Security Boulevard

As cryptocurrency adoption continues to grow, so do the tactics used by cybercriminals to exploit users. One of the emerging threats in the blockchain ecosystem is address poisoning — a subtle yet highly deceptive attack designed to trick users into sending funds to fraudulent wallet addresses. Unlike traditional hacking methods that rely on breaching systems, […]

The post What Is Address Poisoning first appeared on StrongBox IT.

The post What Is Address Poisoning appeared first on Security Boulevard.

Explore how zero-knowledge proofs (ZKPs) secure Model Context Protocol (MCP) deployments with privacy-preserving validation and post-quantum resistance.

The post Zero-Knowledge Proofs for Privacy-Preserving Context Validation appeared first on Security Boulevard.

Key Takeaways Organizations often think about audits only when a certification deadline approaches or when an auditor sends a long list of document requests. At that point, teams begin searching for policies, screenshots, and logs that prove controls are operating correctly. An audit readiness assessment changes that dynamic. Proactively, organizations evaluate their status ahead of […]

The post Audit Readiness Assessments Demystified: Importance and Relevance for Your Business appeared first on Centraleyes.

The post Audit Readiness Assessments Demystified: Importance and Relevance for Your Business appeared first on Security Boulevard.

The average SOC receives 4,400+ alerts per day and can't investigate 67% of them. Autonomous triage platforms like Morpheus are changing the analyst's role from ticket processor to strategic operator — here's what that looks like in practice.

The post The SOC Analyst Role Is Going Up (And It Was Never Going Away) appeared first on D3 Security.

The post The SOC Analyst Role Is Going Up (And It Was Never Going Away) appeared first on Security Boulevard.

The average SOC manages 83 security tools from nearly 30 vendors. Why the smartest CISOs are consolidating their security operations, and how D3 Morpheus makes it possible without compromising coverage.

The post Your SOC Doesn’t Need More Tools. It Needs Fewer. appeared first on D3 Security.

The post Your SOC Doesn’t Need More Tools. It Needs Fewer. appeared first on Security Boulevard.

The Complexity of Non-Human Identities in Cybersecurity How can organizations ensure robust security when dealing with the nuanced challenge of Non-Human Identities (NHIs)? This question resonates with many cybersecurity specialists navigating the delicate balance between innovation and protection. NHIs, or machine identities, represent a crucial aspect of modern security, especially when industries gravitate towards cloud […]

The post Are clients truly satisfied with AI-enhanced security measures appeared first on Entro.

The post Are clients truly satisfied with AI-enhanced security measures appeared first on Security Boulevard.

What Stands Between Cyber Threats and Your Cloud Infrastructure? Where digital transformation accelerates exponentially, the question of security becomes increasingly pertinent. When organizations migrate to cloud environments, ensuring the impenetrability of AI-powered cybersecurity defenses becomes critical. A central theme underpinning these defenses is the management of Non-Human Identities (NHIs) and Secrets Security Management, which offer […]

The post How impenetrable are AI-powered cybersecurity defenses appeared first on Entro.

The post How impenetrable are AI-powered cybersecurity defenses appeared first on Security Boulevard.

Are Businesses Fully Leveraging AI for Optimized Cybersecurity? Security is evolving quickly, demanding businesses to stay ahead with innovative technologies. One such powerful tool is Artificial Intelligence (AI). But how well are companies integrating AI into their cybersecurity measures, and are they truly optimistic about the potential benefits? Understanding Non-Human Identities in Cybersecurity In cybersecurity, […]

The post Why should businesses be optimistic about AI in cybersecurity appeared first on Entro.

The post Why should businesses be optimistic about AI in cybersecurity appeared first on Security Boulevard.

On February 28, 2026, the United States and Israel launched Operation Epic Fury (U.S.) and Operation Roaring Lion (Israel), a coordinated military and cyber campaign targeting Iranian military installations, IRGC leadership, and government infrastructure. U.S. Cyber Command was designated the "first mover," with cyber operations beginning before any kinetic weapons were deployed. In the first 48 hours, U.S. and allied forces struck more than 1,250 targets across Iran, while Israel conducted what has been described as the largest cyberattack in history, collapsing Iran's internet connectivity to 1-4% of normal levels through multi-layered attacks on BGP routing, DNS infrastructure, and SCADA/ICS systems.

The post Defending Against Iranian Cyber Threats in the Wake of Operation Epic Fury  appeared first on AttackIQ.

The post Defending Against Iranian Cyber Threats in the Wake of Operation Epic Fury  appeared first on Security Boulevard.

Learn the security risks in SaaS supply chains and about ShinyHunters’ evolving extortion tactics behind the alleged Woflow breach.

The post ShinyHunters Claims Woflow Breach: What It Means for SaaS Supply Chain Security appeared first on AppOmni.

The post ShinyHunters Claims Woflow Breach: What It Means for SaaS Supply Chain Security appeared first on Security Boulevard.

Cal OES offers up to $250,000 to help California’s state, local, and tribal agencies strengthen their digital infrastructure against evolving cyber threats. Organizations must submit their applications by March 13, 2026. 

Key takeaways

1. Significant competitive funding: Cal OES is distributing $9.7 million for local and tribal governments and $1.8 million for state agencies, with individual awards capped at $250,000.
2. Direct Tenable alignment: Tenable solutions fulfill grant requirements to meet the program’s objectives and statewide priorities by providing continuous asset identification, risk-based vulnerability prioritization, and real-time security gap analysis.
3. Focus on national priorities: Grant applications receive high priority when addressing critical security gaps considered national priorities, such as lack of multi-factor authentication (MFA), use of end-of-life (EOL) software, and inadequate encryption—all of which Tenable identifies and surfaces.
4. Strict deadline and submission rules: Applications are due by 11:59 PM PDT on March 13, 2026, and must be submitted as PDF email attachments; Cal OES will not accept links to files in cloud storage services like Google Drive or Dropbox.

Grant overview

The California Governor’s Office of Emergency Services (Cal OES) is now accepting applications for its Federal Fiscal Year (FFY) 2024 State and Local Cybersecurity Grant Program (SLCGP). The grant program is intended to help local and tribal governments, as well as state agencies address threats to information systems. It also aims to improve the security of critical infrastructure organizations and the resilience of the services these entities provide to their communities.

Tenable solutions directly align with the grant's objectives to “understand your current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments” and “ implement security protections commensurate with risk.”

Organizations can apply for up to $250,000 through two competitive programs:

• Local and tribal governments: $9.7 million available for local agencies and federally recognized tribes.
• State agencies: $1.8 million available for California state agencies.

Key program details

• Application deadline: Friday, March 13, 2026, at 11:59 PM PDT.
• Performance period: 26 months, July 1, 2026 – August 31, 2028.
• Cost match: Grant recipients must have a 30% cost match (cash or third-party in-kind). For example, for a $250,000 award, the match is $107,143, totaling a $357,143 project cost.
• Eligibility restrictions: Previous recipients of FY 2022 or 2023 SLCGP funding are not eligible for this cycle.

Meeting SLCGP objectives

Proposed projects must align with one of the four primary SLCGP objectives: 1) Governance and Planning; 2) Assessment and Evaluation; 3) Mitigation; and 4) Workforce Development. Tenable solutions are uniquely positioned to support objectives 1, 2, and 3 as described below:

SLCGP Objective How Tenable Helps Objective 1: Governance and Planning Tenable provides centralized visibility into cyber risk to support stronger governance and strategic planning. Our exposure management insights help agencies align security programs with recognized frameworks and grant requirements. Objective 2: Assessment and Evaluation Tenable continuously identifies assets and vulnerabilities across IT, OT, cloud and identity environments to identify security gaps in real-time. Risk-based scoring enables agencies to assess their security posture and measure improvement over time. Objective 3: Mitigation Tenable pinpoints the exposures that represent the highest risk to organizations, helping them to prioritize and accelerate remediation and mitigation.  Meeting SLCGP statewide priorities

Applicants are also strongly encouraged to incorporate statewide priorities in their project descriptions which align with Tenable solutions, including:

• Enhance the preparation, response, and resiliency of information systems, applications, and user accounts.
• Implement a process of continuous cybersecurity risk factors and threat mitigation practices prioritized by degree of risk.
• Assess and mitigate risks and threats impacting local jurisdictions’ critical infrastructure and key resources.

Application requirements

To be considered, applicants must submit:

1. Notice of Interest (NOI): Applicants must respond to each question in the NOI form. The applicant’s response to each question will be evaluated as part of the rating process. Applicants should develop a thorough project proposal that takes into consideration planning and implementation of the entire process for the proposed project – from conception to completion of all activities using the requested funding.
2. Project Worksheet: Applicants will complete the Project Worksheet to demonstrate their project alignment to SLCGP objectives, their implementation plan, and to identify key project milestones. The Project Worksheet is an Excel spreadsheet that includes two tabs to be completed by the applicant: the Baseline Project Information tab and the Project Implementation tab. Each will be evaluated as part of the rating process.
3. Cybersecurity Maturity Survey: In addition to the NOI form and Project Worksheet, applicants must complete the Cybersecurity Maturity Survey. This is an online survey that will not be scored, but that is required and will be a helpful tool to assist in identifying gaps to address through SLCGP. Upon completion of the survey, applicants must download a copy of their survey responses and attach them as a PDF file to submit with their proposal; proposals submitted without completing the survey may not be considered for funding.
4. System for Award Management (SAM) registration: Applications must have a Unique Entity Identifier (Unique Entity ID) registered in the federal System for Award Management (SAM). Applicants who do not currently have a Unique Entity ID will need to register at SAM.gov to obtain one.

Pro Tip: All proposals must be emailed to [email protected]. Cal OES cannot access cloud-based storage like Google Drive.

Ready to apply?

You can find the full Request for Proposal (RFP) and necessary forms (Notice of Interest, Project Worksheet, and Cybersecurity Maturity Survey) at the links below:

• Official Press Release: Cal OES News
• Grant Application Info for Local and Tribal Agencies
• Grant Application Info for State Agencies
• Cal OES Grants Management Memorandum

For more information on how Tenable can support your CA SLCGP application, contact us at [email protected] or submit a contact request here.

The post Strengthening California’s Cyber Defenses: Apply Now for FFY 2024 SLCGP Grants appeared first on Security Boulevard.

GitGuardian partnered with Google to answer: what happens when private keys leak? Using Certificate Transparency, we mapped about 1M leaked keys to 140k certificates. Result: 2,622 were valid as of September 2025, exposing major organizations. Our disclosure campaign achieved 97% remediation.

The post 2,622 Valid Certificates Exposed: A Google-GitGuardian Study Maps Private Key Leaks to Real-World Risk appeared first on Security Boulevard.

Learn how to secure Model Context Protocol (mcp) deployments with post-quantum cryptographic agility and granular resource governance to prevent quantum threats.

The post Post-Quantum Cryptographic Agility in MCP Resource Governance appeared first on Security Boulevard.

Are Organizations Truly Equipped to Manage Agentic AI Risks? The rise of Agentic AI has transformed various industries, posing both opportunities and challenges. While we delve into the intricacies of managing these AI systems, it’s critical to consider whether organizations have the right structures in place to handle potential risks effectively. This responsibility often falls […]

The post What support systems are in place for managing Agentic AI risks appeared first on Entro.

The post What support systems are in place for managing Agentic AI risks appeared first on Security Boulevard.

Are You Safeguarding Your Business With Non-Human Identities? Have you ever wondered how secure your organization’s systems are against non-human threats? Where the interaction between machines and systems is increasing, Non-Human Identities (NHIs) have become a critical focus for cybersecurity. These machine identities are pivotal in managing cybersecurity risks, especially where companies increasingly operate in […]

The post Is investing in advanced AI cybersecurity justified appeared first on Entro.

The post Is investing in advanced AI cybersecurity justified appeared first on Security Boulevard.

 

After the United States and Israel began a bombing campaign on Iran, leading to the decapitation of its political and military leaders, the Middle East has erupted into waves of kinetic warfare. But what should we expect about cyber?

Iran has a formidable offensive cybersecurity capability and is considered one of the four most aggressive nations with respect to a willingness to direct cyberattacks against their adversaries. They have invested over the years to develop a mature set of capabilities and leverage external groups as proxies.

So far, we have seen drones damage three Amazon cloud facilities in the United Arab Emirates and Bahrain, and cyber-attacks from Iran-aligned hacking groups.

I expect more attacks to come in the near future. When the initial bombing occurred, two things happened that disrupted Iran’s cyber-attack coordination. First, the bombs disrupted communications networks. Second, their Supreme Leader and many of the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS) leaders were eliminated.

Military and cyber forces were effectively on-their-own, and began to act independently in their retaliatory attacks. Although some denial of service, data leaks, misinformation, and defacement attacks have occurred, large-scale campaigns have not materialized yet.

It has taken some time to reconstitute leadership roles and coordination efforts, but we are now heading into the likely timeframe that focused orders will be given to the cyber forces.

I expect many attacks to occur in the next few days. Hacking crews will leverage the tools they have available and exploit the vulnerabilities they have at hand in a rushed manner. They will be pressured to act quickly to inflict as much damage as possible.

The focus of these attacks will not be pursuing intelligence gathering, data breaches, ransomware, or extortion. Their goal will be simple, do as much damage as possible. Compromise systems, delete, corrupt, and burn down anything they can. This will be a destructive campaign targeting the Western nations and any Arab nations they perceive as allies.

The prioritized targets will be national critical infrastructures, such as electrical grids, transportation, communications, government and military networks, finance, water, and healthcare. Most of these sectors are run by private corporations. These targets will deliver the most impact to citizens, their economy, and health.

Secondary objectives will simply be targets of opportunity. The digital carpet-bombing tactic hopes to affect large numbers of organizations and people to amplify the overall fear, suffering, and political backlash.

Thirdly, there will be misinformation campaigns, but those will likely be delayed in favor of damaging attacks. They will not emerge and gain momentum until kinetic attacks begin to wane.

Right now is the time for critical infrastructure organizations to prepare, take extra steps to harden their environments, and reinforce their response capabilities.

In the next week or two, I expect Iran to deploy everything it can from a cyber perspective. Unless they get really lucky, most attacks on large Western nations will not make a material difference. They may cause limited disruption and damage, but they likely lack the highly complex and mature destructive self-propagating worms that it would take to bring down multiple critical infrastructure sectors simultaneously. Smaller nations may not fare as well and might require international recovery assistance.

It is important for cybersecurity leaders to keep a keen eye on how attacks develop, update their risk assessments, and communicate their recommendations to executive leadership in a timely manner.

As the military conflict in the Middle East moves into its next phase, we should expect cyber-attacks to intensify.

Iran, known for its advanced offensive capabilities, is poised to hit back with digital assaults aimed at causing maximum disruption.

Right now, Iran’s cyber leadership are reconstituting after the initial decapitation attack and will be coordinating assets to focus on destruction rather than espionage, extortion, or data theft. Small nations might be especially vulnerable.

Organizations in the West and Arab nations must harden their defenses now. Preparedness is a strategic advantage.

The post What to Expect from Iran’s Digital Counterstrike appeared first on Security Boulevard.

What Does NHI Management Mean for Your Enterprise’s Security? How do organizations ensure their digital assets remain secure amidst evolving threats? The key lies in the management of Non-Human Identities (NHIs). When organizations increasingly adopt cloud environments, there is a pressing need for robust NHI management to bridge the gap between security and research & […]

The post How does NHI management empower proactive security measures appeared first on Entro.

The post How does NHI management empower proactive security measures appeared first on Security Boulevard.

How Secure Are Your Non-Human Identities? Have you ever wondered how secure your organization’s machine identities are? With the increasing reliance on cloud environments, maintaining the security of these Non-Human Identities (NHIs) is more crucial than ever. NHIs play a fundamental role in cybersecurity, functioning as the machine equivalent of human identities and requiring robust […]

The post How free are companies to choose their Agentic AI security solutions appeared first on Entro.

The post How free are companies to choose their Agentic AI security solutions appeared first on Security Boulevard.

3 min readLegal AI solutions provider LexisNexis has confirmed a massive breach of its AWS environment  According to reports, initial access was gained by exploiting the “React2Shell” vulnerability in an unpatched React frontend application – a flaw the company had reportedly left unaddressed for months.  Among the details reportedly posted by the attacker is the claim that, […]

The post How a Single Overprivileged Service Turned the LexisNexis Breach Into a Keys-to-the-Kingdom Moment appeared first on Aembit.

The post How a Single Overprivileged Service Turned the LexisNexis Breach Into a Keys-to-the-Kingdom Moment appeared first on Security Boulevard.

Your SOC can't triage every alert — the math proves it. See why 75% of alerts go uninvestigated and how AI-autonomous triage closes the gap.

The post 6 Minutes and a Prayer: The Math Your SOC Doesn’t Want You to See appeared first on D3 Security.

The post 6 Minutes and a Prayer: The Math Your SOC Doesn’t Want You to See appeared first on Security Boulevard.