More than 40,000 CVEs were reported in 2025, breaking yet another record. Today, security experts anticipate that frontier AI-powered systems could drive a…
-
AWS Unveils ‘Continuum,’ an AI-Powered Vulnerability Management Platform
Working with frontier AI models, this new platform aims to help discovering, prioritizing, validating and remediating code vulnerabilities First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/aws-continuum-ai-vulnerability/
-
AWS Continuum brings AI models to code vulnerability management
AWS Continuum for code vulnerabilities, a system built to handle a vulnerability across its lifecycle, from discovery through to a fix, is now available in gated preview. It … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/18/aws-continuum-for-code-vulnerabilities/
-
AI Broke Vulnerability Management. That’s Why CISOs Are Moving Budget to BAS.
For thirty years, vulnerability management ran on a buffer: the months between when a vulnerability was found and when someone could figure out how to weaponize it. The solution was straightforward enough; triage by severity, schedule the fix, validate, and move on. The buffer was what made that work.Today, that buffer is gone.AI didn’t make…
-
CISA directive for AI executive order to be released this week, Andersen says
The binding operational directive will focus in part on “vulnerability alleviation and vulnerability management,” Andersen said in remarks delivered at the TechNet Cyber conference in Baltimore. First seen on therecord.media Jump to article: therecord.media/cisa-directive-for-ai-exec-order-release
-
AI agents help Cato slash ‘timeprotect’ from new CVEs
The application of agentic AI to vulnerability management workflows has slashed mitigation times in experimental conditions, claims Sase specialist Cato Networks. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366643833/AI-agents-help-Cato-slash-time-to-protect-from-new-CVEs
-
Microsoft Defender Vulnerability Management gets a smarter exposure score
Microsoft Defender Vulnerability Management’s updated exposure score model adds vulnerability risk signals and asset context to help teams understand where risk is … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/01/microsoft-defender-exposure-score-update/
-
MSSP Market News: Vulnerability Management Moves From CVE Lists to Fixes
First seen on scworld.com Jump to article: www.scworld.com/news/mssp-market-news-58-of-cisos-would-pay-the-ransom-thats-an-mssp-problem
-
Mythos-Level AI Is Creating a Tech Debt Crisis
Advanced AI Models Find More Holes Than Enterprise Security Teams Can Plug. Artificial intelligence models such as Anthropic’s Mythos are rapidly exposing decades of hidden software security debt, forcing CIOs and CISOs to rethink vulnerability management, remediation capacity and the trade-offs between availability and breach prevention. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/mythos-level-ai-creating-tech-debt-crisis-a-31750
-
6 Best Vulnerability Management Software Systems for 2026
Compare the top vulnerability management software in 2026 to help your security team prioritize and apply fixes across your network. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/products/vulnerability-management-software/
-
Why patching SLAs should be the floor, not the strategy
SLAs measure discipline, not risk: Here’s the mental model I’ve been pushing with my peers. Think of patching SLAs the way you think of fire drills. Fire drills are necessary. They prove that, on a predictable cadence, your organization can execute a known procedure. No one in charge of a building full of people would…
-
8 guiding principles for reskilling the SOC for agentic AI
Tags: ai, automation, business, ciso, cyber, cybersecurity, data, governance, incident response, jobs, penetration-testing, sans, skills, soc, technology, tool, training, update, vulnerability, vulnerability-managementSet the tone from the top: The second principle for reskilling security teams for agentic AI is all about leadership.As Baker says, CISOs must set the tone. That means building a culture of rapid experimentation, iteration, and innovation. “Fail fast and move forward,” he says.A key aspect of CISO leadership is understanding the needs of…
-
CISA mulls new three-day remediation deadline for critical flaws
Tags: api, ceo, cisa, exploit, flaw, government, kev, msp, penetration-testing, technology, update, vulnerability, vulnerability-managementTight window: A CISA spokesperson declined to comment on the Reuters report, but security experts were more forthcoming, with most believing the idea is simply an acknowledgement that modern vulnerability management is evolving.One source of anxiety was that a three-day timeline would leave little time for meaningful testing, normally a time-consuming and complex undertaking that…
-
CISA mulls new three-day remediation deadline for critical flaws
Tags: api, ceo, cisa, exploit, flaw, government, kev, msp, penetration-testing, technology, update, vulnerability, vulnerability-managementTight window: A CISA spokesperson declined to comment on the Reuters report, but security experts were more forthcoming, with most believing the idea is simply an acknowledgement that modern vulnerability management is evolving.One source of anxiety was that a three-day timeline would leave little time for meaningful testing, normally a time-consuming and complex undertaking that…
-
Vulnerability remediation: Match CVEs to asset owners in seconds with Tenable Hexa AI
Tags: access, ai, api, attack, automation, business, ciso, compliance, control, cve, cybersecurity, data, exploit, framework, group, identity, Internet, login, nist, okta, service, supply-chain, threat, update, vulnerability, vulnerability-managementDetecting a vulnerability is easy. Finding the person responsible for fixing it is where remediation programs often break down. See how Tenable Hexa AI uses MCP to connect your exposure data to your identity provider, automating the hunt for asset owners in seconds. Key takeaways The accountability gap is the real bottleneck. Finding a vulnerability…
-
As the NVD scales back CVE enrichment, here’s what Tenable customers need to know
Tags: access, ai, cisa, cloud, cve, cvss, data, data-breach, exploit, infrastructure, intelligence, kev, metric, mitre, nist, nvd, ransomware, risk, software, strategy, technology, threat, vulnerability, vulnerability-management, zero-dayNIST’s shift toward selective CVE enrichment creates significant visibility gaps for teams relying solely on the National Vulnerability Database. As AI accelerates vulnerability disclosure rates, organizations need independent, high-fidelity intelligence to prioritize risks that the NVD may now overlook. Key takeaways NIST is pivoting to a prioritized enrichment model, focusing only on specific criteria like…
-
TekStream Targets Proactive Security With ImagineX Cyber Buy
Acquisition Adds Advisory, GRC and Vulnerability Services to ImagineX’s MDR Core. TekStream acquired ImagineX’s cyber division to integrate advisory, vulnerability management and GRC with its MDR services, aiming to help CISOs defend against faster, AI-driven attacks by unifying proactive and reactive security into a single operational model. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/tekstream-targets-proactive-security-imaginex-cyber-buy-a-31507
-
3 practical ways AI threat detection improves enterprise cyber resilience
Legitimate admin activity and malicious behavior often look similar without contextHybrid environments generate fragmented telemetry that rule sets can’t correlateLean teams don’t have time to manually connect the dots across systemsPlatforms like Adlumin MDR apply behavioral models and automated triage to suppress low”‘value alerts and elevate incidents that actually matter. Fewer alerts, better context, and…
-
3 practical ways AI threat detection improves enterprise cyber resilience
Legitimate admin activity and malicious behavior often look similar without contextHybrid environments generate fragmented telemetry that rule sets can’t correlateLean teams don’t have time to manually connect the dots across systemsPlatforms like Adlumin MDR apply behavioral models and automated triage to suppress low”‘value alerts and elevate incidents that actually matter. Fewer alerts, better context, and…
-
Vulnerability Management und SBOM-Generierung sind Key beim CRA
Cyber Resilience Act: Effektives Vulnerability Management und automatisierte Erstellung einer Software Bill of Materials werden zentrale Erfolgsfaktoren für die Hersteller vernetzter Produkte. Mit dem Cyber Resilience Act (CRA) hat die Europäische Union erstmals einen verbindlichen Rechtsrahmen für die Cybersicherheit digitaler Produkte geschaffen. Für die Hersteller vernetzter Geräte, Maschinen und Anlagen rückt damit ein Thema… First…