By integrating security into CI/CD, applying automated policies, and supporting developers with the right processes and tools, infosec teams can increase efficiency and build secure software.

Remi Yazigi, Information Security Engineer, Cisco Systems

February 3, 2025

4 Min Read

Source: Cagkan Sayin via Alamy Stock Photo

COMMENTARY

As cyber threats grow more sophisticated, organizations must prioritize secure software development practices. Vulnerability management is a critical aspect of this, but its success depends on clear ownership and collaboration between information security and engineering teams. By shifting left and embedding vulnerability management into the development life cycle, organizations can empower engineering teams to deliver secure code efficiently. Here's how infosec teams can drive this transformation.

**Shifting Left: The Key to Proactive Security**

Traditional vulnerability management approaches often focus on addressing issues post-deployment. This reactive strategy slows development and increases the risk of exposure. Shifting left means identifying and remediating vulnerabilities earlier in the development process, during the build phase, or even before code reaches the repository. This early action reduces cost and effort while improving the quality of the codebase.

By integrating vulnerability scanning tools like Trivy into continuous integration and continuous delivery (CI/CD) pipelines, infosec teams can block builds that introduce known vulnerabilities. Tools like these, with seamless integration with GitHub Actions (GHA) and Jenkins, provide immediate feedback to developers. When vulnerabilities are identified, engineers can address them without disrupting the workflow. This approach not only enhances security but also fosters a culture of accountability and ownership among developers.

**Applying Policies for Image Promotion**

One of the most effective ways to enforce security practices is through automated policies for container image promotion. For example:

1.  Base images: Ensure that development teams use only approved base images vetted by information security. These images should be regularly updated to incorporate security patches and align with organizational standards.
    
2.  Docker registries: Restrict usage to trusted and approved registries, reducing the risk of introducing malicious or outdated images. Approved registries should provide regular scans and metadata to verify image integrity.
    
3.  Image scanning: Automate the scanning process for all container images before they are promoted to staging or production environments. By applying strict vulnerability gates, organizations can ensure only secure images progress through the pipeline. Coupled with regular rescanning of images in production, this practice maintains security over time.
    

**Handling Exceptions Transparently**

No vulnerability management strategy is complete without a robust mechanism for handling exceptions. infosec teams should provide engineering teams with a clear process to request and manage exceptions when immediate fixes are not feasible. This includes:

*   Time-bound exceptions: Set expiry dates for exceptions to ensure vulnerabilities are addressed within a reasonable time frame. Expired exceptions should trigger reminders and escalate unresolved issues.
    
*   Approval workflow: Establish an approval workflow that involves both engineering and infosec stakeholders. Collaboration ensures balanced decisions that consider security and business needs.
    
*   Documentation: Require detailed justifications for exceptions, including mitigation strategies, impact assessments, and follow-up plans. Documentation enables transparency and ensures accountability for all stakeholders.
    

By managing exceptions transparently, organizations can balance security requirements with operational realities while maintaining accountability. This process also offers an opportunity for continuous improvement by identifying recurring vulnerabilities or patterns requiring systemic fixes.

**Building a Collaborative Framework**

For vulnerability management to succeed, infosec and engineering teams must work in harmony. Information security teams can support engineering teams by:

1.  Providing tools and training: Offer developers access to easy-to-use security tools and training on secure coding practices. This training should emphasize real-world examples.
    
2.  Defining clear policies: Develop and document policies that align with engineering workflows, ensuring that security requirements are achievable without disrupting productivity. Regularly review these policies to adapt to evolving threats and technologies.
    
3.  Creating feedback loops: Establish feedback mechanisms to address false positives, improve tool configurations, and enhance the developer experience. Prompt feedback helps developers focus on genuine risks and encourages compliance with security measures.
    
4.  Encouraging shared metrics: Track shared security metrics that matter to both teams, such as vulnerability closure rates and build success rates. Shared goals foster collaboration and build a sense of collective responsibility.
    

**Leveraging Automation and Metrics**

Automation plays a pivotal role in ensuring the scalability and reliability of vulnerability management processes. Integrating tools for automated scanning, ticket generation, and remediation tracking saves time and reduces human error. Meanwhile, metrics such as mean time to resolution (MTTR) and the number of vulnerabilities detected per build provide valuable insights into program effectiveness and areas for improvement.

**The Path Forward**

Empowering engineering teams with ownership of vulnerability management is a cultural shift that requires effort and collaboration. By integrating security into the CI/CD pipeline, applying automated policies, and supporting developers with clear processes and tools, infosec teams can drive efficiency and foster a shared commitment to building secure software.

Organizations that embrace this approach will not only reduce risk but also enhance their ability to deliver secure and reliable applications at scale. The time to shift left is now. Success requires a proactive mindset, the right tools, and above all, a strong partnership between infosec and engineering teams.

**About the Author**

Information Security Engineer, Cisco Systems

Remi Yazigi is information security engineer for Cisco Systems. He has extensive experience in cloud and container vulnerability management, specializing in automation to enhance security workflows. He holds two master’s degrees in computer engineering and cybersecurity and forensics. He joined ThousandEyes in London in 2018 and moved to the US in 2022 after Cisco Systems acquired ThousandEyes in 2020. There, he lead efforts to improve vulnerability detection and remediation. Prior to that, he worked in France as a cybersecurity consultant, focusing on securing industrial systems, including projects such as Ariane 5 space rocket and SECOIA. He is passionate about empowering engineering teams to take ownership of security processes, ensuring resilient and secure infrastructures. His expertise lies in creating scalable, efficient solutions that address modern security challenges.

Proactive Vulnerability Management for Engineering Success

Now we know exactly how DeepSeek was designed to work, and we may even have a clue toward its highly publicized scandal with OpenAI.

Source: mundissima via Alamy Stock Photo

Researchers have tricked DeepSeek, the Chinese generative AI (GenAI) that debuted earlier this month to a whirlwind of publicity and user adoption, into revealing the instructions that define how it operates.

DeepSeek, the new "it girl" in GenAI, was trained at a fractional cost of existing offerings, and as such has sparked competitive alarm across Silicon Valley. This has led to claims of intellectual property theft from OpenAI, and the loss of billions in market cap for AI chipmaker Nvidia. Naturally, security researchers have begun scrutinizing DeepSeek as well, analyzing if what's under the hood is beneficent or evil, or a mix of both. And analysts at Wallarm just made significant progress on this front by jailbreaking it.

In the process, they revealed its entire system prompt, i.e., a hidden set of instructions, written in plain language, that dictates the behavior and limitations of an AI system. They also may have induced DeepSeek to admit to rumors that it was trained using technology developed by OpenAI.

**DeepSeek's System Prompt**

Wallarm informed DeepSeek about its jailbreak, and DeepSeek has since fixed the issue. For fear that the same tricks might work against other popular large language models (LLMs), however, the researchers have chosen to keep the technical details under wraps.

Related:Code-Scanning Tool's License at Heart of Security Breakup

"It definitely required some coding, but it's not like an exploit where you send a bunch of binary data \[in the form of a\] virus, and then it's hacked," explains Ivan Novikov, CEO of Wallarm. "Essentially, we kind of convinced the model to respond \[to prompts with certain biases\], and because of that, the model breaks some kinds of internal controls."

By breaking its controls, the researchers were able to extract DeepSeek's entire system prompt, word for word. And for a sense of how its character compares to other popular models, it fed that text into OpenAI's GPT-4o and asked it to do a comparison. Overall, GPT-4o claimed to be less restrictive and more creative when it comes to potentially sensitive content.

"OpenAI's prompt allows more critical thinking, open discussion, and nuanced debate while still ensuring user safety," the chatbot claimed, where "DeepSeek’s prompt is likely more rigid, avoids controversial discussions, and emphasizes neutrality to the point of censorship."

While the researchers were poking around in its kishkes, they also came across one other interesting discovery. In its jailbroken state, the model seemed to indicate that it may have received transferred knowledge from OpenAI models. The researchers made note of this finding, but stopped short of labeling it any kind of proof of IP theft.

Related:OAuth Flaw Exposed Millions of Airline Users to Account Takeovers

"\[We were\] not retraining or poisoning its answers — this is what we got from a very plain response after the jailbreak. However, the fact of the jailbreak itself doesn't definitely give us enough of an indication that it's ground truth," Novikov cautions. This subject has been particularly sensitive ever since Jan. 29, when OpenAI — which trained its models on unlicensed, copyrighted data from around the Web — made the aforementioned claim that DeepSeek used OpenAI technology to train its own models without permission.

Source: Wallarm

**DeepSeek's Week to Remember**

DeepSeek has had a whirlwind ride since its worldwide release on Jan. 15. In two weeks on the market, it reached 2 million downloads. Its popularity, capabilities, and low cost of development triggered a conniption in Silicon Valley, and panic on Wall Street. It contributed to a 3.4% drop in the Nasdaq Composite on Jan. 27, led by a $600 billion wipeout in Nvidia stock — the largest single-day decline for any company in market history.

Then, right on cue, given its suddenly high profile, DeepSeek suffered a wave of distributed denial of service (DDoS) traffic. Chinese cybersecurity firm XLab found that the attacks began back on Jan. 3, and originated from thousands of IP addresses spread across the US, Singapore, the Netherlands, Germany, and China itself. 

Related:Spectral Capital Files Quantum Cybersecurity Patent

An anonymous expert told the Global Times when they began that "at first, the attacks were SSDP and NTP reflection amplification attacks. On Tuesday, a large number of HTTP proxy attacks were added. Then early this morning, botnets were observed to have joined the fray. This means that the attacks on DeepSeek have been escalating, with an increasing variety of methods, making defense increasingly difficult and the security challenges faced by DeepSeek more severe."

To stem the tide, the company put a temporary hold on new accounts registered without a Chinese phone number.

On Jan. 28, while fending off cyberattacks, the company released an upgraded Pro version of its AI model. The following day, Wiz researchers discovered a DeepSeek database exposing chat histories, secret keys, application programming interface (API) secrets, and more on the open Web.

Elsewhere on Jan. 31, Enkyrpt AI published findings that reveal deeper, meaningful issues with DeepSeek's outputs. Following its testing, it deemed the Chinese chatbot three times more biased than Claud-3 Opus, four times more toxic than GPT-4o, and 11 times as likely to generate harmful outputs as OpenAI's O1. It's also more inclined than most to generate insecure code, and produce dangerous information pertaining to chemical, biological, radiological, and nuclear agents.

Yet despite its shortcomings, "It's an engineering marvel to me, personally," says Sahil Agarwal, CEO of Enkrypt AI. "I think the fact that it's open source also speaks highly. They want the community to contribute, and be able to utilize these innovations. I think that's why a lot of closed-source model providers are sort of scared."

He adds, too, that "there are other models that are worse than DeepSeek. It's just that DeepSeek is so much in the news, so it has a lot of eyes on it."

**About the Author**

Nate Nelson is a writer based in New York City. He formerly worked as a reporter at Threatpost, and wrote "Malicious Life," an award-winning Top 20 tech podcast on Apple and Spotify. Outside of Dark Reading, he also co-hosts "The Industrial Security Podcast."

DeepSeek Jailbreak Reveals Its Entire System Prompt

Check out all the highlights from Black Hat USA 2024 at the Mandalay Bay in Las Vegas.
#cybersecurity #infosec #blackhat

Black Hat USA returns to the Mandalay Bay Convention Center in Las Vegas with a 6-day program. The 2025 event will open with four days of specialized cybersecurity Trainings (August 2-5), with courses for all skill levels. Also taking place during Black Hat USA is Summit Day on Tuesday, August 5, followed by the two-day main conference on August 6 & 7 featuring more than 100 selected Briefings, dozens of open-source tool demos in Arsenal, a robust Business Hall, networking and social events, and much more. View Pass Options »

Black Hat USA 2024 Highlights

The CHC remains operational, but a host of personal data is now in the hands of a "skilled cybercriminal," it said.

Source: Panther Media via Alamy Stock Photo

NEWS BRIEF

Nonprofit healthcare provider Community Health Center (CHC) has begun notifying more than a million patients of a breach that compromised its data.

This is the third healthcare institution to be targeted in the past week. Frederick Health and the New York Blood Center Enterprises were both targeted in separate ransomware attacks that it alerted the public to on Jan. 27 and Jan. 29, respectively. 

It remains unclear who is behind the heists, and whether there is any connection between the attacks.

In a letter to victims from CHC, it reports that it noticed unusual activity on its computer systems on Jan. 2. It then launched an investigation and bolstered its security systems alongside cybersecurity experts. The investigation determined that a "skilled criminal hacker" was able to gain access to its systems and steal data, including some of the personal information of its patients. That includes names, dates of birth, addresses, phone numbers, emails, diagnoses, treatment details, test results, Social Security numbers, and health insurance information.

"Fortunately, the criminal hacker did not delete or lock any of our data, and the criminal's activity did not affect our daily operations," the CHC wrote in its letter. "We believe we stopped the criminal hacker's access within hours, and that there is no current threat to our systems."

"Incidents in this sector underscore the ongoing risks healthcare providers face, with attackers gaining access to sensitive data like names, medical diagnoses, and insurance details," Emily Phelps, director of Cyware, wrote in an emailed statement to Dark Reading. "This incident highlights the urgency of securing healthcare infrastructures — protecting not just patient data, but the broader ecosystem of communication, collaboration, and care delivery."

Though there is currently no sign that the information was misused, the CHC is offering free identity theft protection through IDX including two years of credit and CyberScan monitoring, $1,000,000 insurance reimbursement policy, and assistance recovering stolen identities. 

The letter provides additional information regarding how customers can sign up for IDX protection services, which the CHC urges individuals to take advantage of, even if there is no current sign of foul play regarding their stolen information, as it remains unclear what the threat actor intends to do with the stolen data.

**About the Author**

Skilled writer and editor covering cybersecurity for Dark Reading.

Community Health Center Data Breach Affects 1M Patients

The "Cracked" and "Nulled" Dark Web sites are now offline, along with the Pakistani "Saim Raza" network of underground forums (aka HeartSender).

Source: Britpix via Alamy Stock Photo

The US Department of Justice Department (DoJ) has partnered with international law enforcement to crack down on Dark Web cybercrime forums, with a pair of operations that disrupted underground markets linked to attacks on millions of victims globally. It's unclear what the long-term effects of the efforts will be, however.

In the first action, the DoJ, in coordination with the Dutch National Police, seized 39 domains operated by a Pakistani group known as Saim Raza (aka HeartSender).

According to a DoJ announcement on Jan. 31, Saim Raza has been operating since 2020, slinging phishing kits and fraud tools to the highest bidder across a network of underground sites. The cybercriminals buying the tools are responsible for global business email compromise (BEC) attacks and other nefarious scams, including against victims in the US who were collectively swindled out of $3 million.

"Not only did Saim Raza make these tools widely available on the open Internet, it also trained end users on how to use the tools against victims by linking to instructional YouTube videos on how to execute schemes using these malicious programs, making them accessible to criminal actors that lacked this technical criminal expertise," the agency said in its announcement. "The group also advertised its tools as 'fully undetectable' by antispam software."

Related:7 Tips for Strategically Saying 'No' in Cybersecurity

**"Cracked" & "Nulled" Dark Web Markets Are … Cracked & Nulled**

In a separate action, the DoJ participated in "Operation Talent," a Europol-backed international operation that disrupted the Cracked and Nulled Dark Web marketplaces. Together, the forums have been linked to cybercrimes against at least 17 million US victims.

According to the DoJ, the Cracked marketplace emerged in 2018, boasted 4 million users, made $4 million in revenue, and hosted more than 28 million cybercrime ads over the course of its reign.

Reflective of its name, one service on offer on the Cracked forum gave users a password search tool to find stolen credentials for millions of accounts and services. In one case, a stalker allegedly sextorted and harassed a woman in the Buffalo, NY, area after using the service to break into one of her accounts and access sensitive materials.

The Nulled website domain seizure meanwhile came in tandem with the unsealing of charges against one of its administrators, Lucas Sohn, an Argentinian national living in Spain. Nulled had been around since 2016, had 5 million users, raked in $1 million per year, and listed more than 43 million ads.

Nulled specialized in selling stolen login credentials, stolen identification documents, and hacking tools, according to the DoJ. If convicted, Sohn faces a maximum penalty of five years in prison for conspiracy to traffic in passwords, 10 years in prison for access device fraud, and 15 years in prison for identity fraud.

Related:IT-Harvest Launches HarvestIQ.ai

**Law Enforcement Takedowns: Do They Deter Cybercrime?**

The actions are just the latest in a flurry of efforts by US law enforcement to take down the infrastructure that powers cybercrime.

Just last week for example, the DoJ announced a partial disruption of North Korea's tech worker scam efforts. And in January, it wrapped up an eradication effort against the notorious PlugX malware. Other recent operations have included arresting actors behind the LockBit ransomware gang and teenaged members of Scattered Spider.

However, law-enforcement disruptions can be a game of whack-a-mole, with new threats popping up, or old ones re-emerging or taking a different shape, in the wake of takedowns. For instance, just two weeks after the DoJ shuttered the infamous BreachForums cybercrime forum last May, it sprang back to life with listings for Ticketmaster breach data. Fast forward several months, and the site is back to enjoying high-traffic status, with cybercriminals using it as a go-to for offering data breach information for sale.

Related:MITRE's Latest ATT&CK Simulations Tackle Cloud Defenses

"Arrests can cause actors to move away from a code base or campaigns that were formerly a notable threat," explains Ken Dunham, cyber threat director at Qualys Threat Research Unit. "In other situations, actors adapt, like cockroaches that simply move to another room when you move the couch, when pressure is applied, taking on new codes and tactics to further nefarious means and motives."

It's important to offer a full-court press against the most virulent threats to have even a scintilla of hope to root them out entirely, according to Derek Manky, global vice president of threat intelligence at Fortinet.

"Turning the tide against cybercrime necessitates a culture of collaboration, transparency, and accountability on a larger scale," he explains. "No single organization can effectively stop cybercrime alone. Public-private partnerships can influence the disruption of large-scale cybercrime activities, leading to a safer, more resilient society. Every organization has a place in the chain of disruption against cyberthreats."

Taken on their own though, it's useful to think of the disruption efforts as an important thorn in cybercriminals' sides, at the very least.

"Historically attackers can more easily obtain information and tools than defenders, giving them a perpetual advantage," Evan Dornbush, former National Security Agency (NSA) cybersecurity expert, said in an emailed statement. "Actions like this make it more expensive for cyber criminals to operate, and ultimately this is a good thing. Lesser players who rely on purchasing tools and network access from these two marketplaces won't be able to get started, raising the barrier to entry for their criminal enterprise aspirations."

**About the Author**

Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.

DoJ Shutters Cybercrime Forums Behind Attacks on 17M Americans

Regulators are ready to enforce new state data privacy laws. Here's how experts say organizations can stay compliant and avoid penalties.

Source: EThamPhoto via Alamy Stock Photo

If you get a call from John Eakins at the Delaware Attorney General's office, you've already filed a data breach notice with the state, so you know there's a problem. What information security teams do next could mean the difference between getting slapped with a hefty fine or getting off with a warning, along with your reputation intact.

Delaware Deputy Attorney General Eakins is in charge of enforcing the new state regulations under the Delaware Personal Data Privacy Act (DPDPA), first passed by lawmakers in 2023 and just coming into effect on Jan. 1. He says organizations operating in Delaware should expect a call from his office after reporting a major breach. Then he is going to want to drill down on two specific criteria: the harm caused and whether it can be fixed.

"They should expect to be asked to provide information about the breach, an assessment of the harm caused, and the sensitivity of the data that was breached," Eakins tells Dark Reading. But that doesn't necessarily mean enforcement is imminent, he adds. Companies are offered what's known as a "right to cure," in Delaware along with many other states, meaning if the error that led to the breach can get fixed within a range of 30 to 60 days, the company won't be penalized.

That's where it becomes critical for organizations and their data security teams to have a "story to tell," according to Andreas Kaltsounis, an attorney and partner with BakerHostetler, who works with data privacy regulators on behalf of clients.

**State Privacy Laws, Enforcement on the Rise**

Twenty states, including Delaware, have passed data privacy regulations as of 2025, but these new laws aren't really necessary for states to levy penalties for data breaches, Kaltsounis points out. Federal law could be used in many of these instances, half the states already have information security requirements on the books, and nearly all the states have some form of an "unfair, deceptive, and abusive practices" (UDAP) law, which could also be used as enforcement mechanisms for many data breach instances, he adds.

What new privacy legislation has done for regulators isn't so much putting rules on the books — it's allocating more money toward enforcing lax data privacy among organizations, including money to hire in-house expertise. Pair that with federal deregulation under the Trump administration, and states are in a prime position to fill the gap.

Each state is picking its own lane.

Texas, for its part, is going after connected car data, filing suit against General Motors and, more recently, insurance company Allstate for collecting consumer data without complying with the new Texas Data Privacy Act (TDPSA). The Texas AG alleges the insurer was paying developers of other apps, including Life360, to incorporate secret embedded software to collect cell phone location data on Texans and then use that information to justify insurance rate hikes.

New York Attorney General Letitia James also recently fined companies, including one distributing a line of insecure home security video systems ($450,000), GEICO and Travelers insurance companies for failing to protect data ($11.3 million), and Capital Regions healthcare provider ($2.25 million) for failing to protect medical data. In December, New York Gov. Kathy Hochul expanded the AG's oversight of the cybersecurity of financial services. New York's primary enforcement efforts have been trained on the sizable financial services companies operating in its jurisdiction.

Delaware will be focused on the abuse of geolocational data and the data security of emerging artificial intelligence (AI) technologies, Delaware's deputy AG Eakins says.

Despite the flurry of press releases, consumer advocates like the Electronic Frontier Foundation's associate director of legislative advocacy, Hayley Tsukayama, say every state should be doing much more to protect consumer data. Tsukayama points to business-friendly loopholes like the "right to cure" offered by regulators, including those in Delaware, as a "get out of jail free card," and would like to see more pressure on companies to protect sensitive data before it's too late.

The Electronic Privacy Information Center (EPIC) is likewise unimpressed overall with state efforts on data privacy. In its recent "State of the Privacy" report, EPIC said new state laws, "...fail to protect consumers." Of the 19 states that have passed consumer privacy legislation packages, nearly half got F grades from EPIC; only California got a B, and no state received an A.

Chronic underfunding has bogged down enforcement efforts, Tsukayama says. But that's all about to change.

Delaware deputy AG Eakins said his office received a boost in funding along with the DPDPA and his office now has a full-time computer scientist to help lend expertise to their investigations. Many other states have followed suit, allocating bigger budgets for data privacy oversight along with new compliance requirements.

**Get Your Data Privacy Story Right, Now**

Attorney Kaltsounis says regulators are busy; in his experience, organizations with a compelling "story to tell" are going to be far better positioned to avoid penalties. That means being able to demonstrate how the organization was taking information security seriously well before the breach. He recommends a good old-fashioned data audit, purging anything sitting on an old server that isn't needed anymore. Then organizations need to double down on collecting only the data they absolutely need for the shortest period of time possible.

"They both need to be done," Kaltsounis advises.

Enterprises should treat this new regulatory environment at the state level as an opportunity to incorporate data privacy as a foundational principle of the business, according to Ryan Edge, director of strategy, privacy, and data governance with OneTrust, a data privacy services provider.

"One thing is for sure — data privacy is not going away," Edge says. "There are more than a dozen US state privacy laws in effect today. It can seem daunting, but it doesn't need to be. Companies don't have to reinvent the wheel for each law. By operationalizing data privacy, they can see benefits beyond compliance, like minimizing risk, driving data quality, and building trust with consumers."

Organizations should develop a strategy that includes data mapping, privacy impact assessments, and privacy engineering to understand how data is being used. This would help define policies such as how long data is kept, how it is protected, and how it is disposed when no longer needed.

When it comes to how the Delaware AG's office will determine where data privacy penalties are appropriate, Eakins says the state's $52 million settlement reached with Marriott for the company's lack of "providing reasonable security" is a strong starting framework. Baseline technical requirements established out of the multistate Marriott settlement include having a comprehensive information security program in place, minimizing the amount of data collected with disposal requirements and supply chain oversight. That's a good place for organizations to start.

Moving forward, Kaltsounis expects to see a "friendly competition" emerge among states to demonstrate the strongest data protection stance on behalf of their citizens. Staffed-up offices of state regulators armed with a mandate and fresh budgets are likely to start becoming a standard fixture in the aftermath of a data breach.

When they call, what story will you have to tell them?

State Data Privacy Regulators Are Coming. What Story Will You Tell Them?

The deal, expected to close this quarter, will give Tenable One Exposure Management much-needed integration with over 100 third-party security tools and platforms.

Source: Maxiphoto via iStock Photo

Tenable is poised to fill significant gaps in its exposure management platform with its agreement to acquire Vulcan Cyber.

Tenable said it was the first vendor to add exposure management to its vulnerability management platform when it launched the Tenable One Exposure Management Platform in 2022. However, Tenable's exposure management has lacked the ability to share telemetry with IT and security tools from other vendors. This is where Vulcan Cyber's exposure management offering, which can integrate with more than 100 third-party security tools, can make a difference for Tenable.

"This will give organizations the ability to have insights across the attack surface, not just what you point at Tenable but also that third-party data," says Tenable senior VP of products Jason Merrick. "At the end of the day, our focus here is helping organizations move as they're progressing from vulnerability management to exposure management and then gaining that context where they can make better decisions."

**Adding Exposure Management to Vulnerability Management**

Unlike vulnerability management offerings that are designed to discover, assess, prioritize, and mitigate threats in IT assets, exposure management considers an organization's cybersecurity posture and performs risk assessment.

Several Tenable rivals also offer exposure management as part of their product portfolios. For example, CrowdStrike added Exposure Management to its Falcon XDR platform in 2023, and Microsoft recently added exposure management to Microsoft Defender, which notably includes third-party connectors. On the same day Tenable announced its Vulcan Cyber plans, exposure management platform provider CYE acquired Solvo.

Omdia analyst Andrew Braunberg believes Vulcan Cyber will bring needed features to Tenable One that its rivals are now touting.

"While Tenable has been talking about exposure management for as long as anyone, it still often has the feel of an old legacy vulnerability management company," Braunberg says. "Vulcan has always seen exposure management as where the market was headed and has taken an impressively open approach to pulling in asset and exposure data and working to broadly support remediation, orchestration, and automation."

Tenable's Merrick acknowledges that Microsoft's licensing model with its M365 E3 and E5 plans give Microsoft an advantage.

"They can throw a lot of free stuff at this, and there are many organizations that are Microsoft-only shops," he says. "CrowdStrike, too, is growing and expanding. But I also think that this is an opportunity for Tenable to differentiate, to continue being that source of truth, to provide better analytic capability, and to tie these things together. Because at the end of the day, this forces us, from a product standpoint, to continue to innovate and deliver new capabilities."

Organizations are only beginning to expand their focus on vulnerability management to include exposure management, Merrick adds.

"I think we're in the first inning of exposure management," he says. "More and more, organizations are starting to talk about this."

The deal, announced on Wednesday, calls for Tenable to pay $147 million in cash and $3 million in restricted stock to Vulcan Cyber. While Merrick is unable to discuss specific integration plans before the deal closes, which the company anticipates will take place this quarter, the 100-plus connectors to third-party systems were a key impetus for the deal.

"We have always been envisioning being able to ingest third-party data into our exposure management platform like we've done with our vulnerability management solution," he says. "We've already built the data model specifically to accept and bring in third-party data. So we want to be able to go and fast-track that. Once we close, this is going to be the big focus for us in 2025."

**About the Author**

Contributing Writer

Jeffrey Schwartz is a journalist who has covered information security and all forms of business and enterprise IT, including client computing, data center and cloud infrastructure, and application development for more than 30 years. Jeff is a regular contributor to Channel Futures. Previously, he was editor-in-chief of Redmond magazine and contributed to its sister titles Redmond Channel Partner, Application Development Trends, and Virtualization Review. Earlier, he held editorial roles with CommunicationsWeek, InternetWeek, and VARBusiness. Jeff is based in the New York City suburb of Long Island.

Tenable to Acquire Vulcan Cyber to Boost Exposure Management Focus

Nine application security toolmakers band together to fork the popular Semgrep code-scanning project, touching off a controversy over access to features and fairness.

Source: TippaPatt via Shutterstock

A group of nine application security service providers announced they would "fork" the popular code-scanning project Semgrep, creating a new codebase, after a series of moves by the eponymous startup made it more difficult for the firms to use the open source software in their own products.

The companies — Aikido Security, Arnica, Amplify Security, Endor Labs, Jit, Kodem, Legit Security, Mobb, and Orca Security — embarked on the initiative after Semgrep announced it had moved some capabilities of its open source engine into the startup's paid version. Dubbed Opengrep, the new project remains under the same license as the Semgrep Community Edition — the Lesser GNU Public License (LGPL) — but will restore advanced features and the ability to export data in JSON and SARIF formats, as well as create an open source database of rules.

The Opengrep initiative is intended to create a neutral open source project that is not owned by a single company and can be improved to suit the needs of enterprise users and the group of companies behind the project, says Varun Badhwar, CEO and co-founder of software supply chain security firm Endor Labs, one of the companies sponsoring Opengrep.

"We are all collectively funding this right now, but once we stabilize the project, our goal is to turn it over to the right community ... we don't want to — as vendors — own this long term," he says. "This is an interim step for us — to create something that is owned by multiple parties and not a single vendor \[that\] can overnight decide to make a change."

The triggering event for the open source split came on Dec. 13, when Semgrep outlined changes it had made to seemingly small — but nevertheless important — features. The company sought to further delineate its Pro version from the open source project by renaming the latter to the "Community Edition," clarifying that the license allowed only internal use of its ruleset and removing the ability of the Community Edition to export certain fields in common output formats, such as JSON and the Static Analysis Results Interchange Format (SARIF).

Essentially, the firm has pursued an open core model, where the core engine is made public using an open source license, but more advanced features are made proprietary.

"I feel that we've clarified what belongs in a Unix-style, open source tool for security practitioners versus what makes sense in a commercial platform," says Luke O'Malley, chief product officer and founder at Semgrep. "Features like platform-focused fingerprinting go beyond CE's core mission. As maintainers, we ask ourselves: Would the majority of the community see this as fair? That principle broadly guides what stays in CE and what is in our commercial offering."

**Freeloading and a Growing Gap**

The creation of the Opengrep project has created a kerfuffle among some application security specialists, with some criticizing the companies for forking, rather than financing, Semgrep's open source core. In many ways, it's part of a playbook where venture-backed companies use an open source project to launch their own products, argued application security specialist Mark Curphey, in a Jan. 29 column.

"\[W\]hy on earth would anyone fork a successful open-source security project with a vibrant community?," he said. "There are a lot of free-loaders in the world of software, companies who build on other peoples hard work, and that don't fairly contribute back to the projects that they are making money off. It's perfectly legal as long as they stay within the license terms, and sadly a fact of life."

He pointed to another application security project — the open source Zed Attack Proxy (ZAP) used for dynamic application security testing (DAST) — which suffered similar commercial issues during its development, struggling to fund the maintainers of the project, even though "over a dozen commercial DAST services" used the open source codebase as the basis of their products. Application security firm Checkmarx ended up hiring all three ZAP maintainers and committed to funding the project, which formed the foundation of its own DAST solution.

In Curphey's mind, Semgrep's efforts have been taken advantage of.

"I think open source funding is incredibly complex, but this doesn't feel right, and it feels hypocritical to me for these companies to be doing this," he told Dark Reading in an interview.

**More Features for Opengrep?**

Endor Labs' Badhwar, however, argues that Opengrep will be a more feature-rich version of the code-scanning engine because Semgrep had slowly created a gap between its professional AppSec Platform and its open source engine — a common practice among companies that create open core technologies.

The creation of the Community Edition and the removal of some "experimental" features that the Opengrep companies considered valuable caused alarm among the commercial vendors who used the Semgrep engine as part of their service offerings, says Badhwar.

"There are several examples where the community tried to contribute things that would close the gaps in the open source version of Semgrep ... that the maintainers of the engine were choosing not to necessarily accept and include," he says. "I think it was becoming very clear ... that Semgrep's biggest competitor was their own open source engine, and so they were trying to create a bigger gap."

Opengrep has already financed two software engineers to work on the project and will discuss a road map during a Feb. 20 meeting.

This tension has played out with other open source projects as well. The open source search engine Elasticsearch, for example, had been developed as an open core project, but Elastic shifted the license in January 2021 to restrict managed service providers from using the software as the basis of their services. The same month, a group of Amazon Web Services engineers created a fork, OpenSearch, to give the community the ability to use an open version.

In Semgrep's case, founder O'Malley argues that the company has an incentive to keep the Community Edition well-maintained and strong, while the Opengrep team has not demonstrated their product will be an improvement. Two parallel projects is never ideal, he says.

"Multiple forks can create confusion, making it harder for individuals to know where to contribute and what’s actively maintained," O'Malley says. "That’s always a risk with fragmentation in open source. Our priority is keeping Semgrep CE strong, well-maintained, and growing. Developers and security engineers relying on it should feel confident that we're committed to its long-term success and a thriving ecosystem."

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Code-Scanning Tool's License at Heart of Security Breakup

The Cyber Trust Mark has the potential to change how we define and measure security at the endpoint level. But potential isn't enough.

Source: Wavebreakmedia Ltd FUS1507-1 via Alamy Stock Photo

COMMENTARY

In the chaotic world of cybersecurity, where attackers innovate faster than we can patch and secure endpoints, trust often feels like a mirage. Between deciphering new attack patterns and troubleshooting operational headaches, I can't help but wonder: How can we rebuild endpoint trust in an era of AI-driven attacks and hybrid work environments?

The Cyber Trust Mark, a recently proposed initiative to label trustworthy devices, claims to offer clarity and build consumer and corporate confidence in this digital chaos. But will it stand the test of enterprise realities, or will it join the graveyard of good ideas that failed to scale? I believe it has potential — but only if paired with actionable AI-driven insights and dynamic enforcement.

**AI: Savior of Cybersecurity or Saboteur?**

AI tools have been a game changer for cybersecurity. They can autonomously detect anomalies, triage vulnerabilities at scale, and even predict attack vectors. A 2023 study by the MIT Technology Review Insights revealed that 62% of security leaders are leveraging AI to speed up decision-making in threat detection. From my vantage point, tools like these are indispensable — particularly when dealing with sprawling endpoint ecosystems.

However, there's a darker side to AI. A 2023 report by ISACA underscores how attackers are weaponizing AI to create polymorphic malware and bypass traditional security controls. AI is only as good as the data it's trained on, and enterprise data environments are far from perfect. According to the article "Understanding and Avoiding AI Failures: A Practical Guide" by Robert Williams and Roman Yampolskiy, published in Philosophies, AI often fails in environments with noisy or incomplete data, resulting in false positives that drain security team resources. This duality — AI as both defender and enabler of threats — is precisely why human oversight remains irreplaceable in endpoint management.

**The Cyber Trust Mark: Promising or Hollow?**

The Cyber Trust Mark, proposed by the Federal Communications Commission (FCC), aims to provide a transparent labeling system for secure devices — like an energy efficiency rating but for cybersecurity. According to an analysis by the National Institute of Standards and Technology (NIST), this initiative could bridge the gap between manufacturers and enterprises, offering a clear standard for endpoint security. In theory, this framework should make it easier for vulnerability analysts like me to prioritize risk, focus remediation efforts, and communicate effectively with stakeholders.

But here's my concern: Standards are only as effective as their enforcement. The article "Role of Advanced Cybersecurity Frameworks in Safeguarding Data Integrity and Consumer Trust in Digital Commerce and Enterprise Systems," published on ResearchGate, warns of the dangers of static certifications, which can quickly become outdated in a dynamic threat landscape. To be meaningful, the Cyber Trust Mark must go beyond static labeling. It must adapt in real-time, factoring in telemetry data and ongoing compliance audits. Otherwise, it risks becoming another checkbox exercise in an industry already overrun with compliance fatigue.

**Lessons From the Endpoint Trenches**

Let me paint a picture from my own experience. Recently, while managing endpoint vulnerabilities for a critical application, I encountered a legacy system — a dinosaur in tech terms. AI-driven tools flagged it as "secure" because it met basic encryption standards, but manual analysis revealed vulnerabilities in its outdated protocols. This is a recurring theme in VM: Tools can't handle nuance, and legacy systems refuse to die. A similar fate could await the Cyber Trust Mark if it fails to address the messy realities of enterprise environments.

So how do we avoid this? I propose the following:

1.  AI-augmented oversight: AI can provide baselines, but human analysts must validate its findings. Studies from Carnegie Mellon University confirm that a hybrid approach reduces false positives by 30% and could provide deeper insights.
    
2.  Dynamic trust scoring: The Cyber Trust Mark should evolve based on real-time telemetry.
    
3.  Collaboration across ecosystems: Public-private partnerships are essential to make the Cyber Trust Mark universally meaningful. The World Economic Forum's 2023 cybersecurity framework emphasizes how global standards succeed only when multiple stakeholders align on enforcement and data sharing.
    

**The Cyber Trust Mark Needs to Be More Than a Marketing Label**

The Cyber Trust Mark has the potential to change how we define and measure security at the endpoint level. But potential isn't enough. If this initiative is going to work, it needs teeth: dynamic scoring, transparent enforcement, and continuous oversight. AI can be a powerful ally, but we can't rely on it alone. The human element — our judgment, our experience, our ability to see through the cracks — is what ultimately will determine the success of this framework.

Here's what I'd like to see: a Cyber Trust Mark that isn't afraid to fail fast and learn faster. A system that acknowledges the imperfect trial-and-error nature of enterprise security. And most importantly, a trust framework that doesn't just label endpoints as "secure," but tells us why they're secure — and for how long.

**Call to Action: Rebuilding Trust Together**

Security professionals, developers, vendors, policymakers — we all have a stake in making this work. As someone on the frontlines of endpoint management, I challenge you to weigh in: What does trust mean to you, and how do we operate it in a rapidly evolving threat landscape? Let's not just label trust — let's build it.

**About the Author**

Security Specialist, IBM

Chris "CT" Thomas currently is security specialist for IBM. Starting his career in healthcare technology, he developed a strong foundation in protecting critical systems and sensitive data. As an email security specialist, he expanded my expertise in defending communication channels against evolving threats. At IBM, he sharpened his skills in vulnerability management, focusing on identifying and mitigating risks to secure enterprise systems. Curiosity drives his work in cybersecurity — he is passionate about breaking down complex systems to understand and improve them. His current focus is on VM, AI, and disaster recovery for AI systems and endpoints, ensuring resilience and security in dynamic environments. When he's not tackling cybersecurity challenges, you’ll find him running or enjoying a great slice of pizza.

Source

DARKReading