Blog Posts

  • When AI agents become admins: Rethinking privileged access in the age of AI

    When AI agents become admins: Rethinking privileged access in the age of AI

    From resetting passwords and approving workflows to pulling HR data and orchestrating cloud infrastructure, AI agents now perform tasks that previously required a human with privileged access. AI...

    Read Blog
  • The invisible threat: Machine identity sprawl and expired certificates

    The invisible threat: Machine identity sprawl and expired certificates

    One unmanaged machine identity—whether a TLS certificate, SSH key, code signing certificate, or API secret—that’s all it takes to crash your website, halt transactions, and leave customers...

    Read Blog
  • CyberArk Privilege Cloud Version 14.7 Release

    CyberArk Privilege Cloud Version 14.7 Release

    CyberArk Privilege Cloud 14.7 improves user experience and enhances security with the new Secure Access space, Identity Protection, Threat Detection, Risk Management and more.

    Read Blog
  • Sandworm in the supply chain: Lessons from the Shai-Hulud npm attack on developer and machine identities

    Sandworm in the supply chain: Lessons from the Shai-Hulud npm attack on developer and machine identities

    Do you know why Shai-Hulud should raise your hackles? Unless you’ve spent time on Arrakis in Frank Herbert’s Dune or the npm ecosystem this month, the name Shai-Hulud might not ring a bell. In...

    Read Blog
  • Persuasion engineering: how to influence humans, LLMs, and AI agents

    Persuasion engineering: how to influence humans, LLMs, and AI agents

    We’ve spent decades treating persuasion like an art—something you could master if you had charisma, practice, or luck. Lawyers use it to hone arguments. Marketers use it to craft taglines. On the...

    Read Blog
  • A practical guide to AI-ready machine identity governance in finance

    A practical guide to AI-ready machine identity governance in finance

    Across financial services operations, machine identities play critical roles, but in many organizations, these cryptographic keys, API tokens, certificates, and service accounts remain chronically...

    Read Blog
  • The AI revolution in financial cybersecurity

    The AI revolution in financial cybersecurity

    Financial cybersecurity has never been a static discipline. Over two decades in this industry, I’ve seen it transform from a compliance checkbox to a cornerstone of business resilience—usually...

    Read Blog
  • Identity Security: Why Buyers Choose CyberArk

    Identity Security: Why Buyers Choose CyberArk

    In the world of identity security, organizations evaluating solutions want to understand why CyberArk stands out as the top choice. Leaders aren’t just looking for a rundown of capabilities – they...

    Read Blog
  • Is autofill safe? Clickjacking risks and security tradeoffs explained

    Is autofill safe? Clickjacking risks and security tradeoffs explained

    When new security research hits the headlines, it often sparks a predictable wave of worry: should we turn off features we rely on? Should we rethink basic workflows? That’s exactly the case with...

    Read Blog
  • User Access Reviews and Compliance: The Auditor’s Perspective

    User Access Reviews and Compliance: The Auditor’s Perspective

    This blog was originally published by Zilla Security, now a CyberArk Company and may reference legacy product names that are now part of the CyberArk IGA portfolio. Protecting company assets and...

    Read Blog
  • Effective User Access Reviews

    Effective User Access Reviews

    This blog was originally published by Zilla Security, now a CyberArk Company and may reference legacy product names that are now part of the CyberArk IGA portfolio. You want to get the most out of...

    Read Blog
  • Why secret sprawl may be your biggest security threat (and how to help fix it)

    Why secret sprawl may be your biggest security threat (and how to help fix it)

    Picture this: You’re having your morning coffee when your phone buzzes with the kind of alert that makes security professionals break into a cold sweat. A single API key, leaked on GitHub months...

    Read Blog
  • Cheaters never win: large-scale campaign targets gamers who cheat with StealC and cryptojacking

    Cheaters never win: large-scale campaign targets gamers who cheat with StealC and cryptojacking

    A sprawling cyber campaign is turning gamers’ hunger to gain an edge into a massive payday for threat actors who are leveraging over 250 malware samples to steal credentials and cryptocurrencies....

    Read Blog
  • Defeating Microsoft EPM in the Race to Admin: a Tale of a LPE vulnerability

    Defeating Microsoft EPM in the Race to Admin: a Tale of a LPE vulnerability

    Introduction Not too long ago I read an interesting blogpost by SpecterOps about Microsoft EPM that got my attention as I was not aware of this Microsoft product/feature. It was interesting to...

    Read Blog
  • Salesloft Drift incident overview and CyberArk’s response

    Salesloft Drift incident overview and CyberArk’s response

    It was recently reported that Salesloft’s Drift application was breached, allowing unauthorized access to its customers’ Salesforce data and affecting hundreds of organizations, including...

    Read Blog
  • Securing cloud console and CLI access for agile software development

    Securing cloud console and CLI access for agile software development

    Fast-moving cloud environments demand speed, but without the right access controls they invite risk. Resources such as virtual machines, containers, and services are created, modified, and...

    Read Blog
  • Automating Certificate Management to Minimize Your TLS Security Risk

    Automating Certificate Management to Minimize Your TLS Security Risk

    As the world’s top organizations prepare for the future, you can bet that certificate lifespans will continue to shorten. Factors such as the pace of continuous development and rapidly evolving...

    Read Blog
  • Declutter your crypto: Machine identity security for a post-quantum world

    Declutter your crypto: Machine identity security for a post-quantum world

    In a bad dream, you open the closet. You think you know exactly what’s in there: a few SSH keys, a bunch of TLS certificates, and some secrets like API keys locked in what you...

    Read Blog
  • A CISO’s guide to post-quantum readiness: How to build crypto agility now

    A CISO’s guide to post-quantum readiness: How to build crypto agility now

    The quantum threat isn’t theoretical—it’s operational. Quantum computing is rapidly shifting from research to reality, forcing chief information security officers (CISOs) to rethink cryptography,...

    Read Blog
  • How external attackers and malicious insiders exploit standing privileges in the cloud

    How external attackers and malicious insiders exploit standing privileges in the cloud

    For many of us, the term “cloud security breach” conjures meticulous attack plans executed by sophisticated criminal syndicates. But in reality, “attacks” can be far more mundane: maybe some...

    Read Blog
  • loading
    Loading More...