Your source for exposure management research, product news, and security insights.
A server-side request forgery flaw in Next.js Image Optimization lets an attacker who controls DNS for an allow-listed host make the server fetch from private internal addresses.
Read more about Emerging Threat: (CVE-2026-94483) Next.js Server-Side Request Forgery via Image OptimizationAn integer underflow in the MikroTik RouterOS web management service lets an unauthenticated attacker run code as root on the device with a single crafted HTTP request.
Read more about Emerging Threat: (CVE-2026-84411) MikroTik RouterOS Unauthenticated Root RCE via Web ManagementToday we’re announcing the CyCognito MCP server. It makes your attack surface data available to any AI client that speaks the Model Context Protocol, so you can search assets and issues and pull the full record behind both.
Read more about Introducing the CyCognito MCP Server: Full Exposure Context, On DemandAttack surface management has served the vulnerability management program for years, and it now has a second job, governing the asset sprawl that AI makes sprawlier by the day.
Read more about ASM Has a Silent C, and It Stands for Change ManagementRunning a pentest through an AI model can cost a few cents per asset or a few thousand dollars, depending entirely on which phase you spend it on. In this post I provide a quick walkthrough of all five phases.
Read more about The Anatomy of a Pentest: Where Does AI Change the Game?I sat down with Gadi Evron, CEO of Knostic and CISO-in-Residence for AI at the Cloud Security Alliance, to talk about why the assumptions behind most security programs are breaking, and what defenders do now that agents changed the game.
Read more about Life Finds a Way: Securing the Enterprise When Everyone Is a DeveloperToday we’re announcing continuous AI pentesting. It runs always-on across your full external surface, using AI agents to spot overlooked weaknesses, reason through context, and chain the multi-step moves a skilled adversary would. It has already uncovered real exposures in live environments. Here’s how it works.
Read more about Continuous AI Pentesting: What We’re Building, and What It’s Already FindingMost organisations don’t know what’s on their external attack surface. Richard Stiennon joins our CEO Rob Gurzeev to unpack why attackers always find what defenders miss, and how AI is making that gap harder to close.
Read more about Thinking Like an Attacker: How to Strengthen Modern Cyber Defence StrategiesStar Wars as a security case study: the Empire’s real failure wasn’t missing the exhaust port, it was never testing whether it mattered.
Read more about The Force Awakens Your Attack SurfaceThe instinctive reaction to Mythos is: we need to patch faster. That instinct is understandable. It is also exactly the wrong frame. The real question isn’t how many CVEs are in your queue. It’s how many of your exposed assets can actually be exploited right now, by anyone with an API key and an afternoon.
Read more about Mythos, MOAK, CTEM and the End of CVE Chasing
