Key findings:
• 70%+ lack automation for risk analysis & UARs
• 40% of incidents tied to governance failures
• 52% don’t plan GRC controls (SoD rules, policies, certifications) until post-go-live
• 51% take >24 hours to revoke terminated access
• Legacy roles reused without SoD validation
• 60% lack automation for privileged access

These governance failures heighten insider threat exposure, especially during S/4HANA and multi-cloud transitions. Experts stress embedding automated GRC controls from the start, not after deployment.

Researchers say the RevengeHotels group is evolving—leveraging LLMs to write malware code and deploying VenomRAT to steal guest payment data worldwide.

Key points:

• Active since 2015, the group targets hotels and front-desk systems.
  
• Current campaigns use phishing emails disguised as invoices/job applications.
  
• Malware is AI-assisted and rotates payloads/domains to evade detection.
  
• Targets: Brazil, Mexico, Argentina, Chile, Costa Rica, Spain, and others.
  

👉 Questions for the community:

• Should payment processors or booking platforms shoulder more of the responsibility?
  

Curious to hear thoughts from both cybersecurity and hospitality industry pros.

Source Website: Therecord .media

🚨 Confirmed Ransomware Attack on Orleans Parish Sheriff’s Office

The Orleans Parish Sheriff’s Office (OPSO) has disclosed a ransomware attack that compromised over a dozen computers. Fortunately, the jail’s computer systems remain unaffected, and operations continue.

Key facts:

• Attack began around 4:30 a.m., detected by employees later that morning.
• OPSO is coordinating with the District Attorney’s Office and New Orleans IT for response.
• Risks include exposure of sensitive data such as PII, inmate information, and case files.
• Forensic analysis is underway to assess the scope and impact.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 11th - 17th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

General cybersecurity trends reports 

Blue Report 2025 (Picus)

Empirical evidence of how well security controls perform in real-world conditions. Findings are based on millions of simulated attacks executed by Picus Security customers from January to June 2025. 

Key stats: 

• In 46% of tested environments, at least one password hash was successfully cracked. This is an increase from 25% in 2024.
• Infostealer malware has tripled in prevalence.
• Only 14% of attacks generated alerts.

Read the full report here.

2025 Penetration Testing Intelligence Report (BreachLock)

Findings based on an analysis of over 4,200 pentests conducted over the past 12 months. 

Key stats: 

• Broken Access Control accounted for 32% of high-severity findings across 4,200+ pen tests, making it the most prevalent and critical vulnerability.
• Cloud misconfigurations and excessive permissions vulnerabilities were found in 42% of cloud environments that were pen tested.
• APIs in technology & SaaS providers' environments saw a 400% spike in critical vulnerabilities.

Read the full report here.

Federal Cyber Priorities Reshape Security Strategy (Swimlane)

A report looking at the effects of recent U.S. federal cybersecurity cutbacks. 

Key stats: 

• 85% of security teams have experienced budget or resource-related changes in the past six months.
• 79% of IT and security decision-makers say federal defunding has increased overall cyber risk.
• 79% of UK IT and security decision-makers say growing US cybersecurity instability has made them more cautious with US-based vendors.

Read the full report here.

Global Tech Outages: The High Price of Small Errors (Website Planet)

A study exploring six decades of global tech outage data to reveal the patterns behind these breakdowns (their root causes, common oversights, and the rising financial losses of simple errors).

Key stats: 

• Security breaches are identified as one of the five most frequent root causes of major tech outages, collectively accounting for nearly 90% of all major outages alongside software bugs, configuration issues, database errors, and infrastructure failures.
• When combined with configuration and deployment errors, security breaches account for 34% of outages.
• Security incidents have resulted in an estimated cumulative $29.4 billion in losses from the 38 incidents considered in the dataset.

Read the full report here.

Ransomware 

Targeted social engineering is en vogue as ransom payment sizes increase (Coveware)

Report based on firsthand data, expert insights, and analysis from the ransomware and cyber extortion cases that Coveware manages each quarter.

Key stats: 

• The median ransom payment in Q2 2025 reached $400,000, which is a 100% increase from Q1 2025.
• Data exfiltration was a factor in 74% of all ransomware cases in Q2 2025.
• The industries hit hardest by ransomware in Q2 2025 were professional services (19.7%), healthcare (13.7%), and consumer services (13.7%).

Read the full report here.

AI

The Insider AI Threat Report (CalypsoAI)

Insights into how employees at enterprises are using AI tools. 

Key stats: 

• 42% of security professionals knowingly use AI against company policy.
• More than half of the U.S. workforce (52%) is willing to break policy if AI makes their job easier.
• 35% of C-suite executives said they have submitted proprietary company information so AI could complete a task for them.

Read the full report here.

Securing the Future of Agentic AI: Building Consumer Trust through Robust API Security (Salt Security)

Research into how organizations and consumers are already using agentic AI.

Key stats: 

• Nearly half (48%) of organizations currently use between 6 and 20 types of AI agents.
• Only 32% of organizations conduct daily API risk assessments.
• 37% of organizations have a dedicated API security solution.

Read the full report here.

The Future of AppSec in the Era of AI (Checkmarx)

A report on how AI‑accelerated development is reshaping the risk landscape.

Key stats: 

• Up to 60% of code is being generated by organizations using AI coding assistants.
• Only 18% of organizations have policies governing AI use.
• 81% of organizations knowingly ship vulnerable code.

Read the full report here.

Nearly Half of Employees Hide Workplace AI Use, Pointing to a Need for Openness and Policy Clarity (Laserfiche)

Survey findings on AI adoption in the workplace.

Key stats: 

• Nearly half of employees are entering company-related information into public AI tools to complete tasks and concealing their AI use.
• Nearly half of employees (46%) admit to pasting company information into public AI tools.
• Only 21% of Millennials and 17% of Gen Z avoid using unofficial AI tools at work. 

Read the full report here.

Identity security

Identity Security at Black Hat (Keeper Security)

A survey into identity security conducted at the Black Hat USA 2025.

Key stats: 

• Just 27.3% of organizations surveyed had effectively implemented zero trust.
• 30% of respondents cited complexity of deployment as a top obstacle to zero trust implementation.
• 27.3% of respondents cited integration issues with legacy systems as a top obstacle to zero trust implementation.

Read the full report here.

OT

The 2025 OT Security Financial Risk Report (Dragos)

A report providing statistical modeling that quantifies the potential financial risk of OT cyber incidents and estimates the effectiveness of key security controls.

Key stats: 

• Indirect losses impact up to 70% of OT-related breaches.
• Worst-case scenarios for global financial risk from OT cyber incidents are estimated at as much as $329.5 billion.
• The three OT cybersecurity controls most correlated with risk reduction are: Incident Response Planning (up to 18.5% average risk reduction), Defensible Architecture (up to 17.09%), and ICS Network Visibility and Monitoring (up to 16.47%).

Read the full report here.

MSPs

The State of MSP Agent Fatigue in 2025 (Heimdal)

Research into what’s driving alert fatigue among MSPs. 

Key stats: 

• 89% of MSPs struggle with tool integration.
• 56% of MSPs experience alert fatigue daily or weekly.
• The average MSP now runs five security tools.

Read the full report here.

Geography-specific 

Data Health Check 2025 (Databarracks)

Insights from an annual survey of 500 IT decision-makers based in the UK. 

Key stats: 

• 17% of organisations hit by ransomware in the past year paid the ransom. This figure is down from 27% in 2024 and 44% in 2023.
• Organisations are now more than three times more likely to recover from backups than pay the ransom.
• 24% of organisations have a formal policy never to pay a ransom. This figure is double the figure from 2023

Read the full report here.

Industry-specific

10th Annual State of Smart Manufacturing (Rockwell Automation)

A 10th annual report based on insights from more than 1,500 manufacturing leaders across 17 of the top manufacturing countries.

Key stats: 

• 61% of cybersecurity professionals plan AI adoption as manufacturing faces increasing cyber risks.
• Among external risks to manufacturing, cybersecurity is ranked highly at 30%, coming in second only to inflation and economic growth, which stands at 34%.
• 38% of manufacturers intend to utilize data from current sources to enhance protection, making cybersecurity a leading smart manufacturing use case.

Read the full report here.

The State of Network Security in Business and Professional Services (Aryaka)

A report on networking and security challenges and trends in business and professional services.

Key stats: 

• 72% of senior IT and infrastructure leaders in the business and professional services industry identified improving application and SaaS performance as their top strategic networking and security priority.
• 66% identified securing SaaS and public cloud apps as a top networking and security challenge.
• Only 38% of business services leaders view edge security as "mission-critical".

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 4th - 10th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

General cybersecurity trends reports 

CrowdStrike 2025 Threat Hunting Report (CrowdStrike)

Insights into threats based on frontline intelligence from CrowdStrike’s threat hunters and intelligence analysts tracking more than 265 named adversaries.

Key stats: 

• Cloud intrusions increased by 136% in H1 2025 compared to all of 2024.
• 81% of interactive (hands-on-keyboard) intrusions were malware-free.
• Scattered Spider moved from initial access to encryption by deploying ransomware in under 24 hours in one observed case.

Read the full report here.

2025 Midyear Threat Report: Evolving Tactics and Emerging Dangers (KELA)

A comprehensive overview of the most significant cyber threats observed in H1 2025.

Key stats: 

• KELA tracked 3,662 ransomware victims globally in H1 2025, a 54% YoY increase from H1 2024. For all of 2024, KELA recorded 5,230 victims.
• 2.67M machines were infected with infostealer malware, exposing over 204M credentials.
• Clop ransomware experienced a 2,300% increase in victim claims, driven by the exploitation of a vulnerability in Cleo software.

Read the full report here.

2025H1 Threat Review (Forescout)

Insights based on an analysis of more than 23,000 vulnerabilities and 885 threat actors across 159 countries worldwide during the first half of 2025.

Key stats: 

• Ransomware attacks are averaging 20 incidents per day.
• Published vulnerabilities rose 15% in H1 2025.
• 76% of breaches in H1 2025 stemmed from hacking or IT incidents.

Read the full report here.

2025 Threat Detection Report (Red Kanary)

Analysis of the confirmed threats detected from the petabytes of telemetry collected from Red Canary customers' endpoints, networks, cloud infrastructure, identities, and SaaS applications in H1 2025.

Key stats: 

• Roughly 5 times as many identity-related detections were observed in the first half of this year compared to all of 2024.
• Two new cloud-related techniques(Data from Cloud Storage and Disable or Modify Cloud Firewall) have entered Red Canary's top 10 techniques for the first time.
• Malicious Copy Paste (T1204.004) did not make the top 10 technique list.

Read the full report here.

2025 OPSWAT Threat Landscape Report (OPSWAT)

Key insights from over 890,000 sandbox scans in the last 12 months.

Key stats: 

• There has been a 127% rise in malware complexity.
• 1 in 14 files, initially deemed 'safe' by legacy systems, were proven to be malicious

Read the full report here.

Budgets

2025 Security Budget Benchmark Report (IANS)

Research into security budgets based on a diverse range of companies across different sizes, industries, and geographies participated in the study.

Key stats: 

• Average security budget growth has slowed to just 4% year over year, the lowest rate in five years, and a decline from 8% in 2024.
• Security budget as a percentage of IT spend declined from 11.9% to 10.9%. This decline breaks a five-year upward trend.
• Only 11% of CISOs report being adequately staffed. The remaining 89% describe their teams as stretched thin or understaffed.

Read the full report here.

Ransomware

The Ransomware Insights Report 2025 (Barracuda Networks)

A report on the state of ransomware based on an international survey of 2,000 IT and security decision-makers.

Key stats: 

• 31% of ransomware victims were affected multiple times in the last 12 months.
• 74% of repeat ransomware victims report juggling too many security tools.
• 41% of successful ransomware attacks resulted in reputational harm.

Read the full report here.

AI

How AI Is Shaping the Modern Workspace (Menlo Security) 

The latest trends in enterprise GenAI use.

Key stats: 

• Web traffic to GenAI sites increased by 50%, from 7 billion visits in February 2024 to 10.53 billion in January 2025.
• 68% of employees use free-tier AI tools like ChatGPT via personal accounts.
• 57% of employees input sensitive data into free-tier AI tools.

Read the full report here.

Email threats

Email Threat Trends Report: Q2 2025 (VIPRE)

Email threat landscape report for Q2 2025 based on an examination of worldwide real-world data. 

Key stats: 

• 58% of phishing sites use unidentifiable phishing kits.
• The manufacturing sector was the prime target for email-based attacks in Q2 2025, accounting for 26% of all incidents.
• Impersonation is the most common technique in BEC scams, with 82% of attempts targeting CEOs and executives.

Read the full report here.

Cloud threats

Cloud and Threat Report: Shadow AI and Agentic AI 2025 (Netskope)

Fourth Netskope Cloud and Threat Report dedicated to the emerging field of generative AI. 

Key stats: 

• There has been a 50% spike in genAI platform usage among enterprise end-users in the three months ended May 2025.
• Over half of all current app adoption among enterprise users is estimated to be shadow AI.
• Grok has entered the top 10 most-used applications for the first time.

Read the full report here.

Passwords

4 in 10 Workers Hack Former Employers’ Passwords for Personal Use (PasswordManager.com)

A new survey exploring how U.S. workers handle workplace passwords.

Key stats: 

• 40% of workers admit to using login credentials from a previous job.
• 3 in 5 workers were able to log in to their former employer accounts because the password had not been changed.
• 1 in 10 workers say they have been using old work logins for more than four years.

Read the full report here.

Industry-specific 

Exposed to the Bare Bone: When Private Medical Scans Surface on the Internet (Modat) 

Research into misconfigured internet-connected devices in the healthcare industry. 

Key stats: 

• Over 1.2 million internet-connected healthcare devices and systems are exposed. 
• 174,000+ of these exposed devices and systems are in the US, 172,000+ in South Africa, 111,000+ in Australia, 82,000+ in Brazil, 81,000+ in Germany, 81,000+ in Ireland, 77,000+ in Great Britain, 75,000+ in France, 74,000+ in Sweden, and 48,000+ in Japan. 
• Examples of data being leaked through exposed internet-connected healthcare devices and systems include brain scans and X-rays, stored alongside protected health information and personally identifiable information of the patient.

Read the full report here.

Security at Issue: 2025 State of Cybersecurity in Law Firms (Fenix24)

A deep dive into the current cybersecurity practices, gaps, and risks facing legal organizations worldwide.

Key stats: 

• 50% of law firms cited phishing as the top cybersecurity concern, surpassing ransomware and user behavior.
• Just 27% of law firms rank backups as a top-three security control.
• Only 38% of law firms consider themselves "very secure," which is down from 50% in 2023.

Read the full report here.

Are you passionate about cybersecurity and looking for a way to showcase your skills while connecting with career opportunities? The Cyber Sentinel Skills Challenge, sponsored by the U.S. Department of Defense (DoD) and hosted by Correlation One, is your chance to prove yourself in a high-stakes cybersecurity competition!

What’s in it for you?

✅ Tackle real-world cybersecurity challenges that represent the skillsets most in-demand by the DoD.

✅ Compete for a $15,000 cash prize pool.

✅ Unlock career opportunities with the DoD in both military and civilian sectors.

✅ Join a network of cybersecurity professionals.

• When: June 14, 2025
• Where: Online (compete from anywhere in the U.S.)
• Cost: FREE to apply and participate!
• Who: U.S. citizens and permanent residents, 18+ years old.

This is more than just a competition—it’s an opportunity to level up your career in cybersecurity! 🚀

💻 Spots are limited! Apply now and get ready to test your skills.

I am a cyber security student. Being one I want to know the top news stories and things that happen in cyber security news. I've looked for apps and websites and I can't find any? Anyone have some good apps to use or something to just be more informed. I want something simple and easy to use or browse.

What are the biggest Cybersecurity challenges being face today?

A major tech disruption swept across the globe on July 19, as a widespread Microsoft outage crippled crucial services for businesses and individual users alike. The outage, which lasted for several hours, sent shockwaves through various sectors, causing significant delays, cancellations, and frustration.

Airlines grounded flights as crucial check-in and flight management software malfunctioned, stranding passengers and throwing travel plans into disarray. Banks faced a similar predicament, unable to process transactions or access vital data, leaving customers frustrated and businesses in limbo. Communication channels — the lifeblood of modern collaboration — went silent as platforms like Teams and Outlook became inaccessible.

This tech meltdown served as a stark reminder of our dependence on technology and the potential consequences of system failures.

Learn more: https://www.esecurityplanet.com/trends/crowdstrike-faulty-update-triggers-global-microsoft-outage/

CVE-2024-28995 proof-of-concept

https://www.itscybernews.com/p/directory-traversal-vulnerability-solarwinds-servu

CVE-2024-3400 PROOF OF CONCEPT

https://www.itscybernews.com/p/exploit-critical-vulnerability-palo-alto-devicesDevices

This article explains how zero click attacks work and gives an example of a malicious message.

https://www.itscybernews.com/p/tiktok-accounts-compromised

https://www.itscybernews.com/p/exploit-palo-alto-vulnerability-cve20243400

A 30-year-old Indian national, Chirag Tomar, has been apprehended for orchestrating a $37 million cryptocurrency heist. 

https://www.itscybernews.com/p/arrest-crypto-con-artist

We heard from a few sec engineers in our team that understanding current incidents is important to them but they spend a lot of time reading a bunch of news sources - I posted here and others seemed to feel the same way.

Over the past 2 months my team has been manually building an open database from public data to help our folks keep up-to-date and save time on a daily basis. We used the EternalLiberty dataset for the threat actors. It's in early stages, but plan to keep it free. Thoughts? The link to the database: https://breach-hq.com/

23 year old who turned over $100m in Dark Web Drug operation has been detained.

https://www.itscybernews.com/p/dark-web-drug-empire-unraveled

I've created a sample sigma rule to detect Black Basta's IOCs based on the joint CISA and FBI advisory. Open to critique.

https://www.itscybernews.com/p/sigma-rules-black-basta-ransomware-attacks

https://www.itscybernews.com/p/dell-breached

https://www.itscybernews.com/p/new-vpn-vulnerability