Analyzing 500,000 internet-exposed assets from Forbes Global 2000 enterprises, we uncovered just how uneven WAF coverage really is, and why that inconsistency creates hidden risk.
Read more about Over 50% of Enterprise External Assets Lack WAF Protection, Including PII PagesCyCognito Blog
Your source for exposure management research, product news, and security insights.
Search the Blog
In the past few weeks we delivered improvements across automation (including Action Rules), APIs improvements, new investigation and management options, and reporting controls for PDFs. Below is a detailed look at what is new.
Read more about What’s New in CyCognito: August 2025 Platform Enhancements
This month’s CyCognito updates give security teams more precision, clarity, and control in exposure management. With the general availability of Teams for advanced role-based access control and enhanced service evidence for greater detection transparency, users gain deeper insights into their environments. Smarter search, streamlined navigation via the new Quick Start feature, and unified asset management improvements all support faster, more confident decision-making.
Read more about What’s New in CyCognito: July 2025 Platform EnhancementsWe analyzed more than two million internet-exposed assets across cloud, on-prem, APIs, and web apps, discovered by our platform over the past 18 months. Using attacker-simulated testing, including black-box pentesting, dynamic application security testing (DAST), and active vulnerability scanning, we mapped how exploitable exposures cluster by industry and asset type. The results reveal systemic weaknesses in how organizations govern their digital perimeter, especially in environments shaped by rapid growth, third-party dependencies, and fragmented ownership.
Read more about What Over 2 Million Assets Reveal About Industry VulnerabilityIn today’s cybersecurity environment, visibility and action are everything. CyCognito’s May updates help security teams move faster, simplify operations, and close critical gaps in protection. From streamlined Azure cloud connector setup to a new WAF protection dashboard, historical DNS tracking, smarter domain discovery, and AI-powered issue verification, these enhancements are built to support proactive exposure management. Discover how these new capabilities can help your team secure what matters most without added complexity.
Read more about What’s New in CyCognito: June 2025 Platform Enhancements
CyCognito’s new Cloudflare integration expands its Cloud Connector capabilities, giving organizations deeper visibility into their external-facing assets. By accessing DNS records managed in Cloudflare, the platform uncovers forgotten or unmanaged domains and IPs that could pose security risks. This automated sync feeds directly into CyCognito’s discovery and testing engine, helping security teams identify vulnerabilities and reduce blind spots. With a quick setup and continuous monitoring, it’s a powerful step toward stronger, more comprehensive attack surface management.
Read more about CyCognito Integrates with Cloudflare for Direct Access to DNS
Cloud assets are increasingly vulnerable, now accounting for one-third of all easily exploitable security issues. Organizations using multi-cloud environments—especially outside the major providers—face significantly higher exposure to both critical and easily exploitable risks. To manage this growing threat, businesses need full visibility into their external attack surfaces and should adopt proactive, automated platforms like CyCognito to detect and remediate vulnerabilities quickly.
Read more about And The Cloud Goes Wild: Looking at Vulnerabilities in Cloud AssetsSecurity teams are under constant pressure to find and fix vulnerabilities faster, but traditional approaches to security testing often create delays. In this blog, we explore why active security testing, despite its perception for being slow and resource intensive, is the key to achieving faster and more confident fixes. You will learn how accurate testing results drive smarter remediation decisions, how fully automated testing at scale overcomes common operational challenges, and why reducing your window of exposure requires moving beyond passive scanning. If your organization is struggling with long remediation cycles and hidden risks, this is the blueprint for accelerating your security outcomes.
Read more about Faster Fixes: Solving the Security Testing Trade-off
External Attack Surface Management (EASM) promised to illuminate the unknown, but early tools barely scratched the surface, relying on what security teams already knew. Today’s attacker-centric EASM flips the script, discovering unknown assets, mapping them to the business, and validating real-world risk with zero input. The result isn’t just visibility—it’s proof of exposure, and a clear path to action.
Read more about External Attack Surface Management Promised Visibility — But Did It Deliver?On April 24, 2025, SAP disclosed CVE-2025-31324, a critical vulnerability (CVSS 10.0) in the Metadata Uploader of SAP NetWeaver Visual Composer 7.50, which is actively exploited. SAP released a patch, with details limited to customers, alongside other mitigation options. CyCognito has deployed detection tests and provides customers with asset lists to assess and validate remediation efforts.
Read more about Emerging Threat: SAP NetWeaver Visual Composer CVE-2025-31324