Explore Resources

For thirteen days, PaperCut's emergency builds reported the same version number as the unpatched releases they were based on. Updated, remediated, and clean are three different states, and most vulnerability programs report them as one.

Adobe Genuine Service creates a named pipe writable by EVERYONE, served by a process running as SYSTEM. Adobe fixed it in July, published no advisory, and scored it a 4.0.

Strip away the model and an AI agent is a process with an identity, a privilege level, and a set of things it can touch. Security teams already have a model for that.

Enterprises are moving inference in-house for privacy and cost. The property that got it approved, that nothing leaves the host, is the property that hides it from AI security tooling built around the cloud.

CVE reachability claims are mostly inference. A former CISO grades three vulnerability tool categories, including his own, against one strict standard.

AI risk scoring for agentic AI: we evaluate AIVSS, MITRE ATLAS, and the OWASP Agentic Top 10, where each works, where it fails, and what to use now.