GoodHound

GoodHound root@kitploit: / / / / / / / / / / / / / / / // / / / / / / / / // / // / // / // / / // / // / / / / // / ///,// ///,// //,/ Gli aggressori pensano in grafi, i difensori pensano in azioni, la direzione pensa in grafici. GoodHound operativizza Bloodhound determinando i percorsi...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

nuvola

nuvola nuvola con la n minuscola è uno strumento per eseguire dump e analisi di sicurezza automatiche e manuali su configurazioni e servizi di ambienti AWS utilizzando regole predefinite, estensibili e personalizzate create con una sintassi Yaml semplice. L'idea generale alla base di questo...

cloudfoxable

Inizia a fare hacking: CloudFoxable Leggi il blog per maggiori dettagli: Presentazione di CloudFoxable: una sandbox gamificata per l'hacking cloud Background CloudFox aiuta i penetration tester e i professionisti della sicurezza a individuare percorsi di attacco sfruttabili nell'infrastruttura...

BloodBash

BloodBash Un progetto open source di SquidSec SquidOffense.com · GitHub BloodBash è un analizzatore JSON offline open source per SharpHound e AzureHound, creato e gestito da SquidSec. Costruisce un grafo, mette in evidenza percorsi di attacco e configurazioni errate di AD/Entra e stampa i risulta...

Dop2Mop

Dop2Mop Ein Proof-of-Concept OpenGraph-Collector für BloodHound, der Angriffspfade von DevOps- zu MLOps-Infrastruktur abbildet. Basierend auf Pipelines of Privilege: Attack Paths from DevOps to MLOps Infrastructure von Brett Hawkins @h4wkst3r. Inhaltsverzeichnis Danksagungen Übersicht Unterstützt...

k8scout

k8scout Beta — Un motore di percorsi d'attacco Kubernetes a singolo binario per valutazioni di sicurezza autorizzate. Inseriscilo in un pod compromesso, eseguilo e ottieni una mappa di ogni percorso di escalation realistico — dal tuo punto d'appoggio attuale fino a cluster-admin, accesso ai nodi,...

Bridging the Visibility Gap: A Unified Security Operating Model for Hybrid Cloud Teams

Move beyond chasing vulnerabilities to a unified hybrid risk strategy. The Sensor Workload Scanner is now GA and extends our risk prioritization engine to on-premise environments to identify the critical attack paths across your hybrid cloud...

Beyond the Zero-Day: See Your Network Like an Attacker | Webinar with HD Moore

Assume the breach. Zero-days keep shipping, AI is writing exploits faster than anyone patches, and "patch everything in time" stopped working years ago. Stop betting the org on winning that race. You don't control which bug lands. You control what it can reach once it does. That is a question abo...

Identity Exposure Management: Risks and Response

Start with the path that carries risk. Security teams need a clear view of access risk. Stolen tokens and excessive privileges turn legitimate access into an attack route. Identity risk becomes urgent when one exposed account opens a path across critical systems. Identity exposure management is t...

[Webinar] How Modern Attack Paths Cross Code, Pipelines, and Cloud

TL;DR: Stop chasing thousands of "toast" alerts. Join experts from Wiz to learn how hackers connect tiny flaws to build a "Lethal Chain" to your data—and how to break it. Register for the Strategic Briefing Here. Most security tools work like a smoke alarm that goes off every time you burn a piec...

Firmware Distribution As Attack Surface: A Security Study of ASIC Cryptocurrency Miners

ASIC cryptocurrency miners are a core component of blockchain infrastructures, directly converting computation and energy into monetary value. Despite their economic im- portance, their security is rarely evaluated in a structured manner. In this paper, we show that the firmware distribution...

What Is Threat Exposure Management? A Complete Guide

Most security teams can tell you how many vulnerabilities they found last quarter. Very few can tell you which of those vulnerabilities an attacker could actually exploit to breach a critical system. That gap between "found" and "actually dangerous" is the problem threat exposure management was...

Product Walkthrough: How Mesh CSMA Reveals and Breaks Attack Paths to Crown Jewels

Security teams today are not short on tools or data. They are overwhelmed by both. Yet within the terabytes of alerts, exposures, and misconfigurations – security teams still struggle to understand context: Q: Which exposures, misconfigurations, and vulnerabilities chain together to create viable...

What is CTEM? A Modern Approach to Cyber Risk

To effectively defend your organization, you need to think like an attacker. Attackers don’t care about a vulnerability’s CVSS score; they care about whether they can exploit it to reach a valuable target. Traditional security often misses this crucial context, leaving you to guess which of the...

A Guide to Threat Exposure Management for Enterprises

For years, security has been an inside-out job. We scan our own systems, find our own flaws, and create our own to-do lists. But what if we flipped the script and looked at our organization from the outside-in? This is the core idea behind Threat Exposure Management. It’s a continuous process tha...

What Is Exposure Management? A Modern Guide

Attackers don't just look for a single high-severity vulnerability; they look for a path of least resistance. They connect the dots between a misconfigured cloud service, an exposed credential, and an unpatched server to reach their goal. To build a strong defense, you need to see your environmen...

From Exposure to Exploitation: How AI Collapses Your Response Window

We’ve all seen this before: a developer deploys a new cloud workload and grants overly broad permissions just to keep the sprint moving. An engineer generates a "temporary" API key for testing and forgets to revoke it. In the past, these were minor operational risks, debts you’d eventually pay do...

A CISO’s Guide to Threat Management Platforms

Attackers don’t see your organization as a list of CVEs. They see a web of interconnected assets, looking for a single weak link that will give them a path to your most valuable data. A traditional vulnerability scanner might miss these dangerous connections, but a threat management platform is...

Cybersecurity Predictions for 2026 Signal the Maturation of Risk-First Security Models

Key Takeaways Cyber risk management gets operationalized in 2026. Leading organizations move beyond visibility and frameworks to govern risk through prioritization, simulation, and deliberate action. Attack-path modeling matures into execution. Static views give way to dynamic, decision-driving...