Blog

Security Insights

Deep dives, expert analysis, and practical guidance on exposure management, adversarial validation, and the future of AI-driven exposure management.

CompliancePenetration Testing

PCI DSS Penetration Testing Requirements

PCI DSS v4.0.1 Requirement 11.4 is the rare standard that names penetration testing outright: internal and external annually plus after change, segmentation at 12 or 6 months, mandatory since 31 Mar 2025.

May 5, 20267 min

Data BreachesCybersecurity

Top 10 Data Breaches of April 2026

The biggest data breaches of April 2026 ranked and analyzed, from Checkmarx supply chain poisoning to Salesforce misconfigurations and ransomware hitting two major US banks.

May 1, 202615 min

CVEVulnerability Intelligence

Top 7 Critical CVEs of April 2026 You Need to Act On Now

The top CVEs of April 2026 were exploited in hours. Marimo RCE, Windows IKE, Fortinet EMS, GitHub GHES, ActiveMQ, and more. Attack scenarios, risk context, and fixes.

May 1, 202622 min

Checkmarx and Bitwarden supply chain attack: Your CI/CD pipeline is the attack surface

CybersecurityVulnerability Intelligence

Checkmarx and Bitwarden Just Showed That Your Pipeline Is the Attack Surface

How the Checkmarx supply chain attack compromised Bitwarden's CLI pipeline in four minutes, what was stolen, and the program design gap that made it possible.

Apr 29, 20267 min

CVEVulnerability Management

NIST Just Changed How It Tracks and Prioritizes CVEs

NIST has changed how it enriches CVEs in the NVD. Learn what the new risk-based triage model means for your vulnerability management program, scanner data, and remediation workflows.

Apr 29, 202613 min

Offensive SecurityCybersecurity

AI-Accelerated Offense: The Cyberattack Your Security Program Was Never Built to Stop

AI-Accelerated Offense uses autonomous agents to run the full cyberattack chain in hours. A frontier AI model found thousands of zero-day vulnerabilities across every major OS and browser in weeks. See how it works, why your security program is already behind, and what to do now.

Apr 23, 202613 min

CompliancePenetration Testing

HIPAA Penetration Testing Requirements

HIPAA never says "penetration test," but the Security Rule's risk analysis and its REQUIRED evaluation standard expect technical testing of every system touching ePHI. Here is the precise read.

Apr 20, 20267 min

Vercel security breach 2026 featured image

Data BreachesCybersecurity

The Vercel Hack: How One AI Tool Compromised the Infrastructure Behind Millions of Websites

Vercel's April 2026 security breach started with one AI tool's OAuth approval. Here is the full attack chain, blast radius, and what every security team must do now.

Apr 20, 202613 min

Best AI Pentesting Tools in 2026 - Ranked Priced and Compared

Penetration TestingCTEM

Best AI Pentesting Tools in 2026: Ranked, Priced & Compared (12 Tools)

Which AI pentesting tool actually reduces risk in 2026? We reviewed 12 platforms on autonomy, proof quality, pricing, and what happens after a vulnerability is found.

Apr 9, 202630 min

CTEMPenetration Testing

Is Claude Mythos the End of Pentesting?

Claude Mythos found thousands of zero-days in Linux, browsers, and Apache. Does that make pentesting platforms obsolete? Understanding why models, harnesses, and platforms are three different things -- and why smarter AI makes Strobes more valuable, not less.

Apr 8, 202615 min

CompliancePenetration Testing

SOC 2 Penetration Testing Requirements

SOC 2 never names penetration testing in any criterion, yet auditors treat it as the load-bearing evidence for CC4.1 and CC7.x. Here is the gap between the letter and the audit.

Apr 5, 20267 min

Strobes VI Supply Chain Attacks Ransomware Groups Threat Actors - Featured Image

Product UpdatesVulnerability Intelligence

Strobes VI Now Tracks Supply Chain Attacks, Ransomware Groups, and Threat Actors

224,487 supply chain incidents. 1,251 threat actors. Ransomware groups tracked in real time. Strobes VI now provides the threat intelligence layer that powers proactive exposure management, starting with the lessons from the Axios npm compromise.

Apr 3, 202611 min