Kamakshi Lall

Download Pentera Labs Report - revealing three new critical injection points in the ingress-nginx controller, building on Wiz’s IngressNightmare CVE. These overlooked vulnerabilities could let attackers hijack traffic, spoof headers, or reach unauthorized backend services - They exist in one of the most widely used ingress controllers in Kubernetes, putting countless environments at risk. This research highlights how small misconfigurations can lead to major exposure in modern cloud-native architectures. What’s Inside: ✅ 3 new injection vulnerabilities in ingress-nginx ✅ How attackers find and exploit CVEs in open source ✅ Actionable tips to secure your Kubernetes environment https://lnkd.in/eHtX6EdP

9

1 Comment

Download Pentera Labs Report - revealing three new critical injection points in the ingress-nginx controller, building on Wiz’s IngressNightmare CVE. These overlooked vulnerabilities could let attackers hijack traffic, spoof headers, or reach unauthorized backend services - They exist in one of the most widely used ingress controllers in Kubernetes, putting countless environments at risk. This research highlights how small misconfigurations can lead to major exposure in modern cloud-native architectures. What’s Inside: ✅ 3 new injection vulnerabilities in ingress-nginx ✅ How attackers find and exploit CVEs in open source ✅ Actionable tips to secure your Kubernetes environment https://lnkd.in/eHtX6EdP

6

1 Comment

Download Pentera Labs Report - revealing three new critical injection points in the ingress-nginx controller, building on Wiz’s IngressNightmare CVE. These overlooked vulnerabilities could let attackers hijack traffic, spoof headers, or reach unauthorized backend services - They exist in one of the most widely used ingress controllers in Kubernetes, putting countless environments at risk. This research highlights how small misconfigurations can lead to major exposure in modern cloud-native architectures. What’s Inside: ✅ 3 new injection vulnerabilities in ingress-nginx ✅ How attackers find and exploit CVEs in open source ✅ Actionable tips to secure your Kubernetes environment https://lnkd.in/eHtX6EdP

3

Browsers have become the biggest attack surface where compliance, visibility, and data protection all converge. A proxy security strategy is no longer optional. It’s how modern organizations enforce Zero Trust, strengthen ISO compliance alignment, and stop breaches before they happen. Discover how Proxy integrates with SASE See why unmanaged browsing costs companies millions every year Learn how to design a scalable, compliant proxy framework for hybrid teams read the full guide https://lnkd.in/dJARdp-s #Cybersecurity #ProxySecurity #SASE #ISO27001 #ZeroTrust #Compliance #CloudSecurity #NetworkSecurity #SMB #Secithub #TechLeaders #DataProtection #BrowserSecurity #EnterpriseIT #InfoSec

3

Achieving cloud compliance doesn’t have to be complex. With Saner Cloud CSPM, stay continuously aligned with leading benchmarks like CIS, NIST, and HIPAA—all from a single platform. - Monitor compliance across multi-cloud environments without switching tools - Instantly identify benchmark-specific gaps and track compliance trends over time - Prioritize remediation based on real risk, impact, and severity - Get audit-ready with clear, region- and service-level dashboards From predefined policies to custom compliance rules, Saner Cloud CSPM removes ambiguity and simplifies audit validation so teams can focus on fixing what matters most.   Know more: https://lnkd.in/grGnpUDV #CloudSecurity #CSPM #Compliance #Automation #NIST #HIPAA #CISBenchmarks #SecPod

16

𝗔𝗜 𝗴𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲 𝗶𝘀𝗻’𝘁 𝗮𝗯𝗼𝘂𝘁 𝗰𝗼𝗻𝘁𝗿𝗼𝗹. 𝗜𝘁’𝘀 𝗮𝗯𝗼𝘂𝘁 𝗰𝗼𝗺𝗽𝗼𝘂𝗻𝗱𝗶𝗻𝗴 𝗮𝗱𝘃𝗮𝗻𝘁𝗮𝗴𝗲. 🤖📈 Most organizations treat AI governance as a compliance exercise. The reality? It’s becoming a 𝗳𝗶𝗱𝘂𝗰𝗶𝗮𝗿𝘆 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆. ⚖️ That’s why AI governance must move from 𝘤𝘰𝘮𝘱𝘭𝘪𝘢𝘯𝘤𝘦 𝘢𝘧𝘵𝘦𝘳 𝘥𝘦𝘱𝘭𝘰𝘺𝘮𝘦𝘯𝘵 to 𝙨𝙩𝙧𝙖𝙩𝙚𝙜𝙞𝙘 𝙤𝙫𝙚𝙧𝙨𝙞𝙜𝙝𝙩 𝙛𝙧𝙤𝙢 𝙩𝙝𝙚 𝙨𝙩𝙖𝙧𝙩. In my experience, the hardest part isn’t building the model. It’s aligning 𝗼𝘄𝗻𝗲𝗿𝘀𝗵𝗶𝗽, 𝗿𝗶𝘀𝗸 𝗮𝗽𝗽𝗲𝘁𝗶𝘁𝗲, 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝗮𝗯𝗶𝗹𝗶𝘁𝘆, and 𝗺𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 𝗯𝗲𝗳𝗼𝗿𝗲 𝘀𝗰𝗮𝗹𝗲 𝗮𝗺𝗽𝗹𝗶𝗳𝗶𝗲𝘀 𝘁𝗵𝗲 𝗰𝗼𝗻𝘀𝗲𝗾𝘂𝗲𝗻𝗰𝗲𝘀. At scale, small governance gaps become enterprise-level risks. 𝗘𝗳𝗳𝗲𝗰𝘁𝗶𝘃𝗲 𝗔𝗜 𝗴𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝘀: 🔹 𝗖𝗹𝗲𝗮𝗿 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝗮𝗯𝗶𝗹𝗶𝘁𝘆 — defined ownership across design, deployment, and audit 🔹 𝗧𝗿𝗮𝗻𝘀𝗽𝗮𝗿𝗲𝗻𝗰𝘆 & 𝗲𝘅𝗽𝗹𝗮𝗶𝗻𝗮𝗯𝗶𝗹𝗶𝘁𝘆 — black-box decisions erode trust 🔍 🔹 𝗥𝗶𝘀𝗸 𝗰𝗹𝗮𝘀𝘀𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 — not all AI use cases carry equal exposure 🔹 𝗖𝗼𝗻𝘁𝗶𝗻𝘂𝗼𝘂𝘀 𝗺𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 — drift, bias, and misuse don’t self-correct 📊 🔹 𝗕𝗼𝗮𝗿𝗱 𝘃𝗶𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆 — AI strategy and AI risk must live in the same conversation 🧭 AI governance doesn’t have to mean slow innovation. It ensures innovation compounds safely — across customers, regulators, and markets. 🚀 As AI becomes embedded into core operating models, boards must now ask: 👉 𝘞𝘩𝘢𝘵 𝘪𝘴 𝘰𝘶𝘳 𝘈𝘐 𝘳𝘪𝘴𝘬 𝘪𝘯𝘷𝘦𝘯𝘵𝘰𝘳𝘺? 👉 𝘞𝘩𝘦𝘳𝘦 𝘥𝘰 𝘸𝘦 𝘭𝘢𝘤𝘬 𝘨𝘰𝘷𝘦𝘳𝘯𝘢𝘯𝘤𝘦 𝘮𝘢𝘵𝘶𝘳𝘪𝘵𝘺? 👉 𝘈𝘳𝘦 𝘸𝘦 𝘮𝘦𝘢𝘴𝘶𝘳𝘪𝘯𝘨 𝘵𝘳𝘶𝘴𝘵 𝘸𝘪𝘵𝘩 𝘵𝘩𝘦 𝘴𝘢𝘮𝘦 𝘳𝘪𝘨𝘰𝘳 𝘢𝘴 𝘱𝘦𝘳𝘧𝘰𝘳𝘮𝘢𝘯𝘤𝘦? Because responsible AI isn’t just about compliance. It’s about 𝘀𝘂𝘀𝘁𝗮𝗶𝗻𝗶𝗻𝗴 𝗰𝗼𝗺𝗽𝗲𝘁𝗶𝘁𝗶𝘃𝗲 𝗮𝗱𝘃𝗮𝗻𝘁𝗮𝗴𝗲. 🏆 𝗪𝗵𝗮𝘁 𝗴𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲 𝗰𝗮𝗽𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗱𝗼𝗲𝘀 𝘆𝗼𝘂𝗿 𝗯𝗼𝗮𝗿𝗱 𝘀𝘁𝗶𝗹𝗹 𝗻𝗲𝗲𝗱 𝘄𝗵𝗲𝗻 𝗶𝘁 𝗰𝗼𝗺𝗲𝘀 𝘁𝗼 𝗔𝗜? 👇 #AIGovernance #BoardLeadership #TechnologyGovernance #EnterpriseRisk #AILeadership #FutureOfWork

52

7 Comments

An investigation by DeepDelver exposes Delve, a compliance automation startup, for running what amounts to a "fake compliance as a service" scheme predrafting audit reports, rubber stamping them through compliant CPA firms, and misleading hundreds of customers into believing they had achieved genuine SOC 2, GDPR, and HIPAA compliance. The leaked evidence reveals not only systemic fraud and fabricated evidence, but also serious downstream risk for Delve's clients, who may now face regulatory fines, contractual liability, and reputational damage as a result. https://lnkd.in/eVZrsDAH

8

Operationalizing Trust: Fixing the Broken Feedback Loop in Modern SOCs Is your security team chasing ghosts or hunting threats? The "swivel chair" workflow is costing you talent and money. Stop adding more tools and start fixing the broken feedback loop. Discover how to build a human-centric SOC for 2026. Link to the article: https://lnkd.in/dEds7SaQ #CyberSecurity #SOCBurnout #CISO

2

Developers and security teams spend more time chasing alerts, updating spreadsheets, and coordinating manual scans than actually improving security. As a result you get slower releases, frustrated teams, and overlooked vulnerabilities. The challenge isn’t a lack of talent but a lack of orchestration. When security tools operate in silos, every new project or update is a juggling act. We've seen this solved however. FAANGs have clear, automated workflows that free up teams to focus on what matters: building secure software efficiently. Any platform like Smithy takes these repetitive, time-consuming tasks off your plate. By unifying scans, alerts, remediation, policy and reporting, developers and security teams can collaborate seamlessly without extra meetings or manual handoffs. If you want to automate time-consuming Application Security tasks, Smithy can help you.

14

Still on supply chain security, I recently consulted for a fintech startup that takes security extremely seriously due to compliance requirements and their ambition to serve over 10 million users. Naturally, their security posture had to be rock solid. Beyond protecting against vectors like insecure code, exposed APIs, and other threats, supply chain risk stood out to me, especially given the rising wave of attacks through compromised packages. To address this, I leveraged GitHub Dependabot. Dependabot, a native GitHub tool, scans project dependencies and identifies vulnerabilities. I enabled it at both the repository and organization levels, turned on alerts, and integrated it into the CI/CD workflow. Specifically, I added a job that queried the Dependabot endpoint and enforced pipeline failure whenever vulnerabilities of critical, high, or medium severity were detected. However, we quickly discovered a gap: engineers with write access could dismiss alerts, effectively bypassing enforcement. To close this loophole, I designed a separate enforcement pipeline. This pipeline triggers whenever Dependabot alerts are dismissed and automatically reopens them if the actor isn’t part of a pre-approved list of team leads or management. It also sends notifications, ensuring visibility and accountability. With this system, we struck a balance between operations and security: engineers could review findings with their team leads, while decisions on whether to dismiss alerts (e.g., false positives, acceptable risk, impact levels) were made based on established policy. If you’ve implemented Dependabot or similar supply chain protection tools, how did you ensure operational flexibility without compromising security enforcement?

20

2 Comments

Boards ask for assurance. CISOs respond with maturity. Maturity is often just the art of looking stable while drift continues. Risk doesn’t grow because systems fail. It grows when leadership refuses to make decisions irreversible. Dashboards comfort boards. Frameworks calm committees. Neither stops entropy. What’s called “risk management” today is often permission to postpone commitment. The most dangerous systems aren’t underfunded. They’re over-negotiated. A system doesn’t collapse when it’s attacked. It collapses when leadership keeps every option open long after one should have been closed. Control begins when hesitation is no longer allowed.

2

3 Comments

📌 Build Momentum Through Continuous Releases 📌   Releasing something every sprint keeps your team sharp and confident. Sharon Allpress, VP of Strategic Engagements at EOT.AI, shares how maintaining a continuous release rhythm prevents teams from getting rusty and strengthens collaboration across product, engineering, and stakeholders.   Here’s her approach: Release something every sprint, even small improvements Keep documentation and stakeholder comms updated Use momentum to stay ready for larger launches   🎥 Watch now on YouTube: https://lnkd.in/e-PgruY7

1

Stop switching tabs. Start shipping verified artifacts. JFrog is officially live on the Cursor Marketplace! You can now bring JFrog’s #SoftwareSupplyChain security directly into your AI-native IDE. Ask Cursor to check for vulnerabilities, and it will use JFrog's verified security data to analyze your code and recommend precise remediation. 🛠️ Install now: https://lnkd.in/gUZUP-2d #CursorAI #DevSecOps #AI

130

The Next-generation Identity Platform will help address two key needs: 1.) The most urgent use cases of Identity Security Posture Management (ISPM), NHI Security, and AI Agent Security 2.) The core business needs of Next-Gen IGA with full fidelity of 100x app onboarding, AI powered access recertifications, access lifecycle management, access hub / portal for employees and app teams, and "access grant and access revoke" that materializes access on all enterprise systems rooted in the principle of least privilege, vs. directory groups! Enter "Veza Access AuthZ", our newest product that comprehensively brings the power of least privilege access rooted in permissions and entitlements. This product was fully driven by our customers, making it an extra special release. Our customers are looking for full scale enterprise adoption which drove us to bring an engineering mindset of APIs and automation for access lifecycle events (create user, delete user, etc.) to this product design. cc Tarun Thakur Jim Lester Sandler Rubin Ryan Thomas Maohua Lu Ph.D Josh Williams Marc Olin Learn more about the power of AuthZ in the official press release https://lnkd.in/gws3k8VT Learn more about it in the Access AuthZ Blog Post: https://lnkd.in/gwDZx36a

36