Penetration Testing

A robot pen tester sits in front of several computer screens, hoodie on, several cans of energy drinks on the desk.

robot-pen-tester-socialsightai

AI/ML

Application security

Exposure management

Perspective

The bug bounty middlemen are dying off: RIP

AI fix 2

Brief

Mounting downloads of AI-based Villager pentesting tool raise threat worries

<body>Segment 1 - Interview with Jeff Pollard</body>

<body><h3>Segment 1 - Interview with Jeff Pollard</h3></body>

<body><a rel="noreferrer noopener" target="_blank" href="https://www.forrester.com/blogs/introducing-aegis-the-guardrails-cisos-need-for-the-agentic-enterprise/">Introducing Forrester’s AEGIS Framework: Agentic AI Enterprise Guardrails For Information Security</a></body>

<body><a rel="noreferrer noopener" target="_blank" href="https://www.forrester.com/blogs/introducing-aegis-the-guardrails-cisos-need-for-the-agentic-enterprise/">Introducing Forrester’s AEGIS Framework: Agentic AI Enterprise Guardrails For Information Security</a></body>

<body>For this episode’s interview, we’re talking to Forrester analyst Jeff Pollard. I’m pulling this segment’s description directly from the report’s executive summary, which I think says it best:</body>

<body>For this episode’s interview, we’re talking to Forrester analyst Jeff Pollard. I’m pulling this segment’s description directly from the report’s executive summary, which I think says it best:</body>

<body>As AI agents and agentic AI are introduced to the enterprise, they present new challenges for CISOs. Traditional cybersecurity architectures were designed for organizations built around people. Agentic AI destroys that notion. In the near future, organizations will build for goal-oriented, ephemeral, scalable, dynamic agents where unpredictable emergent behaviors are incentivized to accomplish objectives. This change won’t be as simple or as straightforward as mobile and cloud — and that’s bad news for security leaders who in some cases still find themselves challenged by cloud security.</body>

<body>As AI agents and agentic AI are introduced to the enterprise, they present new challenges for CISOs. Traditional cybersecurity architectures were designed for organizations built around people. Agentic AI destroys that notion. In the near future, organizations will build for goal-oriented, ephemeral, scalable, dynamic agents where unpredictable emergent behaviors are incentivized to accomplish objectives. This change won’t be as simple or as straightforward as mobile and cloud — and that’s bad news for security leaders who in some cases still find themselves challenged by cloud security.</body>

<body><h3>Segment 2 - Weekly News</h3></body>

<body>Then, in the enterprise security news,</body>

<body>Then, in the enterprise security news, </body>

<ol class="wp-block-list">
<li>there’s funding and acquisitions, but we’re not going to talk about them</li>


<li>AI’s gonna call the cops on you</li>


<li>and everyone’s losing money on it</li>


<li>and Anthropic agreed to pay for all the copyright infringement they did when training models</li>


<li>and <a rel="noopener" target="_blank" href="http://Otter.ai">Otter.ai</a> got sued for recording millions of conversations without consent</li>


<li>Burger King got embarrassed and their lawyers didn’t like it</li>


<li>NPM package mayhem</li>


<li>certificate authority hijinks</li>


<li>AI darwin awards</li>
</ol>

<body><ol><li>there’s funding and acquisitions, but we’re not going to talk about them</li><li>AI’s gonna call the cops on you</li><li>and everyone’s losing money on it</li><li>and Anthropic agreed to pay for all the copyright infringement they did when training models</li><li>and <a rel="noreferrer noopener" target="_blank" href="https://Otter.ai">Otter.ai</a> got sued for recording millions of conversations without consent</li><li>Burger King got embarrassed and their lawyers didn’t like it</li><li>NPM package mayhem</li><li>certificate authority hijinks</li><li>AI darwin awards</li></ol></body>

<body>All that and more, on this episode of Enterprise Security Weekly.</body>

<body>All that and more, on this episode of Enterprise Security Weekly.</body>

<body>Segment 3 - Executive Interviews from Black Hat 2025</body>

<body><h3>Segment 3 - Executive Interviews from Black Hat 2025</h3></body>

<body>Interview with Rohit Dhamankar from Fortra</body>

<body>Interview with Rohit Dhamankar from Fortra</body>

<body>Live from Black Hat 2025 in Las Vegas, Matt Alderman sits down with Rohit Dhamankar, VP of Product Strategy at Fortra, to dive deep into the evolving world of offensive security. From red teaming and pen testing to the rise of AI-powered threat simulation and continuous penetration testing, this conversation is a must-watch for CISOs, security architects, and compliance pros navigating today's dynamic threat landscape.</body>

<body>Live from Black Hat 2025 in Las Vegas, Matt Alderman sits down with Rohit Dhamankar, VP of Product Strategy at Fortra, to dive deep into the evolving world of offensive security. From red teaming and pen testing to the rise of AI-powered threat simulation and continuous penetration testing, this conversation is a must-watch for CISOs, security architects, and compliance pros navigating today's dynamic threat landscape.</body>

<body>Learn why regulatory bodies worldwide are now embedding offensive security requirements into frameworks like PCI DSS 4.0, and how organizations can adopt scalable strategies—even with limited red team resources. Rohit breaks down the nuances of purple teaming, AI-assisted red teaming, and the role of BAS platforms in enhancing defense postures.</body>

<body>Learn why regulatory bodies worldwide are now embedding offensive security requirements into frameworks like PCI DSS 4.0, and how organizations can adopt scalable strategies—even with limited red team resources. Rohit breaks down the nuances of purple teaming, AI-assisted red teaming, and the role of BAS platforms in enhancing defense postures.</body>

<body>Whether you’re building in-house capabilities or leveraging external partners, this interview reveals key insights on security maturity, strategic outsourcing, and the future of cyber offense and defense convergence.</body>

<body>Whether you’re building in-house capabilities or leveraging external partners, this interview reveals key insights on security maturity, strategic outsourcing, and the future of cyber offense and defense convergence.</body>

<body>This segment is sponsored by Fortra. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/fortrabh">https://securityweekly.com/fortrabh</a> to learn more!</body>

<body>This segment is sponsored by Fortra. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/fortrabh">https://securityweekly.com/fortrabh</a> to learn more!</body>

<body>Interview with Michael Leland from Island</body>

<body>Interview with Michael Leland from Island</body>

<body>At BlackHat 2025 in Las Vegas, Matt Alderman sits down with Michael Leland, VP Field CTO at Island, to tackle one of cybersecurity’s most urgent realities: compromised credentials aren’t a possibility — they’re a guarantee. From deepfakes to phishing and malicious browser plug-ins, attackers aren’t “breaking in” anymore… they’re logging in.</body>

<body>At BlackHat 2025 in Las Vegas, Matt Alderman sits down with Michael Leland, VP Field CTO at Island, to tackle one of cybersecurity’s most urgent realities: compromised credentials aren’t a possibility — they’re a guarantee. From deepfakes to phishing and malicious browser plug-ins, attackers aren’t “breaking in” anymore… they’re logging in.</body>

<body>Michael reveals how organizations can protect stolen credentials from being used, why the browser is now the second weakest link in enterprise security, and how Island’s enterprise browser can enforce multi-factor authentication at critical moments, block unsanctioned logins in real time, and control risky extensions with live risk scoring of 230,000+ Chrome plug-ins.</body>

<body>Michael reveals how organizations can protect stolen credentials from being used, why the browser is now the second weakest link in enterprise security, and how Island’s enterprise browser can enforce multi-factor authentication at critical moments, block unsanctioned logins in real time, and control risky extensions with live risk scoring of 230,000+ Chrome plug-ins.</body>

<ul class="wp-block-list">
<li>Why credential compromise is inevitable — and how to stop credential use</li>


<li>How presentation layer DLP prevents data leaks inside and outside apps</li>


<li>Real-time blocking of phishing logins and unsanctioned SaaS access</li>


<li>Plug-in risk scoring, version pinning, and selective extension control</li>


<li>Enabling BYOD securely — even after a catastrophic laptop loss</li>


<li>Why many users never go back to Chrome, Edge, or Safari after switching</li>
</ul>

<body><ul><li>Why credential compromise is inevitable — and how to stop credential use</li><li>How presentation layer DLP prevents data leaks inside and outside apps</li><li>Real-time blocking of phishing logins and unsanctioned SaaS access</li><li>Plug-in risk scoring, version pinning, and selective extension control</li><li>Enabling BYOD securely — even after a catastrophic laptop loss</li><li>Why many users never go back to Chrome, Edge, or Safari after switching</li></ul></body>

<ul class="wp-block-list">
<li><a rel="noopener" target="_blank" href="https://www.island.io/blog/how-the-enterprise-browser-neutralizes-the-risks-of-compromised-credentials">https://www.island.io/blog/how-the-enterprise-browser-neutralizes-the-risks-of-compromised-credentials</a></li>
</ul>

<body><ul><li><a rel="noreferrer noopener" target="_blank" href="https://www.island.io/blog/how-the-enterprise-browser-neutralizes-the-risks-of-compromised-credentials">https://www.island.io/blog/how-the-enterprise-browser-neutralizes-the-risks-of-compromised-credentials</a></li></ul></body>

<body>This segment is sponsored by Island. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/islandbh">https://securityweekly.com/islandbh</a> to learn more!</body>

<body>This segment is sponsored by Island. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/islandbh">https://securityweekly.com/islandbh</a> to learn more!</body>

Penetration Testing

The bug bounty middlemen are dying off: RIP

Mounting downloads of AI-based Villager pentesting tool raise threat worries

Forrester’s AEGIS Framework, the weekly news, and interviews with Fortra and Island – Jeff Pollard, Rohit Dhamankar, Michael Leland – ESW #424

Open-source pentesting tool AdaptixC2 increasingly used in cyberattacks

HexStrike AI pentesting framework abused to exploit Citrix vulnerabilities

Ransomware gangs seeking penetration testers

The rising need for offensive security strategy and skill

Fast Five

Selected by the SC Media Editorial team every Tuesday.