In the beginning, building Machine Learning models was a skill only data scientists with knowledge of Python could master. However, low-code AI platforms have made things much easier now. Anyone can now directly make a model, link it to data, and publish it as a web service with just a few clicks. Marketers can now develop customer segmentation models, user support teams can implement chatbots, and product managers can automate the process of predicting sales without having to write code. Even so, this simplicity has its downsides. A False Start at Scale When a mid-sized e-commerce company introduced its first machine learning model, it went for the quickest route: a low-code platform. The data team quickly built a product recommendation model with Microsoft Azure ML Designer. There was no need for coding or a complicated setup, and the model was up and running in only a few days. When staged, it did well, recommending relevant products and maintaining user interest. However, when 100,000 people used the app, it faced problems. Response times tripled. Recommendations were only shown twice, or they did not appear at all. Eventually, the system crashed. The issue wasn’t the model that was being used. It was the platform. Azure ML Designer and AWS SageMaker Canvas are designed to operate fast. Thanks to their easy-to-use drag-and-drop tools, anyone can use machine learning. However, the simplicity that makes them easy to work with also covers their weaknesses. Tools that start as simple prototypes fail when they are put into high-traffic production, and this happens due to their structure. The Illusion of Simplicity Low-code AI tools are promoted to people who are not technology experts. They take care of the complex parts of data preparation, feature creation, training the model, and using it. Azure ML Designer makes it very quickly possible for users to import data, build a model pipeline, and deploy the pipeline as a web service. However, having an abstract idea is both positive and negative. Resource Management: Limited and Invisible Most low-code platforms run models on pre-set compute environments. The amount of CPU, GPU, and memory that users can access is not adjustable. These limits work well in most cases, but they become a problem when there is a surge in traffic. An educational technology platform using AWS SageMaker Canvas created a model that could classify student responses as they were submitted. During testing, it performed perfectly. Yet, as the number of users reached 50,000, the model’s API endpoint failed. It was found that the model was being run on a basic compute instance, and the only solution to upgrade it was to rebuild all the workflows. State Management: Hidden but Dangerous Because low-code platforms keep the model state between sessions, they are fast for testing but can be risky in real-life use. A chatbot for retail was created in Azure ML Designer so that user data would be maintained during each session. While testing, I felt that the experience was made just for me. However, in the production environment, users started receiving messages that were meant for someone else. The issue? It stored information about the user’s session, so each user would be treated as a continuation of the one before. Limited Monitoring: Blindfolded at Scale Low-code systems give basic results, such as accuracy, AUC, or F1 score, but these are measures for testing, not for running the system. It is only after incidents that teams discover that they cannot track what is essential in the production environment. A logistics startup implemented a demand forecasting model using Azure ML Designer to help with route optimization. All was good until the holidays arrived, and the requests increased. Customers complained of slow responses, but the team could not see how long the API took to respond or find the cause of the errors. The model could not be opened up to see how it worked. Scalable vs. Non-Scalable Low-Code Pipeline (Image by author) Why Low-Code Models Have Trouble Handling Large Projects Low-code AI systems cannot be scaled, as they lack the key components of strong machine learning systems. They are popular because they are fast, but this comes with a price: the loss of control. 1. Resource Limits Become Bottlenecks Low-code models are used in environments that have set limits on computing resources. As time passes and more people use them, the system slows down or even crashes. If a model has to deal with a lot of traffic, these constraints will likely cause significant problems. 2. Hidden State Creates Unpredictability State management is usually not something you must consider in low-code platforms. The values of variables are not lost from one session to another for the user. It is suitable for testing, but it becomes disorganised once multiple users employ the system simultaneously. 3. Poor Observability Blocks Debugging Low-code platforms give basic information (such as accuracy and F1 score) but do not support monitoring the production environment. Teams cannot see API latency, how resources are used, or how the data is input. It is not possible to detect the issues that arise. Low-Code AI Scaling Risks – A Layered View (Image by author) A list of factors to consider when making low-code models scalable Low-code does not automatically mean the work is easy, especially if you want to grow. It is essential to remember Scalability from the beginning when making an ML system with low-code tools. 1. Think about scalability when you first start designing the system. You can use services that provide auto-scaling, such as Azure Kubernetes Service in Azure ML and SageMaker Pipelines in AWS. Avoid default compute environments. Go for instances that can handle more memory and CPU as needed. 2. Isolate State Management To use session-based models like chatbots, ensure user data is cleared after every session. Ensure that web services handle each request independently, so they do not pass on information accidentally. 3. Watch production numbers as well as model numbers. Monitor your API’s response time, the number of requests that fail, and the resources the application uses. Use PSI and KS-Score to find out when the inputs to your system are not standard. Focus on the business’s results, not only on the technical numbers (conversion rates and sales impact). 4. Implement Load Balancing and Auto-Scaling Place your models as managed endpoints with the help of load balancers (Azure Kubernetes or AWS ELB). You can set auto-scaling guidelines depending on CPU load, number of requests, or latency. 5. Version and Test Models Continuously Make sure that every model is given a new version every time it is changed. Before releasing a new version to the public, it should be checked in staging. Perform A/B testing to check how the model works without upsetting the users. When Low-Code Models Work Well Low-code tools do not have any significant flaws. They are powerful for: Rapid prototyping means giving priority to speed over stable results. Analytics that are done inside the system, where the potential for failure is minimal. Simple software is valuable in schools since it speeds up the learning process. A group of people at a healthcare startup built a model using AWS SageMaker Canvas to catch medical billing errors. The model was created just for internal reporting, so it didn’t need to scale up and could easily be used. It was a perfect case for using low-code. Conclusion Low-code AI platforms provide instant intelligence, as they do not require any coding. However, when the business grows, its faults are revealed. Some issues are insufficient resources, information seeping out, and limited visibility. These issues cannot be solved just by making a few clicks. They are architectural issues. When beginning a low-code AI project, consider whether it will be used as a prototype or a marketable product. If the latter, low-code should only be your initial tool, not the final solution. The post The Automation Trap: Why Low-Code AI Models Fail When You Scale appeared first on Towards Data Science.

Sergey Nivens - Stock.Adobe.com News The Security Interviews: David Faugno, 1Password David Faugno, co-CEO of 1Password, discusses how his background led to him joining the company and why maintaining profitability is a key factor in overcoming the challenges of switching markets. By Peter Ray Allison Published: 16 May 2025 12:15 Although companies may embrace emerging technologies to remain competitive, they can be risk averse, especially when it comes to changing their customer base. However, this shift in focus is what 1Password did when it moved from being consumer focused to providing enterprise grade security solutions. In 2006, the company 1Password developed a password manager of the same name for the Windows, Android, iOS and Linux platforms. Since then, it has earned a reputation for being a secure method for protecting sensitive user information. Software licenses and other sensitive information can also be securely stored in a virtual vault on their servers, which is locked with a password-based key derivation function (PBKDF2) guarded master password (a password storage algorithm that is designed for deterring brute force attacks by making them computationally expensive). David Faugno had previously been enjoying a semi-retirement, working as a board member and adviser for various companies, including 1Password. As his interest in the company grew, he soon became increasingly impressed with its collaborative approach and transparency. He was invited to join the company as its president and chief operating officer in September 2023, before becoming co-CEO just over a year later. Faugno had previously spent more than 10 years with security and storage provider Barracuda Networks as its chief finance officer. Faugno’s experience with Barracuda Networks gave him a broad understanding of the security landscape, as well as a unique perspective for solving security problems facing organisations of all sizes. When Faugno joined 1Password, the world was emerging from the Covid-19 pandemic. Covid transformed the way companies operate by accelerating remote working technologies and encouraging people to work from home and, since then, hybrid working has become the norm in many sectors. “The world was fundamentally changing. The way people worked and the tools that businesses had provided to their employees to stay safe and secure, and create a secure perimeter, no longer really existed,” says Faugno. “This got accelerated pretty dramatically during the pandemic, which is right at the point in the time when we first invested and got involved.” As a consequence of the proliferation of remote working, the security perimeter for an organisation also expanded. Previously, the security perimeter had been at the endpoints of the corporate network, but now it has extended into homes of employees. Most cyber security incidents are due to compromised credentials, such as stolen, weak or reused passwords. Consequently, employees who use weak identification systems at home may inadvertently expose corporate networks to attack. It is therefore essential for maintaining security of a corporate network security that the cyber security of devices in the employees’ home is also protected. One method for achieving this is to provide each employee with a free family license for a cyber security package. Balancing security and data privacy against accessibility and usability can be challenging as these aspects can often be at odds with each other. Faugno acknowledges that uncompromised security may cause friction with setup and account recovery, however, 1Password took a decision early in the product development cycle to focus on ensuring that the most secure way was also the easiest. This led to a rapid uptake of its password manager, which resulted in it being adopted into thousands of businesses. Faugno soon noted that although 1Password was primarily a consumer-focused product at the time, it was becoming increasingly used in the enterprise sector. “When the work environment started to change and people started to get access to resources that were not being necessarily centrally controlled through their SSO, or through the tools that the company had put behind the firewall, these security-centric folks in business thought, ‘Oh, I can use 1Password for this’,” says Faugno. “We got pulled into thousands of business environments by these people. That’s when our awakening happened – the battlefield had moved from the building walls to where the end user was, wherever they were, with whatever tools they were using.” One of the first things Faugno did when he joined 1Password was to hire a finance leader. By having a sales team engage with enterprise clients to understand their needs, such as administrative controls or additional reporting functionality, 1Password was able to develop its existing platform and market an enterprise service to the business community. “When we first made the investment in 1Password in 2019, the company had zero salespeople and pretty much zero accountants,” says Faugno. “It was nothing but developers, building a great product, and support people. Those use cases would organically come, but what we weren’t doing is interfacing with the chief information security officers at large enterprises to share how our platform fits into their overall security architecture.” 1Password started building infrastructure around enterprise level support and billing capabilities, as well as sales and post-sales implementation capabilities, to allow it to engage with the business sector. Any change to a company carries with it a certain level of risk and expense, especially when it involves adapting to a changing market. It has taken four years, but 1Password’s core business model has created solid foundation for the company to build on. Despite the absence of salespeople and accountants, 1Password’s cash flow had remained profitable. This strong position allowed 1Password the opportunity for forward investment (investing in a company to improve a return on investment) without sacrificing profitability. Although maintaining durability of growth is essential for financial sustainability, it can be challenging. Unless an organisation has a financially stable core product, significant resources can be spent promoting a product that causes a sudden growth curve, but the growth will stop as soon as the money is used up if it was not sustainable. 1Password had the opportunity to invest in itself while remaining profitable in the different sectors, ensuring a durable growth. Instead of optimising for profitability, 1Password is forward investing across several areas without the need to pay off debt from a private equity transaction. “Over 75% of our sales are to companies, but so many people think of us as a consumer business, because either they know us personally or they’ve seen the legacy of us over the 20 years,” says Faugno.  The cyber security sector is a constantly evolving market, with an ongoing war of attrition between hackers and security teams: what is cutting edge now could be obsolete in six months’ time. Not only must security companies have a solid product, but they must also constantly update it in response to emerging threats. Soon, one of the key challenges that cyber security teams will need robust solutions for is protecting their communications in a post-quantum world. Quantum computers can process vast amounts of information in a fraction of the time that classical computers would take, including today’s supercomputers. This will have massive implications for cyber security as quantum computers will be able quickly break current encryption systems. There are various technologies already being developed that are described as quantum resistant, but testing of these is still ongoing. Rather than focusing on a specific technology, 1Password has teams researching emerging challenges. The future security challenge presented by quantum computing necessitate a multifaceted security strategy – 2FA/MFA, passkeys and federation (authentication across networked systems). “We have teams that are engaged deeply in thinking about what’s not only the next step, but two steps ahead,” says Faugno. “The world is changing across a number of dimensions, and quantum computing represents one. Passkeys are going to help, but the pathway to passwordlesss is a journey that’s going to take decades.   “Our view is that you have to start with the visibility of everything that exists and move everything on the continuum to passwordlesss. Today, that is having strong and unique passwords and encrypted vaults, adding multi-factor authentication, using passkeys where they’re available, and ultimately moving to federation.” Reputation is essential, especially in security. If a tool has proven itself to be viable and effective protection against attacks in the wild, then that will over carry into the business sector and naturally generate interest from organisations. “If you can build that level of endearment to the end user at the individual level, then what you can do for the business user is very similar,” concludes Faugno. “You can satisfy the most robust and hard-to-crack use case for making someone feel like this tool is helping them be secure and productive.”  Read more from the Security Interviews Series Armis CEO Yevgeny Dibrov talks about how his military service and intelligence work opened the door into the world of cyber security entrepreneurship. Okta regional chief security officer for EMEA sits down with Dan Raywood to talk about how Okta is pivoting to a secure-by-design champion. Threat intel expert and author Martin Lee, EMEA technical lead for security research at Cisco Talos, joins Computer Weekly to mark the 35th anniversary of the first ever ransomware attack. In The Current Issue: UK MoJ crime prediction algorithms raise serious concerns Interview: Markus Schümmelfeder, CIO, Boehringer Ingelheim Download Current Issue GraphQL as an ‘essential protocol’ for AI-API orchestration – CW Developer Network Mind the insight-to-impact gap, Qlik captures analytics ‘in the moment’ – CW Developer Network View All Blogs

Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More Unpatched systems are a ticking time bomb. Fifty-seven percent of cyberattack victims acknowledge that available patches would have prevented breaches, yet nearly one-third admit failing to act, compounding the risk. Ponemon research shows organizations now take an alarming average of 43 days to detect cyberattacks, even after a patch is released, up from 36 days the previous year. According to the Verizon 2024 Data Breach Investigations Report, attackers’ ability to exploit vulnerabilities surged by 180% from 2023 to 2024. Chronic firefighting makes manual or partially automated patching overly burdensome, further pushing patching down teams’ priority lists. Relying on manual or partially automated patching systems is considered too time-consuming, further reducing patching to the bottom of a team’s action item list. This is consistent with an Ivanti study that found that the majority (71%) of IT and security professionals think patching is overly complex, cumbersome and time-consuming. When it comes to patching, complacency kills Attackers aggressively exploit legacy Common Vulnerabilities and Exposures (CVEs), often ten or more years old. A sure sign of how effective attackers’ tradecraft is becoming at targeting legacy CVEs is their success with vulnerabilities in some cases, 10-plus years old. A sure sign that attackers are finding new ways to weaponize old vulnerabilities is reflected in the startling stat that 76% of vulnerabilities leveraged by ransomware were reported between 2010 and 2019. The misalignment between IT and security teams compounds delays, with 27% lacking cohesive patch strategies and nearly a quarter disagreeing on patch schedules. One of the unexpected benefits of automating patch management is breaking the impasse between IT and security when it comes to managing the patch workload.    “Typically, on average, an enterprise may patch 90% of desktops within two to four weeks, 80% of Windows servers within six weeks and only 25% of Oracle Databases within six months from patch release date”, writes Gartner in their recent report, “We’re not patching our way out of vulnerability exposure.” The report states that “the cold, hard reality is that no one is out patching threat actors at scale in any size organization, geography or industry vertical.” Ring deployment: proactive defense at scale Every unpatched endpoint or threat surface invites attackers to exploit it. Enterprises are losing the patching race, which motivates attackers even more. In the meantime, patching has become exponentially more challenging for security and IT teams to manage manually. Approximately a decade ago, ring deployment began to rely on Microsoft-dominated networks. Since then, ring deployments have proliferated across on-premise and cloud-based patch and risk management systems. Ring deployment provides a phased, automated strategy, shrinking attacker windows and breach risks. Ring deployment rolls out patches incrementally through carefully controlled stages or “rings:” Test Ring (1%): Core IT teams quickly validate patch stability. Early Adopter Ring (5–10%): A broader internal group confirms real-world compatibility. Production Ring (80–90%): Enterprise-wide rollout after stability is conclusively proven. Ivanti’s recent release of ring deployment is designed to give security teams greater control over when patches will be deployed, to which systems and how each sequence of updates will be managed. By addressing patching issues early, the goal is to minimize risks and reduce and eliminate disruptions. Gartner’s ring deployment strategy escalates patches from internal IT outward, providing continuous validation and dramatically reducing deployment risk. Source: Gartner, “Modernize Windows and Third-Party Application Patching,” p. 6. Ring deployment crushes MTTP, ends reactive patching chaos Relying on outdated vulnerability ratings to lead patch management strategies only increases the risk of a breach as enterprises race to keep up with growing patch backlogs. That’s often when patching becomes cybersecurity’s endless nightmare, with attackers looking to capitalize on the many legacy CVEs that remain unprotected. Gartner’s take in their recent report “Modernize windows and third-party application patching” makes the point brutally clear, showing how traditional patching methods routinely fail to keep pace. In contrast, enterprises embracing ring deployment are getting measurable results. Their research finds ring deployment achieves a “99% patch success within 24 hours for up to 100,000 PCs,” leaving traditional methods far behind. During an interview with VentureBeat, Tony Miller, Ivanti’s VP of enterprise services, emphasized that “Ivanti Neurons for Patch Management and implementing Ring Deployment is an important part of our Customer Zero journey.” He said the company uses many of its own products, which allows for a quick feedback loop and gives developers insight into customers’ pain points. Miller added: “We’ve tested out Ring Deployment internally with a limited group, and we are in the process of rolling it out organization-wide. In our test group, we have benefited from deploying patches based on real-world risk, and ensuring that updates don’t interrupt employee productivity–a significant challenge for any IT organization.” VentureBeat also spoke with Jesse Miller, SVP and director of IT at Southstar Bank, about leveraging Ivanti’s dynamic Vulnerability Risk Rating (VRR), an AI-driven system continuously recalibrated with real-time threat intelligence, live exploit activity, and current attack data. Miller stated clearly: “This is an important change for us and the entire industry. Judging a patch based on its CVSS now is like working in a vacuum. When judging how impactful something can be, you have to take everything from current events, your industry, your environment and more into the equation. Ultimately, we are just making wiser decisions as we are not disregarding CVSS scoring; we are simply adding to it.” Miller also highlighted his team’s prioritization strategy: “We have been able to focus on prioritizing Zero-Day and Priority patches to get out first, as well as anything being exploited live in the wild. Using patch prioritization helps us eliminate our biggest risk first so that we can reduce our attack surface as quickly as possible.” By combining ring deployment and dynamic VRR technology, Ivanti Neurons provides enterprises with structured visual orchestration of incremental patch rollouts. This approach sharply reduces Mean-Time-to-Patch (MTTP), accelerating patches from targeted testing through full deployment and significantly decreasing the exposure windows that attackers exploit. Caption: The Ivanti Neurons interface visually manages deployment rings, success thresholds, patching progress and streamlining operational clarity. Source: Ivanti Neurons Comparing Ivanti Neurons, Microsoft Autopatch, Tanium and ServiceNow: Key strengths and gaps When selecting enterprise patch management solutions, apparent differences emerge among leading providers, including Microsoft Autopatch, Tanium, ServiceNow and Ivanti Neurons. Microsoft Autopatch relies on ring deployment but is restricted to Windows environments, including Microsoft 365 applications. Ivanti Neurons expands on this concept by covering a broader spectrum, including Windows, macOS, Linux and various third-party applications. This enables enterprise-wide patch management for organizations with large-scale, diverse infrastructure. Tanium stands out for its robust endpoint visibility and detailed reporting features, but its infrastructure requirements typically align better with resource-intensive enterprises. Meanwhile, ServiceNow’s strength lies in workflow automation and IT service management integrations. Executing actual patches often demands significant additional customization or third-party integrations. Ivanti Neurons aims to differentiate by integrating dynamic risk assessments, phased ring deployments and automated workflows within a single platform. It directly addresses common enterprise challenges in patch management, including visibility gaps, operational complexity and uncertainty about vulnerability prioritization with real-time risk assessments and intuitive visual dashboards. Caption: Ivanti Neurons provides real-time patch status, vulnerability assessments, and risk exposure metrics, ensuring continuous visibility. Source: Ivanti Neurons Transforming patch management into a strategic advantage Patching alone cannot eliminate vulnerability exposure. Gartner’s analysts continue to stress the necessity of integrating compensating controls, including endpoint protection platforms (EPP), multifactor authentication, and network segmentation to reinforce security beyond basic patching. Combining ring deployment with integrated compensating controls that are part of a broader zero-trust framework ensures security, allows IT teams to shrink exposure windows, and better manage cyber risks. Ivanti’s approach to ring deployment incorporates real-time risk assessments, automated remediation workflows, and built-in threat management, directly aligning patch management with broader business resilience strategies. The design decision to make it part of Neurons for Patch Management delivers the scale enterprises need to improve risk management’s real-time visibility.   Bottom line: Integrating ring deployment with compensating controls and prioritization tools transforms patch management from a reactive burden to a strategic advantage. Daily insights on business use cases with VB Daily If you want to impress your boss, VB Daily has you covered. We give you the inside scoop on what companies are doing with generative AI, from regulatory shifts to practical deployments, so you can share insights for maximum ROI. Read our Privacy Policy Thanks for subscribing. Check out more VB newsletters here. An error occured.

May 16, 2025The Hacker NewsZero Trust / Data Protection Data is the lifeblood of productivity, and protecting sensitive data is more critical than ever. With cyber threats evolving rapidly and data privacy regulations tightening, organizations must stay vigilant and proactive to safeguard their most valuable assets. But how do you build an effective data protection framework? In this article, we'll explore data protection best practices from meeting compliance requirements to streamlining day-to-day operations. Whether you're securing a small business or a large enterprise, these top strategies will help you build a strong defense against breaches and keep your sensitive data safe. 1. Define your data goals When tackling any data protection project, the first step is always to understand the outcome you want. First, understand what data you need to protect. Identify your crown jewel data, and where you THINK it lives. (It's probably more distributed than you expect, but this is a key step to help you define your protection focus.) Work with business owners to find any data outside the typical scope that you need to secure. This is all to answer the question: "What data would hurt the company if it were breached?" Second, work with the C-suit and board of directors to define what your data protection program will look like. Understand your budget, your risk tolerance to data loss, and what resources you have (or may need). Define how aggressive your protection program will be so you can balance risk and productivity. All organizations need to strike a balance between the two. 2. Automate data classification Next, begin your data classification journey—that is, find your data and catalog it. This is often the most difficult step in the journey, as organizations create new data all the time. Your first instinct may be to try to keep up with all your data, but this may be a fool's errand. The key to success is to have classification capabilities everywhere data moves (endpoint, inline, cloud), and rely on your DLP policy to jump in when risk arises. (More on this later.) Automation in data classification is becoming a lifesaver thanks to the power of AI. AI-powered classification can be faster and more accurate than traditional ways of classifying data with DLP. Ensure any solution you are evaluating can use AI to instantly uncover and discover data without human input. 3. Focus on zero trust security for access control Adopting a zero trust architecture is crucial for modern data protection strategies to be effective. Based on the maxim "never trust, always verify," zero trust assumes security threats can come from inside or outside your network. Every access request is authenticated and authorized, greatly reducing the risk of unauthorized access and data breaches. Look for a zero trust solution that emphasizes the importance of least-privileged access control between users and apps. With this approach, users never access the network, reducing the ability for threats to move laterally and propagate to other entities and data on the network. The principle of least privilege ensures that users have only the access they need for their roles, reducing the attack surface. 4. Centralize DLP for consistent alerting Data loss prevention (DLP) technology is the core of any data protection program. That said, keep in mind that DLP is only a subset of a larger data protection solution. DLP enables the classification of data (along with AI) to ensure you can accurately find sensitive data. Ensure your DLP engine can consistently alert correctly on the same piece of data across devices, networks, and clouds. The best way to ensure this is to embrace a centralized DLP engine that can cover all channels at once. Avoid point products that bring their own DLP engine (endpoint, network, CASB), as this can lead to multiple alerts on one piece of moving data, slowing down incident management and response. Look to embrace Gartner's security service edge approach, which delivers DLP from a centralized cloud service. Focus on vendors that support the most channels so that, as your program grows, you can easily add protection across devices, inline, and cloud. 5. Ensure blocking across key loss channels Once you have a centralized DLP, focus on the most important data loss channels to your organization. (You'll need to add more channels as you grow, so ensure your platform can accommodate all of them and grow with you.) The most important channels can vary, but every organization focuses on certain common ones: Web/Email: The most common ways users accidentally send sensitive data outside the organization. SaaS data (CASB): Another common loss vector, as users can easily share data externally. Endpoint: A key focus for many organizations looking to lock down USB, printing, and network shares. Unmanaged devices/BYOD: If you have a large BYOD footprint, browser isolation is an innovative way to secure data headed to these devices without an agent or VDI. Devices are placed in an isolated browser, which enforces DLP inspection and prevents cut, paste, download, or print. (More on this later.) SaaS posture control (SSPM/supply chain): SaaS platforms like Microsoft 365 can often be misconfigured. Continuously scanning for gaps and risky third-party integrations is key to minimizing data breaches. IaaS posture control (DSPM): Most companies have a lot of sensitive data across AWS, Azure, or Google Cloud. Finding it all, and closing risky misconfigurations that expose it, is the driver behind data security posture management (DSPM). 6. Understand and maintain compliance Getting a handle on compliance is a key step for great data protection. You may need to keep up with many different regulations, depending on your industry (GDPR, PCI DSS, HIPAA, etc.). These rules are there to make sure personal data is safe and organizations are handling it the right way. Stay informed on the latest mandates to avoid fines and protect your brand, all while building trust with your customers and partners. To keep on top of compliance, strong data governance practices are a must. This means regular security audits, keeping good records, and making sure your team is well-trained. Embrace technological approaches that help drive better compliance, such as data encryption and monitoring tools. By making compliance part of your routine, you can stay ahead of risks and ensure your data protection is both effective and in line with requirements. 7. Strategize for BYOD Although not a concern for every organization, unmanaged devices present a unique challenge for data protection. Your organization doesn't own or have agents on these devices, so you can't ensure their security posture or patch level, wipe them remotely, and so on. Yet their users (like partners or contractors) often have legitimate reasons to access your critical data. You don't want sensitive data to land on a BYOD endpoint and vanish from your sight. Until now, solutions to secure BYOD have revolved around CASB reverse proxies (problematic) and VDI approaches (expensive). Browser isolation provides an effective and eloquent way to secure data without the cost and complexity of those approaches. By placing BYOD endpoints in an isolated browser (part of the security service edge), you can enforce great data protection without an endpoint agent. Data is streamed to the device as pixels, allowing interaction with the data but preventing download and cut/paste. You can also apply DLP inspection to the session and data based on your policy. 8. Control your cloud posture with SSPM and DSPM Cloud posture is one of the most commonly overlooked aspects of data hygiene. SaaS platforms and public clouds have many settings that DevOps teams without security expertise can easily overlook. The resulting misconfigurations can lead to dangerous gaps that expose sensitive data. Many of the largest data breaches in history have happened because such gaps let adversaries walk right in. SaaS security posture management (SSPM) and data security posture management (DSPM for IaaS) are designed to uncover and help remediate these risks. By leveraging API access, SSPM and DSPM can continuously scan your cloud deployment, locate sensitive data, identify misconfigurations, and remediate exposures. Some SSPM approaches also feature integrated compliance with frameworks like NIST, ISO, and SOC 2. 9. Don't forget about data security training Data security training is often where data protection programs fall apart. If users don't understand or support your data protection goals, dissent can build across your teams and derail your program. Spend time building a training program that highlights your objectives and the value data protection will bring the organization. Ensure upper management supports and sponsors your data security training initiatives. Some solutions offer built-in user coaching with incident management workflows. This valuable feature allows you to notify users about incidents via Slack or email for justification, education, and policy adjustment if needed. Involving users in their incidents helps promote awareness of data protection practices as well as how to identify and safely handle sensitive content. 10. Automate incident management and workflows Lastly, no data protection program would be complete without day-to-day operations. Ensuring your team can efficiently manage and quickly respond to incidents is critical. One way to ensure streamlined processes is to embrace a solution that enables workflow automation. Designed to automate common incident management and response tasks, this feature can be a lifesaver for IT teams. By saving time and money while improving response times, IT teams can do more with less. Look for solutions that have a strong workflow automation offering integrated into the SSE to make incident management efficient and centralized. Bringing it all together Data protection is not a one-time project; it's an ongoing commitment. Staying informed of data protection best practices will help you build a resilient defense against evolving threats and ensure your organization's long-term success. Remember: investing in data protection is not just about mitigating risks and preventing data breaches. It's also about building trust, maintaining your reputation, and unlocking new opportunities for growth. Learn more at zscaler.com/security Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More LangChain, one of the leaders in the AI framework and orchestration space, plans to remain committed to the open source ecosystem, particularly as it reinforces its vendor-agnostic stance.  Harrison Chase, Langchain co-founder and CEO, told VentureBeat that the success of its different platforms can be attributed to developers demanding model choice and not staying in a closed provider.  “The power of the LangChain framework is in its integrations and the ecosystem,” Chase said. “The scale of the ecosystem is enormous, and much of that is made possible by the framework being open source.” Chase said LangChain downloads reached 72.3 million last month, compared to competitors like OpenAI’s Agents SDK. He added that the LangChain Python and JS frameworks “have 4,500 contributors, that’s more contributors than Spark.” LangChain, founded in 2022, has grown beyond its initial framework, which helped developers build AI applications. In February last year, it released the testing and evaluation platform LangSmith, a second framework called LangGraph and LangGraph Platform to help deploy autonomous agents.  LangChain remained open source and agnostic to vendors and models throughout its growth. For example, it’s partnered with multiple companies, like Google and Cisco, around agent interoperability. As enterprises began experimenting with AI agents, Chase said LangChain saw an opportunity to offer deployment options that considered developer choices. “Over the past year and a half or so, more and more enterprises and companies are just looking to go into production. So we matured all of our offerings, not just the open source LangChain, but all of our offerings collectively as a company to meet that demand and make it as easy as possible to build agentic applications,” he said.  LangGraph Platform extends open-source offerings One of LangChain’s new open-source platforms is the LangGraph Platform, which became generally available this week. The LangGraph Platform lets developers manage and begin deploying long-lasting or stateful agents. These agents build on what Chase calls “ambient agents,” or agents that work in the background and are triggered by certain events.  “We’ve tried to focus a lot on some of the harder infrastructure problems that surround these agents,” Chase said. “LangGraph is good for long-running stateful agents, so if you’re deploying a simple application, you don’t want to use LangGraph Platform.” He added that the company wants to bet big on ambient or long-running agents, finding this more independent, autonomous agent a more interesting infrastructure challenge.  Through the LangGraph Platform, organizations can deploy agents with one-click deployment, horizontal scaling to handle “bursty, long-running traffic,” a persistence layer to support agentic memory, API endpoints for customization and native access to LangGraph Studio to debug any agents.  Organizations might find themselves bringing more and more agents online. LangGraph Platform includes a management console that lays out all the agents currently deployed and lets users find agents, reuse common agent architectures and create multi-agent architectures.” “One of the big benefits of LangGraph is that it gives the builder of the agent full control over the cognitive architecture. If there’s an [large language model] LLM action that must be done right, a good tool you have to enforce quality is to create an in-the-loop evaluation directly in your LangGraph app,” Chase said.  Chase added that with LangGraph, developers can access “a good orchestration framework” to build agents and bring these reliable agents into LangGraph Platform for deployment.  During the best test, Chase said over 370 teams used LangGraph Platform. LangChain offers three tiers to use LangGraph Platform, with pricing dependent on how developers plan to host the service.  The broader LangChain open-source ecosystem For Chase, one of LangChain’s strengths is its ability to create an entire application and agent development ecosystem.  LangSmith, the company’s testing and observability platform, works with LangGraph and LangGraph Platform to track agent metrics. Since many agents built and run with LangGraph Platform are longer-running, enterprises need to check whether they continue to perform to specifications constantly.  Chase boasted that LangGraph “is the most widely adopted agent framework” and claimed it’s downloaded more than AutoGen from Microsoft and the CrewAI agentic platform, once again citing the open-source value for its success. “LangGraph is most often selected by teams that need to build end-user facing or highly trafficked agents (LinkedIn, Uber, GitLab) – the reason is that you won’t scale off of LangGraph because it’s very low-level and controllable, which is needed for reliable agents. CrewAI and Autogen are often used because they have a less steep learning curve – these frameworks make more decisions for the user, so you’re trading ease of adoption for power,” he said. Daily insights on business use cases with VB Daily If you want to impress your boss, VB Daily has you covered. We give you the inside scoop on what companies are doing with generative AI, from regulatory shifts to practical deployments, so you can share insights for maximum ROI. Read our Privacy Policy Thanks for subscribing. Check out more VB newsletters here. An error occured.

May 15, 2025The Hacker NewsRansomware Defense / Business Continuity Ransomware has evolved into a deceptive, highly coordinated and dangerously sophisticated threat capable of crippling organizations of any size. Cybercriminals now exploit even legitimate IT tools to infiltrate networks and launch ransomware attacks. In a chilling example, Microsoft recently disclosed how threat actors misused its Quick Assist remote assistance tool to deploy the destructive Black Basta ransomware strain. And what’s worse? Innovations like Ransomware-as-a-Service (RaaS) are lowering the bar for entry, making ransomware attacks more frequent and far-reaching than ever before. According to Cybersecurity Ventures, by 2031, a new ransomware attack is expected every 2 seconds, with projected damages hitting an astronomical $275 billion annually. No organization is immune to ransomware, and building a strong recovery strategy is equally, if not even more, important than attempting to prevent all attacks in the first place. A solid business continuity and disaster recovery (BCDR) strategy can be your last and most critical line of defense when ransomware breaks through, allowing you to bounce back quickly from the attack, resume operations and avoid paying ransom. Notably, the cost of investing in BCDR is negligible compared to the devastation that prolonged downtime or data loss can cause. In this article, we’ll break down the five essential BCDR capabilities you should have in place to effectively recover from ransomware. These strategies can mean the difference between swift recovery and business failure after an attack. Let’s explore what every organization must do before it’s too late. Follow the 3-2-1 (and then some!) backup rule The 3-2-1 backup rule has long been the gold standard: keep three copies of your data, store them on two different media and keep one copy off-site. But in the age of ransomware, that’s no longer enough. Experts now recommend the 3-2-1-1-0 strategy. The extra 1 stands for one immutable copy — a backup that can’t be changed or deleted. The 0 represents zero doubt in your ability to recover, with verified, tested recovery points. Why the upgrade? Ransomware doesn’t just target production systems anymore. It actively seeks and encrypts backups as well. That’s why isolation, immutability and verification are key. Cloud-based and air-gapped backup storage provide essential layers of protection, keeping backups out of reach from threats that even use stolen admin credentials. Having such immutable backups ensures recovery points remain untampered, no matter what. They’re your safety net when everything else is compromised. Plus, this level of data protection helps meet rising cyber insurance standards and compliance obligations. Bonus tip: Look for solutions offering a hardened Linux architecture to camouflage and isolate backups outside of the common Windows attack surface. Automate and monitor backups continuously Automation is powerful, but without active monitoring, it can become your biggest blind spot. While scheduling backups and automating verification saves time, it’s just as important to ensure that those backups are actually happening and that they’re usable. Use built-in tools or custom scripting to monitor backup jobs, trigger alerts on failures and verify the integrity of your recovery points. It’s simple: either monitor continuously or risk finding out too late that your backups never had your back. Regularly testing and validating the recovery points is the only way to trust your recovery plan. Bonus tip: Choose solutions that integrate with professional services automation (PSA) ticketing systems to automatically raise alerts and tickets for any backup hiccups. Protect your backup infrastructure from ransomware and internal threats Your backup infrastructure must be isolated, hardened and tightly controlled to prevent unauthorized access or tampering. You must: Lock down your backup network environment. Host your backup server in a secure local area network (LAN) segment with no inbound internet access. Allow outbound communication from the backup server only to approved vendor networks. Block all unapproved outbound traffic using strict firewall rules. Permit communication only between protected systems and the backup server. Use firewalls and port-based access control lists (ACLs) on network switches to enforce granular access control. Apply agent-level encryption so data is protected at rest, using keys generated from a secure passphrase only you control. Enforce strict access controls and authentication. Implement role-based access control (RBAC) with least-privilege roles for Tier 1 techs. Ensure multifactor authentication (MFA) for all access to the backup management console. Monitor audit logs continuously for privilege escalations or unauthorized role changes. Ensure audit logs are immutable. Review regularly for: Security-related events like failed logins, privilege escalations, deletion of backups and device removal. Administrative actions such as changes to backup schedules, changes to retention settings, new user creation and changes to user roles. Backup and backup copy (replication) success/failure rates and backup verification success/failure rates. Stay alert to serious risks. Configure automatic alerts for policy violations and high-severity security events, such as an unauthorized change to backup retention policies. Test restores regularly and include them in your DR plan Backups mean nothing if you can’t restore from them quickly and completely, and that’s why regular testing is essential. Recovery drills must be scheduled and integrated into your disaster recovery (DR) plan. The goal is to build muscle memory, reveal weaknesses and confirm that your recovery plan actually works under pressure. Start by defining the recovery time objective (RTO) and the recovery point objective (RPO) for every system. These determine how fast and how recent your recoverable data needs to be. Testing against those targets helps ensure your strategy aligns with business expectations. Importantly, don’t limit testing to one type of restore. Simulate file-level recoveries, full bare-metal restores and full-scale cloud failovers. Each scenario uncovers different vulnerabilities, such as time delays, compatibility issues or infrastructure gaps. Also, recovery is more than a technical task. Involve stakeholders across departments to test communication protocols, role responsibilities and customer-facing impacts. Who talks to clients? Who triggers the internal chain of command? Everyone should know their role when every second counts. Detect threats early with backup-level visibility When it comes to ransomware, speed of detection is everything. While endpoint and network tools often get the spotlight, your backup layer is also a powerful, often overlooked line of defense. Monitoring backup data for anomalies can reveal early signs of ransomware activity, giving you a critical head start before widespread damage occurs. Backup-level visibility allows you to detect telltale signs like sudden encryption, mass deletions or abnormal file modifications. For example, if a process begins overwriting file contents with random data while leaving all modified timestamps intact, that’s a major red flag. No legitimate program behaves that way. With smart detection at the backup layer, you can catch these behaviors and get alerted immediately. This capability doesn’t replace your endpoint detection and response (EDR) or antivirus (AV) solutions; it supercharges them. It speeds up triage, helps isolate compromised systems faster and reduces an attack’s overall blast radius. For maximum impact, choose backup solutions that offer real-time anomaly detection and support integration with your security information and event management (SIEM) or centralized logging systems. The faster you see the threat, the faster you can act — and that can be the difference between a minor disruption and a major disaster. Bonus tip: Train end users to recognize and report suspicious activity early If BCDR is your last line of defense, your end users are the first. Cybercriminals are increasingly targeting end users today. According to Microsoft Digital Defense Report 2024, threat actors are trying to access user credentials through various methods, such as phishing, malware and brute-force/password spray attacks. Over the last year, around 7,000 password attacks were blocked per second in Entra ID alone. In fact, ransomware attacks often begin with a single click, usually via phishing emails or compromised credentials. Regular security training — especially simulated phishing exercises — helps build awareness of red flags and risky behaviors. Equip your team with the knowledge to spot ransomware warning signs, recognize unsafe data practices and respond appropriately. Encourage immediate reporting of anything that seems off. Foster a culture of enablement, not blame. When people feel safe to speak up, they’re more likely to take action. You can even take it further by launching internal programs that reward vigilance, such as a Cybersecurity Hero initiative to recognize and celebrate early reporters of potential threats. Final thoughts Ransomware doesn’t have to be feared; it has to be planned for. The five BCDR capabilities we discussed above will equip you to withstand even the most advanced ransomware threats and ensure your organization can recover quickly, completely and confidently. To seamlessly implement these strategies, consider Datto BCDR, a unified platform that integrates all these capabilities. It’s built to help you stay resilient, no matter what happens. Don’t wait for a ransom note to discover that your backups weren’t enough. Explore how Datto can strengthen your ransomware resilience. Get custom Datto BCDR pricing today. Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

A patch and a workaround are available but Ivanti urges users patch up.

May 14, 2025Ravie LakshmananVulnerability / Endpoint Security Ivanti has released security updates to address two security flaws in Endpoint Manager Mobile (EPMM) software that have been chained in attacks to gain remote code execution. The vulnerabilities in question are listed below - CVE-2025-4427 (CVSS score: 5.3) - An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials CVE-2025-4428 (CVSS score: 7.2) - A remote code execution vulnerability in Ivanti Endpoint Manager Mobile allowing attackers to execute arbitrary code on the target system The flaws impact the following versions of the product - 11.12.0.4 and prior (Fixed in 11.12.0.5) 12.3.0.1 and prior (Fixed in 12.3.0.2) 12.4.0.1 and prior (Fixed in 12.4.0.2) 12.5.0.0 and prior (Fixed in 12.5.0.1) Ivanti, which credited CERT-EU for reporting the issues, said it's "aware of a very limited number of customers who have been exploited at the time of disclosure" and that the vulnerabilities are "associated with two open-source libraries integrated into EPMM." The company, however, did not disclose the names of the impacted libraries. It's also not known what other software applications relying on the two libraries could be affected. Furthermore, the company said it's still investigating the cases, and that it does not have reliable indicators of compromise associated with the malicious activity. "The risk to customers is significantly reduced if they already filter access to the API using either the built-in Portal ACLs functionality or an external web application firewall," Ivanti noted. "The issue only affects the on-prem EPMM product. It is not present in Ivanti Neurons for MDM, Ivanti's cloud-based unified endpoint management solution, Ivanti Sentry, or any other Ivanti products." Separately, Ivanti has also shipped patches to contain an authentication bypass flaw in on-premise versions of Neurons for ITSM (CVE-2025-22462, CVSS score: 9.8) that could allow a remote unauthenticated attacker to gain administrative access to the system. There is no evidence that the security defect has been exploited in the wild. With zero-days in Ivanti appliances becoming a lightning rod for threat actors in recent years, it's imperative that users move quickly to update their instances to the latest versions for optimal protection. Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    