Security Boulevard

Learn how to debug and fix invalid security token errors in Enterprise SSO, SAML, and CIAM systems. Practical tips for CTOs and VPs of Engineering.

The post How to Resolve Invalid Security Token Issues appeared first on Security Boulevard.

A deep dive into the evolution of identity management and cardspace technology. Learn how modern enterprise sso and ciam solutions replace legacy frameworks.

The post Exploring Identity Management and CardSpace Technology appeared first on Security Boulevard.

Explore the security of passkey synchronization. Learn how end-to-end encryption and cloud providers keep passwordless authentication secure across devices.

The post Are Passkeys Safely Synced Across Multiple Devices? appeared first on Security Boulevard.

With organizations becoming more digitally interconnected, threat actors are placing greater emphasis on manipulating people instead of breaching systems directly. One of the most deceptive and damaging tactics is helpdesk impersonation — a form of social engineering in which attackers pose as legitimate users or trusted personnel to manipulate support staff into granting unauthorized access. […]

The post Helpdesk Impersonation: A High-Risk Social Engineering Attack first appeared on StrongBox IT.

The post Helpdesk Impersonation: A High-Risk Social Engineering Attack appeared first on Security Boulevard.

Key Takeaways When companies run payment systems, those systems operate on infrastructure provided by hosting platforms. That layer includes the servers, networks, and data centers where applications live.  The term PCI compliance hosting is commonly used to describe infrastructure environments that have been structured with PCI-related security expectations in mind and that provide documentation and […]

The post Top 5 PCI Compliant Hosting Providers appeared first on Centraleyes.

The post Top 5 PCI Compliant Hosting Providers appeared first on Security Boulevard.

After two years of daily ChatGPT use, I recently started experimenting with Claude, Anthropic’s competing AI assistant.

Related: Microsofts see a  ‘protopian’ AI future

Claude is four to five times slower generating responses. But something emerged that matters more than … (more…)

The post MY TAKE: Transparent vs. opaque — edit Claude’s personalized memory, or trust ChatGPT’s blindly? first appeared on The Last Watchdog.

The post MY TAKE: Transparent vs. opaque — edit Claude’s personalized memory, or trust ChatGPT’s blindly? appeared first on Security Boulevard.

In cybersecurity, we live by our metrics. We measure Mean Time to Respond (MTTR), Dwell Time, and Patch Cadence. These numbers indicate to the Board how quickly we respond when issues arise.

But in the era of Agentic AI, reaction speed is no longer enough. When an AI Agent or an MCP server is compromised, data exfiltration happens in milliseconds rather than days. If you are waiting for an incident to measure your success, you have already lost.

CISOs need a new way to measure readiness, not just reaction. We call this strategic approach Agentic AI Posture.

Why Traditional Metrics Fail AI

Traditional security metrics are often binary. They ask whether the WAF is enabled and whether the endpoint agent is installed. Agentic AI defies this binary measurement because it is inherently dynamic. An MCP server might be secure today but insecure tomorrow because a developer exposed a new API endpoint that allows unrestricted data access. Similarly, an AI Agent might be compliant in testing but risky in production when it starts interacting with sensitive business logic in unexpected ways.

You cannot secure the AI Action Layer with a static checklist. You need a continuous view of risk that aggregates multiple signals from your API fabric.

The Three Pillars of AI Readiness

While no single dashboard dial can capture the complexity of AI, a robust understanding of your posture requires aggregating risk across three critical dimensions. CISOs should build their internal reporting around these pillars:

1. The Visibility Ratio

The first dimension asks if you can see the shadow agents. The Visibility Ratio compares the AI-driven API traffic you have inventoried against the unknown shadow traffic moving through your network. This is critical because if developers run MCP servers on localhost or connect CoPilots to production APIs without oversight, your visibility into those environments declines. You cannot govern what you cannot see, so the goal must always be complete visibility into the APIs your agents consume.

2. Privilege Density

The second dimension analyzes the actual power granted to your AI agents through the APIs they consume. This is not just about identity permissions; it is about the APIs' functional capabilities. You must ask whether the APIs your agents use support destructive actions, such as DELETE, or massive data retrieval, such as EXPORT_ALL, even if the agent only needs to read a single record. When AI agents are connected to APIs that are functionally over-permissive, the blast radius of a prompt injection attack expands exponentially. High privilege density indicates that your API endpoints expose too much business logic to autonomous decision-making.

3. Behavioral Integrity

The final dimension determines if your agents are behaving as expected. Behavioral Integrity tracks the frequency of anomalies detected in your API traffic. For example, is an agent that typically retrieves 5 records per minute suddenly requesting 5,000? A low integrity standing indicates that your agents are drifting from their intended logic or are under active manipulation. You need a stable baseline where deviations trigger immediate governance actions.

Talking to the Board: From Incidents to Risk Factors

Adopting an Agentic AI Posture mindset changes the conversation with your Board of Directors. Instead of simply reporting on attacks that have been stopped, you can discuss the Risk Factor of your API estate.

You can explain that while you have full visibility into your MCP servers, you are actively working to reduce the risk associated with APIs that expose sensitive financial data to external agents. This is the language of risk maturity. It shows the Board that you are proactively managing the attack surface rather than just reacting to incidents.

How Salt Security Enables This View

At Salt, we turn API visibility into a dedicated visual map of your AI Agent and MCP estate. Because we observe the API traffic powering these agents, we can automatically discover and catalog every machine identity operating in your environment, including the "shadow" agents deployed locally.

We then translate this data into actionable intelligence by calculating a risk score for each agent based on the APIs it consumes. If an MCP server has access to sensitive PII endpoints or uses overly permissive API methods, Salt flags it as a high-risk asset. This allows you to move beyond generic API security and assess your digital workforce posture, knowing exactly which agents are secure and which are introducing critical vulnerabilities.

Conclusion

As AI Agents become the primary consumers of your APIs, your security strategy must evolve from perimeter defense to posture governance. Understanding your risk across visibility, API privilege, and behavior is the only way to navigate this shift safely.

Don't wait for a breach to measure your resilience. Start assessing your API risk factors today.

If you want to learn more about Salt and how we can help you, please contact us, schedule a demo, or visit our website. You can also get a free API Attack Surface Assessment from Salt Security's research team and learn what attackers already know.

The post Measuring Agentic AI Posture: A New Metric for CISOs appeared first on Security Boulevard.

What is Agentic AI, and How Is It Changing the Landscape of Technology? Where technology evolves at warp speed, how do organizations ensure they stay ahead of the curve? One approach gaining traction is leveraging Agentic AI to drive innovation across various sectors. Agentic AI, a term often associated with autonomous decision-making systems, is paving […]

The post How does Agentic AI foster innovation in tech appeared first on Entro.

The post How does Agentic AI foster innovation in tech appeared first on Security Boulevard.

How Are Non-Human Identities Paving the Way for Secure Tech Environments? The digital transformation of industries has raised numerous questions about safeguarding sensitive information. How do organizations effectively manage machine identities to create secure environments? Enter the concept of Non-Human Identities (NHIs), a linchpin in fortifying tech security, especially when businesses transition to cloud-based systems. […]

The post What role does NHI play in secure tech environments appeared first on Entro.

The post What role does NHI play in secure tech environments appeared first on Security Boulevard.

Why Are Non-Human Identities Essential for Cloud Compliance? Can organizations truly trust their cloud compliance processes without effectively managing Non-Human Identities (NHIs)? With digital grows, the management of machine identities within cybersecurity becomes increasingly vital. NHIs, or machine identities, consist of secrets such as encrypted passwords, tokens, and keys. Together with permissions granted by destination […]

The post Why trust your cloud compliance to Agentic AI appeared first on Entro.

The post Why trust your cloud compliance to Agentic AI appeared first on Security Boulevard.

Are You Managing Non-Human Identities Effectively? The strategic management of Non-Human Identities (NHIs) is more important than ever for organizations expanding their cloud-based operations. NHIs, which consist of encrypted passwords, tokens, or keys combined with permissions, play a crucial role in securing machine identities. However, the inadequacies in managing them can create significant security vulnerabilities. […]

The post Why is scalable AI security important for growth appeared first on Entro.

The post Why is scalable AI security important for growth appeared first on Security Boulevard.

ReversingLabs this week published a report that finds there was a 73% increase in the number of malicious open source packages discovered in 2025 compared with the previous year. More than 10,000 malicious open source packages were discovered, most of which involved node package managers (npms) that cybercriminals were using to compromise software supply chains...

The post Report: Open Source Malware Instances Increased 73% in 2025 appeared first on Security Boulevard.

Reducing technical debt manually can be a time-consuming, never-ending process. Use tools to automate the process.

The post Still Trying to Reduce Technical Debt Manually? appeared first on Azul | Better Java Performance, Superior Java Support.

The post Still Trying to Reduce Technical Debt Manually? appeared first on Security Boulevard.

Season 5, EP 01: Unpacking RTO fallout, endpoint sprawl, tooling fatigue, junior workforce erosion

The post The Security Debt We Pretend Isn’t There appeared first on Security Boulevard.

Early 2026, Moltbot a new AI personal assistant went viral. GitGuardian detected 200+ leaked secrets related to it, including from healthcare and fintech companies. Our contribution to Moltbot: a skill that turns secret scanning into a conversational prompt, letting users ask "is this safe?"

The post Moltbot Personal Assistant Goes Viral—And So Do Your Secrets appeared first on Security Boulevard.

Session 10D: Machine Unlearning

Authors, Creators & Presenters: hen Gong (University of Vriginia), Kecen Li (Chinese Academy of Sciences), Jin Yao (University of Virginia), Tianhao Wang (University of Virginia)

PAPER
TrajDeleter: Enabling Trajectory Forgetting in Offline Reinforcement Learning Agents

Reinforcement learning (RL) trains an agent from experiences interacting with the environment. In scenarios where online interactions are impractical, offline RL, which trains the agent using pre-collected datasets, has become popular. While this new paradigm presents remarkable effectiveness across various real-world domains, like healthcare and energy management, there is a growing demand to enable agents to rapidly and completely eliminate the influence of specific trajectories from both the training dataset and the trained agents. To meet this problem, this paper advocates TRAJDELETER, the first practical approach to trajectory unlearning for offline RL agents. The key idea of TRAJDELETER is to guide the agent to demonstrate deteriorating performance when it encounters states associated with unlearning trajectories. Simultaneously, it ensures the agent maintains its original performance level when facing other remaining trajectories. Additionally, we introduce TRAJAUDITOR, a simple yet efficient method to evaluate whether TRAJDELETER successfully eliminates the specific trajectories of influence from the offline RL agent. Extensive experiments conducted on six offline RL algorithms and three tasks demonstrate that TRAJDELETER requires only about 1.5% of the time needed for retraining from scratch. It effectively unlearns an average of 94.8% of the targeted trajectories yet still performs well in actual environment interactions after unlearning. The replication package and agent parameters are available.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – TrajDeleter: Enabling Trajectory Forgetting In Offline Reinforcement Learning Agents appeared first on Security Boulevard.

Deep dive into SAML 2.0 architecture for enterprise SSO. Learn how IdPs and SPs exchange XML assertions for secure B2B authentication and CIAM.

The post What is SAML and how does SAML Authentication Work? appeared first on Security Boulevard.

Discover top community help resources for Single Sign-on, CIAM, and enterprise authentication. Learn where CTOs and VPs of Engineering find technical support.

The post Single Sign-on Community Help Resources appeared first on Security Boulevard.

Learn how to secure Model Context Protocol (MCP) transport layers using post-quantum cryptography (PQC) to defend against future quantum computing threats.

The post PQC-Hardened Model Context Protocol Transport Layers appeared first on Security Boulevard.

Are Organizations Truly Safe Without Effective Non-Human Identity Management? The Growing Importance of Agentic AI in Platform Security How can organizations navigate the complex terrain of cybersecurity to ensure both human and machine identities are secure? The answer may lie within the burgeoning field of Agentic AI, which is transforming platform security. Where businesses increasingly […]

The post How does Agentic AI improve platform security appeared first on Entro.

The post How does Agentic AI improve platform security appeared first on Security Boulevard.