Generative AI

IT and security-team staffers fight to control a dark shadow spreading through their network.

battling-network-shadows-socialsight

AI/ML

Governance, Risk and Compliance

Security Program Controls/Technologies

Resource

Microsoft

Handling shadow AI at the source: Why the browser is the new control layer

Identity

Privileged access management

Application security

News

Microsoft patches Entra ID bug that let AI agents escalate privileges

Robots And Humans as AI or Artificial Intelligence facing off as a symbol of future technology and employment or unemployment as automation in society changing the global economy.

Robots And Humans

Government security

OWASP

AI-driven attacks target governments, cloud agents, supply chains

Firefox web browser under magnifying glass. Firefox is a free and open-source web browser developed by the Mozilla Foundation.

Firefox web browser

Threat Management

Firefox report offers early insight into Claude Mythos AI model

Claude, an artificial intelligence chatbot developed by Anthropic, based on a large language model LLM. Icon and logo isolated on a dark surface, 3D rendering

Security Operations

AI benefits/risks

Leadership

CISOs: Revamp security programs in the wake of Claude Mythos

<body>It's one thing to write secure code, it's another to release it into the wild. That code needs to be designed, built, tested, released, and maintained. Farshad Abasi and Cameron Walters explain how the OWASP Secure Pipeline Verification Standard picks up from where ASVS left off, how it complements other supply chain security efforts like SLSA, and why they updated it with explicit coverage for AI.</body>

<body>It's one thing to write secure code, it's another to release it into the wild. That code needs to be designed, built, tested, released, and maintained. Farshad Abasi and Cameron Walters explain how the OWASP Secure Pipeline Verification Standard picks up from where ASVS left off, how it complements other supply chain security efforts like SLSA, and why they updated it with explicit coverage for AI.</body>

<body>They show what goes into making a project relevant and -- most importantly -- successful at defending how supply chains are attacked. They're also looking for more feedback and participation! If you build software packages, consume software packages, or have an interest in helping organizations stay secure, check it out!</body>

<body>They show what goes into making a project relevant and -- most importantly -- successful at defending how supply chains are attacked. They're also looking for more feedback and participation! If you build software packages, consume software packages, or have an interest in helping organizations stay secure, check it out!</body>

<ul class="wp-block-list">
<li><a rel="noopener" target="_blank" href="https://owasp.org/www-project-spvs/">https://owasp.org/www-project-spvs/</a></li>


<li><a rel="noopener" target="_blank" href="https://github.com/OWASP/www-project-spvs/blob/main/1.5/Release_Notes_OWASP_SPVS_1.5-AI-Pipeline-Security.md">https://github.com/OWASP/www-project-spvs/blob/main/1.5/ReleaseNotesOWASPSPVS1.5-AI-Pipeline-Security.md</a></li>


<li><a rel="noopener" target="_blank" href="https://youtu.be/-WoqGDdivGw?si=kK5-csbnTw8Y4g2J">https://youtu.be/-WoqGDdivGw?si=kK5-csbnTw8Y4g2J</a> -- The Story Behind OWASP SPVS</li>


<li><a rel="noopener" target="_blank" href="https://slsa.dev">https://slsa.dev</a></li>
</ul>

<body><ul><li><a rel="noreferrer noopener" target="_blank" href="https://owasp.org/www-project-spvs/">https://owasp.org/www-project-spvs/</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://github.com/OWASP/www-project-spvs/blob/main/1.5/Release_Notes_OWASP_SPVS_1.5-AI-Pipeline-Security.md">https://github.com/OWASP/www-project-spvs/blob/main/1.5/ReleaseNotesOWASPSPVS1.5-AI-Pipeline-Security.md</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://youtu.be/-WoqGDdivGw?si=kK5-csbnTw8Y4g2J">https://youtu.be/-WoqGDdivGw?si=kK5-csbnTw8Y4g2J</a> -- The Story Behind OWASP SPVS</li><li><a rel="noreferrer noopener" target="_blank" href="https://slsa.dev">https://slsa.dev</a></li></ul></body>

<body>Zero Trust That Actually Ships: Moving From Strategy Decks to Real Security</body>

<body>Zero Trust That Actually Ships: Moving From Strategy Decks to Real Security</body>

<body>Most enterprise organizations have been working at Zero Trust for years and fail to deliver truly secure environments. Rohan Ravindranath shares insights that Zappsec has gained from guiding the global teams that are succeeding at protecting their orgs. Discover the common pitfalls so you can deploy a solution that works.</body>

<body>Most enterprise organizations have been working at Zero Trust for years and fail to deliver truly secure environments. Rohan Ravindranath shares insights that Zappsec has gained from guiding the global teams that are succeeding at protecting their orgs. Discover the common pitfalls so you can deploy a solution that works.</body>

<body>This segment is sponsored by Zappsec. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/zappsecrsac">https://securityweekly.com/zappsecrsac</a> to learn more about them!</body>

<body>This segment is sponsored by Zappsec. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/zappsecrsac">https://securityweekly.com/zappsecrsac</a> to learn more about them!</body>

<body>Cloning Attacker Tradecraft: Why AI Pentesting is Becoming Essential</body>

<body>Cloning Attacker Tradecraft: Why AI Pentesting is Becoming Essential</body>

<body>Enterprises ship code continuously, but most security validation still happens in snapshots. Novee CEO and co-founder Ido Geffen explains what “AI penetration testing” means, why it’s different from automated scanning, and why it’s becoming essential as attackers adopt AI to move faster. He breaks down what separates best-in-class AI pentesting: operator-like reasoning across real environments, validated exploitability, and the ability to uncover business logic flaws and multi-step attack chains. Ido covers the technology behind Novee’s AI penetration tester: a proprietary LLM model, built independently of “frontier” LLMs (like Claude, ChatGPT, Cursor, etc.), and consistently outperforming them at browser exploitation tests. Finally, he shares what buyers should demand in a live evaluation and how continuous retesting closes the loop after fixes ship.</body>

<body>Enterprises ship code continuously, but most security validation still happens in snapshots. Novee CEO and co-founder Ido Geffen explains what “AI penetration testing” means, why it’s different from automated scanning, and why it’s becoming essential as attackers adopt AI to move faster. He breaks down what separates best-in-class AI pentesting: operator-like reasoning across real environments, validated exploitability, and the ability to uncover business logic flaws and multi-step attack chains. Ido covers the technology behind Novee’s AI penetration tester: a proprietary LLM model, built independently of “frontier” LLMs (like Claude, ChatGPT, Cursor, etc.), and consistently outperforming them at browser exploitation tests. Finally, he shares what buyers should demand in a live evaluation and how continuous retesting closes the loop after fixes ship.</body>

<body>This segment is sponsored by Novee Security. See what your attackers already know at <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/noveersac">https://securityweekly.com/noveersac</a>.</body>

<body>This segment is sponsored by Novee Security. See what your attackers already know at <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/noveersac">https://securityweekly.com/noveersac</a>.</body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”14411″} podcast from PPWorks

Supply chain

Securing Software’s Journey with the OWASP SPVS – Cameron W., Farshad Abasi, Rohan Ravindranath, Ido Geffen – ASW #378

chatgpt_AdobeStock_1414552807_Editorial_Use_Only

OpenAI’s macOS app-signing process hit by axios supply chain attack

The United States Treasury Department building in Washington, D.C.