SecurityScorecard

📣 Something big is coming, and it's at RSAC. Today, SecurityScorecard Unveils TITAN AI: A New Era of Threat-Informed Third-Party Risk Management TPRM is evolving, and so are we. 🛡️ SecurityScorecard today announced TITAN AI at RSAC 2026 in San Francisco. TITAN AI replaces the reactive, manual grind of third-party risk management (TPRM) programs with AI-acceleration and predictive control. 🌐 TITAN AI is built on top of SecurityScorecard’s industry-leading Ratings and TPRM platform with AI-driven technology and enhanced threat intelligence, delivering a powerful solution built for the demands of today's risk landscape. 📊 The Numbers: 🔹 With TITAN AI, organizations will be able to automate the majority of the work traditionally required to manage vendor risk, reclaiming hours previously spent chasing vendors by reducing manual effort by up to 95%. 🔹 Organizations leveraging TITAN AI will identify and address third-party risk faster and more consistently, with customers achieving up to 75% fewer supply-chain breaches. 🔹 Vendor engagement soars with TITAN AI. A 9x higher vendor engagement will allow vendors to respond more quickly and resolve issues before they escalate. 🔹 TITAN AI provides 99.9% accurate risk attribution with a near-zero refute rate. “Today, we're still redefining what's possible. Many teams still spend too much time stuck in manual, compliance-driven processes that don’t actually reduce risk. TITAN AI is our answer to that problem.” – Dr. Aleksandr Yampolskiy, CEO and Co-Founder of SecurityScorecard 📘 Read the full press release here: securityscorecard.com/resour… #cybersecurity #pressrelease #TitanAI #cybernews #SecurityScorecard #artificialintelligence #TPRM #ThirdPartyRiskManagement #SecOps #RiskOps #RSAC2026 #AI

CanOworms sells anonymity by relaying others’ traffic. SecurityScorecard’s STRIKE Threat Intelligence Team found CanOworms, a 633-server network attackers lease to hide where malware and intrusions originate. Rent a server, and your traffic exits through someone else’s IP address. Trace the attack back, and you reach a rented relay. Attackers stay hidden. STRIKE used SecurityScorecard’s Driftnet internet-scanning engine to pivot from known indicators to one certificate, then to the full CanOworms network. Here is what STRIKE found: 🪱 CanOworms’ tenants range from commodity malware operators to suspected state-linked actors. 🔄 Adversaries swap IPs and domains faster than blocklists can update, so chasing them individually keeps defenders a step behind. 🔍 Persistent, rentable networks can outlast address changes, so defenders should track behavior instead of reputation. 👉 Watch Richard Hummel and Gilad Friedenreich Maizles explain how they unmasked CanOworms. Learn which signals you can track to catch attackers even if they are rotating addresses: brighttalk.com/webcast/19566… #cybersecurity #threatintel #threatintelligence #TPRM #attacksurface #cyberrisk #Driftnet

✈️ Names, reservation codes, and flight details make phishing emails look real. The Amadeus breach exposed all three for 92,000 Japan Airlines customers. Hackers accessed reservation data through Amadeus IT Group, the provider behind Japan Airlines’ reservation, ticketing, and check-in systems. About 2,000 customers also had passport numbers, email addresses, and phone numbers stolen. A single breach at a third-party vendor can cascade across every company that relies on it, exposing tens of thousands of people without ever touching the victims’ own networks. If a vendor holding your customer data got breached tomorrow, would you know before the breach notice arrived? The longer it takes a customer to learn that a vendor was compromised, the more damage the breach can do. Three steps to start this week: 🔐 Map the vendors that handle your customer data 📊 Replace annual questionnaires with real-time evidence 🚨 Add vendor incidents to your response playbook 👉 Read the blog and see how outside-in monitoring helps your team spot vendor exposure before a breach notice arrives: securityscorecard.com/blog/t… #cybersecurity #TPRM #vendorriskmanagement #thirdpartyrisk #supplychain #cyberrisk #Japan

🏥 Attackers don’t wait for visiting hours. They look at hospitals’ internet-facing systems around the clock, and leaders can now look, too. SecurityScorecard’s new report, “Visiting Hours,” shows what attackers see when they scan U.S. healthcare systems from the outside. It draws on Project Meridian, our geospatial intelligence platform that shows cyber and physical risk across the nation’s 16 critical infrastructure sectors as one connected system. It covers approximately 40,000 healthcare records across 2,979 counties. 🚨 1 in 7 records (5,862) carries a Known Exploited Vulnerability (KEV) flag, a bug criminals already use in real attacks ✅ 62.5% of graded records earn an A or B, but 1 in 6 earns a D or F ⚠️ A top grade can still hide risk: one Texas health system earned an A while running eight urgent vulnerabilities on live machines 🔑 3,767 records (9.6%) show leaked-password signals 🔗 In Texas, 11 of 12 hospital groups use Microsoft, so one supplier failure can ripple across many hospitals 📍 Rural clinics score a D or F more often (16.7%) than hospitals (15.2%), but the next facility can sit 30 miles away The encouraging part: in our Texas case study, 316 possible vulnerabilities narrowed to nine confirmed on live systems. A small team can work through that list in weeks. 👉 Read the report and see what attackers see in your region, plus a 30-day plan your team can start this week to act on the findings: securityscorecard.com/resour… #cybersecurity #healthcare #TPRM #cyberrisk #attacksurface #threatintel #ProjectMeridian

📰 CPO Magazine reports a data breach at Burger King Japan exposed more than 11 million customer records tied to its official app. SecurityScorecard CEO and Co-Founder Dr. Aleksandr Yampolskiy shared what our external data shows across Burger King’s broader footprint: 🔍 A D rating (61 out of 100), with a 31-point downward indicator ⚠️ 2,460 findings, including 63 critical-CVSS vulnerability observations across 32 distinct CVEs 📊 F-rated companies were 13.8 times more likely to experience a breach than A-rated companies These findings require validation, and we have not connected them to the Japan breach. Yampolskiy’s takeaway: “One compromised account or application should not provide unrestricted access to customer data.” 👉 Read the full coverage and see why Zero Trust segregation and access controls matter for customer data: cpomagazine.com/cyber-securi… #cybersecurity #TPRM #cyberrisk #vendorriskmanagement #thirdpartyrisk

You can’t secure an attack surface you haven’t measured. Snyk’s Manoj Nair says SecurityScorecard's TPRM Benchmark gives security teams a shared, transparent way to evaluate AI models on capability and attack resistance together. Snyk’s own research backs up the need: across 3,000 enterprise environments, 74.5% of those with a detected model reference at least one that scores “high” on an attacker goal under adversarial testing. Thank you, @snyksec & @mnair1, for the support. Explore the benchmark: tprmbenchmark.com/

AI now sits on both sides of the fight, and unexpected model behavior can become an incident for defenders or an opportunity for attackers. GreyNoise’s Corey Bodzin says his team has seen attackers’ AI use leave identifiable tells, and defenders’ models make mistakes. His perspective on SecurityScorecard's TPRM Benchmark: objective, transparent measurement puts evidence of model performance on the table, so defenders can adopt AI with a clear view of its strengths and limits. Thank you @GreyNoiseIO for the support. Explore the benchmark: tprmbenchmark.com/

📣 SecurityScorecard just launched the first AI Third-Party Risk Management (TPRM) Benchmark. Can AI manage third-party risk without becoming part of the risk? Now you can test both sides before you deploy a model. 🎯 Capability: Scores models on exposure triage, breach correlation, vendor concentration, and vulnerability prioritization 🛡️ Resilience: Grades models A to F against prompt injection, jailbreaks, and deceptive vendor inputs 🏁 Autonomy: Rates each model from L0 to L4 to show where humans still need to stay in control Early runs show open-weight models closing the gap with frontier models on supply chain security tasks. Several remain susceptible to adversarial attacks. The framework is open source. AI labs, security vendors, and researchers can test models and join the public leaderboard. 🤝 We’re grateful to the industry and academic leaders who weighed in on why measuring AI matters, including @nyuniversity Yevgeniy Dodis, @UMIDSC University of Miami Frost Institute for Data Science & Computing Dr. @YelenaYesha, @GreyNoiseIO Corey Bodzin, @SimSpaceCorp Peter Lee, @snyksec @mnair1, and our very own @ayampolskiy and Mike Mylrea 👉 Read the announcement and see how the benchmark tests whether AI can do the work and resist manipulation: securityscorecard.com/compan… #cybersecurity #artificialintelligence #ThirdPartyRisk #TPRM #supplychainsecurity #cyberrisk

PHP2Shell kicked off “Black October.” Attacks on Node, GitLab, and others have followed close behind. When a zero-day hits, your supply chain gets blindsided. We looked at two PHP2Shell CVEs and found 10 vendors with 20,000+ open findings apiece and no response. When nothing looks more urgent than anything else, a bulk “please fix your stuff” ask isn’t defensible, and vendors deprioritize it. Here’s how TITAN AI changes that, in about three minutes: → Filter Findings to the two PHP2Shell CVEs → Group by vendor to see exactly who’s exposed → Select, choose Request Remediation, and send a specific, CVE-level ask to every exposed vendor in one click → Track who’s been asked with a flagged column Then automate it. Workflows link a trigger to conditions and actions, so a confirmed breach event can fire vendor outreach on its own. You decide how much runs automatically and how much waits for a person. Watch the PHP2Shell response in action below! #ThirdPartyRisk #SupplyChainSecurity #ZeroDay #PHP2Shell #TITANAI

New Research Drop: Two TeamPCP suspects have been arrested for their alleged roles in a supply chain campaign, but their attack blueprint lives on. What SecurityScorecard’s STRIKE Threat Intelligence Team is unveiling today: -Coding bugs in the worm: STRIKE’s static analysis found defects that can covertly change the worm’s path, so a missing artifact does not prove a stage did not run. -Examples include: Health checks that skip await and can block the backup exfiltration route, uploads that count as sent even when they fail, unresolved Windows file paths, and a security-tool check that is defined but never called. -A response-order consequence: Blocking network access can make the worm’s npm check fail and trigger the wipe. Responders should stop the malware before blocking the network, not just before revoking tokens. Come for the worm, stay for the connected alliance map: STRIKE conducted dark web research, linking dark web forum posts and leak-site posts to show how TeamPCP worked with five partner groups: 📣 BreachForums recruited affiliates and hosted the Shai-Hulud worm 💰 xpl0itrs turned raw access into targeted intrusions 🔓 LAPSUS$ converted stolen credentials into paid extortion 💥 Vect Ransomware tried to encrypt victims, but a flaw turned it into a wiper 🕵️ ShinyHunters turned on TeamPCP, hijacked the credentials, and kept the proceeds 👉 Read the full STRIKE analysis for details on the worm — and see which relationships were real partnerships and which appear a little more one-sided: securityscorecard.com/wp-con… #cybersecurity #threatintel #threatintelligence #TPRM #attacksurface #cyberrisk #supplychain

📊 Reviewing a vendor questionnaire answer by answer takes hours your team doesn’t have. In this installment of SecurityScorecard’s TITAN demo series, see how TITAN AI scores and analyzes assessments automatically. You set the criteria once at the template level. Our platform handles the review when the supplier submits. ✅ Set pass and fail weighting for each risk metric 🤖 Check answers against your policy and the supplier’s uploaded evidence 📥 Pull answers from documents already in the vendor’s profile In the demo, one assessment returns 36 passed answers, 2 failed, 4 partial, and 4 empty. You can drill into each section to see why. 📺 Watch the demo below 👉 See how to get a questionnaire health score and risk score without reviewing every response by hand: securityscorecard.com/resour… #cybersecurity #TPRM #TitanAI #vendorriskmanagement #ThirdPartyRiskManagement #cyberrisk

🚨 SecurityScorecard’s STRIKE Threat Intelligence Team found more than 7.6 million internet-facing assets running PHP. Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) are facing attack attempts. One unpatched shared dependency can take down many services at once. Here’s what to do today: 🔗 Map the hosting providers and managed service providers (MSPs) behind your most critical services 🛡️ Confirm your WAF rule sits in the request path, because a reachable origin skips it 🔐 Rotate secrets if you see probing, since one flaw can leak process memory 📺 Watch TITAN Secure with the Driftnet add-on build a PHP2Shell response workflow, from vendor exposure to a verified fix. 👉 Read the advisory and learn how to rank your public services by mission impact and shared dependencies: securityscorecard.com/blog/s… #cybersecurity #threatintel #TPRM #attacksurface #cyberrisk #TitanAI #vendorriskmanagement #PHP2Shell

The EU AI Act moved from preparation to enforcement on August 2, 2026. For most security teams, that raises a harder question than “are we compliant?” Do you actually know where AI exists across your supply chain? AI often enters an organization through vendors and software providers long before security teams deploy it directly, and annual questionnaires can’t keep pace with how quickly that changes. 📋 What the AI Act’s risk-based approach actually requires, and when 🔍 Why AI exposure often lives several layers deep in your vendor ecosystem 🔄 Why continuous oversight matters more than a once-a-year compliance check 👉 Read the full blog and see what it takes to track AI exposure across your supply chain: securityscorecard.com/blog/h… #cybersecurity #AI #EUAIAct #TPRM #SecurityScorecard #compliance

If you're investigating PHP you're likely asking if you're exposed or which vendors put you at risk — or what should we fix first? SecurityScorecard’s MAX team will help you answer those questions about PHP2Shell (CVE-2026-109618 and CVE-2026-109619) this week and next, for free. We will help identify potential exposure across your organization and vendors, and you don’t need to be a customer. Email [email protected]. Here is why it matters. SecurityScorecard’s STRIKE team found approximately 6 million internet-facing IPs running PHP. 🚨 🌐 7,669,724 distinct IPs showed PHP in a 30-day windownbsp; ⚠️ 2,705,148 IPs advertised a PHP version below the upstream fixnbsp; 🇺🇸 The United States leads with 1.69 million PHP-tagged IPs, ahead of France and Germany 👉 Read the blog and get the full data, plus a five-step plan to patch, restart, and verify every PHP runtime, and reach out if you need support: securityscorecard.com/blog/p… #cybersecurity #threatintel #PHP2Shell #CISO #TPRM #attacksurface #cyberrisk

Aviation averages a B grade for cybersecurity. That sounds fine, until you learn a B-rated organization is 2.9x more likely to suffer a breach than an A-rated one. SecurityScorecard’s research on 250 major aerospace and aviation companies found the real problem isn’t the airlines themselves. It’s their vendors: aviation-specific software and IT suppliers scored the lowest of any group studied, dragging the sector’s average down. ✈️ Why a handful of low-scoring vendors are wrecking the curve for an entire industry 📋 Why annual questionnaires can’t catch a vendor exposure that appears mid-year 🏛️ Why TSA and FAA oversight are now asking for proof, not paperwork 👉 Read the full breakdown and see what continuous, threat-informed TPRM looks like for aviation: securityscorecard.com/blog/a… #cybersecurity #aviation #TPRM #vendorriskmanagement #SecurityScorecard #supplychainsecurity

“People who design systems, people who build systems, they usually believe that people will be well behaved,” our CEO and Co-Founder Dr. Aleksandr Yampolskiy told Cybersecurity Dive. “But hackers are not well behaved.” Days after the French supermarket refrigeration attacks, Cybersecurity Dive reports that thousands of controllers remain exposed globally. SecurityScorecard’s own investigation found more than 5,200 StoreView instances visible across more than 4,600 public IP addresses, a wider footprint than any single headline captured. 👉 Read the full Cybersecurity Dive coverage: cybersecuritydive.com/news/t… #cybersecurity #OT #criticalinfrastructure #Driftnet #SecurityScorecard #threatintelligence

A doctor checks your blood pressure. Your car has a speedometer. Buy a financial instrument, and you get a credit rating from S&P or Moody’s. What about for cybersecurity? Our CEO and Co-Founder Dr. Aleksandr Yampolskiy explains how he pioneered security ratings, the idea behind SecurityScorecard on The Vlad Kachur Show: a security score for any company, so you can actually see the risk before you do business with them. 📺 Watch the full episode: youtube.com/watch?v=3OYUrYq9… #cybersecurity #TPRM #SecurityScorecard #startups #leadership

We’re proud to be participating in TPRA’s October 2026 Virtual Demo Day, an exclusive event for TPRM professionals to explore innovative tools and services in third-party risk management. Join Michelle Koestani, Director, Solutions Architects at SecurityScorecard for a 25-minute live demo, where she’ll showcase how TITAN AI helps TPRM teams move from periodic assessments to continuous, threat-informed risk management. Her session is at 12:00 PM CT. 🔍 See how continuous monitoring surfaces vendor risk as it emerges ⚙️ Learn how AI agents automate manual questionnaire work 🎯 Get a clear view of your entire vendor ecosystem, not just your top-tier vendors 📅 Wednesday, October 21, 2026 | Starting at 9:00 AM CT 👉 Register here: tprassociation.org/demo-days #TPRA #DemoDay #TPRM #ThirdPartyRisk #VendorRisk #GRC

A 200-question spreadsheet sent to every vendor regardless of risk level isn’t enough to stay ahead of third-party cyber risk. SecurityScorecard’s new eBook breaks down why legacy TPRM tools can’t keep pace anymore: biannual assessment cycles, massive questionnaires, and manual evidence review create six-week delays while third-party involvement in breaches has climbed from 30% to 48% year-over-year. 📋 Why checkbox-driven assessment cycles fail to catch changing threats ⏱️ The hidden cost of questionnaire fatigue: delayed assessments and disconnected tools 🤖 How AI-driven automation and continuous monitoring close the visibility gap 👉 Get the eBook and see what it takes to modernize your vendor risk workflow to match the pace of real threats: securityscorecard.com/resour… #CISO #CTO #cybersecurity #vendorriskmanagement #TPRM #cyberrisk #AI #solutionguide

Takedowns once cost attackers weeks of rebuilding. Now they only cost minutes. Richard Hummel and Gilad Friedenreich Maizles broke down how SecurityScorecard’s STRIKE team uncovered CanOworms, a 633-server proxy fleet for rent, and why law enforcement takedowns rarely stick against infrastructure like this. One single IP can host 10,000 domains, leased for as little as three hours. When attackers lose infrastructure, underground LLMs can rebuild it automatically in minutes. 🔍 Why tracking TCP flag anomalies and TLS fingerprints beats chasing IP reputation 🔄 Why one open-source tip from a partner led researchers to 633 servers 🛡️ The specific actions defenders should prioritize right now 👉 Read the full recap: securityscorecard.com/blog/c… #cybersecurity #threatintelligence #STRIKE #CanOworms #TPRM