New release extends best-in-class coverage of identity vulnerability discovery and remediation.

NEW YORK and TEL AVIV, Israel, Oct. 25, 2022 /PRNewswire/ — Illusive, a leader in identity threat detection and response (ITDR), today announced the release of its enhanced ITDR solution, enabling organizations to protect privileged identities, which are at risk of cyberattack and regulatory non-compliance. Account takeover attacks, which evade traditional detection and reduce attack dwell time to days instead of months, have become the top vector of cyberattacks.

According to Gartner®, "Deploying and maturing ITDR is a crucial security best practice."

Illusive's ITDR solution, Illusive Spotlight™ and Illusive Shadow™, enables the comprehensive discovery of the unmanaged, misconfigured and exposed identity risks that leave every organization vulnerable to attack. It delivers aggregated, prioritized and contextualized insights into identity risks, so that security teams can focus on responding to their greatest risks first. Further, the solution fully automates remediation where there is no risk to business impact.

Illusive's agentless approach scans directory structures (e.g., Active Directory), privileged access management (PAM) solutions (e.g., CyberArk, Delinea), endpoints, servers and services, revealing the gaps between the intention of an organization's identity security policies and the reality of their environment. Illusive prevents attacks by taking away what attackers need to succeed: privileged account access.

New features and benefits in Illusive's ITDR solution include:

*   **MITRE ATT&CK Risk Correlation** – Associate identity risk factors to MITRE ATT&CK tactics, techniques and sub-techniques. Dashboard-level information indicating an aggregate view of the percentage of identities vulnerable to any specific attacker tactics, such as initial access, privilege escalation or credential access, which can be drilled down into the individual identities for an aggregated view of risk.
*   **Kerberoastable Accounts** – Discover and remediate misconfigured Active Directory accounts with vulnerable Kerberos tickets that can be exploited by attackers to brute force credentials.
*   **Active Directory Domains & Trusts** – A graphical visualization of Active Directory forests, domains and trusts reveals misconfigurations that could enable an attacker to move between domains.
*   **ServiceNow Integration** – Integrate with ServiceNow to create identity-based incident tickets to facilitate identity risk resolution in the ServiceNow Incident module from within the Illusive console.
*   **Delinea Centrify Integration** – Connect with Delinea Centrify vault to continuously discover unmanaged accounts.
*   **Azure AD Privilege Classification** – Classify Azure AD user privileges based on automatically collected evidence, such as directory or subscription level privileged roles.

**About Illusive**

lllusive continuously discovers and automatically mitigates privileged identity risks that are exploited in all ransomware and other cyberattacks. Despite best-practice investments to protect identities, including deployment of PAM and MFA, 1 in 6 enterprise endpoints holds exploitable identity risks.

Illusive makes it easy for security teams to get visibility into the vulnerable identities sprawled across an organization's endpoints and servers, then eliminate them or deploy deception-based detection techniques as a compensating control to stop attackers. Illusive has participated in over 140 red team exercises and has never lost one!

Founded by nation state attackers, Illusive's technology is trusted by large global financial companies, retailers, services organizations, and pharmaceutical companies.

Illusive's Identity Threat Detection and Response (ITDR) Solution Protects Privileged Accounts

**BURLINGTON, Mass., October 24, 2022 —** Aware, Inc. (NASDAQ: AWRE), a leading authentication company applying proven and trusted adaptive authentication to solve everyday business challenges with biometrics, disrupted the industry today with the introduction of its newest product, AwareID™. Gone are the days when advanced security was only available to those organizations with large budgets, deep IT teams and time to spare. AwareID combines the historically-disjointed best practices behind identity verification, multi-factor authentication and multi-modal biometrics into a single, low-code platform that is pre-configured for the most common use cases and is functional right from the start.

“We know that the increased frequency of data breaches, the rising rate of fraud and the introduction of government regulations and mandates have driven organizations from all industries to look for security solutions that promise protection,” commented Bob Eckel, president and CEO of Aware. “The problem is, what they find when they go looking is a plethora of products from a variety of providers that all need to be technically integrated and multi-sourced to make a complete offering. This sourcing and integration takes time, money and advanced technical knowledge—thus preventing any organizations that don’t have those resources available from deploying the level of security they need. With AwareID, we’re making the latest in next-generation authentication available to the masses.”

Pre-configured for the most common use cases, and positioned at an affordable price point, AwareID tackles onboarding and authentication to help organizations of all sizes improve their security posture while enhancing the end-user experience. Non-IT professionals can protect their organization through AwareID’s intuitive, easy-to-use, low-code administrative platform. For those organizations that do have deep technical expertise, IT teams can override the pre-configuration and scale the realm of possibilities to fine tune for unique requirements—or to simply develop internal workflows and/or trade secrets to drive differentiation for their organization and offerings.

“From a consumer perspective we know that users are fed up with passwords, as reiterated in our recent survey. From a customer perspective, we know organizations are struggling to piece together disparate technology in an attempt to find the right balance of friction and security,” says Craig Herman, chief revenue officer at Aware. “AwareID takes the burden off the customer’s organization and provides a functional offering that can be deployed in a matter of minutes versus months, and at a fraction of the cost of existing piecemeal solutions.”

Aware is leveraging its 25+ years of proven implementation expertise and converging machine learning, artificial intelligence and biometrics to provide a next-generation authentication platform that aligns with the needs of organizations and protects identities against newly-emerging attack vectors. AwareID’s scalability and open environment allow it to continue to adapt to enterprise needs and the changing security landscape, giving Aware’s customers an edge they can’t find anywhere else.

To learn more about how AwareID can help your organization—and how you can bring trusted technology deployed within more than 20 countries, more than 80 government agencies (including within 12 of the 15 major Departments in the U.S. Federal Government), and more than 100 commercial leaders to your company—visit awareid.com.

**About Aware**  
Aware is a global authentication company that validates and secures identities using proven and trusted adaptive biometrics. Aware’s software and software-as-a-service offerings address the growing challenges that government and commercial enterprises face in knowing, authenticating and securing individuals through frictionless and highly secure user experiences. Aware’s algorithms are based on the most diverse data sets in the world and can be tailored to the unique security and requirements of each customer. The company empowers users to have control over identities through clear, intuitive opt-in/opt-out features, helping them feel secure and improving their lives. Aware is a publicly held company (Nasdaq: AWRE) based in Burlington, Massachusetts. To learn more, visit https://www.aware.com or follow Aware on Twitter @AwareBiometrics.

**Safe Harbor Warning**  
Portions of this release contain forward-looking statements regarding future events and are subject to risks and uncertainties, such as the projected benefits and success of AwareID, and the growth of the biometrics markets. Aware wishes to caution you that there are factors that could cause actual results to differ materially from the results indicated by such statements.

Risk factors related to our business include, but are not limited to: i) our operating results may fluctuate significantly and are difficult to predict; ii) we derive a significant portion of our revenue from government customers, and our business may be adversely affected by changes in the contracting or fiscal policies of those governmental entities; iii) a significant commercial market for biometrics technology may not develop, and if it does, we may not be successful in that market; iv) we derive a significant portion of our revenue from third party channel partners; v) the biometrics market may not experience significant growth or our products, including AwareID, may not achieve broad acceptance; vi) we face intense competition from other biometrics solution providers; vii) our business is subject to rapid technological change; viii) our software products may have errors, defects or bugs which could harm our business; ix) our business may be adversely affected by our use of open source software; x) we rely on third party software to develop and provide our solutions and significant defects in third party software could harm our business; xi) part of our future business is dependent on market demand for, and acceptance of, the cloud-based model for the use of software: xii) our operational systems and networks and products may be subject to an increasing risk of continually evolving cybersecurity or other technological risks which could result in the disclosure of company or customer confidential information, damage to our reputation, additional costs, regulatory penalties and financial losses; xiii) our intellectual property is subject to limited protection; xiv) we may be sued by third parties for alleged infringement of their proprietary rights; xv) we must attract and retain key personnel; xvii) our business may be affected by government regulations and adverse economic conditions; xviii) we may make acquisitions that could adversely affect our results, xix) we may have additional tax liabilities; and xx) we believe the effects caused by the COVID-19 pandemic may have an adverse impact on our revenue over the next several quarters.

We refer you to the documents Aware files from time to time with the Securities and Exchange Commission, specifically the section titled Risk Factors in our annual report on Form 10-K for the fiscal year ended December 31, 2021 and other reports and filings made with the Securities and Exchange Commission.

AwareID™ Offers Lightning-Fast Identity Verification, Multi-Factor Authentication and Multi-Modal Biometrics in a Single Low-Code platform

Passkeys are designed to replace passwords and allow seamless logins for consumers across devices and platforms.

SAN JOSE, Calif., Oct. 24, 2022 /PRNewswire/ — Today, PayPal announced it is adding passkeys as an easy and secure log in method for PayPal accounts. Passkeys are a new industry standard created by the FIDO Alliance and the World Wide Web Consortium that replace passwords with cryptographic key pairs, offering customers a simple and secure way to log in to PayPal based on technology that is resistant to phishing and designed so that there is no shared passkey data between platforms. The new PayPal log in option will first be available to iPhone, iPad, or Mac users on PayPal.com and will expand to additional platforms as those platforms add support for passkeys.

A founding member of the FIDO Alliance, PayPal is one of the first financial services companies to make passkeys widely available to its users. This cutting-edge security standard is significant as passkeys address one of the biggest security problems on the web, which is the weakness of password authentication. Over 2.6 billion records were hacked in 2017 and of these hacks, 81% are estimated to have been caused by password stealing and guessing1. Many consumers recycle passwords across online services, which can not only be cumbersome but can also lead consumers to reuse the same, potentially vulnerable passwords across services. Passkeys are designed to replace passwords for an even more seamless and secure login experience with PayPal.

Passkeys will also help more consumers complete their purchases with PayPal - once PayPal users create a passkey, they won't have to remember their password, allowing them to check out with greater ease. According to a recent survey of U.S. consumers, 44% of consumers have abandoned an online purchase because they forgot a password.2

"Launching passkeys for PayPal is foundational to our commitment to offering our customers safe, secure and easy ways to access and manage their daily financial lives," said Doug Bland, SVP and GM, Head of Consumer, PayPal. "We are excited to provide our customers a more seamless checkout experience that eliminates the risks of weak and reused credentials and removes the frustration of remembering a password. We are making it easier for customers to shop online."

**How to Create a PayPal Passkey**

Creating and using a passkey with PayPal is a quick and easy process on an Apple device. Once created, passkeys are synced with iCloud Keychain, ensuring a strong, private relationship between a customer and their device, and an easy sign-in experience for PayPal users with devices running iOS 16, iPadOS 16.1, or macOS Ventura.

*   Once existing customers log in to PayPal with a browser on desktop or mobile web using their existing PayPal credentials such as a username and password, they will have the option to "Create a passkey."
*   Customers will then be prompted to authenticate with Apple Face ID or Touch ID. Then the passkey will be automatically created, and next time PayPal customers log in, they won't need to use or manage a password again.

**PayPal Passkeys Can Be Used to Log In on Any Device**

If they have devices that don't support passkeys yet, users can still use an iPhone to log in with a PayPal passkey. Users simply scan the QR code that will appear after they enter their PayPal User ID.

PayPal passkeys will start rolling out today to customers in the U.S.. PayPal passkeys will become available in additional countries early in 2023, and on additional technology platforms as they add support for passkeys.

**About PayPal**

PayPal has remained at the forefront of the digital payment revolution for more than 20 years. By leveraging technology to make financial services and commerce more convenient, affordable, and secure, the PayPal platform is empowering more than 429 million consumers and merchants in more than 200 markets to join and thrive in the global economy. For more information, visit paypal.com.

PayPal Introduces More Secure Payments with Passkeys

For organizations struggling to protect a rapidly expanding volume of IoT devices, IoT fingerprinting could help with security and management.

The growing ecosystem of Internet of Things (IoT) devices, from basic IP phones and printers to more sophisticated hardware like medical devices and manufacturing equipment, requires a more comprehensive approach to IoT security.

However, businesses are struggling to adequately protect IoT devices. A July report from Barracuda Networks found 93% of organizations surveyed had failed IoT security projects. The survey also found many firms face significant challenges regarding implementation, including basic cyber hygiene.

IoT devices have proliferated because they solve a lot of problems for users, but, unfortunately, the companies that make IoT devices have been traditionally unconcerned with security. The devices often ship with known vulnerabilities (e.g., blank admin password), they are difficult to patch when vulnerabilities are found, and these headless devices are difficult to monitor as you would a laptop, especially since they don't self-identify on the network.

Organizations could turn to IoT fingerprinting to shore up device security. An IoT device fingerprint is essentially information collected about the hardware of an IoT device for the purpose of identifying its make, model, manufacturer, operating system, or device type.

**Moving to a Cloud-Native Approach**

Network and endpoint security startup Portnox recently expanded its IoT fingerprinting and profiling capabilities with a cloud-native platform for midmarket and enterprise businesses. The platform offers profiling and access control and is built to enhance zero-trust security models with no on-premises footprint.

"Without fingerprinting and profiling capabilities, all IoT devices effectively look the same or simply like an unidentifiable device," explains Portnox CEO Denny LeCompte. "All these challenges make IoT devices an attractive target for threat actors, and rightly so, as most IT teams have found shadow IoT on the network."

These shadow IoT devices are connected to the network, but the organizations have no clear visibility into or control over them.

"An attacker could enter the network through an IoT device as a part of a botnet for a denial-of-service attack, or they could use it as a stepping stone to get to more valuable devices," he explains.

While other vendors like Forescout, Cisco, and Aruba offer on-premises IoT fingerprinting platforms, LeCompte maintains that a cloud-native solution can deliver a "radically simpler deployment and management experience," enhanced security that places the onus for patching on the vendor, and a generally lower total cost of ownership.

"Organizations are shifting more and more critical security capabilities to the cloud to save on either capital or operational costs," LeCompte says. "This generally aligns with a 'do more with less' — or even 'do more with the same' — operational mindset."

**Factoring in Zero Trust**

For businesses looking to deploy an IoT fingerprinting approach as part of their security strategies, LeCompte says it's important to prioritize the solution for zero-trust security.

In theory, this would mean not allowing any IoT device onto the network if the organization is trying to legitimately institute zero trust. "That simply isn't an option from an operational standpoint, however," he adds.

LeCompte also points out that active profiling methods can place a significant burden on the IoT devices in use across the network. With passive methods, the platform pulls information that is available on the device itself or from other devices on the network.

Many IoT devices are often not prepared to perform their tasks and become overloaded with signals, which could render them ineffective or useless. "As such, it's preferred to rely on passive profiling methods, such as MAC address clustering or DHCP gleaning," he says.

LeCompte predicts that IoT fingerprinting will continue to evolve in response to innovation in IoT and the increased sophistication of cybercriminals. He notes that his company is investigating the use of fingerprinting information to bring robust security to the traditionally insecure MAC Address Bypass (MAB) devices, as well as to provide agentless risk assessment information by tapping into vulnerability and Common Vulnerabilities and Exposures (CVE) databases.

"IoT fingerprinting represents a huge gap closure with respect to zero-trust security models," he explains. "Without accurate profiling data on IoT devices, organizations simply can't confidently know what IoT devices are on their network."

IoT Fingerprinting Helps Authenticate and Secure All Those Devices

Burnout has led one-third of cybersecurity staffers to consider changing jobs over the next two years, potentially further deepening the talent shortage, research shows.

The stress and strain of cyberattacks on the staff tasked with protecting businesses is driving droves of desperately needed security practitioners to rethink their roles.

New research from Mimecast reveals a huge mental health toll being exacted from cybersecurity professionals with every ransomware, data theft, or other cybersecurity incident.

More than half (54%) of those surveyed told researchers ransomware attacks have put a strain on their mental health, while a full 56% say their job gets harder with each passing year.

The constant barrage of attacks has also eroded a feeling of personal responsibility when an attack is successful. For comparison, Mimecast reported that last year 71% of respondents said they would "feel very personally responsible" for a successful breach — this year it was only 57%.

"With the profession facing a pressure cooker of ongoing attacks, disruption, and burnout, it’s critical that organizations support security teams by giving cyberattacks the focus and resources needed — or face losing critical employees," according to Mimecast's State of Ransomware Readiness 2022: Reducing the Personal and Business Cost report.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Stress Is Driving Cybersecurity Professionals to Rethink Roles

Two flaws in the popular developer cloud platform show how weaknesses in authorization functions and SaaS flaws can put cloud apps at risk.

Two vulnerabilities in Atlassian Jira Align, an agile planning software-as-a-service (SaaS) tool, could allow users with access to the service to become application administrators, and then attack the Atlassian service.

That's according to cybersecurity services firm Bishop Fox, which said in an advisory today that the vulnerabilities typify the risks posed to cloud services by relatively well-known, but often hard to catch, flaws. 

The two vulnerabilities found by Bishop Fox affect the Jira Align application, which is used to set agile-development goals, track efforts toward those goals, and create agile strategies. Because every instance of Jira Align is provisioned by Atlassian, an attacker could gain control of a part of the company's cloud infrastructure, Bishop Fox stated.

One vulnerability, a server-side request forgery (SSRF), could allow a user to retrieve "the AWS credentials of the Atlassian service account that provisioned the Jira Align instance," according to Bishop Fox.

The second vulnerability — in the authorization mechanism for users with the People role — could allow those users to elevate their role to Super Admin, which has access to all settings for the Jira Align tenant, such as resetting accounts and modifying settings.

The combination of the two flaws could allow a significant attack, says Jake Shafer, a security consultant with Bishop Fox, who found the flaws.

"Using the authorization finding would allow a low-privileged user to elevate their role to super admin which, in terms of information disclosure, would allow the attacker to gain access to everything the client of the SaaS had in their Jira deployment," he says. "From there, the attacker could then leverage the SSRF finding to go after the infrastructure of Atlassian themselves."

Both vulnerabilities have been patched — the first within a week and the second within a month, according to the disclosure timeline published by Bishop Fox.

However, companies should note that the increasing reliance on cloud applications has made attacks on cloud services and workloads much more common, so much so that the top class of vulnerability, according to the Open Web Application Security Project (OWASP), is broken authentication and access-control issues.

Furthermore, authorization issues are difficult for automated tools to pinpoint; plus, SSRF is a relatively new class of vulnerability that uses a cloud service's functionality and servers to conduct attacks, often bypassing security at the network edge as well as some internal security measures. 

Atlassian's Jira software has already had to deal with other instances of server-side request forgery, but the company is not alone. In 2019, a former Amazon Web Services used a SSRF vulnerability to steal data from financial firm Capital One.

**How to Combat Cloud Security Bugs**

With cloud services becoming part of operations for the vast majority of companies, tackling the top cloud vulnerabilities is critical, Shafer says.

"With the prevalence of how integrated these SaaS applications have become in the day-to-day operations of small and large companies, it’s important to remember that even these well-established companies can make mistakes," he says. "Trust but verify for all new software you’ll have to be reliant on, especially something as entrenched in the tech."

These most recent vulnerabilities highlight that developers should always make sure to double-check content supplied by users before completing a request, Shafer says. Additional input-sanitization checks could prevent both attacks.

"You're allowing customers into your cloud infrastructure, they may be paying for the service but at the end of the day they should be considered just as untrusted as a potential attacker," he says.

Companies should make sure to either manually test third-party applications or reach out to the cloud provider and check the results of their security assessments. Unfortunately, automated tools are not great at discovering authorization issues, Shafer says.

"These tools rely on a set of instructions or guidelines for what to look for and dealing with authorization issues will be different for every single piece of software out there," he says. "It’s very difficult to establish a set of rules that a scanner can pick up on and say 'Hey, user X shouldn’t be able to do Y in the context of this specific functionality.'"

Shafer lauded Atlassian's response, saying the company "did all the right things." Atlassian did not provide a comment by publishing time.

Atlassian Vulnerabilities Highlight Criticality of Cloud Services

A CISA advisory warns that the Daixin Team ransomware group has put the US healthcare system in its crosshairs for data extortion, and provides tools to fight back.

Daixin Team has actively targeted the US Healthcare and Public Health (HPH) sector since last June, according to a joint advisory issued by the FBI, Cybersecurity and Infrastructure Agency (CISA), and the Department of Health and Human Services (HHS), which provides indicators of compromise (IoCs) and tactics techniques and procedures (TTPs). 

Third-party investigations revealed that the Daixin Team ransomware is based on Babuk Locker source code, targets VMware EXSi servers and encrypts files, the advisory said. 

Officials believe the Daixin Team uses phishing campaigns to steal VPN credentials, and exploits.

"Daixin actors gain initial access to victims through virtual private network (VPN) servers. In one confirmed compromise, the actors likely exploited an unpatched vulnerability in the organization’s VPN server," the advisory explained. "In another confirmed compromise, the actors used previously compromised credentials to access a legacy VPN server that did not have multifactor authentication (MFA) enabled." 

The FBI reported that as of October, the HPH sector makes up a full 25% of ransomware complaints filed to its Internet Crime Complaint Center, and accounted for the most overall ransomware reports during 2021. 

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Ransomware Barrage Aimed at US Healthcare Sector, Feds Warn

Affiliation adds new all-source and counterintelligence, cyber, software development, and identity intelligence capabilities to SilverEdge's growing suite of technology solutions focused on the US intelligence community.

**RESTON, Va., Oct. 24, 2022, (****BUSINESS WIRE****)** — SilverEdge Government Solutions (“SilverEdge”) today announced it has partnered with Counter Threat Solutions, LLC (“CTS”), a leading provider of all source and counterintelligence analysis, identity intelligence, and enterprise IT and data management solutions, which include sophisticated software development and engineering and niche ServiceNow capabilities. The partnership furthers SilverEdge’s objective of serving as the cyber, software, intelligence, and technology solutions provider of choice for the U.S. Intelligence Community (“IC”).

“We are excited to welcome the CTS team to the SilverEdge family,” said Robert Miller, CEO of SilverEdge. “By combining CTS’ capabilities with SilverEdge’s existing cybersecurity, software, and intelligence solutions, we are increasing our cleared workforce to approximately 450 engineers and technical staff whose primary focus is to provide our intelligence customers with the tools required to support critical mission needs."

Founded in 2015 and based in Reston, Virginia, CTS provides technology solutions and related services to key U.S. intelligence agencies. Led by CEO Theresa Keith, a U.S. Army intelligence veteran with more than 20 years of experience in the IC, CTS employs more than 100 technical and mission support specialists, nearly 100% of whom hold high-level security clearances. The company will continue to operate with its current leadership under the SilverEdge platform.

Theresa Keith said, “We are thrilled to be joining SilverEdge, whose tremendous resources, qualified team, and extensive capabilities will enable us to continue to grow our business rapidly and provide additional opportunities for our people. Our team looks forward to working together as part of SilverEdge, contributing our specialized expertise to expand our shared capabilities, and growing our talent pool to serve national security interests and our IC customers.”

Douglas T. Lake Jr., Founder & Managing Partner at Godspeed, remarked, “The addition of CTS to SilverEdge’s comprehensive suite of offerings further enhances the growth potential of the platform as it continues to scale into the leading technology and cybersecurity solutions provider for critical U.S. Intelligence agencies and select mission-oriented Department of Defense customers.”

Nathaniel Fogg, Partner at Godspeed, added, “Following SilverEdge’s recent acquisition of QVine, bringing CTS on board alongside will help to further bolster our commitment to the Intelligence Community. We welcome Theresa and her team to SilverEdge and are excited to be partnering with them.”

CTS was advised by the McLean Group. Latham & Watkins LLP acted as legal advisor to Godspeed.

**About Counter Threat Solutions**

Counter Threat Solutions, LLC (“CTS”) is a leading technology services and solutions company providing mission-focused subject matter experts in all source and counterintelligence analysis, enterprise IT and data management, and identity intelligence services to the U.S. intelligence and defense communities. Learn more about CTS at www.ctstruenorth.com.

**About SilverEdge**

SilverEdge is a next-generation provider of innovative and proprietary cybersecurity, software, and intelligence solutions for the Defense and Intelligence Communities. SilverEdge’s seasoned team of cybersecurity experts, software developers and engineers, and intelligence analysts identify tomorrow’s challenges today and work to empower America’s defenders with the tools and solutions needed to address our National Security Community’s toughest challenges. SilverEdge is based in Columbia, MD. For more information, please visit the SilverEdge website at www.silveredge-gs.com.

**About Godspeed Capital**

Godspeed Capital is a lower middle-market Defense & Government services, solutions, and technology focused private equity firm investing alongside forward-thinking management teams that seek an experienced and innovative investment partner with unique sector expertise, operational insight, and flexible capital for growth. While a typical investment will involve companies generating approximately $3 million to $30 million of EBITDA, Godspeed Capital has significant support to complete larger transactions through strategic co-invest relationships. The firm focuses on control buyouts, buy-and-builds, corporate carve-outs, and special situations. For more information, please visit the Godspeed Capital website at www.godspeedcm.com.

Godspeed Capital-Backed SilverEdge Partners with Counter Threat Solutions

Comprehensive CNAPP coverage for Kubernetes and containers in a single solution.

**WALTHAM, Mass., Oct. 24, 2022 /PRNewswire/** — Uptycs, provider of the first unified CNAPP and XDR solution, today announced enhanced Kubernetes and container security capabilities. These new features provide threat detection for container runtime correlated with the Kubernetes control plane attacks alongside scanning of container images in registries for vulnerabilities, malware, credentials, secret keys, and other sensitive information.

According to the latest Cloud Native Computing Foundation survey, 96% of organizations are either using or evaluating Kubernetes — the highest percentage since the surveys began in 2016.1 Yet many organizations are not prepared to detect threats against these new deployments. "Kubernetes-orchestrated clusters are essentially 'clouds within clouds.' The monitoring and visibility of the Kubernetes logs, network flows and application behaviors within the cluster should be baselined and analyzed for indications of compromise," recommends Gartner.2

Organizations can detect attacks against their Kubernetes deployments by adopting a shift up approach to cybersecurity, in which telemetry emanating from Kubernetes clusters and containers, laptops, and cloud services is normalized at the point of collection, but processed, correlated, and analyzed in a data lake.

Unlike siloed endpoint and cloud security solutions, Uptycs protects the entire arc of cloud-native application development, from the developer's laptop to container runtime. "Threat actors know a developer's laptop is often just one hop away from cloud infrastructure," said Ganesh Pai, co-founder and CEO of Uptycs. "Uptycs correlates risk signals from the modern attack surface for lightning-fast, contextualized detection and response. We do this with our unique, telemetry-powered approach and Detection Cloud. It's a shift up approach to cybersecurity that brings together multiple teams and types of IT infrastructure into a unified data model and UI."

"Our security team is organized around six domains, including threat detection and response, risk and compliance, application security, data security, infrastructure security, and enterprise security," said Anwar Reddick, Director of Information Security at Greenlight Financial. "Having a single solution like Uptycs that traverses these domains, and contextualizes threat activity across multiple asset types like Kubernetes, cloud services, and laptops improves cross-domain collaboration and insights. As a result, we've dramatically shortened our threat investigation time."

New Kubernetes and container runtime security features include:

*   **Kubernetes threat detections** — Combines anomalous Kubernetes actions with actions on a granular container lever, Uptycs is able to observe in real-time and store the behavior for investigation; this reduces mean time to detection (MTTD), collects forensic evidence for investigation, and determines the full scope of the incident as it happens
*   **Registry scanning** — Enables the ability to look for vulnerabilities in container images in a registry; Uptycs supports many registries, including AWS ECR, Azure Container Registry, DockerHub, and jFrog Artifactory
*   **Secret scanning** — Provides the ability to look for private keys, credentials, and other secrets stored in container images
*   **NSA/CISA hardening checks** — Ensures that Kubernetes deployments are set up per the updated hardening guidance provided by the U.S. National Security Agency and Cybersecurity and Infrastructure Security Agency. For example, ensuring that pod security and network security policies are in line with guidance

Uptycs fills in security visibility gaps with a single solution to protect container-based applications, whether they are run on-premises or in the cloud, from bare-metal to a serverless deployment. With Uptycs, customers can identify vulnerabilities early in the process, verify secure configurations, ensure compliance posture against standards like CIS benchmarks for Linux and Docker, and continuously monitor the runtime in production.

Uptycs was recognized as a Sample Vendor for Container and Kubernetes Security in the Gartner Hype Cycle for Application Security, 2022 and the Gartner Hype Cycle for Network and Workload Security, 2022. In addition, Uptycs was recognized as a Sample Vendor in the report from Gartner, Emerging Tech: CIEM Is Required for Cloud Security and IAM Providers to Compete.

Uptycs will be at KubeCon + CloudNativeCon from Oct. 24 - 28, 2022 in Detroit, Michigan. To learn more, please stop by booth #G29 or visit: https://www.uptycs.com/lp-kubecon-2022-request-a-meeting

**Resources**

*   Uptycs Live Webinar: Kubernetes and Container Security with Uptycs
*   Blog: Detecting Threats to the Kubernetes Control Plane
*   Self-Guided Product Tour: Uptycs KSPM and CWPP
*   Follow Uptycs on LinkedIn and Twitter
*   Request a demo

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Note: All new features will be available to Uptycs customers in Q4, 2022.

**About Uptycs**

Your developer's laptop is just a hop away from cloud infrastructure. Attackers don't think in silos, so why would you have siloed solutions protecting public cloud, private cloud, containers, laptops, and servers?

Uptycs reduces risk by prioritizing your responses to threats, vulnerabilities, misconfigurations, sensitive data exposure, and compliance mandates across your modern attack surface — all from a single platform, UI, and data model. This includes the ability to tie together threat activity as it traverses on-prem and cloud boundaries, thus delivering a more cohesive enterprise-wide security posture.

Looking for acronym coverage? We have that, too, including CNAPP, CWPP, CSPM, KSPM, CIEM, CDR, and XDR. Start with your Detection Cloud, Google-like search, and the attack surface coverage you need today. Be ready for what's next.

Shift your cybersecurity up with Uptycs. Learn how at: https://uptycs.com

1 Cloud Native Computing Foundation, CNCF Annual Survey, February 2022 https://www.cncf.io/reports/cncf-annual-survey-2021/  
2 Gartner, "How to Make Cloud More Secure Than Your Own Data Center," Neil MacDonald, Tom Croll, April 2021 https://www.gartner.com/document/3970177

**SOURCE:** Uptycs

Uptycs Introduces Detections that Correlate Threat Activity from the Kubernetes Control Plane and Container Runtime

Best-in-class awareness training comes after a marked increase in cybersecurity risks and attacks in 2022.

**PITTSBURGH, Oct. 24, 2022 /PRNewswire/** — Today, Hornetsecurity launches a next-generation Security Awareness Training, to better equip employees to counter cyber-attacks, building on its international reputation as a cybersecurity leader.

Cyber criminals are constantly innovating and attacks are on the rise: Hornetsecurity's 2022 Ransomware Report found that 60% of attacks came from phishing attempts. Many attackers exploit human vulnerability to phishing and fraud, so this new training service integrates the human factor into the cybersecurity cycle — bolstering this weaker link in the defence chain.

**Systems and tools are only as secure as their users**

Even with the best cybersecurity offering in place, there is always room for human error, which is why many cybersecurity insurance providers demand awareness training for employees. The new training from Hornetsecurity highlights the individual's importance in establishing an organisation's human firewall — and how essential each and every employee is in corporate cybersecurity, from prevention to protection, to response and recovery. In doing so, it helps companies establish a sustainable security culture.

**An easy service that helps build a security mindset**

Hornetsecurity's automated training is innovative in that it is simple, rather than maintenance-intensive, for customers. The Awareness Engine is the technological heart of the Security Awareness product, offering bespoke, needs-based training: each user receives as much training as is necessary. Its Patented Spear Phishing Engine simulates sophisticated attacks to build knowledge of attacks.

To measure progress, it uses the Employee Security Index (ESI®) as an industry-wide unique benchmark, constantly measuring and comparing the organization's and employee security behaviour.

It is available via subscription licensing, as a standalone service, or as an addition to Hornetsecurity's email security services, such as 365 Total Protection.

**Training possible thanks to acquisition of IT-Seal**

Hornetsecurity has always seen education as a key part of cybersecurity, providing ebooks, webinars and reports. The acquisition of IT-Seal in May 2022 further expanded Hornetsecurity's education capabilities. Alongside its established email security and backup and recovery solutions, all aspects of the awareness-prevention-detection cycle are now covered.

Commenting on the Security Awareness Training launch, **Daniel Hofmann, Hornetsecurity CEO says:** _"With cyber-attacks on the rise, it's increasingly important for organisations to implement a cybersecurity ecosystem that includes education and robust email security functionality for prevention as well as back up for recovery. Our new offering specifically supports and guards against very human vulnerabilities to phishing and other cyber risks._

_"The Security Awareness Training product adds great value to our portfolio, bringing us closer to our goal of being one-stop vendor for next-gen security, backup and compliance for our partners and customers, with a special focus on Microsoft 365. It has already been implemented by global customers, including BMW Group and FC Bayern Munich._

_"This is part of a very exciting 2022 and 2023 growth pipeline and we're looking forward to continuing this momentum."_

For more information, please click here.

**About Hornetsecurity**

Hornetsecurity is the leading security and backup solution provider for Microsoft 365. Its flagship product is the most extensive cloud security solution for Microsoft 365 on the market, providing robust, comprehensive, award-winning protection: Spam and virus filtering, protection against phishing and ransomware, legally compliant archiving and encryption, advanced threat protection, email continuity, signatures and disclaimers. It's an all-in-one security package that even includes backup and recovery for all data in Microsoft 365 and users' endpoints.

Hornetsecurity Inc. is based in Pittsburgh, PA, with other North America offices in Washington D.C., and Montreal, Canada. Globally, Hornetsecurity operates in more than 30 countries through its international distribution network. Its premium services are used by 50,000+ customers including Swisscom, Telefónica, KONICA MINOLTA, LVM Versicherung, and CLAAS.

**SOURCE:** Hornetsecurity

Source

DARKReading