https://clicksecure.ai/blog Penetration testing, AI/LLM security, NIS 2 & DORA, and human risk. en https://clicksecure.ai/blog/owasp-api-top-10-pentest-findings https://clicksecure.ai/blog/owasp-api-top-10-pentest-findings Tue, 14 Jul 2026 09:00:00 GMT APIs are where modern applications actually live. The browser is just a thin shell; the real logic, data and authorization decisions sit behind a growing surface of REST and GraphQL endpoints. That is also where we find the most impactful bugs during penetration tests. The OWASP API Security Top 10 (2023 edition) is a good map of the terrain, and after enough engagements the same handful of categories keep coming back. #penetrationtesting #APIsecurity #OWASP #NET #RCE https://clicksecure.ai/blog/owasp-api-top-10-pentest-findings penetration testing API security OWASP .NET RCE https://clicksecure.ai/blog/device-code-phishing-mfa-bypass https://clicksecure.ai/blog/device-code-phishing-mfa-bypass Fri, 10 Jul 2026 09:00:00 GMT Most phishing training teaches one lesson: check the URL before you type your password. Device code phishing wins precisely because the victim never types a password on a fake site. There is no lookalike login page to spot, and multi-factor authentication does not help. That is why it has quietly become one of the defining attack techniques of 2026. #phishing #MFA #humanrisk #identity #awareness https://clicksecure.ai/blog/device-code-phishing-mfa-bypass phishing MFA human risk identity awareness https://clicksecure.ai/blog/poisoned-ai-skills-supply-chain https://clicksecure.ai/blog/poisoned-ai-skills-supply-chain Thu, 09 Jul 2026 09:00:00 GMT Supply chain attacks used to mean poisoned npm packages and typosquatted Python libraries. In mid-2026, two campaigns showed the same playbook moving to two new targets: the skills your AI agents install, and the proof-of-concept code your security team downloads. #supplychainsecurity #AIsecurity #malware #developers #agentskills https://clicksecure.ai/blog/poisoned-ai-skills-supply-chain supply chain security AI security malware developers agent skills https://clicksecure.ai/blog/ai-agent-identity-governance https://clicksecure.ai/blog/ai-agent-identity-governance Wed, 08 Jul 2026 09:00:00 GMT Every identity system your company runs — Active Directory, your IdP, your access reviews — rests on one quiet assumption: behind every account there is a human being whose status changes through HR events. Someone is hired, an account is provisioned. Someone changes roles, access is adjusted. Someone leaves, access is revoked. #AIsecurity #identity #IAM #nonhumanidentities #governance https://clicksecure.ai/blog/ai-agent-identity-governance AI security identity IAM non-human identities governance https://clicksecure.ai/blog/ai-browser-prompt-injection https://clicksecure.ai/blog/ai-browser-prompt-injection Tue, 07 Jul 2026 09:00:00 GMT AI browsers — Chrome-like products where an agent clicks, reads and fills forms for you — are moving into companies fast, often through employees who simply install them. Two pieces of research published in June 2026 show why security teams need a position on them now, not later. #AIsecurity #promptinjection #agenticAI #browsersecurity #LLM https://clicksecure.ai/blog/ai-browser-prompt-injection AI security prompt injection agentic AI browser security LLM https://clicksecure.ai/blog/fortibleed-edge-devices https://clicksecure.ai/blog/fortibleed-edge-devices Tue, 07 Jul 2026 09:00:00 GMT For years the mental model was simple: the firewall protects the network. In 2026 the model needs an update, because the firewall — and every other internet-facing appliance — is increasingly the thing being attacked. #networksecurity #ransomware #FortiGate #credentialtheft #incidentresponse https://clicksecure.ai/blog/fortibleed-edge-devices network security ransomware FortiGate credential theft incident response https://clicksecure.ai/blog/jadepuffer-ai-ransomware-patching https://clicksecure.ai/blog/jadepuffer-ai-ransomware-patching Tue, 07 Jul 2026 09:00:00 GMT On July 1, 2026, the Sysdig Threat Research Team published its analysis of what it assesses to be the first documented case of agentic ransomware — a complete extortion operation driven from start to finish by a large language model, with no human at the keyboard. The team named the operator JADEPUFFER. The techniques it used were not new or clever. What is new is that a machine strung them together into a full attack against a neglected, internet-facing server, on its own. #ransomware #AI #vulnerabilitymanagement #patching #NIS2 https://clicksecure.ai/blog/jadepuffer-ai-ransomware-patching ransomware AI vulnerability management patching NIS 2 https://clicksecure.ai/blog/ai-identity-consent-registry https://clicksecure.ai/blog/ai-identity-consent-registry Fri, 03 Jul 2026 09:00:00 GMT The debate about artificial intelligence has shifted. For a while the question was "what can AI create?" Increasingly it is "whose name, face, voice and work was used to create it — and did they agree?" In June 2026, that question got a concrete answer for individuals: the Human Consent Registry, a free tool to tell AI systems how — or whether — they may use your identity. #AIsecurity #LLM #dataprotection #consent #EUAIAct https://clicksecure.ai/blog/ai-identity-consent-registry AI security LLM data protection consent EU AI Act https://clicksecure.ai/blog/nis2-dora-readiness https://clicksecure.ai/blog/nis2-dora-readiness Mon, 29 Jun 2026 09:00:00 GMT Two EU frameworks are reshaping how organizations are expected to manage cyber risk: NIS 2 (Directive (EU) 2022/2555) and DORA (Regulation (EU) 2022/2554). They apply to different populations — NIS 2 to a broad set of essential and important entities across many sectors, DORA to financial entities and their ICT providers — but they pull in the same direction: measurable security measures, fast incident reporting, supply-chain scrutiny, and personal accountability for management. #NIS2 #DORA #compliance #operationalresilience https://clicksecure.ai/blog/nis2-dora-readiness NIS 2 DORA compliance operational resilience https://clicksecure.ai/blog/human-risk https://clicksecure.ai/blog/human-risk Sat, 27 Jun 2026 09:00:00 GMT For two decades, most security budgets flowed toward technical controls: firewalls, endpoint agents, segmentation, patching. Those controls still matter. But the dominant way into a modern organization is no longer an unpatched server — it is a person. When an employee clicks a crafted link, approves a fraudulent invoice, or reuses a password, the most expensive perimeter in the world is bypassed in seconds. #NIS2 #humanrisk #securityawareness #phishing #DORA https://clicksecure.ai/blog/human-risk NIS 2 human risk security awareness phishing DORA https://clicksecure.ai/blog/pentest-vs-vulnerability-assessment https://clicksecure.ai/blog/pentest-vs-vulnerability-assessment Thu, 25 Jun 2026 09:00:00 GMT "Pentest" and "vulnerability assessment" are used interchangeably far too often. They are different tools for different jobs. #penetrationtesting #vulnerabilityassessment https://clicksecure.ai/blog/pentest-vs-vulnerability-assessment penetration testing vulnerability assessment https://clicksecure.ai/blog/nis2-readiness-checklist https://clicksecure.ai/blog/nis2-readiness-checklist Sat, 20 Jun 2026 09:00:00 GMT NIS 2 raises the bar for cybersecurity across a much wider range of organizations than its predecessor. If you are not sure where you stand, this short checklist is a good place to start. #NIS2 #compliance #DORA https://clicksecure.ai/blog/nis2-readiness-checklist NIS 2 compliance DORA