Application and platform security
Applications and platform security is the basis of preventing vulnerabilities and attacks. Learn the latest about applications attacks, secure software development, patch management, OS security, virtualization, open source security, API security, web app and server security and more.
Top Stories
-
Tip
27 Jun 2025
12 DevSecOps tools to secure each step of the SDLC
DevSecOps tools integrate security throughout development. These 12 options enhance workflows from coding to deployment without slowing teams down. Continue Reading
-
Tip
27 Jun 2025
SBOM formats explained: Guide for enterprises
SBOMs inventory software components to help enhance security by tracking vulnerabilities. Teams have three standard SBOM formats to choose from: CycloneDX, SPDX and SWID tags. Continue Reading
-
Tip
27 Jun 2025
Cybersecurity skills gap: Why it exists and how to address it
The cybersecurity skills shortage is putting enterprises at risk. Worse, it shows no sign of abating. Here is why it's happening and what employers can do to mitigate the problem. Continue Reading
-
Tip
25 Jun 2025
10 remote work cybersecurity risks and how to prevent them
Larger attack surfaces, limited oversight of data use, AI-driven attacks and vulnerable enterprise technologies are among the security risks faced in remote work environments. Continue Reading
-
Tutorial
23 Jun 2025
Update Kali Linux to the latest software repository key
Kali Linux users might encounter errors when they update or download new software, exposing systems to security threats. A new repository key will eliminate those problems. Continue Reading
-
Podcast
18 Jun 2025
Mitigating AI's unique risks with AI monitoring
Coralogix CEO highlights the difference between AI and software monitoring, as illustrated by his company's acquisition and product expansion this year. Continue Reading
-
Feature
18 Jun 2025
TikTok bans explained: Everything you need to know
The United States government takes aim at the viral video sharing application TikTok. Continue Reading
-
Definition
18 Jun 2025
What is an attack surface? Examples and best practices
An attack surface is the total number of possible entry points and attack vectors an organization or system has that are susceptible to unauthorized access. Continue Reading
-
Tip
17 Jun 2025
How to create an SBOM: Example and free template
SBOMs provide an inventory of every component in an organization's software supply chain. Use this free downloadable SBOM template to create one for your organization. Continue Reading
-
Definition
16 Jun 2025
What is HMAC (Hash-Based Message Authentication Code)?
Hash-based message authentication code (HMAC) is a message encryption method that uses a cryptographic key with a hash function. Continue Reading
-
Tip
13 Jun 2025
How to deploy Windows LAPS for tighter security
Microsoft improved the feature that automates local administrator password management in Windows Server and the client OS. This tutorial explains the updates and how to set it up. Continue Reading
-
News
12 Jun 2025
Datadog AI agent observability, security seek to boost trust
As AI agents mature, new tools aim to bolster their reliability and security with fresh visibility into automation workflows and more detailed troubleshooting. Continue Reading
-
News
10 Jun 2025
June Patch Tuesday resolves Windows zero-day
Microsoft fixes 66 bugs, including an actively exploited WebDAV remote-code execution flaw, but the BadSuccessor vulnerability remains unpatched. Continue Reading
-
Guest Post
10 Jun 2025
How to implement effective app and API security controls
Security leaders must implement multilayered strategies combining threat modeling, balanced controls, cloud-first approaches and more to protect apps and APIs from evolving threats. Continue Reading
-
News
03 Jun 2025
HashiCorp Terraform leads IBM, Red Hat integration roadmap
HashiCorp and IBM have begun to knit together products such as Terraform and Ansible and divulged some roadmap details, but a few potential product overlaps are still unresolved. Continue Reading
-
Tip
02 Jun 2025
The DOGE effect on cybersecurity: Efficiency vs. risk
The DOGE effect on security is a complex issue. Pursuit of efficiency might be a legitimate goal, but experts caution it can conflict with cybersecurity defenses. Continue Reading
-
Video
02 Jun 2025
The DOGE effect on cyber: What's happened and what's next?
In this webinar, part of 'CISO Insights' series, cybersecurity experts debate the pros and cons of the Department of Government Efficiency's actions and the impact on their field. Continue Reading
-
News
30 May 2025
Software supply chain security tools take on toil for users
Recent updates from software supply chain security vendors simply take over vulnerability management on behalf of IT orgs, rather than provide facilitating tools. Continue Reading
-
Tip
29 May 2025
Security risks of AI-generated code and how to manage them
Application security teams are understandably worried about how developers use GenAI and LLMs to create code. But it's not all doom and gloom; GenAI can help secure code, too. Continue Reading
-
Tip
28 May 2025
Comparing Windows Hello vs. Windows Hello for Business
Windows Hello allows desktop admins to manage local Windows authentication with new tools, but the difference between the free and business versions is critical for IT to know. Continue Reading
-
Definition
21 May 2025
What is a passkey?
A passkey is an alternative user authentication method that eliminates the need for usernames and passwords. Continue Reading
-
News
19 May 2025
New GitHub Copilot agent edges into DevOps
The GitHub Copilot coding agent can take on toilsome tasks such as bug fixes and code reviews with its own GitHub Actions pull requests. Continue Reading
-
News
16 May 2025
News brief: Patch critical SAP, Samsung and chat app flaws now
Check out the latest security news from the Informa TechTarget team. Continue Reading
-
Definition
16 May 2025
What is risk appetite?
Risk appetite is the amount of risk an organization or investor is willing to take in pursuit of objectives it deems have value. Continue Reading
-
Definition
14 May 2025
What is penetration testing?
A penetration test, also called a 'pen test,' is a simulated cyberattack on a computer system, network or application to identify and highlight vulnerabilities in an organization's security posture. Continue Reading
-
News
13 May 2025
Microsoft tackles 5 Windows zero-days on May Patch Tuesday
The company addresses 72 unique CVEs this month, but several AI features bundled in a larger-than-usual update could bog down some networks. Continue Reading
-
Tip
07 May 2025
10 leading open source application security testing tools
Security testing enables companies to discover and remediate vulnerabilities and weaknesses in apps before malicious actors find them. Continue Reading
-
News
02 May 2025
Independent lab crowns new WAAP product among its leaders
An API security specialist's newly launched WAAP product outranked more established WAF competitors during independent benchmark testing. Continue Reading
-
News
24 Apr 2025
Software supply chain security AI agents take action
Three software supply chain security vendors join the AI agent trend that is sweeping tech, as AI-generated code threatens to overwhelm human security pros. Continue Reading
-
Opinion
22 Apr 2025
3 EUC security topics I'll be looking for at RSAC 2025
There will be a ton of security topics that RSA Conference-goers can check out, but IT admins should be aware of three common themes surrounding email and endpoints. Continue Reading
-
News
22 Apr 2025
Docker plans Model Context Protocol security boost
Docker said it plans new tools integrating the emerging agentic AI standard protocol into existing workflows, including security controls. Continue Reading
-
Tip
18 Apr 2025
Try these strategies to modernize Windows workloads
Legacy applications create tough choices for admins who must balance business needs and security. This article covers these challenges and modernization strategies. Continue Reading
-
News
18 Apr 2025
Availity eyes GitLab Duo with Amazon Q for code refactoring
The healthcare network's release engineering team is testing the new AI agent pairing to help with code consolidation, modernization and risk mitigation. Continue Reading
-
Definition
16 Apr 2025
What is Pretty Good Privacy and how does it work?
Pretty Good Privacy, or PGP, was a popular program used to encrypt and decrypt email over the internet, as well as authenticate messages with digital signatures and encrypted stored files. Continue Reading
-
News
09 Apr 2025
Exploited Windows zero-day addressed on April Patch Tuesday
Microsoft delivers fixes for 121 vulnerabilities with 11 rated critical this month. Admins will have extra mitigation work to correct three flaws. Continue Reading
-
Tip
04 Apr 2025
Generative AI security best practices to mitigate risks
When tackling AI security issues, enterprises should minimize shadow IT risks, establish an AI governance council and train employees on the proper use of AI tools. Continue Reading
-
News
02 Apr 2025
Model Context Protocol fever spreads in cloud-native world
The Anthropic-led spec for AI agent tool connections gains further momentum this week, with support from cloud-native infrastructure vendors such as Kubiya and Solo.io. Continue Reading
-
Opinion
01 Apr 2025
How ESET is using AI PCs to boost endpoint security
While AI PCs show legitimate promise, the rock-solid use cases haven't been as prominent. However, security vendor ESET is showing more concrete applications of this technology. Continue Reading
-
Tip
28 Mar 2025
Follow Patch Tuesday best practices for optimal results
Microsoft releases most security updates on Patch Tuesday, a day that brings anxiety to many sys admins. Learn how to develop a strategy to test and deploy these fixes. Continue Reading
-
Opinion
27 Mar 2025
What the $32B Google-Wiz deal says about cloud-native security
Google's acquisition of Wiz for $32 billion highlights the importance of cloud-native security as organizations transition to microservices and containerization. Continue Reading
-
Tip
21 Mar 2025
Does using DeepSeek create security risks?
The Chinese AI chatbot, despite its efficiency and customizability, raises serious concerns about data privacy, censorship and security vulnerabilities for business users. Continue Reading
-
Tip
20 Mar 2025
13 API security best practices to protect your business
APIs are the backbone of most modern applications, and companies must build in API security from the start. Follow these guidelines to design, deploy and protect your APIs. Continue Reading
-
Feature
20 Mar 2025
3 types of deepfake detection technology and how they work
Think you're talking to your boss on Zoom? You might want to think again. Deepfake technology has already cost enterprises millions of dollars. Here's how to fight fire with fire. Continue Reading
-
Opinion
20 Mar 2025
How to sideload iOS apps and why it's dangerous
IT professionals might think the hassle of jailbreaking a device deters users from sideloading iOS apps. Learn the other methods users turn to and why it's still dangerous. Continue Reading
-
Tip
19 Mar 2025
The Microsoft patch management guide for admins
Microsoft recently added WSUS to its deprecation list. Now that the battle-tested patch management tool's days are numbered, what are the alternatives from the company? Continue Reading
-
Definition
18 Mar 2025
What is security by design?
Security by design is an approach to software and hardware development that seeks to make systems as free of vulnerabilities and impervious to attack as possible through such measures as continuous testing, authentication safeguards and adherence to best programming practices. Continue Reading
-
Answer
18 Mar 2025
How do competition laws affect Apple's sideloading policies?
The EU's Digital Markets Act has caused Apple to allow sideloading in certain regions. This change could have broader effects on Apple's operations, mobile security and IT teams. Continue Reading
-
News
17 Mar 2025
GitHub Actions supply chain attack spotlights CI/CD risks
Experts say a GitHub Actions vulnerability should renew enterprises' attention to securing build pipelines the same way they secure production environments. Continue Reading
-
Tip
17 Mar 2025
5 fundamental strategies for REST API authentication
Implementing an effective REST API authentication strategy can help protect users and their data while maintaining a seamless data exchange across boundaries. Continue Reading
-
Definition
17 Mar 2025
What is a buffer overflow? How do these types of attacks work?
A buffer overflow occurs when a program or process attempts to write more data to a fixed-length block of memory, or buffer, than the buffer is allocated to hold. Continue Reading
-
Tip
14 Mar 2025
How to secure AI infrastructure: Best practices
AI tools are creating an even greater attack surface for malicious hackers to penetrate. But there are steps you can take to ensure your organization's AI foundation remains safe. Continue Reading
-
Tip
13 Mar 2025
How to build an application security program
A well-defined application security program that includes multilayer software testing, SBOMs, and documentation and standards is vital to protect apps from threat actors. Continue Reading
-
News
11 Mar 2025
March Patch Tuesday fixes 6 Windows zero-day exploits
All the vulnerabilities that had been actively exploited in the wild will get resolved quickly by deploying the Windows cumulative update for this month. Continue Reading
-
Feature
11 Mar 2025
Incident response for web application attacks
Web app security is like learning to ride a bike -- expect to struggle before getting it right. But don't be disheartened; learn from prior incidents to improve controls. Continue Reading
-
Definition
11 Mar 2025
What is a rootkit?
A rootkit is a program or a collection of malicious software tools that give a threat actor remote access to and control over a computer or other system. Continue Reading
-
News
28 Feb 2025
Microsoft targets AI deepfake cybercrime network in lawsuit
Microsoft alleges that defendants used stolen Azure OpenAI API keys and special software to bypass content guardrails and generate illicit AI deepfakes for payment. Continue Reading
-
Tip
28 Feb 2025
Why and how to create Azure service principals
Service principals are a convenient and secure way to protect Azure resources. Follow this step-by-step guide to create a service principal that defends vital Azure workloads. Continue Reading
-
News
27 Feb 2025
FBI: Lazarus Group behind $1.5 billion Bybit heist
Researchers say the heist, in which North Korean state-sponsored hackers stole funds from a cold wallet, is the biggest theft in the history of the cryptocurrency industry. Continue Reading
-
Definition
27 Feb 2025
What is a domain controller?
A domain controller is a server that processes requests for authentication from users and computers within a computer domain. Continue Reading
-
Tip
26 Feb 2025
How to improve third-party API integration security
External API integrations are critical, but so is managing third-party API risks to maintain customer trust, remain compliant and ensure long-term operational resilience. Continue Reading
-
Tip
25 Feb 2025
WAF vs. RASP for web app security: What's the difference?
Web application firewalls use a negative security model, while runtime application self-protection tools use a positive security model. Which is better at keeping apps secure? Continue Reading
-
Definition
21 Feb 2025
What is application allowlisting?
Application allowlisting, previously known as 'application whitelisting,' is the practice of specifying an index of approved software applications or executable files that are permitted to be present and active on a computer system. Continue Reading
-
Tip
21 Feb 2025
3 ways to retool UC platform security architecture models
Hybrid workers moving between home and office environments create a UC security gap. But adopting modern tools to augment traditional security policies can mitigate risks. Continue Reading
-
News
20 Feb 2025
Zero-CVE Chainguard Images gain customization option
Chainguard opens its container image builder factory to let users mix and match hardened container components while preserving a zero-vulnerability SLA. Continue Reading
-
Tip
20 Feb 2025
Penetration testing vs. vulnerability scanning: What's the difference?
Confused by the distinctions between penetration testing and vulnerability scanning? You're not alone. Learn the key differences between the two and when to use each. Continue Reading
-
Tutorial
18 Feb 2025
Deploy a read-only domain controller for security, speed
A read-only domain controller requires a fair amount of work for a proper deployment, but it can be a great option for quicker logins for users in branch offices. Continue Reading
-
News
12 Feb 2025
Docker Inc. CEO swap has analysts anticipating a sale
Industry watchers see the takeover by a former Oracle exec as the precursor to merging with a broader software development portfolio at a larger company. Continue Reading
-
News
12 Feb 2025
Fortinet discloses second authentication bypass vulnerability
Fortinet disclosed CVE-2025-24472 in an updated advisory that confused some in the infosec community because it stated that 'reports show this is being exploited in the wild.' Continue Reading
-
News
11 Feb 2025
Microsoft plugs two zero-days for February Patch Tuesday
The company corrects active exploits in vulnerable Windows systems, one of which could give the attacker complete control if successful. Continue Reading
-
Tip
11 Feb 2025
How to build an API security strategy
Lax API protections make it easier for threat actors to steal data, inject malware and perform account takeovers. An API security strategy helps combat this. Continue Reading
-
News
11 Feb 2025
Apple zero day used in 'extremely sophisticated attack'
CVE-2025-24200 is a zero-day vulnerability that bypasses Apple's USB Restricted Mode in iPhones and iPads and was exploited in the wild against 'specific targeted individuals.' Continue Reading
-
News
10 Feb 2025
DevSecOps platform tucks in API security as AI apps heat up
Harness merges with its sister company, Traceable, for API security, which has broadening appeal as organizations develop generative and agentic AI applications. Continue Reading
-
News
10 Feb 2025
Trimble Cityworks zero-day flaw under attack, patch now
CVE-2025-0994 is a high-severity deserialization vulnerability that enables remote code execution in unpatched versions of Cityworks enterprise asset management software. Continue Reading
-
News
06 Feb 2025
Unpatched.ai: Who runs the vulnerability discovery platform?
There is limited information on the AI-powered vulnerability discovery platform that emerged in December after it reported Microsoft vulnerabilities Continue Reading
-
Tip
04 Feb 2025
How to properly implement Exchange Extended Protection
This security feature can better protect Exchange Server deployments to prevent a wide range of attacks and safeguard sensitive data transmitted over the network. Continue Reading
-
Definition
04 Feb 2025
What is Internet Key Exchange (IKE)?
Internet Key Exchange (IKE) is a standard protocol used to set up a secure and authenticated communication channel between two parties via a virtual private network (VPN). Continue Reading
-
News
04 Feb 2025
WatchTowr warns abandoned S3 buckets pose supply chain risk
WatchTowr researchers found that they could reregister abandoned Amazon S3 buckets and detail alarming ways that threat actors could exploit the attack surface. Continue Reading
-
News
03 Feb 2025
NSFocus: DeepSeek AI hit with 'well planned' DDoS attacks
Cybersecurity vendor NSFocus said AI startup DeepSeek endured multiple waves of DDoS attacks from attackers since its reasoning model was released Jan. 20. Continue Reading
-
Definition
31 Jan 2025
What is DOS (Disk Operating System)?
A DOS, or disk operating system, is an operating system (OS) that runs from a disk drive. The term can also refer to a particular family of disk operating systems, most commonly MS-DOS (Microsoft DOS). Continue Reading
-
Definition
30 Jan 2025
What is blockchain? Definition, examples and how it works
Blockchain is a distributed ledger technology (DLT) that's shared across a network of computers to keep a digital record of transactions. Continue Reading
-
News
30 Jan 2025
Wiz reveals DeepSeek database exposed API keys, chat history
Wiz expressed concern about security shortcomings with AI tools and services amid the rapid adoption and rising popularity of offerings like DeepSeek-R1. Continue Reading
-
News
29 Jan 2025
Google details adversarial AI activity on Gemini
Google identified APTs from more than 20 nations misusing its Gemini AI chatbot but noted that threat actors were unsuccessful in finding novel techniques or vulnerabilities. Continue Reading
-
News
28 Jan 2025
Apple zero-day vulnerability under attack on iOS devices
Apple said the zero-day vulnerability, tracked as CVE-2025-24085, affects its CoreMedia framework and 'may have been actively exploited against versions of iOS before iOS 17.2.' Continue Reading
-
News
24 Jan 2025
AMD processor vulnerability inadvertently leaked early
The flaw was revealed when hardware manufacturer Asus published a patch for an 'AMD Microcode Signature Verification Vulnerability' to a gaming motherboard update page. Continue Reading
-
News
23 Jan 2025
Eclypsium finds security issues in Palo Alto Networks NGFWs
Eclypsium researchers stressed how essential supply chain security is as threat actors increasingly target and exploit vulnerabilities in firewalls, VPNs and other edge devices. Continue Reading
-
News
21 Jan 2025
Threat actors abusing Microsoft Teams in ransomware attacks
Sophos researchers observed two separate threat campaigns in which attackers used Microsoft Teams to pose as IT support personnel and gain access to victims' systems. Continue Reading
-
News
16 Jan 2025
Tech industry experts digest cybersecurity executive order
IT pros assess a last-minute cybersecurity executive order with new directives on a broad swath of topics, from cybercriminal sanctions to AI and identity management. Continue Reading
-
News
16 Jan 2025
ESET details UEFI Secure Boot bypass vulnerability
ESET researchers last year discovered an unsigned binary in a third-party UEFI application that could have been abused to bypass the Secure Boot process. Continue Reading
-
News
14 Jan 2025
January Patch Tuesday resolves 3 Hyper-V zero-days
The number of vulnerabilities corrected for January Patch Tuesday is one of the highest in recent memory and includes three Hyper-V vulnerabilities exploited in the wild. Continue Reading
-
News
08 Jan 2025
Critical Ivanti Connect Secure zero-day flaw under attack
Although Ivanti has seen exploitation of CVE-2025-0282 in only Ivanti Connect Secure instances, Ivanti Policy Secure and ZTA gateways are also vulnerable to the flaw. Continue Reading
-
Tip
08 Jan 2025
Top 15 email security best practices for 2025
Attackers exploit email every day to break into corporate networks, but the risk can be reduced by adhering to these 15 email security best practices. Continue Reading
-
News
02 Jan 2025
Dozens of Chrome extensions hacked in threat campaign
Although data security vendor Cyberhaven disclosed that its Chrome extension was compromised on Dec. 24, additional research suggests the broader campaign could be months older. Continue Reading
-
Feature
30 Dec 2024
Navigate the 2025 threat landscape with expert insights
AI technology and company employees can serve as both gateways and buffers against cyberthreats. Learn more from expert thought leaders on how to protect your environment in 2025. Continue Reading
-
Definition
23 Dec 2024
What is a proxy firewall?
A proxy firewall is a network security system that protects network resources by filtering messages at the application layer. Continue Reading
-
News
23 Dec 2024
10 of the biggest cybersecurity stories of 2024
Some of the biggest stories of the year include a massive IT outage, a record-setting ransom payment and devastating breaches at several U.S. telecommunications companies. Continue Reading
-
Definition
17 Dec 2024
What is passwordless authentication?
Passwordless authentication allows a user to sign into a service without using a password. This is often done using certificates, security tokens, one-time passwords (OTPs) or biometrics. Continue Reading
-
News
12 Dec 2024
Aqua Security warns of significant risks in Prometheus stack
The cloud security vendor called on Prometheus to provide users with additional safeguards to protect against misconfigurations discovered in the open source monitoring tool. Continue Reading
-
News
10 Dec 2024
December Patch Tuesday shuts down Windows zero-day
Microsoft addresses 72 vulnerabilities, including 17 rated critical. Administrators should focus on patching the Windows OS to stop a flaw that has been exploited in the wild. Continue Reading
-
News
10 Dec 2024
Citrix NetScaler devices targeted in brute force campaign
Citrix advised NetScaler customers to ensure that their devices are fully updated and properly configured to defend against the recent spike in brute force attacks. Continue Reading
-
News
10 Dec 2024
Microsoft enhanced Recall security, but will it be enough?
Microsoft's controversial Recall feature began rolling out to certain Windows Insiders with Copilot+ PCs in November, with more expected to participate this month. Continue Reading
-
News
09 Dec 2024
Attackers exploit vulnerability in Cleo file transfer software
Cleo disclosed and patched the remote code execution vulnerability in late October, but managed file transfer products have proved to be popular targets for threat actors. Continue Reading
-
Definition
09 Dec 2024
What is a session key?
A session key is an encryption and decryption key that is randomly generated to ensure the security of a communications session between a user and another computer or between two computers. Continue Reading