legitify

Укрепите безопасность вашего управления исходным кодом! Обнаруживайте и устраняйте неправильные конфигурации, проблемы безопасности и соответствия требованиям во всех ваших ресурсах GitHub и GitLab 🔥 от Legit Security. Хотите узнать, что делает Legit Security? Legit Security — это решение для...

red-kube

Red Team K8S Adversary Emulation Based on kubectl Red Kube is a collection of kubectl commands written to evaluate the security posture of Kubernetes clusters from the attacker's perspective. The commands are either passive for data collection and information disclosure or active for performing...

ElectricEye

ElectricEye ElectricEye — это мультиоблачный, мультиSaaS CLI-инструмент на Python для управления активами, контроля безопасности и мониторинга поверхности атаки, поддерживающий сотни сервисов и оценок для укрепления ваших CSP и SaaS-сред, с привязкой элементов контроля к более чем 20 отраслевым,...

drs-malware-scan

Perform malware scan analysis of on-prem servers using AWS services Challenges with on-premises malware detection It can be difficult for security teams to continuously monitor all on-premises servers due to budget and resource constraints. Signature-based antivirus alone is insufficient as moder...

opencspm

OpenCSPM Open Cloud Security Posture Management, OpenCSPM, — это платформа с открытым исходным кодом для получения более глубокого понимания конфигурации и метаданных вашего облака, помогающая оценивать и снижать риски с течением времени. Для кого предназначен OpenCSPM? Для команд безопасности,...

aws-recon

AWS Recon Многопоточный инструмент для сбора инвентаризации AWS с фокусом на безопасность, написанный на Ruby. Этот инструмент создан для эффективного сбора большого объёма атрибутов и метаданных ресурсов AWS. Он стремится собрать практически всё, что имеет отношение к конфигурации безопасности и...

honeypot

🍯 허니팟 연구 프로젝트 허니팟이란 무엇인가 허니팟honeypot은 잠재적인 보안 위협을 탐지, 분석 및 대응하기 위해 의도적으로 공격자에게 취약하게 남겨둔 컴퓨터 시스템 또는 네트워크입니다. 허니팟의 목표는 악의적인 행위자가 사용하는 전술, 기법, 절차에 대한 정보를 수집하여 전반적인 네트워크 보안을 개선하는 데 도움을 주는 것입니다. alt text 이점 향상된 위협 인텔리전스: 허니팟은 공격자의 전술, 기법, 절차TTPs에 대한 귀중한 통찰력을 제공하여 보안 팀이 방어 체계를 개선하도록 돕습니다. 조기 탐지 및 대응:...

internal-security-detect

내부 보안 탐지 SafeBase 활용 노출된 SafeBase 포털은 동시에 두 부류의 사용자를 대상으로 합니다: 보안 태세에 대한 증명이 필요한 잠재 고객과 보안 연구자블루 팀 및 레드 팀입니다. 각 녹색 체크 표시는 아마도 현재 존재하는 통제 항목을 나타내며, 누락된 체크 표시는 존재하지 않는 항목에 대한 똑같이 명확한 힌트가 됩니다. 이 데이터를 수집하는 이유는? ISO 27001, SOC 2, PCI-DSS와 같은 규정 준수 프레임워크와 각 지역에서 증가하는 개인정보 보호 규정은 보안 통제가 마련되어 제대로 작동하고 있다...

cloud-doctor

cloud-doctor Одна команда оценивает всю вашу облачную учетную запись — неверные конфигурации, отсутствие наблюдаемости и уровень безопасности, отсортированные по пяти вещам, которые нужно исправить в первую очередь. Направьте её на AWS, Cloudflare, Vercel, Supabase, Render, Fly.io или Railway, и...

GO-2026-5381 vulnerabilities

Vulnerabilities for packages: minio-object-browser, keda, k8sgpt, opentelemetry-collector, prometheus-pushgateway, mc, minio-operator, trillian, aws-otel-collector, metrics-server, jaeger, datadog-agent, certificate-transparency, fluent-bit-plugin-loki, grafana, loki,...

Qualys Expands Serverless Security with Vulnerability Scanning for AWS Lambda

Key Takeaways Qualys now delivers automated AWS Lambda vulnerability scanning , extending serverless security beyond posture checks CSPM into workload-level risk visibility. CSPM alone only catches misconfigurations excessive permissions, exposure, logging, encryption — it can't detect vulnerable...

Revive Adserver 6.0.6 Security Auditor

This script is a defensive security auditing utility designed to identify exposed services, review configuration weaknesses, and collect security posture information from a Revive Adserver deployment without performing direct exploitation...

PT-2026-45725

Name of the Vulnerable Software and Affected Versions Apache Kafka affected versions not specified Description An improper authorization issue exists in the 'CONSUMER GROUP DESCRIBE' 69 API. The implementation validates the DESCRIBE operation on the GROUP resource, which contradicts the READ...

Cross-Vendor Sola ISPM Benchmark: Evaluating Agentic AI for Federated Identity Security Reasoning

The rapid proliferation of multi-cloud and SaaS platforms has transformed Identity Security Posture Management ISPM into a fundamentally cross-vendor challenge: critical misconfigurations and privilege escalation paths increasingly span multiple identity providers, infrastructure layers, and...

Lessons from Penetration Tests on Large-Scale Agent Systems

As AI systems gain increasing autonomy and execution capability, the number of discovered security vulnerabilities continues to rise. However, many of these vulnerabilities are not fundamentally novel, but instead reflect recurring classes of weaknesses long observed in prior computing systems...

CSPM vs Exposure Management: Key Differences

Your CSPM tool flags 4,000 misconfigurations every month. Your team remediates 400. Attackers only need one. That gap between what your posture tools report and what actually puts your organization at risk is exactly where exposure management picks up. Book a demo to see how Hive Pro's Uni5 Xposu...

On Microsoft’s Lousy Cloud Security

ProPublica has a scoop: In late 2024, the federal government's cybersecurity evaluators rendered a troubling verdict on one of Microsoft's biggest cloud computing offerings. The tech giant's "lack of proper detailed security documentation" left reviewers with a "lack of confidence in assessing th...

A Guide to Continuous Monitoring for Cyber Threats

A Guide to Continuous Monitoring for Cyber Threats Most security teams still rely on periodic vulnerability scans and annual penetration tests to assess their risk. The problem? Attackers do not work on your schedule. Between those snapshots, new vulnerabilities emerge, configurations drift, and...

Can the Security Platform Finally Deliver for the Mid-Market?

Mid-market organizations are constantly striving to achieve security levels on a par with their enterprise peers. With heightened awareness of supply chain attacks, your customers and business partners are defining the security level you must meet. What if you could be the enabler for your...

A CISO’s Guide to Threat Management Platforms

Attackers don’t see your organization as a list of CVEs. They see a web of interconnected assets, looking for a single weak link that will give them a path to your most valuable data. A traditional vulnerability scanner might miss these dangerous connections, but a threat management platform is...