Learn how attackers enumerated Salesforce Experience Cloud and ServiceNow portals — and how defenders can detect and prevent the same abuse. When Guest…
Category: DZone Security Zone
Multi-Account AWS Architecture: Isolating PHI Workloads Without Slowing Down Engineering Teams
Most engineering teams working on healthtech applications reach a point where someone asks a question that sounds simple but isn’t: How do we make sure a…
How to Secure Fintech REST APIs Against BOLA Vulnerabilities
Broken Object Level Authorization (BOLA) occurs when a REST API exposes an object identifier—such as an account, transaction, or loan ID — without…
Why DAST Findings Are Hard to Fix and How to Make Them Actionable
Dynamic testing is essential because it uncovers vulnerabilities in running applications. But while SAST gets the attention because it’s shift-left and…
Future-Proofing JWT Security: Crypto-Agility, Post-Quantum Signatures, and IAM Migration
Today, applications are built around identity systems. All API gateways, microservices, mobile backends, and single sign-on flows require some form of…
5 Infrastructure Controls for Securing AI Agents
The Disturbing Discovery In July 2026, the AI Red Team at NVIDIA published findings of a six-month assessment review of enterprise AI agents, ranging from…
The AI Memory Security Blueprint
Designing Context Isolation, Retrieval Trust, and Vector Database Governance for Enterprise RAG Systems Part 1 — Five Documents Can Hijack a Frontier…
The Agent in Your Pipeline Doesn’t Have a Manager. That’s the Problem.
AI coding tools made developers faster. Nobody asked what happened when the tools started making decisions. I want to start with a question that most…
Uncover Security Risks in Your Agent Skills Before Deploying
This tutorial explains how to catch a dangerous agent skill before an agent ever runs it: review it automatically, block it in CI if it fails, and only…
We Empowered AI Agents With ‘Hands,’ Now We Require Kernel-Level Vision to Monitor Them
The cybersecurity industry has been looking at large language models (LLMs) for the past few years as a scary librarian who can be slightly dangerous. We…
Why AWS and Azure Handle Data Perimeter Differently
AWS can send audit logs to an attacker’s account unless denials are enforced at the network layer, while Azure doesn’t log network-block requests at all.…
The AI Memory Security Blueprint
Designing Context Isolation, Retrieval Trust, and Vector Database Governance for Enterprise RAG Systems Part 1 — Five Documents Can Hijack a Frontier…
The Agent in Your Pipeline Doesn’t Have a Manager. That’s the Problem.
AI coding tools made developers faster. Nobody asked what happened when the tools started making decisions. I want to start with a question that most…
Uncover Security Risks in Your Agent Skills Before Deploying
This tutorial explains how to catch a dangerous agent skill before an agent ever runs it: review it automatically, block it in CI if it fails, and only…
We Empowered AI Agents With ‘Hands,’ Now We Require Kernel-Level Vision to Monitor Them
The cybersecurity industry has been looking at large language models (LLMs) for the past few years as a scary librarian who can be slightly dangerous. We…
A Practical Pipeline for Identifying Sensitive Columns Before Test Data Masking
I work as a data analyst at a legal services company. Part of my work involves protecting sensitive data during the Test Data Management (TDM) process.…
Mastering Enterprise Security in Microsoft Power Platform
Citizen development was supposed to free up IT teams, not give them a new category of risk to manage. Yet that is precisely what has happened in many…
A Zero-Trust Implementation Framework for Cloud Migrations: Lessons From Enterprise Deployments
Cloud migration projects almost always treat security as a downstream concern something to bolt on after workloads have already moved, once the “real”…
Securing Branch Networks With Firewalls, VPNs, IDS/IPS, and Identity-Based Access
Branch networks no longer behave like quiet extensions of a single headquarters LAN. They terminate local user traffic, break out directly to the internet…
Performance Testing With JMeter Beyond the Basics: Distributed Load, Realistic Profiles, and Identifying Security Bottlenecks
Most JMeter test plans I’ve inherited share a common shape. Two hundred threads, one ramp-up, a flat plateau, and a results table that says “p95 was…