Senhasegura first to offer password manager and privileged access management (PAM) in a single platform.

**SÃO PAULO & SAN FRANCISCO -- (BUSINESS WIRE) —** senhasegura, a leading provider of privileged access management (PAM) solutions, today introduced MySafe, an advanced password manager that works with senhasegura’s PAM solution to enhance IT security in the personal sphere. With the goal to assist “normal” users with regular permissions, such as administration, salespeople or engineers that make up the majority of a company’s employees, senhasegura is the first to help security teams tackle user passwords, one of an organization’s biggest security risks, and privileged users, one of an attacker’s most lucrative targets, all from a single platform.

Securing employees' personal passwords should be an essential part of overall information security. Yet users still use the same password for multiple applications and online services, including easy-to-guess passwords such as birth dates, personal names, and 123456. According to the 2022 Verizon Data Breach Investigations Report, compromised passwords were responsible for 82% of reported cyberattacks in the last year alone.

Working in conjunction with senhasegura’s PAM solution, MySafe helps employees easily manage their passwords with just a few clicks, reducing the risk of stolen credentials. By randomly generating passwords, senhasegura’s MySafe makes it more difficult for cybercriminals to guess an employee's personal password and gain access to corporate systems. Through encryption, MySafe enables secure password sharing via the internet or mobile devices.

Key benefits of senhasegura MySafe include:

*   Encryption – All managed passwords are stored encrypted, ensuring they are only accessed through senhasegura MySafe.
*   Password Sharing – Enables password sharing between users via web or smartphone, meeting the needs of employees who share access to common services.
*   Automatic Password Injection – Passwords can be automatically injected on websites or just checked out on demand.
*   Traceability – Verify which passwords people had access to, letting administrators know what passwords they need to change after someone leaves the company
*   Maximum Security – senhasegura MySafe is secured by strong encryption methods and several methods of multi-factor authentication.

According to Marcus Scharra, CEO of senhasegura, “Passwords are still the most popular method for authenticating users, yet they create a huge security risk when employees reuse or share them with others. MySafe addresses the needs of employees with regular account privileges through an easy and secure way to store, manage and share their passwords. By using the same platform and user interface as our PAM solution, senhasegura uniquely offers security teams a simple yet powerful solution that addresses the authentication needs of all of a company’s employees, all in one place.”

Detailed product information can be found at MySafe.

**About senhasegura**

senhasegura is committed to helping companies create secure, resilient organizations by stopping privilege abuse from inside and out of the organization. senhasegura’s award- winning, Privileged Access Management (PAM) solution addresses the entire privilege access management lifecycle, including before access, during and afterward, and plays a critical role in implementing a company’s zero trust architecture. Established in São Paulo, New York and San Francisco, senhasegura is a global leader with customers in over 45 countries throughout Latin America, North America, Asia-Pacific, and Europe, Middle East and Africa. The Company’s PAM solution is distributed through an international network of more than 150 value added, trusted channel partners.

For more information, go to https://senhasegura.com/ or follow us on LinkedIn https://www.linkedin.com/company/senhasegura and Twitter @senha\_segura.

Senhasegura Introduces MySafe for Managing Personal Passwords

**TEL AVIV, LONDON and NEW YORK – November 3, 2022 –** Apiiro, the leader in Cloud-Native Application Security, today announced a significant Series B round of $100M led by General Catalyst with participation by Greylock and Kleiner Perkins. The new funding will be used to accelerate the business and advance the company’s mission to empower developers and application security engineers to proactively fix risks before releasing to the cloud with all the context they need in a single solution.

With more companies shifting to agile development and adopting CI/CD practices to release code to the cloud on a daily basis, there is an exponential increase in the number of changes. This creates a massive market opportunity to help CISOs and CIOs effectively and contextually identify, prioritize and eliminate risks in their code and development environments to prevent application and software supply chain threats using one solution.

“In this economy, it’s important to invest in technology that helps companies drive business growth,” said Quentin Clark, Managing Director at General Catalyst. “Idan, Yonatan and the Apiiro team are giving customers a solution to a whole problem – not just a piece of it. They are going beyond providing tools for developers to address potential security issues in the code base and actually delivering an operational platform that workflows those fixes in context of how a company is configuring and deploying software. This approach has driven phenomenal growth to date, which comes from strong execution with the right team at the right time.”

Apiiro has introduced a completely new approach to application security in the cloud by providing complete visibility into code bases, assessing risks from design to code to cloud and proactively fixing actual risks that attackers can exploit before releasing to the cloud. This enables Fortune 500 companies to reduce operational costs and risks at scale with seamless deployment by connecting to their source control managers via API.

There are several isolated and unrelated findings hiding across code, configurations, open source packages and cloud infrastructure that when pulled together with relevant context, creates a “risk story” that is exploitable by attackers. Apiiro’s Risk Graph technology connects these infinite factors with actionable context to offer a completely new way for developers and security teams to fix risks.

_“_The unrelenting demand for next generation application security solutions has allowed us to deploy our product at-scale with leading Fortune 500 customers,” said Idan Plotnik, co-founder and CEO of Apiiro. “Early innovation enabled us to grow faster and more efficiently than the competition, and we are building the company for hyper growth. The combination of our team, business momentum, and support from top-tier investors positions Apiiro to continue to lead a growing industry.”

**Supporting Resources**

*   Apiiro blog
*   Apiiro on LinkedIn
*   Apiiro on Twitter

**About Apiiro**

Apiiro helps security and development teams proactively fix risks before releasing to the cloud. The company is backed by General Catalyst, Greylock, and Kleiner Perkins. apiiro.com.

Apiiro Raises $100M Series B Funding Round to Solidify Position as the Cloud-Native Application Security Leader

Banco de Crédito Cooperativo (BCC) wins the first hyper-realistic cybersecurity competition for the financial industry.

**RESTON, Va. and BOSTON, Nov. 3, 2022 /PRNewswire/ —** FS-ISAC, the member-driven, not-for-profit organization that advances cybersecurity and resilience in the global financial system, and Cyberbit, provider of the world's leading cybersecurity skill development and readiness platform, announced today that team "IsNotTheEDR" from Banco de Crédito Cooperativo (BCC) is the winner of the first International Cyber League (ICL) Financial Cup, 2022 – the first hyper-realistic cybersecurity tournament for the financial industry. The first runner-up is team "Suboptimal" from a leading Fortune 500 financial institution, the second runner-up is Team "AskITTeam" from BCC and the third runner up is team "TIAA" from TIAA.

The tournament ran from 6-26 October 2022 and challenged cybersecurity teams from the financial sector to respond to live-fire cyberattack simulations replicating attacks they may encounter in real life. Teams were scored based on typical incident response KPIs including investigation, eradication, and remediation goals, as well as their response times. The BCC team outperformed 55 cyber defense teams from leading financial organizations around the world and scored a perfect 100 in the live-fire challenge. The Cyberbit platform, normally used by enterprises to train and upskill information security teams, as well as for FS-ISAC's monthly cyber range workshops, was repurposed to power the ICL competition. The platform provided a virtual arena that emulated an organizational network and a virtual security operations center (SOC) that simulated the live attacks and automatically scored the teams based on their achievements.

The ICL reinvents cybersecurity competition formats by assessing cyber defense skills in real-world scenarios, allowing teams to predict their performance during an attack. Traditional Capture-the-Flag (CTF) events test offensive skills, but these do not reflect the capabilities that cyber defenders will be required to demonstrate during an attack. The ICL leverages cyber range live-fire scenarios to simulate real threat vectors and malware that assess essential "blue team" skills, including technical skills like malware analysis and SIEM investigation, as well as soft skills like teamwork, critical thinking, and communications.

"We in the financial sector believe that exercising builds muscle memory to ensure smooth and efficient incident response," said **Cameron Dicker, Global Head of Business Resilience at FS-ISAC**. "We run a wide variety of exercises to ensure preparedness throughout all different organizational levels and functions, and we chose this competition format during Cybersecurity Awareness Month to bring a little fun into this critical tool for operational resilience."

"CISA and the NCA aptly named this year's cyber awareness month theme as 'See Yourself in Cyber,' demonstrating that cybersecurity is ultimately, about people," said **Sharon Rosenman, Chief Marketing Officer at Cyberbit**. "The feedback from the ICL teams was overwhelmingly positive and we are proud to collaborate with FS-ISAC in helping the financial industry become better prepared for real-world attacks by assessing and maximizing human performance."

"A Cyber Range is a strategic capability that enables governments and companies to effectively educate and train their professionals, as well as to experiment, test and validate new cybersecurity and cyber defense concepts, technologies, techniques, and tactics. Cyber range competitions such as the ICL Financial Cup help in providing a comparison with the rest of the peers in the sector", said Francisco Navarro García, Chief Information Security Officer, Banco de Crédito Cooperativo (BCC).

Additional teams who reached the top 10 in ICL finals include Loan Depot and Somerset Trust.

"The International Cyber League has been an excellent experience for our teams and a fantastic opportunity for them to test their skills with other elite teams across the financial services sector. We are incredibly proud of their work in keeping our company safe. Their strong performance in this competition is celebrated across Technology and the entire company", said Harold Rivas, Chief Information Officer, Loan Depot.

"Somerset Trust takes the security of our information very seriously, and I have always known that we assembled a good team of security professionals. It's always nice to see a competition like this that hones their skills and proves our dedication to security", said John Ash, Sr. Vice President and Chief Information Officer, Somerset Trust.

**About FS-ISAC**

FS-ISAC is the member-driven, not-for-profit organization that advances cybersecurity and resilience in the global financial system, protecting the financial institutions and the people they serve. Founded in 1999, the organization's real-time information sharing network amplifies the intelligence, knowledge, and practices of its members for the financial sector's collective security and defenses. Member financial firms represent $100 trillion in assets in 75 countries.

**About Cyberbit**

Cyberbit provides the global leading attack readiness platform for enabling SOC teams to maximize their performance when responding to cyberattacks. The platform empowers security leaders to make the most of their cybersecurity investment by boosting the impact of the human element in their organization. Cyberbit delivers hyper-realistic attack simulations mirroring real-world scenarios. It enables security leaders to dramatically reduce MTTR, dwell time and cybercrime costs, improve hiring and onboarding, and increase employee retention. Customers include Fortune 500 companies, MSSPs, systems integrators, governments, and leading healthcare providers.

FS-ISAC and Cyberbit Announce Winner of the First Financial Cyber League

Earns Recognition in 2022 Gartner® Market Guide for Operational Technology Security.

**DENVER — Nov. 3, 2022 —** Global conflicts and national infrastructure needs are bringing operational technology (OT) to the forefront of the security market. Optiv, the cyber advisory and solutions leader, is extending its end-to-end capabilities to serve clients’ essential assets with heavy investment in people, process and technology for its OT cyber program.

Critical industries, such as pharmaceuticals, heavy manufacturing, energy and food and beverage production, are facing the same rapidly changing and intensifying threat landscape as today’s enterprises and governments. Optiv’s holistic security program guides clients toward cyber maturity via more modern, integrated IT/OT systems. In addition, the offering goes beyond traditional OT security to uncover previously unknown areas of risk and define tactical opportunities to improve the security posture of a client’s OT environment.

**Access the Gartner® Market Guide for OT Security here.**

“Our objectives are to keep operations online, reduce costs and downtime, and maintain the overall cyber resilience of our clients’ OT environments. We’re able to leverage our extensive combined industrial control system (ICS) expertise to identify and quantify cyber risk so the transition to more modern, outcome-driven security is smoother than not,” said Sean Tufts, IoT/OT security leader, Optiv.

Historically, industrial facilities have relied on dated ICS technologies coupled with siloed, operations-centric network security. According to Gartner, security and risk management leaders responsible for OT systems security should “anchor security efforts to operational resilience in the face of mounting risks by adopting an integrated security strategy beyond legacy OT.”1

Introducing traditional IT technologies to OT environments can improve data utilization. However, new devices and data sources open up antiquated OT networks to a whole slew of vulnerabilities they aren’t equipped to detect. It’s vital for security to be involved in the optimization and convergence of IT and OT, because Gartner also predicts “by 2025, attackers will have weaponized OT environments to successfully harm or kill humans.” 2 Optiv helps clients prepare for and cover that expanding threat surface with physical walkthroughs, risk assessments, asset discovery, threat modeling and strategic roadmapping.

In addition, Optiv’s OT cyber program offers technical network validation and network architectural services made possible by strategic, collaborative relationships with major players in OT cybersecurity products.

Learn more about Optiv’s OT Security Services with these resources:

*   Service Brief
*   Gartner® Market Guide for Operational Technology Security

Learn more about Optiv at https://www.optiv.com/company/optiv-newsroom.

Optiv Helps Safeguard Critical Industries with Cyber Advisory and Protection Offerings

TA569 has modified the JavaScript of a legitimate content and advertising engine used by news affiliates, in order to spread the FakeUpdates initial access framework.

The cyber-threat threat actor known as TA569, or SocGholish, has compromised JavaScript code used by a media content provider in order to spread the FakeUpdates malware to major media outlets across the US.

According to a series of tweets from the Proofpoint Threat Research Team posted late Wednesday, the attackers have tampered with the codebase of an application that the unnamed company uses to serve video and advertising to national and regional newspaper websites. The supply chain attack is being used to spread TA569's custom malware, which is typically employed to establish an initial access network for follow-on attacks and ransomware delivery.

Detection might be tricky, the researchers warned: "TA569 historically removed and reinstated these malicious JS injects on a rotating basis," according to one of the tweets. "Therefore the presence of the payload and malicious content can vary from hour to hour and shouldn't be considered a false positive."

More than 250 regional and national newspaper sites have accessed the malicious JavaScript, with impacted media organizations serving cities such as Boston, Chicago, Cincinnati, Miami, New York, Palm Beach, and Washington, DC, according to Proofpoint. However, only the impacted media content company knows the full range of the attack and its impact on affiliate sites, the researchers said.

The tweets cited Proofpoint threat detection analyst Dusty Miller, senior security researcher Kyle Eaton, and senior threat researcher Andrew Northern for the discovery and investigation of the attack.

**Historical Links to Evil Corp**

FakeUpdates is an initial access malware and attack framework in use since at least 2020 (but potentially earlier), that in the past has used drive-by downloads masquerading as software updates to propagate. It previously has been linked to activity by the suspected Russian cybercrime group Evil Corp, which has been formally sanctioned by the US government.

The operators typically host a malicious website that executes a drive-by download mechanism — such as JavaScript code injections or URL redirections — which in turn triggers the download of an archive file that contains malware.

Symantec researchers previously observed Evil Corp using the malware as part of an attack sequence to download WastedLocker, then a new ransomware strain, on target networks back in July 2020.

A surge of drive-by download attacks that used the framework followed toward the end of that year, with the attackers hosting malicious downloads by leveraging iFrames to serve up compromised websites via a legitimate site.

More recently, researchers tied a threat campaign distributing FakeUpdates through existing infections of the Raspberry Robin USB-based worm, a move that signified a link between the Russian cybercriminal group and the worm, which acts as a loader for other malware.

**How to Approach the Supply Chain Threat**

The campaign discovered by Proofpoint is yet another example of attackers using the software supply chain to infect code that's shared across multiple platforms, to broaden the impact of malicious attack without having to work any harder.

Indeed, there already have been numerous examples of the ripple effect these attacks can have, with the now infamous SolarWinds and Log4J scenarios being among the most prominent.

The former started in late December 2020 with a breach in the SolarWinds Orion software and spread deep into the next year, with multiple attacks across various organizations. The latter saga unfolded in early December 2021, with the discovery of a flaw dubbed Log4Shell in a widely used Java logging tool. That spurred multiple exploits and made millions of applications vulnerable to attack, many of which remain unpatched today.

Supply chain attacks have become so prevalent that security administrators are looking for guidance about how to prevent and mitigate them, which both the public and private sector have been happy to offer.

Following an executive order issued by President Biden last year directing government agencies to improve the security and integrity of the software supply chain, the National Institute for Standards and Technology (NIST) earlier this year updated its cybersecurity guidance for addressing software supply chain risk. The publication includes tailored sets of suggested security controls for various stakeholders, such as cybersecurity specialists, risk managers, systems engineers, and procurement officials.

Security professionals also have offered organizations advice on how to better secure the supply chain, recommending that they take a zero-trust approach to security, monitor third-party partners more than any other entity in an environment, and choose one supplier for software needs that offers frequent code updates.

Supply Chain Attack Pushes Out Malware to More than 250 Media Websites

These aren't quick fixes, but by prioritizing needs based on risk, organizations can incrementally apply these steps to become more resilient.

With new threat actors emerging every day, cybersecurity has become a critical business imperative. Security leaders must stay competitive in a rapidly evolving business landscape while also defending against threats, reducing complexity, and facilitating digital transformation.

To better understand the top concerns among CISOs, Microsoft Security conducted a survey about cyber resilience. Keep reading to uncover our results.

**Embrace the Vulnerability of Hybrid Work and Build Resilience**

Hybrid work has forced businesses of all types into the cloud. As a result, 61% of security leaders said they view the cloud as the digital feature most susceptible to attack, and two out of three believe that hybrid work has made their organizations less secure.

This concern is not unfounded, given that 40% of all attacks in 2021 and half of all cloud attacks significantly impacted businesses. Microsoft’s research revealed that breaches due to cloud misconfiguration are just as common as malware attacks and are even more associated with significant damage to the business.

Securing the cloud is different from securing an internal network and can often be challenging. We recommend leveraging cloud security specialists to avoid administrator errors like misconfiguration and inconsistent implementation of security policies.

**Limit the Impact of Ransomware Attacks**

One in five businesses experienced a ransomware attack in 2021, and roughly one-third of security leaders listed ransomware among their top concerns. And while the financial aspects of ransomware are disruptive, they’re only part of the story. Some 48% of ransomware attack victims in our study reported that attacks caused significant operational downtime, exposure of sensitive data, and reputational damage.

Ransomware attacks come down to three primary entrance vectors: remote desk protocol (RDP) brute force, vulnerable Internet-facing systems, and phishing. Organizations can limit damage by forcing attackers to work harder to gain access to multiple business-critical systems. Zero-trust principles like least-privilege access are especially effective at preventing attacks from traveling across networks and addressing human-operated ransomware.

**Elevate Cybersecurity Into a Strategic Business Function**

An interesting mindset shift is happening among CISOs: A strong security posture should focus on building awareness of the threat landscape and establishing resilience, not on preventing individual attacks.

Microsoft’s survey data supports this line of thinking; 98% of respondents who reported feeling extremely vulnerable to attack were also implementing zero trust, and 78% already had a comprehensive zero-trust strategy in place. Because zero trust assumes a breach and optimizes for resilience rather than protection, respondents who indicated maturity in their zero-trust journey were also more likely to see attacks as an inevitability rather than a preventable threat. And while implementing zero trust does not necessarily result in fewer attacks, it can help reduce the average cost of a breach.

**Maximize Your Existing Resources**

While this data may seem dire, many CISOs are also optimistic about their ability to manage future challenges down the road.

For example, nearly 60% of leaders said they see networks as a vulnerability today. Yet only 40% see the issue persisting two years from now. Likewise, 26% fewer cite email, collaboration tools, and end users as anticipated concerns in 2024 compared with 2022, and roughly 20% fewer see supply chain vulnerability as a top concern. Only operational technology (OT) and Internet of Things (IoT) are expected to be the same or more of a challenge two years from now.

Building on a strong zero-trust foundation, organizations can optimize their existing security investments, like endpoint detection and response, email security, identity and access management, cloud access security broker, and built-in threat protection tools.

**Implement Security Fundamentals**

Today’s CISOs are being asked to do more with less. Security leaders must make the most of their existing resources by setting the right priorities — starting with foundational cyber best practices.

Microsoft estimates that 98% of cyberattacks can be thwarted by basic security hygiene, such as multifactor authentication (MFA), least privilege access, regular software updates, anti-malware, and data protection. Yet only 22% of customers using Microsoft’s cloud identity solution, Azure Active Directory, had implemented strong identity authentication protection as of December 2021.

Strengthening your cyber resilience does not happen overnight. It is a continuous journey that all organizations are on as we move forward in this rapidly changing threat landscape. By prioritizing what needs to be attended to first based on risk, organizations can incrementally apply these five steps to confidently move toward better cyber resiliency.

_Read more Partner Perspectives from Microsoft._

Security Leaders Share 5 Steps to Strengthen Cyber Resilience

Confused economies and rising unemployment rates foster a rich opportunity for cybercrime recruitment.

It's well known that cybercrime has become big business — and not just in terms of the volume but also in how crime syndicates are organizing themselves. As we saw earlier this year with the leak of files from the Conti ransomware group, that organization was operating very much like any other enterprise — it even had an HR lead and a recruitment director. We've also seen how bad actors are actively recruiting internal help with their missions.

Here's one aspect of cybercrime syndicates that's unlike most of their legitimate business counterpoints — economic uncertainty and rising unemployment rates are a boon for them. That's because these factors create a ripe opportunity for ramped-up recruitment efforts.

We're witnessing huge growth in ransomware-as-a-service (RaaS). The ransomware threat continues to adapt with more variants enabled by RaaS; our researchers saw 10,666 different variants in the first half of 2022, compared with just 5,400 in the previous six-month period. Why is this important? Because it underscores just how much easier RaaS is making it for bad actors to operate — they're able to perpetrate attacks faster and at a high rate of scale.

**Recruitment, Recruitment, Recruitment**

One way cybercriminals operate is through the use of "cyber mules" to launder their financial gain. Sometimes these mules know what they're getting into, and sometimes they're lured in under false pretenses. Criminal organizations frequently rely on legitimate-looking job postings on legitimate job-hunting websites. A dubious job ad might refer to the need for a "money transfer agent," a "payment processing agent," or even a role as vague and general as an "administration representative." These job listings and solicitation emails prey on people's desperation by offering what seems to be legitimate employment.

Leaning on insiders within organizations for help is another tactic cybercrime syndicates use for their recruitment efforts. One recent survey found 65% of respondents said they had been approached by bad actors to help with ransomware attacks against the organizations they work for.

With more people and resources, cybercrime organizations will be able to pull off more attacks and organizations need to be aware of this. Recruitment efforts show that ransomware groups are expanding and potentially able to pull off more sophisticated attacks.

**Collaboration to Combat Cybercrime Recruiting**

It takes a global team effort with solid, dependable relationships among cybersecurity stakeholders to defeat international cybercriminal groups. Criminal organizations operate nearly identically to legitimate enterprises. They have costs and profit margins. They may start looking for a new way to make money if they are unable to make a profit in a timely manner because cyber defenders are destroying their infrastructures and making them constantly start over. Cybercrime may start to decline after attackers start to give up out of concern about being discovered and arrested or because they believe the rewards aren't worth the dangers.

The World Economic Forum Partnership Against Cybercrime (PAC) is undertaking one such initiative. To disrupt cybercrime ecosystems, PAC has concentrated on fusing private sector data and digital knowledge with public sector threat intelligence. PAC has long said that breaking down communication barriers and adopting a worldwide strategy will make it simpler to get beyond the factors that protect cybercriminals.

Last year, this private-public partnership introduced the Cybercrime Atlas, a joint research initiative that gathers and compiles data about the cybercriminal ecosystem and the main threat actors active today. Legal authorities will gain from increased visibility into cybercrime operations in their investigations, takedowns, prosecutions, and convictions.

Economic insecurity provides a ripe opportunity for cybercriminals to recruit, and they've gotten so good at it that some unsuspecting job seekers get pulled into their web of evil. Or they go after employees at companies they want to target, hoping for some insider help. Collaboration at the global level combines the strengths and resources of the private and public sectors to give organizations the up-to-date intel they need to protect their networks from increased cybercrime recruitment and its fruits.

Economic Uncertainty Isn't Stopping Cybercrime Recruitment — It's Fueling It

Human-centric security leader will deliver passwordless technology across every major device, browser, and operating system.

**TORONTO, Nov. 3, 2022 /PRNewswire/ —** 1Password, a leader in human-centric security and privacy, today announced the acquisition of Passage, a developer-first passwordless authentication company. 1Password will use Passage's technology to launch a passwordless authentication platform for enterprises – enabling a safer, simpler, and more secure end-user experience across any platform or device.

"1Password is focused on empowering companies and consumers to have safer and simpler digital experiences. As the world evolves, that means helping companies and consumers navigate all the complexities on the path to a passwordless future," said Jeff Shiner, chief executive officer of 1Password. "With today's Passage acquisition, we are committing to giving businesses and end users what they want and deserve: the convenience of passwordless without compromising security."

Together, 1Password and Passage Identity will enable developers, businesses, and consumers to make progress toward a passwordless future by accelerating adoption of passkeys. Passkeys represent the opportunity to replace passwords in favor of more secure and seamless user experiences. With passkeys, the pain of forgotten passwords is a thing of the past, and users minimize exposure to phishing attacks. For businesses, passwordless authentication can improve top- and bottom-line revenue by eliminating forgotten customer passwords and reducing sign-up friction.

"Passwords are ubiquitous, but ever-changing requirements can make them a hassle to use, and that can harm the user experience and cause real ramifications for businesses," said Cole Hecht, co-founder and chief executive officer of Passage. "1Password's market leadership and human-centric mission make them a natural fit to achieve our shared vision of a secure, user-friendly experience that enables businesses to deliver a frictionless and safe experience to users on any device – no QR codes required."

The entire Passage team, including co-founders Cole Hecht (CEO) and Anna Pobletts (CTO), will bring their technical expertise and exclusive focus on passkey authentication to 1Password. The Passage team will continue to focus on developing passkey-first authentication for consumer-facing businesses. This solution will be available in beta in early 2023.

The FIDO Alliance is an open industry association focused on improving authentication standards to minimize password use and improve online security. "Enterprises around the world are rapidly adopting FIDO-based solutions in order to accelerate the journey toward a safer, passwordless future," said Andrew Shikiar, executive director and CMO of the FIDO Alliance. "With the Passage acquisition, 1Password has bolstered their solution offering which stands to help more companies reduce reliance on passwords in favor of user-friendly and unphishable FIDO authentication."

**About 1Password  
**1Password's human-centric security keeps people safe, at work and at home. Our solution is built from the ground up to enable anyone – no matter the level of technical proficiency – to navigate the digital world without fear or friction. The company's award-winning security platform is re-shaping the future of authentication, including passwordless. 1Password is trusted by over 100,000 businesses such as IBM, Slack, Snowflake, Shopify, and Under Armour and protects the most sensitive information of millions of individuals and families across the globe. The company's ultimate goal is to help consumers and businesses get more done in less time – with security and privacy as a given. Learn more at 1Password.com.

1Password Acquires Passage Identity to Power a Passwordless Future

During the 2022 holiday shopping season, US consumers will still be shopping digitally, despite cyberattacks and fraud attempts being top of mind.

**W****ASHINGTON, Nov. 3, 2022 /PRNewswire/ —** Iris® Powered by Generali, provider of a proprietary identity and cyber protection platform, today released the findings of its sixth annual _Holiday Shopping ID Theft_ survey, an annual survey that polls consumers on their holiday shopping habits and the cybersecurity and identity theft concerns they have surrounding their shopping plans. The key findings of this year's survey are listed below:

**Concerns About Data Breaches and Identity Protection Trend Higher**

*   Seven in 10 respondents (71%) express concerns about their personal and financial data being at risk during the holiday shopping season.
    *   Inflation remains the top concern for 69% of respondents, but data privacy remains the number two concern for nearly 40% of Americans.
*   Four in five Americans (82%) say that past data breaches have impacted their willingness to shop with a specific retailer.
    *   Two-thirds of respondents (67%) reported that data breaches would have some impact on their holiday shopping decisions, making them more hesitant to shop with a retailer affected by a data breach.
*   Nearly two-thirds of those surveyed (65%) would feel safer with identity theft protection services baked into a retailer's offering.
    *   Seven in 10 Millennials (72%) are the most likely of any demographic to shop with a retailer that offers identity theft protection services.

**Men and Millennials Most Likely to Spend Big this Holiday Season**

*   30% of men and 39% of Millennial shoppers plan to spend over $1,000 respectively during the holiday season, considerably higher than all other demographics.
*   Two in three shoppers (67%) will spend less than $1,000.
*   Women (73%) are more likely to spend less than $1,000 when compared with men (60%) during this holiday season.

**Online Shopping Remains the Retail King, But Over Half Will Shop at Brick-and-Mortar Stores**

*   Online shopping will account for 85% of consumer buying, remaining consistent with reports from 2021's _Holiday Shopping ID Theft_ survey.
    *   55% of respondents also reported that they plan to shop at brick-and-mortar stores, and in-person shopping numbers rival that of reports from 2017's survey.
*   Nine in 10 Gen Zers (89%), Millennials (91%), and Gen Xers (89%) plan to shop online compared to 79% of Baby Boomers.
    *   Two-thirds of Millennials (68%) and six in 10 Gen Zers/Gen Xers (61%) plan to use a cell phone to shop online, compared with just 31% of Baby Boomers.
*   One in three Americans (33%) trust e-retailers the most with their personal data this holiday shopping season, but nearly as many (29%) consider big box stores the most trustworthy.
    *   Local small businesses (18%) rank third in trustworthiness, followed by department stores (11%).
    *   Only 5% of American consumers trust social media platforms the most with their personal data this holiday shopping season.

**Debit Cards Will be the Primary Method of Payment for Holiday Shopping**

*   Eight in 10 (88%) of respondents reported that they plan to pay with a credit or debit card.
    *   Six in 10 respondents (60%) plan to use debit over credit cards, particularly Gen Z, Millennial, and Gen X shoppers.
    *   Nearly 40% of Millennial and Gen Z shoppers will take advantage of Buy Now, Pay Later apps, while over 40% of Baby Boomers and Gen X shoppers are more likely to use a credit card.

Paige Schaffer, CEO of Iris® Powered by Generali, commented on the findings, "Consumers view protecting their personal and financial data as a top priority this holiday season, and with good reason. Online shopping will still account for the bulk of purchases during the fourth quarter, and recent data breaches of large retailers clearly still weigh heavily on shoppers' minds. Consumers should be taking advantage of the most comprehensive identity theft protection and fraud protection services they can, as a large contingent of respondents (71%) expressed concerns about their personal and financial data being at risk during this holiday shopping season."

**Survey Methodology:**

This survey was conducted via an Online CARAVAN® survey conducted by Big Village among a sample of 1,009 adults ages 18 and older, live from October 10th through the 12th. Respondents were voluntary members of an online panel weighted by five variables – age, gender, geographic region, race, and education – using data from the U.S. Census Bureau to verify the accuracy of the results.

**About Iris® Powered by Generali:**

Iris® Powered by Generali is a B2B2C global identity and cyber protection company owned by the 190-year-old multinational insurance company, Generali, offering always-available identity protection and resolution experts (real people, 24/7/365) and tech-forward solutions that uncomplicate the protection process. Understanding that victimization has no geographical boundaries, we've got a solution no matter your customers' coordinates.

Iris® Powered by Generali Reports Four in Five Americans Less Willing to Shop at Stores With Data Breaches in 2022 Holiday Survey

Investment to advance efforts to detect and mitigate disinformation.

**WASHINGTON and SAN FRANCISCO, Nov. 2, 2022 /PRNewswire/ —** Alethea, a technology company that detects and mitigates disinformation, misinformation, and social media manipulation, raised $10 million Series A, led by Ted Schleinand Kevin Mandia of Ballistic Ventures.

Proceeds will be invested into Alethea's machine learning SaaS platform, Artemis (in closed beta), by growing its engineering and data science teams. Currently in use by household name brands, Artemis conducts multichannel analysis across billions of datapoints to identify disinformation and social media manipulation at its start. As a result, communicators and risk and intelligence teams have the insights they need to protect their brands, bottom lines, and market cap.

"Disinformation is the next iteration of information security, and communicators and risk professionals are on the front lines of protecting their organizations from the information that exists outside their systems," said Lisa Kaplan, Founder and CEO of Alethea. "We've earned our record of alerting customers to the unknown unknowns to help avoid crises. Our incident response capabilities during high-stress periods, such as short-seller attacks, protects our customers. To provide this protection at scale, we created the system that didn't exist – Artemis – to provide tailored insights into the disinformation, misinformation, and social media manipulation ecosystem."

"We have found the right partners with Ted, Kevin, and the Ballistic network to deliver this capability at scale. With the ability to operate in free economies and democracies at stake, we look forward to rapidly scaling our support to customers as they navigate the new digital reality," continued Kaplan.

"Alethea is on the cutting edge of the fight against misinformation, one of the biggest threats to our modern society," said Ted Schlein, Chairman and General Partner of Ballistic Ventures. "We invested in the company because we believe Alethea's proven technology is critical to helping corporations promote access to accurate information and a more secure world."

Alethea was represented by outside counsel, WilmerHale, in the transaction.

**About Ballistic Ventures**

Ballistic Ventures is a venture capital firm solely dedicated to early-stage cybersecurity and cyber-related companies. The founding partners, Kevin Mandia, Barmak Meftah, Ted Schlein, Jake Seid, and Roger Thornton, have spent their entire careers defending against every cyber threat conceivable. Collectively, they have founded, funded, and operated over 90 successful cybersecurity firms, led over 10,000 security professionals globally, and have 40+ years of experience in venture capital. Learn more at ballisticventures.com.

**About Alethea**

Alethea is a technology company helping the Fortune 500, private companies and nonprofits protect themselves from harms stemming from disinformation. Leveraging its multi-channel machine learning platform, Artemis, Alethea detects disinformation narratives across the internet, enabling customers to proactively defend against this pervasive threat. With Artemis-powered early detection, Alethea customers can protect their reputations, key assets, physical safety and market value. The company was founded in 2019 and is woman-owned. Learn more at www.aletheagroup.com.

Source

DARKReading