CISA Adds New Exploited Vulnerability to KEV Catalog

Your vulnerability scanner says you have 4,000 vulnerabilities. Congratulations. That number means almost nothing. Here's what CISOs in my network are actually wrestling with: Not how many vulnerabilities they have — but which ones an attacker can chain together to do real damage. There's a massive difference between a vulnerability that exists and a vulnerability that's exploitable in your environment, given your actual configuration, your actual credentials, your actual network paths. I moderate a monthly roundtable with 600+ CISOs, CIOs, and CTOs. The ones sleeping better at night aren't the ones with the lowest CVE counts. They're the ones who've actually validated what an attacker could do in their environment, right now. Stop counting. Start validating. #CISO #CyberSecurity #PenTesting #VulnerabilityManagement #SecurityLeadership

Penetration testing and Red Teaming are often used interchangeably… but they serve very different purposes. Understanding the difference is key to building a security strategy that actually holds up against real-world threats. 👉 Pen testing helps identify vulnerabilities 👉 Red Teaming shows how those weaknesses can be exploited in a real attack scenario It’s not just about finding issues it’s about understanding how an attacker would chain them together and whether your organisation would detect and respond in time. If you’re looking to move beyond compliance and truly test your resilience, knowing when to use each approach is essential. 🔍 Read the full breakdown here: https://lnkd.in/evpVN9NU See how we can support you here: https://lnkd.in/dZT3fwD #CyberSecurity #PenTesting #RedTeaming

🔔 Just one day to go until our Patrowl.io X SASIG webinar!
 🔍 Are you sure you’re focusing your efforts on what really matters? With the number of vulnerabilities skyrocketing, security teams can no longer fix everything. It’s becoming essential to rethink how we prioritise. Join us tomorrow for our webinar with SASIG Events: “Measuring Attractiveness: What Makes an Asset Hackable?” 🗓 Date: 22 April 
⏰ Time: 11am (UK) | 12pm (FR) 💡 On the agenda: 
Vulnerability management has evolved significantly — from automated tools (SAST, DAST, SCA), to penetration testing and bug bounty programmes, right through to business risk-based approaches. But today, one reality is clear: it is impossible to fix everything. So, how do you decide where to focus your efforts? In this session, we will go beyond reactive approaches to introduce a new perspective: measuring the attractiveness of your assets from an attacker’s point of view #cybersecurity #Webinar #Patrowl

Most penetration tests are accurate the day they’re delivered. The problem is what happens next. Environments change. New vulnerabilities emerge. Attackers don’t wait. So while the report stays the same, the risk doesn’t. Continuous testing isn’t about doing more testing for the sake of it. It’s about keeping your understanding of risk aligned to reality. Not once a year...but all year. We’ve broken down what continuous testing really means to us and why more teams are moving away from point-in-time approaches. 👉 https://ow.ly/A7Na50YGV31 #PenetrationTesting #CyberSecurity #ContinuousTesting #InfoSec #CyberRisk

Does your security teams rely on CVSS scores? That era might be ending. NIST is now stepping back from rating many lower-priority vulnerabilities—not because they don’t matter, but because there are simply too many to keep up with. Submissions have surged over 260% in recent years, overwhelming traditional scoring models. https://hubs.ly/Q04cPPg70 So why the shift? From scoring everything to prioritizing what’s actually being exploited. If you’re still waiting for a score to tell you what matters, you’re already behind. Risk isn’t about volume anymore. It’s about context, exploitability, and impact. And increasingly… that’s on us to figure out. #CyberSecurity #VulnerabilityManagement #RiskManagement

Came across the CISA Known Exploited Vulnerabilities catalog again this week. What’s interesting is not the list itself. It’s how many of those vulnerabilities have had fixes available for quite some time. Still, they continue to be exploited. At some point, this stops being about discovering vulnerabilities. And starts being about how quickly organizations can actually respond to them. Curious how others see this: Is the gap really about awareness, or about execution? #CyberSecurity #VulnerabilityManagement #CISO For reference: https://lnkd.in/dWzpUCTF

NIST is changing how CVE data is enriched in the NVD: only vulnerabilities present in the CISA KEV list or affecting critical software will be prioritized for detailed enrichment. This means other CVEs may have delayed or reduced enrichment, potentially impacting vulnerability management workflows. No direct vulnerabilities or exploits are included in this update, but security teams should stay attentive to the CISA KEV and NVD feeds for actionable alerts. 🔎 https://lnkd.in/d9tsrPRG #OffSeq #NVD #CISA #Cybersecurity #VulnerabilityManagement

Most people learn bug bounty from theory. Very few get to see how real targets are approached — from recon to exploitation. This Wednesday, we’re hosting a live session with Rere Ayodele on: “Discovery & Exploitation of Vulnerabilities in Real Bounty Programs” You’ll see: - How attackers approach real targets (asset discovery → attack surface) - Where vulnerabilities like BOLA/IDOR, BFLA, exposed keys, and subdomain takeovers actually show up - A live walkthrough of an active finding from discovery to proof of concept This isn’t a slide-based session — it’s a real attacker workflow. If you’re getting into bug bounty or API security, this session is for you! 📅 Join us: April 22, 2026 at 12 PM ET 🔗 Event link: https//https://lnkd.in/gsbeHbbw Have you ever attended any of the Bugbounty Wednesday sessions before? Let us know your experience in the comments! #BugBounty #APISecurity #CyberSecurity #EthicalHacking #OWASP

If it’s been overwhelming getting your grounds in bug bounty, a live walkthrough might be all you need just like I do. Note the date, schedule it in your calendar and make yourself available and watch a hunter hunt for bugs.

Advanced Persistent Threats don't follow a predictable playbook. They are methodical, well-resourced, and designed to operate undetected, sometimes for months before any indicators surface. The organizations that weather these threats best aren't always the ones with the largest security budgets. They're the ones who understand their vulnerabilities before an adversary does. That's where red teaming comes in. If your security posture hasn't been tested under realistic conditions, now is the right time to change that. 🔗 Learn More: https://lnkd.in/dxt5YKT6 #RedTeaming #CyberSecurity #EthicalHacking #APT #PenetrationTesting #CyberResilience #InfoSec #ThreatSimulation #TrilliumInfoSec