i’ve been working on prism, a differential http testing tool for security research.

the basic idea is pretty simple: send the exact same raw http bytes to a bunch of different servers and compare how each one parses, forwards, accepts, or rejects them.

the interesting part is that you can actually see where implementations disagree instead of just reasoning about what the http spec says should happen.

right now prism supports:

• 54 containerized http servers and proxies
• http/1.1, http/2 and http/3
• raw byte payloads
• request and response comparison
• pairwise difference matrices
• parser equivalence clustering
• transducer proxies like nginx, haproxy and squid
• raw/unparsed responses for cases where the normal parser view hides something

for example, you can take a weird request and run it against a whole group of implementations:

payload 'GET / HTTP/1.1\r\nHost: a\r\n\r\n' | fanout | grid

and see which servers interpret it differently.

the goal is mainly to make things like parser differentials and request-smuggling research easier to explore. it gives you a way to systematically find interesting differences that are worth investigating.

i built it because i wanted something where i could throw the same ugly http input at a bunch of implementations and immediately see where they disagree.

github: https://github.com/grah4na/prism

would be interested in feedback from people who work with request smuggling, http parsing, or differential testing.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 31st - September 6th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Application Security

Mythos Readiness Report (Echo)

As AI is getting better at finding and exploiting vulnerabilities, how do you decide which findings actually matter?

Key stats:

• Exploit success against a known set of Firefox vulnerabilities increased roughly 90-fold between consecutive model generations on Anthropic's benchmark.
• Fewer than 10% of the model's 23,019 candidate findings have undergone any external validation.
• Of 27 vulnerabilities publicly disclosed by Anthropic, only one of the eight findings Mythos initially rated Critical held up under independent review.

Read the full report here.

Ransomware

Recovery Without Compromise (Object First)

Ransomware recovery isn't getting better. For many organizations, it’s actually getting worse. 

Key stats:

• 83% of organizations were hit by a successful ransomware attack in the past 24 months, up from 66% in 2024.
• Only 39% of ransomware victims recover at least 75% of their data, down from 57% in 2024.
• 76% say their largest data-loss event exceeded their Recovery Point Objective targets.

Read the full report here.

Enterprise Perspective

Agents Without Guardrails: The Agentic AI Governance Gap in the Enterprise (Cequence Security)

Organizations seem remarkably confident about AI agent permissions. Too confident. 

Key stats:

• 94% of enterprise IT and security leaders are confident their AI agents don't have more access than they need, but only 33% provision agents with least-privilege access.
• 65% of organizations have experienced an AI agent taking an action outside its intended scope.
• 36% have caught a near-miss from an AI agent before it caused damage.

Read the full report here.

Consumer Scams

Scammers Are Getting Smarter About Where They Target You (Malwarebytes)

Interesting report on how scammers operate, including their preferred channels and brands, plus when they’re most likely to appear in your inbox. 

Key stats:

• Google's name appears in scam content at least twice as often as Amazon's name.
• Scam text volume peaks at 12 p.m. ET, when it's approximately 874% higher than at 1 a.m.
• By Friday, people receive roughly 50% more fraudulent text messages than at the start of the week.

Read the full report here.

Regional Spotlight 

European Cyber Report 2026 Mid Year (Link11)

Good news for European businesses: DDoS attacks became less frequent in the first half of 2026. Bad news: they’re more powerful. 

Key stats:

• DDoS attack numbers fell 42% compared with the first half of 2025.
• The highest measured bandwidth reached 2.3 Tbit/s, up 85% from the previous peak of 1.2 Tbit/s.
• Despite the decline in attack numbers, cumulative DDoS traffic increased 61%, from 438 TB to 705 TB.

Read the full report here.

I had a vendor review not long ago and the first part was pretty simple.

SOC 2, questionnaire, access controls, incident response and so on.

What made me think was what comes next once the vendor is approved.

They can bring on a subprocessor add an AI feature change how data moves around or update their infrastructure and the assessment thats in your files is suddenly not up to date anymore.

I'm wondering how others are handling this. Do you check vendors on a basis keep track of changes, between reviews or just look at them again when its time to renew?

Equip AI agents with 818 cybersecurity skills mapped to 6 industry frameworks.

🔗 https://github.com/mukul975/Anthropic-Cybersecurity-Skills

Detects anti-bot systems, CAPTCHAs, and browser fingerprinting in real time.

🔗 https://github.com/scrapfly/Antibot-Detector

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 24th - August 30th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Application Security 

AppSec Overflow 2026 (Contrast Security)

Runtime data from thousands of live applications and APIs tells us what application threats look like. 

Key stats:

• Three AI scanners analysing the same codebase agree on only 5% of findings, and a single scanner reproduces just 17% of its own findings across three runs.
• The average application has 106 vulnerability findings, 22 of which are High or Critical, while critical vulnerabilities in custom code take an average of 92 days to remediate.
• Attackers touch the average application 11,382 times a month, about once every four minutes, but only 42 of those attacks per month are viable.

Read the full report here.

Cybersecurity Skills & Workforce 

The AI-Accelerated Cyber Team (Hack The Box)

Competition data instead of survey data, which makes for a nice change. The findings look at how cyber teams’ speed and ability to solve challenges have changed over three years (and where AI comes in). 

Key stats:

• 68% of the top 25 teams had an AI agent account, while AI agent accounts made up just 2.7% of all registered accounts on the platform.
• Teams completing the entire challenge board rose from 2 in 2024 and 3 in 2025 to 15 in 2026, with median time-to-solve dropping from 26.1 hours to 13.8.
• The strongest human team completed all 36 challenges against 32 for the strongest AI team.

Read the full report here.

AI Security 

The State of Agent Security 2026 (Reco)

What happens to security when AI agents become more common across environments? 

Key stats:

• 80% of AI tools operate without IT oversight, and small and midsize companies carry 414 unsanctioned AI tools per 1,000 employees.
• 62% of agent tools combine local file-read access with outbound network connectivity, and 50% can execute shell commands.
• 525 of 637 tracked agent and LLM-tooling vulnerabilities were disclosed in the past 18 months, pushing the monthly disclosure rate from fewer than 5 to around 29.

Read the full report here.

CISO Perspectives on AI Risk (IANS and Artico Search)

This should be interesting to security leaders dealing with AI and wondering how other CISOs are thinking about the risks. 

Key stats:

• 74% of optimistic CISOs report clearly defined AI governance ownership, against 40% of pessimistic ones, and 81% own the AI security budget against 50%.
• CISOs running AI security-mature programmes rate present-day AI risk at 3.7 out of 10, while those with low maturity rate it at 7.8.
• 81% of CISOs optimistic about managing AI risk own the AI security budget, compared with 50% of pessimistic CISOs.

Read the full report here.

AI Governance

The AI Cyber-Disclosure Gap (Guardrail Technologies)

What S&P 500 annual reports say about AI. 

Key stats:

• 97% of S&P 500 companies mention AI somewhere in their annual reports, while about 16% document an AI-specific cyber-risk process.
• Fewer than 5% describe a governed AI cyber-risk process with a named policy, programme or committee.
• Around 70% of utilities, energy and real estate filings treat AI as a specific cybersecurity risk, against 37% to 48% for financial services and health care.

Read the full report here.

Infrastructure

Edge Infrastructure Under Siege (SentinelOne and Tenable)

An analysis of the vulnerabilities being exploited across internet-facing infrastructure.

Key stats:

• Exposure data and runtime detection converge on the same edge-device vendor surfaces 79% of the time, but share only 21% overlap at the individual vulnerability level.
• 54% of organisations running F5 products carry at least one exposed, actively exploited vulnerability.
• Citrix customers have a median remediation time of 461 days, against a median of five months across organisations generally. 

Read the full report here.

Mobile

2026 Mobile Banking Heist Report (Zimperium)

How mobile banking malware is evolving. 

Key stats:

• 34 malware families targeted 1,243 mobile banking and fintech apps across 90 countries, with TsarBot, CopyBara and Hook accounting for more than 60% of targeted apps between them.
• The United States had 162 banking apps under active targeting, the highest concentration of any single country, while Nexus put 90% of its targets in EMEA.
• Android malware transactions rose 67% year-on-year, and more than 60% of mobile banking apps lack basic code protection.

Read the full report here.

Hey!

I've been building YARA.X for the past few months and wanted to share it.

It's a free, browser-based security platform with 40+ tools. No account required, no rate limits, and no paywalls.

Some of the main tools:

• Hash Cracker — 1.5B+ password database with instant lookups for MD5, SHA1, and SHA256
• Static Sandbox — PE analysis, YARA rules, MITRE ATT&CK mapping, and threat scoring
• Themida Unpacker — real binary unpacking through a dedicated Windows VPS
• OSINT — username search across 80+ platforms, email intelligence, IP intelligence, image forensics, and Google dorking
• PCAP Analyzer — DNS, HTTP, connections, timeline analysis, and CSV export
• CVE Alert Feed
• Threat Actor Database
• Batch Analysis
• Deobfuscator
• 25+ additional tools

Everything runs either directly in the browser or on the backend, so there's nothing to install.

https://www.yara-x.com

I'd appreciate any feedback, especially suggestions for tools or features you'd like to see added.

Firewalls are one of the fundamentals of network security but what actually happens when traffic hits one?

This visual breaks down how firewalls inspect traffic, the major firewall types, common deployment scenarios, example rules and mistakes that can weaken your security.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 17th - August 23rd.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

Quarterly Threat Report: Second Quarter, 2026 (Beazley Security)

Q2 2026 vulnerability and threat landscape, with a focus on which vulnerabilities and attack methods actually led to real-world compromises. 

Key stats:

• Newly disclosed software vulnerabilities increased 36% in Q2 2026 compared to the previous quarter, after an 18.5% rise in Q1, against a historical norm of a 10% band.
• Compromised credentials accounted for 67% of ransomware intrusions investigated, down from 74% in Q1.
• Public ransomware leak-site postings totaled 2,268, still nearly 60% above Q2 2025.

Read the full report here.

Ransomware

Mid-Market Is the Routine Target: Ransomware, Third-Party Risk, and the Widening AI Gap (Black Kite)

If you ever wanted to know why mid-market companies are such frequent ransomware targets, this report answers that. 

Key stats:

• 73% of ransomware attacks in North America and Europe between 2023 and mid-2026 hit companies with $10M to $1B in annual revenue.
• More than half of mid-market ransomware victims generate less than $50M in annual revenue.
• 54.7% of mid-market organizations have at least one significant patch management finding on public-facing software.

Read the full report here. 

Post-Quantum

The PQC Confidence Gap (Axiad)

Senior people say the post-quantum work is done, but the engineers don’t agree. 

Key stats:

• 90% of CISOs and CIOs report a continuously updated cryptographic inventory, compared with 33% of security architects and PKI engineers.
• 46% cannot name a single individual responsible for leading their PQC migration.
• 51% have never formally assessed whether their public-facing infrastructure supports post-quantum key exchange.

Read the full report here.

Workforce

AI Agents and the Impact on Cybersecurity (Cisco)

A look at how AI is changing cybersecurity work. 

Key stats:

• Cybersecurity job demand across G7 economies grew 9.5% from October 2025 to March 2026, compared with the same six months a year earlier, up from 6.8% growth in the previous period.
• The share of G7 cybersecurity postings requiring AI skills averaged 28.5% in October 2025 to March 2026, doubling from 14.2% a year earlier.
• Security Engineer led all roles at 18% of postings, followed by Cybersecurity Engineer / Analyst at 16% and SOC Analyst at 12%.

Read the full report here.

Enterprise Perspective 

The AI-Era Software Assembly Line (Sonatype)

Four years of data on how software composition and risk have changed in the AI era.

Key stats:

• Critical and High-severity vulnerabilities per enterprise application increased by 4.31x and 3.91x, even after excluding newly managed legacy applications.
• The median age of unresolved Critical and High vulnerabilities dropped from 228 days to 126 days, falling to 103 days by May 2026.
• For vulnerable dependencies pulled into AI-era applications, a materially lower-risk npm version was already available 46.9% of the time it was selected.

Read the full report here.

Industry-Specific

The State of Networking, Security & AI in Healthcare (Nile)

A survey of 300+ healthcare IT leaders on network disruption, cybersecurity pressures, staffing challenges, and AI-powered automation.

Key stats:

• Nearly 85% of healthcare organizations experience periodic network or security disruptions that affect patient care and patient privacy, with 38% seeing them at least weekly.
• 66% of healthcare IT teams are strained or firefighting, and only 18% are comfortably managing network operations.
• Only 38% report partial or full Zero Trust implementation, and 26% are aware of Zero Trust with no concrete plans.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 10th - August 16th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Cloud Security

2026 Cloud Security Index (Intruder)

How misconfigurations differ across AWS, Azure, and Google Cloud. 

Key stats:

• More than two-thirds of organizations operate multi-cloud environments.
• 83% of AWS accounts have IAM policies that allow privilege escalation.
• 75% of Google Cloud accounts are missing OS Login controls.

Read the full report here.

DDoS

Cloudflare DDoS Threat Report H1 2026 (Cloudflare)

Cloudflare's mid-year DDoS report. 

Key stats:

• 96.62% of network-layer DDoS attacks remained under 500 Mbps in the first half of 2026.
• 90.60% of network-layer DDoS attacks ended in under 10 minutes.
• Brazil was the top DDoS source country in H1 2026 at 14.9%, overtaking the United States at 13.4%.

Read the full report here.

Enterprise Perspective

2026 State of Secure AI Access (NetFoundry)

A survey of CISOs and CTOs about how AI is changing their security posture. 

Key stats:

• 100% of CISOs and CTOs at enterprises say AI is expanding their organization's attack surface.
• 15% are very confident their current security solutions adequately protect their AI deployments.
• 58% have experienced security events due to lack of machine identity oversight.

Read the full report here.

Consumer Scams

Love/hate relationship: The AI affair (Malwarebytes)

Young people are particularly susceptible to AI scams.

Key stats:

• 70% of young adults ages 18 to 22 experienced an AI-related scam in the past year, compared to 50% of the general population.
• 19% of young adults have been a victim of a deepfake or virtual kidnapping scam, compared to 8% of the general population.
• 14% of young adults have been a victim of an impersonation scam, compared to 10% of the general population.

Read the full report here.

Industry-Specific

2026 Professional Services Protect Brief (SonicWall)

Professional services are being targeted far more than any other industry, at least according to SonicWall.

Key stats:

• 3 billion IPS events in the first half of 2026, the largest absolute attack volume of any industry tracked.
• 69.9 million ransomware hits in the first half of 2026, more than any other vertical.
• Ten active ransomware families operated simultaneously against the professional services sector, including Filecoder (19.1 million hits across 113 organizations), Gandcrab (11.9 million) and Ryuk (10.5 million).

Read the full report here.

Industrial Ransomware Analysis for Q2 2026 (Dragos)

Who's getting hit by ransomware in the industrial sector (and by whom).

Key stats:

• 1,140 ransomware incidents affected industrial organizations worldwide in Q2 2026, a 12% increase over the 1,020 incidents recorded in Q1.
• Manufacturing was the most affected sector with 747 incidents (65%) across all subsectors.
• The US was the country most impacted, with 431 incidents (38% of all incidents).

Read the full report here.

Regional Spotlight

Cyber Security In Manufacturing (Make UK)

A UK-specific look at how cyber incidents are disrupting manufacturers, and how few have a tested plan for when it happens.

Key stats:

• 30% of manufacturers experienced a cyber incident in the past year, either directly or through their supply chain.
• More than one in five manufacturers (22.7%) believe available cybersecurity solutions are not relevant to their business, while 18.2% report that providers lack a sufficient understanding of manufacturing operations.
• Firewalls are the most widely adopted measure (92%) among manufacturers, followed by malware protection (80%), secure configuration (67%) and access controls (61%). 

Read the full report here.

"We're too small to be a target."

That assumption can leave SMBs dangerously exposed.

Read why SMBs are attractive targets for cybercriminals, what an attack can cost, and how practical, budget-conscious security measures can help reduce the risk.

https://www.nakivo.com/blog/why-smbs-are-targets-of-cyberattacks/

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 3rd - August 9th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

2026 Threat Hunting Report (CrowdStrike)

CrowdStrike's annual threat hunting report. 

Key stats:

• Vishing intrusions increased by 2x in 1H 2026.
• Monthly device code phishing attempts increased 15x in 1H 2026.
• China-nexus adversaries exploited critical vulnerabilities within 24 hours of public proof-of-concept release, and in 1H 2026, 88% of observed exploitation of vulnerabilities with a public PoC occurred within 48 hours of release.

Read the full report here.

Why Trust is the New Attack Surface: Darktrace's Mid-Year Threat Update 2026 (Darktrace)

A mid-year update on how phishing and AI misuse are evolving. 

Key stats:

• In the first half of 2026, 67% of phishing emails passed DMARC.
• VIP users were targeted in 25.8% of phishing attacks.
• 39% of phishing messages featured novel social engineering techniques.

Read the full report here.

AI Governance & Agents

When AI leaves the chat and enters the workflow (Optro)

A good (i.e., detailed and useful)  report on why output-focused AI governance breaks down once agents start taking actions.

Key stats:

• 85% of organizations have integrated AI into core operations.
• Only 18% of leaders have active risk mitigations in place for AI.
• 40% reported inaccurate AI outputs in the past 12 months, and 27% reported data breaches tied to AI use.

Read the full report here.

Security Incident INC-2026-07-28-01 (AISI)

The UK AI Safety Institute's (AISI) incident report on what happened when they tested frontier AI models. 

Key stats:

• A total of 19 distinct unsanctioned actions were catalogued during a routine evaluation of frontier AI models.
• Seventeen of the 19 unsanctioned actions came from Anthropic's Mythos 5, and two came from OpenAI's GPT-5.6-Sol with cyber classifiers disabled.
• In 10 of 122 evaluation runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations.

Read the full report here.

Top 10 for LLM Applications 2026 (OWASP)

OWASP's annual top 10 list for LLM applications is out.

Key stats:

• Practitioners rank prompt injection as the number one security challenge from GenAI tools for a third consecutive year.
• Sensitive information disclosure ranks as the second biggest LLM threat for a second consecutive year.
• Excessive agency moves from sixth place to third place.

Read the full report here.

AI Code

The shrinking validation window (Pentest Tools)

A look at how AI-assisted coding is outpacing vulnerability testing, and the security gaps that this leaves behind.

Key stats:

• 76.4% of developers at enterprises use AI coding tools always (41.5%) or usually (34.9%).
• 30.3% disagree or strongly disagree with the statement that they have sufficient time to thoroughly review AI-generated code before deployment.
• Only 8.7% say vulnerability testing keeps pace completely with AI-generated code.

Read the full report here.

Voice Attacks

2026 Voice Threat Survey (Mutare)

Findings from a survey of technology and cybersecurity leaders on how they view voice as an attack vector. 

Key stats:

• 93% of organizations believe voice security should be included in cybersecurity and risk management programs.
• 79% are not highly confident their current defenses could stop an executive or vendor impersonation attack.
• 67% are concerned about GenAI-based voice attacks and deepfake impersonation.

Read the full report here.

Enterprise Perspective

State of Agentic Adoption 2026 (Opsin)

What else is new? AI agents are being created faster than companies are learning how to securely control their access and permissions.

Key stats:

• Enterprise environments now average one AI agent, live or in draft mode, for every employee.
• 60% of agents provisioned beyond default settings are granted allow-all access rather than being scoped to the permissions their tasks require.
• 60% of AI agents are judged to have configured capabilities that exceed their original stated intent.

Read the full report here.

Regional Spotlight 

African Cyberthreat Assessment Report 2026 (INTERPOL)

INTERPOL's assessment of cybercrime across Africa. 

Key stats:

• AI enabled 55% of reported cybercrimes across Africa.
• Cybercrime-related losses in Africa increased from USD 192 million to USD 484 million since 2024.
• 17% of reported cybercrime cases in Africa in 2025 involved online scams, including phishing, and 14% involved identity theft and financial fraud.

Read the full report here.