A supply chain security platform that builds trust in every device.
Portland, OR
Joined May 2017
- Tweets2.2K
- Following213
- Followers1.8K
- Likes578
Trusted AI starts with trusted infrastructure. Eclypsium is on a mission to help organizations safely realize the full potential of AI transformation. We're working with NVIDIA to produce technology and research for trusted GPU compute. Read more: na2.hubs.ly/H08JgYj0
Between September 18 and October 14, we saw 133 new security advisories across 18 hardware vendors. Of these, 37 were rated critical by CVSS, 58 involved vulnerabilities exploitable remotely without authentication. Read the full InfraTrust Pulse here: na2.hubs.ly/H08GbpP0
A 16-year-old flaw in TianoCore EDK II, used in UEFI firmware, could expose millions of servers to pre-boot code execution. CVE-2026-97631 highlights the risks of shared firmware code and vendor-dependent patching. Commentary by Eclypsium's Jesse Michael: na2.hubs.ly/H08G4gv0
If you're a cybersecurity professional in the Boston area, be sure to get yourself registered for the IANS Forum to listen to Paul Asadoorian wax poetic on Infrastructure Attack Trends!
Register here: na2.hubs.ly/H08FpFs0
Join us for a live webinar on Oct 27 to explore the results of a recent survey Eclypsium conducted with 200 security leaders about their network device security posture.
na2.hubs.ly/H08pZZb0
Here's a clip of Chase Snyder from our webinar earlier this week on infrastructure threat landscape trends from the past three months of InfraTrust Pulse na2.hubs.ly/H080hLw0
Watch the entire webinar here: na2.hubs.ly/H080hxs0
The latest InfraTrust Pulse is out and September’s data reminds us that CVSS alone isn’t a patch strategy. Reachability, active exploitation, device role, inherited components, and firmware exposure all matter when deciding what gets attention first. na2.hubs.ly/H07-9WC0
Great article in Infrastructure News about the August InfraTrust guidance. na2.hubs.ly/H07wdSk0
Our latest blog explores why patching faster alone isn't enough even in the age of Mythos and AI-powered vulnerability discovery—and what security leaders should do instead. Read more: na2.hubs.ly/H06k6Hh0
Our latest research examines what FortiBleed means for defenders, why patching alone may not be enough, and the steps organizations should take to verify whether their devices remain exposed. Read the full analysis: na2.hubs.ly/H06cfNN0
Below the Surface Episode #76 is live: Binwalk, Brickstorm & AI model madness. What happens when AI finds vulnerabilities faster than teams can safely patch?
Listen now: na2.hubs.ly/H06c0qP0
Coming up next week! If you're interested in learning about CJIS audit requirements tied to firmware integrity, component inventory, configuration baselines, and vulnerability remediation below the OS, be sure to sign up for this virtual event.
na2.hubs.ly/H0694080
For federal agencies and defense organizations, many of the hardest #DoW #ZeroTrust Device Pillar requirements need to be operational well before FY2027. Join our webinar on June 11 to learn how to build device trust and produce compliance evidence: hubs.ly/Q04j6Dxq0
YellowKey (upatched BitLocker bypass) shows a growing problem with relying on full-disk encryption alone to protect your data. Want recommendations on how to mitigate your Windows 11 risk from #YellowKey? Read our latest blog post here - hubs.ly/Q04hmhGs0
Episode 74 of our Below the Surface #podcast is now available! Learn about the “YellowKey” BitLocker bypass and what it means for Windows security, why CVE enrichment and vulnerability context matter, and how AI is changing vulnerability research. hubs.ly/Q04hcgVW0
Super excited for this upcoming May 14 webinar on Reverse Engineering and Hardware Hacking with a focus on how agentic AI is revolutionizing security research. Register today! hubs.ly/Q04fG4C70
The DoD Zero Trust Strategy mandates that by 2027, organizations need to reach Target Level maturity across all pillars, including Devices. Our latest blog focuses on what that actually means for the Device Pillar, beyond the high-level guidance.
hubs.ly/Q04fvbKS0
New from Eclypsium: CVE-2026-25250. A Microsoft-signed third-party bootloader that completely skips signature verification when loading drivers. Secure Boot bypass on most Windows systems. Discovered by Mickey Shkatov and Stas Lyakhov. Patch now.
hubs.ly/Q04crLzN0
NIST just announced updates to how the NVD operates, directly addressing the continued surge in CVE submissions. This reinforces a broader shift: vulnerability data alone isn’t enough anymore—context, prioritization, and automation matter more than ever.
hubs.ly/Q04crg_p0
