Peter Pavlovich

Download Pentera Labs Report - revealing three new critical injection points in the ingress-nginx controller, building on Wiz’s IngressNightmare CVE. These overlooked vulnerabilities could let attackers hijack traffic, spoof headers, or reach unauthorized backend services - They exist in one of the most widely used ingress controllers in Kubernetes, putting countless environments at risk. This research highlights how small misconfigurations can lead to major exposure in modern cloud-native architectures. What’s Inside: ✅ 3 new injection vulnerabilities in ingress-nginx ✅ How attackers find and exploit CVEs in open source ✅ Actionable tips to secure your Kubernetes environment https://lnkd.in/eHtX6EdP

6

1 Comment

Your CI/CD bill is not exploding because of “expensive runners,” it is bleeding out through flaky tests, over-parallelized jobs, and slow feedback loops that quietly tax every deploy This piece shows you how to redesign pipelines so you cut compute waste, shrink queues, and speed up developer flow without adding yet another approval gate or YAML religion Full breakdown in the comments. #DevOps #CICD #PlatformEngineering

8

1 Comment

"My team feels like they’re drowning in bugs & incidents AI is speeding everything up" - From a CISO friend  👀 Here’s the playbook she used to handle the AI flood 👇🏾 AI has been a double-edged sword for most teams: ⚡ 10x more bugs ⚡ Constant alerts ⚡ Pressure to respond faster 𝘢𝘯𝘥 smarter Fact: That overwhelming sensation is real. Ignoring it won’t make it go away. A CISO recently shared how she tried to maintain calm in her team while AI drove heavier workloads and tighter response timelines. Here’s the playbook approach that’s starting to work, so i wanted to share it here for others: 1️⃣ Start with empathy. - Acknowledge it out loud: “𝘐 𝘬𝘯𝘰𝘸 𝘵𝘩𝘪𝘴 𝘪𝘴 𝘩𝘢𝘳𝘥 & 𝘶𝘯𝘤𝘩𝘢𝘳𝘵𝘦𝘥 𝘵𝘦𝘳𝘳𝘪𝘵𝘰𝘳𝘺 𝘣𝘶𝘵 𝘸𝘦 𝘤𝘢𝘯 𝘵𝘢𝘤𝘬𝘭𝘦 𝘵𝘩𝘪𝘴 𝘵𝘰𝘨𝘦𝘵𝘩𝘦𝘳 𝘢𝘴 𝘢 𝘵𝘦𝘢𝘮.” - Share the load: empathy > heroics. - Ask the tough questions about AI usage: Would you trust AI in IR, and where must humans stay firmly in the loop? 2️⃣ Then provide structure/practical playbook that gives teams clarity (and speed): - Prioritise what matters → set AI usage standards (good / risky / don’t use) instead of reviewing every LLM or cloud service individually. - Protect the data → apply classification so teams know what can/can’t go into AI projects. - Experiment safely → use sandbox environments to test AI before it touches production. 🚀 This combination of empathy + clarity gave the teams both breathing room 𝘢𝘯𝘥 direction. ❤️ 👀 And then there’s AI safety which brings unpredictable risks that keep security leaders awake at night. ⚙️One creative way to tackle it - which was shared by another CISO? 🎯 Turn fear into play → run an AI CTF around your AI project (vibe coding is your friend) ⚡This give the workforce a Safe space to explore, break, and learn. ⚡You can also include Prizes to encourage more participation. The challenges with AI won’t vanish. But with empathy, smart AI adoption, and the right structures, we can help our teams move from 𝘥𝘳𝘰𝘸𝘯𝘪𝘯𝘨 to 𝘭𝘦𝘢𝘳𝘯𝘪𝘯𝘨. 👉🏾 How are you helping your team manage AI overwhelm without burning out?

12

7 Comments

#2025 gave us identity visibility. Lots of dashboards. Lots of confidence. And yet… Identity kept doing whatever it wanted. Some of what we saw included: • Apps ghosting IAM • Credentials living rent-free in code • Auth-flows sneaking around controls • Audits confidently wrong Nothing “failed.” It just wasn’t observable. That gap is where risk throws parties. If you want to read more we published some of it here 👉 Top Identity Gaps of 2025 https://lnkd.in/e_D6ZHBh Watch the video. Read the report. Then ask yourself what’s still running wild in your environment.

53

2 Comments

Most “remote access” stacks weren’t built for regulated, hybrid, and high-assurance environments. That’s where they break: • Fragmented tools • Inconsistent policies across cloud + on-prem • Weak session oversight • Audit trails you can’t defend Netop Portal fixes that by acting as a single control plane for Zero Trust remote access across cloud, on-prem, hybrid — even air-gapped deployments. What you get in one pane of glass: ✅ Centralized governance (identity, policy, workflows, session oversight) ✅ Zero Trust by design (verify, authorize, log every access request) ✅ Enterprise-grade visibility (active + historical sessions; who/what/when/why) ✅ Granular RBAC down to devices/groups + temporary elevation workflows ✅ Audit-grade logging & reporting (actions performed, auth events, policy matches/alerts) Integrates cleanly with your ecosystem • Identity: Azure AD / Microsoft Entra ID, AWS IAM, SAML, OIDC • Monitoring/SIEM: Splunk, Azure Monitor/Log Analytics, CloudWatch/CloudTrail, Elastic, plus SYSLOG/HTTPS SIEMs If you’re managing thousands of endpoints, supporting legacy/critical systems, or governing vendor & contractor access, #Netop Portal is built for that reality. Try Netop Portal or book a technical demo: https://netop.com/portal/ #ZeroTrust #Akeydor #RemoteAccess #CyberSecurity #IAM #ITOperations #Compliance #OTSecurity #CriticalInfrastructure #Netop

3

2 Comments

Get real-time SaaS visibility – right where it matters most: your browser 🎯 We built this extension because of one simple fact: your employees aren't making SaaS decisions in security reviews – they're making them in browser tabs. Now you can actually see and guide those decisions as they happen. 😍 Now you can: ✨ Get real-time insights into SaaS & AI tool usage (no more guessing!) ‼️ Detect identity security risks as they happen (catch those weak or reused passwords) 👉 Guide employees toward secure choices with in-browser nudges Stop playing whack-a-mole with shadow IT or shadowy workarounds. Now you can see it happen, understand it, and guide better decisions in real-time. Your employees stay productive, and you stay secure. That's what we call a win-win! 🤝 Learn More: https://bit.ly/3HZ7SQY

16

🚀 Anthropic Just Transformed Enterprise AI Collaboration Claude Cowork now lets admins build private plugin marketplaces for their entire organization. Here's what just dropped: **For Admins:** Private plugin marketplaces with full control over distribution Build plugins from templates or scratch - Claude guides you through setup New unified'Customize' menu for managing plugins, skills, and connectors OpenTelemetry support to track usage and costs across teams Per-user provisioning and auto-install options **For Teams:** Slash commands now launch with structured forms Company branding throughout the interface Claude works across Excel AND PowerPoint - handles multi-step tasks end-to-end **New Connectors:** Google Workspace (Calendar, Drive, Gmail), Docusign, Apollo, Clay, Outreach, Similarweb, MSCI, LegalZoom, FactSet, WordPress, and Harvey. Plus partnerships with Slack, LSEG, S&P Global, and more. **Fresh Plugin Templates:** HR operations, Design workflows, Engineering tasks, Brand voice analysis, Financial modeling, Investment banking, Equity research, Private equity, Wealth management. Each template built with actual practitioners. Real workflows, not theory. The cross-app functionality is wild. Claude can run analysis in Excel, then automatically create a presentation in PowerPoint. Context flows between apps just like your work does. "Three waves have reshaped professional work: productivity tools, cloud and search, and now agentic AI." - Sanjay Subramanian, PwC Available now for Team and Enterprise plans. The Excel and PowerPoint integration is in research preview for all paid plans. This is how AI becomes actually useful at work. Not replacing your tools - connecting them. Thoughts on private plugin marketplaces for enterprise?👇

14

2 Comments

A CTO told me last week: “I’m perfectly fine with 30% data center utilization—as long as the systems are resilient.” Meanwhile, vendors are still pitching 80%+ server utilization and hyperscale efficiency as the main selling points. Here’s the disconnect: The CTO doesn’t care about hyperscale metrics. He cares about one thing: keeping the manufacturing line running. If production stops, no one’s asking about CPU cycles or energy curves. They’re asking: Why did we go down? How much did it cost us? How fast can we get back online? Business outcomes > infrastructure performance. That’s the real metric modern IT leaders care about.

58

20 Comments

Stop blaming vibe coding for security failures. Instead, practice 𝗭𝗲𝗿𝗼 𝗧𝗿𝘂𝘀𝘁 and 𝗹𝗮𝘆𝗲𝗿𝗲𝗱 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 principles, and build it into your architecture up front. This has little to do with AI, and everything to do with agile, flexible engineering that allows "vibe" speed with "just enough" security and compliance. At LSA Digital, we practice "𝗩𝗶𝗯𝗲 𝗘𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝗶𝗻𝗴". For us, that means minimal architecture up front and day-0 security practices (even in dev), and compliance sweeps (which get heavier when data / IP needs to be protected). For example, even if you are working on a localhost machine and testing an app with test data (exposed to the internet), it can be trivial to setup a ZT reverse proxy authentication gateway with nothing more than a raspberry Pi server + apache modules + auto-updates enabled. 𝗙𝗼𝗿 𝘁𝗵𝗶𝘀 𝗺𝗶𝗻𝗶𝗺𝗮𝗹 𝗲𝗳𝗳𝗼𝗿𝘁, 𝘆𝗼𝘂 𝗴𝗲𝘁 𝗮 𝟮-𝗳𝗼𝗿-𝟭: your apps don't have to worry about complex authorization (from various providers), that gets delegated to mature, tested apache code & modules that have been around for years. You just focus on solving the business problem, not integrating your own auth code (that will eventually be mis-configured or day-0 hacked). 𝗦𝗰𝗮𝗹𝗶𝗻𝗴 𝗻𝗼𝘁𝗲: Obviously, don't run an apache gateway on an RPI for production boxes, scale up to cloud services for hardened security. Keith Mangold, Zach Y.

3