Our Blog

Executive TL;DR:

» The Verizon 2026 DBIR confirms software exploitation is surging, but identity compromise remains the primary foothold for ransomware affiliates and SaaS intrusion campaigns.

» Adversaries are bypassing conventional MFA using Adversary-in-the-Middle (AiTM) phishing frameworks, session token hijacking, and targeted helpdesk social engineering.

» Defenders must shift focus from static malware signatures to behavioral alerts, monitoring ignored telemetry like OAuth permission changes and helpdesk ticket anomalies.

Reading time 15 minutes

AI-assisted development is accelerating faster than security teams can keep up. The Purple Book Community 2026 survey of 650+ security leaders shows 73% report velocity exceeding review capacity, with 70% identifying AI-generated vulnerabilities in production. This analysis examines the resulting “production gap” and its implications.

CVSS assigns severity scores based on theoretical impact. EPSS estimates the probability that adversaries will exploit a vulnerability in the next 30 days. For security teams managing more than 40,000 published CVEs annually, that distinction is operationally critical: Learn why severity alone no longer provides sufficient prioritisation accuracy.

MOVEit exploitation exposed a critical failure in vulnerability management: organizations had signals, patches, and intelligence—but failed to prioritize and respond to active exploitation. This OFA breaks down where controls failed and what security teams must change.