Features – Help Net Security

David Fuhr, CTO at intcube, talks about a security cohort for public administration, where 27 municipalities hardened Windows Server and Active Directory together over 12 weeks. This Help Net Security interview covers how a cohort works, with weekly sessions, homework and measurements at the start and end. He explains how the group handled settings that can break systems, such as SMB signing, LDAP signing and Kerberos hardening, how changes were tested in a lab, and … More → The post Why Active Directory weaknesses stay open for years in teams with one or two admins appeared first on Help Net Security.

US employers posted 235,786 cybersecurity jobs from January through September 2026. That is the lowest total for those months in the four years that staffing and workforce intelligence firm CyberSN has tracked. They pulled the listings from job data provider JobSpikr, removed duplicates and sorted each one by the security work it described. The postings that remain have drifted toward governance, risk and compliance (GRC), the teams that track an organization’s risk and answer to … More → The post The cyber talent shortage? Job postings just hit a four-year low appeared first on Help Net Security.

In this Help Net Security interview, Michael Scott, CISO at Immuta, talks about how organizations should handle permissions for AI agents. He argues agents should be treated as lower-trust identities that don’t inherit everything their user can access. Scott explains why agent privilege creep differs from the human kind, how authority should pass to sub-agents, and why authentication alone does not secure what an agent does. He predicts at least two major enterprises outside the … More → The post Immuta CISO predicts critical AI incidents at major enterprises within 18 months appeared first on Help Net Security.

In this Help Net Security interview, Kunal Modasiya, Senior VP & GM at Qualys, talks about why patching is still hard to get right. He explains how business pressure, revenue-critical systems, and patches that break things keep fixes from going out. Modasiya argues that speed alone has limits and that teams should look at the whole remediation workflow. He discusses how proactive teams judge risk, why the gap between exposure time and weaponization time matters … More → The post Patching and preventing issues: What are the lessons you can learn? appeared first on Help Net Security.

In this Help Net Security interview, Akshay Joshi, Head of the Centre for Cybersecurity at the World Economic Forum, talks about how AI, geopolitics and industrialized fraud are changing cyber risk. He discusses findings from the Global Cybersecurity Outlook 2026, including that CEOs now rank cyber-enabled fraud above ransomware as their top concern. Joshi explains the widening resilience gap between large and small organizations and between regions, the role of skills shortages, and what public-private … More → The post Geopolitics and the cyber resilience gap belong in your threat model appeared first on Help Net Security.

A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special “magic packet” before it acts. In this interview with Help Net Security, Christiaan Beek, VP of Rapid7 Intelligence, explains why its operators go after mail gateways and other edge devices that can’t run endpoint agents, and why a hacked telecom network can put a whole nation at risk. Beek also covers how … More → The post What the BPFDoor backdoor tells us about attacks on the network edge appeared first on Help Net Security.

Modat and NCSC-NL, the Dutch government’s cybersecurity center, found 8,547 internet-facing systems at wind farms and solar parks in 35 countries in and around the EU that should not be reachable from the internet. The systems range from login screens to a turbine control page that offers a Stop button to anyone with a browser. Operators in Spain, Greece, Italy and Germany account for most of the confirmed systems. The real number is higher. A … More → The post Thousands of wind and solar park systems sit exposed on the internet across Europe appeared first on Help Net Security.

Ivan Milenkovic, VP Risk Technology EMEA at Qualys, explains how security leaders can build an economic model that puts money behind their decisions. He suggests starting with a few loss scenarios, then working down to the assets that drive them. He covers how to rank fixes by value at risk, what CFOs expect to see, and how to show the worth of incidents that never happened. He also looks at how one model can serve … More → The post Pricing your bad days and how to build an economic model for security decisions appeared first on Help Net Security.

Yusaku Fujii, a professor at Gunma University in Japan, has designed audits and penalties to stop operators from misusing AI that analyzes street camera footage. His system adds an independent record-keeper and unannounced spot checks to the AI’s outputs. Fujii’s test setting is what he calls a Fully Monitored Public Space (FMPS): streets where cameras are dense enough to follow people and vehicles continuously. It can be built with existing network cameras and encrypted storage. … More → The post Who watches the AI watching your street? appeared first on Help Net Security.

Just over half of the 200 senior security and technology leaders polled for ArmorCode say their organizations will struggle to simplify their software security programs if they keep working the way they do today. The respondents are senior people, most of them at companies with 10,000 or more employees, and their worries center on what happens after a scanner flags something. Someone has to decide whether the flaw matters, find out who owns it, and … More → The post Automation, AI agents or people? Sorting out who handles each security finding appeared first on Help Net Security.