A Qualys India perspective on CERT-In’s blueprint, the post-Mythos threat landscape India faces, and why the operating model needs to change.  Key Takeaways Mythos-class AI changes the vulnerability equation from CVE matching to autonomous exploit discovery, turning known, unpatched weaknesses into weaponized exploits at machine speed.  CERT-In’s 2026 blueprint expects 12-hour containment for known exploited vulnerabilities on […]

Key Takeaways Windows 11 24H2 reaches the end of servicing on October 13, 2026, making timely enterprise upgrades critical. Enterprises often face version drift, with multiple Windows 11 builds across endpoints requiring different upgrade paths. Upgrade approaches vary based on system state and may include enablement packages, ISO-based feature updates, or direct Windows 10 upgrades. […]

AI-powered detection has crossed a threshold. Security teams can now surface vulnerabilities, misconfigurations, and active attack paths at a speed and scale that was unimaginable a few years ago. The problem is no longer finding or knowing risk; it’s closing it fast enough to matter. Cloud deployments compound this pressure in a specific way: the […]

Oracle released its third quarterly edition of this year’s Critical Patch Update. The update received patches for 245 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products. In this quarterly Oracle Critical Patch Update, Oracle Fusion Middleware received the highest […]

Key Takeaways The 2025 list introduces two new categories – Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10) – reflecting attacks already happening in production. Security Misconfiguration jumping from #5 to #2 signals that continuous deployment without continuous scanning creates active exposure windows. Broken Access Control (A01) now explicitly covers BOLA and […]

Executive Summary Recognizing the ability of Frontier AI models to discover and exploit vulnerabilities at unprecedented speed and scale, CISA’s Binding Operational Directive (BOD) 26-04 marks a significant shift in federal vulnerability management. The directive introduces aggressive mandates, requiring federal civilian agencies to remediate high-risk vulnerabilities, specifically those that are publicly exposed, on the KEV […]

Every security leader walks into Monday morning with the same question. The findings are there. The dashboards are running. But out of the thousands of critical vulnerabilities on that list, which ones can an attacker actually use against this organization today? Not in theory. Not in a lab. In production, with the controls that are […]

Every Patch Tuesday presents a race between defenders applying fixes and attackers seeking opportunities. Microsoft’s June 2026 release is no exception, delivering security updates for vulnerabilities that could significantly impact enterprise environments if left unaddressed. Microsoft Patch Tuesday for June 2026 This month’s release addresses 206 vulnerabilities, including 33 critical and 167 important-severity vulnerabilities. In this month’s updates, Microsoft has addressed three publicly disclosed zero-day vulnerabilities. There were also a massive 360 Microsoft […]

The cybersecurity industry has spent much of the last two years debating how attackers might use AI. That debate matters, but it misses a larger point: defenders now have an opportunity to change the economics of cyber risk. For me, the question is not whether AI will influence cybersecurity. It already is. The real question […]

In the first article in this series, we made the case for a prevention-led operating model. This article is about what happened next: the decision to build something that did not exist, and what it took to make it real. Turning an operating model into a product sounds straightforward until you are standing in front […]