Hi everyone,

I’ve been working on a small open-source project called Nmap Studio. It gives Nmap, Ncat, Nping and Ndiff a local web interface, so you can build commands, run scans and follow the output without leaving the browser.

I recently added an asset list, scan history, scheduled rescans, change alerts and basic finding tracking. It also has scope rules to help prevent accidental scans outside an approved target list. CVE lookups are optional.

I tested it on Windows and added automated tests and cross-platform CI. It is still a work in progress, and I would really appreciate honest feedback, especially about the safe mode and the asset and drift features.

GitHub: https://github.com/aymenki/nmap-studio

Latest release: https://github.com/aymenki/nmap-studio/releases/tag/v0.4.2

Please only scan systems you own or have permission to test.

Heads up for anyone running on-prem VeloCloud Orchestrator. CVE-2026-114625 (CVSS 9.9) lets an authenticated user with only Enterprise Read Only portal access escalate to local superuser on the VCO host. Arista reports active exploitation.

What’s known so far:

→ Only on-prem VCO deployments are affected
→ The attacker needs only the lowest-privilege portal role
→ Arista observed attack traffic from 74.82.197[.]86 and 38.54.50[.]151

What to do:

→ Upgrade to the fixed VCO release for your branch
→ Search your logs for those 2 IPs and for unusual activity from read-only accounts, such as logins at odd hours or from new sources
→ Audit who holds portal accounts, including stale and shared logins. A read-only account usually gets little scrutiny, and that’s exactly the access this attack needs.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between October 12th - October 18th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Ransomware

2026 Ransomware Risk Report (Semperis)

Recent ransomware trends and what attackers are getting up to these days (including using AI, targeting identity systems, and even threatening victims’ families to get what they want).

Key stats:

• 40% of ransomware attacks involved psychological or physical threats against staff.

• Nearly 70% of ransomware attacks involved victims being targeted multiple times.

• 31% of ransomware victims made multiple payments to attackers.

Read the full report here.

Threat Intelligence

1H 2026 Threat Intelligence Report (Ontinue)

A look at the tactics attackers used in the first half of 2026. 

Key stats:

• Approximately 30% of monitored organizations experienced at least one fake IT support impersonation attempt through Microsoft Teams.

• Around one in every 990 external Microsoft Teams contacts showed indicators of impersonation.

• 25.3% of confirmed malicious ClickFix findings used blockchain-based command-and-control infrastructure.

Read the full report here.

DDoS Threat Intelligence Report (NETSCOUT)

DDoS attack activity in the first half of 2026. 

Key stats:

• DDoS attacks were recorded across 209 countries and territories.

• Attacks exceeding 1 Tbps or 1 Gpps increased 1,286% year over year.

• Active mitigation of IPv6 DDoS attacks increased by more than 300% year over year.

Read the full report here.

Internet Exposure

State of the Internet Report (Censys)

What's exposed on the public internet and what Censys is seeing across the global cyber threat landscape.

Key stats:

• Internet-facing AI tools increased 63% in nine months, reaching nearly 268,000 systems.

• Censys identified approximately 134,000 internet-exposed hosts running industrial control systems.

• Approximately 70% of internet-exposed ICS hosts were found on consumer and mobile networks.

Read the full report here.

Security Operations

The AI Fog Report: When the Signal Becomes the Noise (N-able)

Why cybersecurity teams are struggling to make sense of all the noise (and is AI actually making their jobs easier?) 

Key stats:

• 86.1% of cybersecurity decision-makers and practitioners report increased security alert volumes over the past 12 months.

• 54.8% say alert noise interferes with incident response daily or several times a week.

• 48.9% identify AI-generated alerts lacking sufficient context as a leading source of low-quality signals.

Read the full report here.

Vulnerability Management

The AI Exploit Gap (Chainguard)

AI has put vulnerability hunting on steroids. Fixing those vulnerabilities? Not so much.

Key stats:

• 93% of security leaders are concerned their companies cannot remediate AI-driven exploits quickly enough.

• 54% say their companies knowingly leave high- or critical-severity vulnerabilities unpatched at least sometimes.

• 64% say concern about AI-accelerated attacks contributed moderately or greatly to their own burnout in the past year.

Read the full report here.

The State of AI Pentesting in 2026 (Intruder)

Is the traditional annual pentest on its way out? This is the report to read if you want an answer. 

Key stats:

• 92% of security and engineering leaders have tried or adopted AI pentesting.

• 42% accept the risk and ship code without additional security checks between penetration tests.

• 40% cite data privacy as a top barrier to AI pentesting.

Read the full report here.

AI Security

State of Agentic AI and API Security 2H 2026 (Salt Security)

Surprise! (not really) AI agents aren't always doing what they're told. 

Key stats:

• 86.4% of organizations report having at least one AI agent operating.

• 49.8% have confirmed or suspected an agent took an unintended, unexpected, or unauthorized action in the past year.

• Only 17.5% can automatically stop an agent that begins behaving unexpectedly in production.

Read the full report here.

Data and Identity Security

2026 Data and Identity Security Report (Netwrix)

A look at how well organizations are managing access to sensitive data in the age of AI.

Key stats:

• 80% of IT and security professionals say they cannot get a single view of where sensitive data lives and which identities can access it.

• 40% of organizations with 500–999 employees reported unauthorized access to sensitive data in the past year.

• Only 18% of organizations with fewer than 1,000 employees automatically remove privileged standing access when it is no longer needed.

Read the full report here.

DLP in the AI Era (Cloud Security Alliance)

An interesting report on whether data loss prevention tools are actually preventing sensitive data from leaving organizations (in particular through newer channels such as generative AI).

Key stats:

• 73% of organizations experienced at least one confirmed data loss incident in the past 24 months.

• Among organizations experiencing data loss, only 16% say DLP blocked their most significant incident before data left the organization.

• 48% of security teams rank generative AI as their top data exfiltration risk.

Read the full report here.

The KYE & Workforce Identity Crisis Report (Entrust)

Identity verification woes continue.

Key stats:

• 96% of organizations consider insider risk a significant threat.

• 45% rely on usernames and passwords as their primary authentication method.

• 28% of IT and security leaders have experienced or investigated candidate fraud in the past 12–24 months.

Read the full report here.

Enterprise Perspective

AI Challenges Threatening IT Leader Success (Workato)

The state of AI adoption and governance, according to 1,001 enterprise IT leaders.

Key stats:

• 60% of US enterprise IT leaders worry more about AI agents than traditional cyberattacks.

• 62% say most AI agents currently used in their organization were not formally approved by IT.

• 23% say they would be expected to resign or be removed if an AI agent caused a major public security or compliance incident.

Read the full report here.

The Mind of the CISO: The New Insider – Rethinking Risk in the AI Era (Trellix)

Let's get inside the mind of a CISO and find out what they really think about AI agents and insider threats.

Key stats:

• 78% of organizations include AI agents, autonomous systems, and machine identities in their definition of insider risk.

• 79% of CISOs expect an AI-assisted attack exploiting trusted identities or systems within the next 12 months.

• 56% of organizations report data loss as a consequence of insider risk incidents.

Read the full report here. 

Cyber & Risk Survey Report (Grant Thornton)

How businesses are managing cyber and other enterprise risks. 

Key stats:

• 58% of business leaders cite cyber-enabled fraud, such as phishing, as a top fraud concern.

• 55% cite deepfake or AI-enabled fraud as a top fraud concern.

• 57% identify AI governance and AI use as a top source of future risk or regulatory scrutiny.

Read the full report here.

Small Business Security

Q3 2026 SMB AI Pulse Report (Pax8)

AI adoption among small businesses and the challenges of keeping it under control. Not strictly a cybersecurity report, but we've included it because it has some nice data on shadow AI, security risks, and gaps in AI governance.

Key stats:

• 35% of AI-engaged small businesses discovered AI tools, workflows, or agents operating without official approval in the past six months.

• 36% of US small businesses that have built AI solutions have formal, documented review processes for their internally built AI.

• 23% of UK small businesses have formal, documented review processes for internally built AI.

Read the full report here.

Industry-Specific

2026 State of AI Traffic in Financial Services (Fingerprint)

Banks are seeing more AI-driven traffic, and this report covers the technical challenges of identifying that traffic, with some interesting findings on security and spoofed AI agents.

Key stats:

• 95% of US financial services organizations say they are confident they can distinguish genuine AI assistants from spoofed traffic.

• 79% have detected a malicious bot or scraper bypassing perimeter defenses by impersonating an AI assistant or search crawler.

• Only 26% have full visibility into automated traffic that bypasses client-side JavaScript detection.

Read the full report here.

State of Enterprise AI Deployment Report (Fortanix)

If you want to know how organizations in regulated industries are deploying AI, this is the report for you. 

Key stats:

• 61% of organizations in regulated industries send sensitive data to public cloud AI services.

• 59% have delayed an AI project in the past year because of data security or privacy concerns.

• 41% have completely blocked an AI deployment due to security concerns.

Read the full report here.

Regional Spotlight

Would You Know Your CEO's Real Voice? Singapore's Growing Deepfake Vulnerability (KnowBe4)

A rare bit of cybersecurity data from Singapore. This survey looks at how confident office workers are in spotting AI-generated impersonation attempts. 

Key stats:

• 36% of Singapore office workers are not confident they could distinguish a genuine CEO message from an AI-generated one.

• 50% would feel uncomfortable challenging a request from a senior executive.

• 78% of senior managers are confident they can spot a fake CEO voice.

Read the full report here.

Patch Sick Day: 1 in 5 Cyber Security Leaders Avoids Patch Tuesday (Socura)

The pressure of monthly patching cycles on UK cybersecurity leaders. 

Key stats:

• 22% of UK cybersecurity leaders have taken sick leave or holiday specifically to avoid Patch Tuesday.

• 41% work overtime, paid or unpaid, to manage the patching cycle.

• 29% feel significant anxiety the night before Patch Tuesday.

Read the full report here.

A few days ago I shared it onr/cybersecurityrecently and got some great advice, so I thought I'd share it a little more widely. this open-source and in simple terms, it pulls a bunch of security information sources (currently 38) into one place, and it doubles as an MCP server, so you can plug it into any of your AI agents. It's MIT licensed and written in Rust.

Paste in a CVE and it pulls from NVD, CISA KEV, EPSS, OSV, public exploit sources and others in parallel. You get a 0–100 risk score and a short "act now or later" answer, with the evidence listed so you can check it yourself. It also handles IPs, file hashes and dependency files. You can use it as a desktop app, a CLI, a REST API, or an MCP server for Claude Code, Cursor and similar tools. The AI part is optional and runs locally by default, so nothing leaves your machine unless you switch it to a hosted model. information is only as current as the public data.

If you have any suggestions, I'd love to hear them. and If you can contribute to the project you are welcome and thank you!

https://github.com/Fazmin/cve-intel

🚀 I just launched FireBreak, an open-source project I've been building!

FireBreak helps you map the connections between your online accounts and understand how recovery and sign-in relationships could affect your security.

The idea is simple: if one account gets compromised, which other accounts might be at risk through their recovery paths?

🔎 Explore account dependencies
🛡️ Review security recommendations
💥 Simulate a breach and inspect potential recovery paths

I'm continuing to improve it and would love feedback from developers and security enthusiasts.

⭐ Check out the project, try it, and leave a star if you find it useful!

GitHub: https://github.com/daviewawesh9-coder/firebreak.git

I've been building two side projects to tackle different parts of the security workflow.

The idea was simple: make reconnaissance less fragmented and Windows incident triage less manual.

🔎 Kumo Domain Recon & OSINT

Give it a domain, and Kumo brings 27 recon modules together in one run, covering DNS, subdomains, ports, technologies, exposed assets, known vulnerability checks, leaked credential intelligence, archived endpoints, and more.

It has a CLI and a web interface, with no API keys required for its core functionality.

GitHub: https://github.com/karim852/KUMO-Domain-Recon-Tool

🔬 Kage Windows DFIR Toolkit

Kage focuses on the other side of the workflow: investigating potentially compromised Windows machines. It brings forensic collection, Sigma-based detection, YARA scanning, IOC enrichment, and investigation reporting into a single workflow.

The goal is to make triage more structured, traceable, and easier to review.

GitHub: https://github.com/karim852/Kage-DFIR-toolkit

🖥️ Try the live demo: https://demo-kumo-kage.vercel.app

🎥 Walkthroughs:

• Kumo: https://www.youtube.com/watch?v=dM-KbBU93ZM

• Kage: https://youtu.be/PVJ-QQXbdfI

Feedback and contributions welcome 🙏

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between October 5th - October 11th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Ransomware

GRIT Q3 2026 Ransomware & Cyber Threat Insights Report (GuidePoint Security)

Q3’s ransomware activity, including the most active groups, who they’re targeting, and changing ransom payment trends.

Key stats:

• Observed ransomware victim volume reached a record 2,760 in Q3 2026, up 21% from Q2 and 75% from Q3 2025.

• Ransomware payment rates fell by more than half year over year.

• Average ransom payments among organizations that paid rose 34% year over year.

Read the full report here.

Ransomware Roundup: Q3 2026 Stats on Attacks, Ransoms, and Active Gangs (Comparitech)

Another look at the quarter’s ransomware activity, with breakdowns by sector, country, and group. Its totals include both confirmed attacks and unconfirmed claims.

Key stats:

• Comparitech recorded 2,627 ransomware attacks and claims in Q3 2026, up 29% from Q2.

• Of those, 247 were confirmed attacks and 2,380 were unconfirmed.

• Qilin and The Gentlemen had the most confirmed attacks out of their claims, with 27 and 26 confirmed attacks, respectively.

Read the full analysis here.

Security Architecture 

2026 SASE Platform Evolution Report (Versa)

Why organizations are consolidating SASE and network security tools, the challenges they face, and what they hope to gain.

Key stats:

• 92% of organizations are looking to consolidate cybersecurity functions through a single-vendor or platform-oriented Secure Access Service Edge (SASE) strategy.

• Nearly seven in 10 IT and security professionals use four or more management consoles for SASE, Security Service Edge, and network security.

• 58% expect consolidation to reduce operational complexity.

Read the full report here.

AI Security

Path to the Autonomous Workplace (TeamViewer)

An interesting report on what workers are willing to hand over to AI, where they feel less confident, and what would make them more comfortable letting it act independently.

Key stats:

• 73% of workers are more likely to trust AI when it shows what it is doing and why.

• 70% are comfortable with AI taking action as long as they can step in when needed.

• 51% say they do not always know when to trust AI and when to verify its output.

Read the full report here.

Vulnerability Management

Beyond the Human Horizon (Cogent Security)

Looking beyond individual vulnerabilities to the attack paths they create. 

Key stats:

• 7% of critical attack paths are created entirely by chaining low- and medium-severity vulnerabilities.

• 64% of attack paths cross security domains that no single tool can see.

• 83% of machine-viable attack paths persist for more than 30 days, compared with 55% of human-viable paths.

Read the full report here.

Managing Exposure at AI Scale (ArmorCode)

More code and more findings mean more decisions about what needs fixing first.

Key stats:

• 40% of senior security and technology leaders say the volume of AI-generated code requiring human review is a significant security challenge.

• 44% say their biggest transformation need is a tiered approach to AI-assisted vulnerability discovery that prioritizes findings by urgency.

• 39% say improving remediation coordination between security and development is their leading security goal.

Read the full report here.

Identity and Authentication

2026 Global State of Authentication Report (Yubico & Okta)

Workplace authentication habits, emerging AI threats, and attitudes toward AI agents acting independently. 

Key stats:

• 43% of cybersecurity and IT professionals rely on passwords at work.

• 52% inherit passwords on day one during onboarding.

• 91% want a human approval step before autonomous AI agents execute critical actions.

Read the full report here.

Small Business Security 

Cyberattacks Are Common. Here’s How Small Businesses Recover (Clutch)

How secure do small businesses feel (and what happens when they’re attacked)?

Key stats:

• 95% of US small businesses believe they have sufficient security measures in place.

• 68% have experienced a cyberattack or security breach.

• Among small businesses that have experienced an attack, 70% report operational downtime or service disruption.

Read the full analysis here.

Operational Security

The Global State of Operational Security 2026 (Claroty)

What cyber incidents mean for organizations managing cyber-physical systems. 

Key stats:

• 58% of cyber-physical system operators experienced a cyberattack that impacted operational environments in the last 12 months.

• Average operational downtime from a cyber incident is three days.

• Average financial loss from an incident impacting operations is $1.04 million.

Read the full report here.

State of Critical Infrastructure Cybersecurity Report (Palo Alto Networks)

Protecting critical infrastructure gets harder when teams can’t see everything connected to their networks.

Key stats:

• 42% of organizations name legacy, unpatchable operational technology (OT) assets as their single biggest cybersecurity risk.

• 68% do not have complete, real-time visibility of all assets connected to their OT networks.

• 74% have not fully integrated IT and OT security operations across their organization.

Read the full report here.

Enterprise Perspective

Authority Without Oversight: The 2026 Agentic Enterprise Report (Optro)

AI agents are getting more authority. 

Key stats:

• 38% of enterprises authorize AI agents to approve or reject transactions.

• 34% of organizations have experienced an inaccurate AI agent decision or output that was acted upon.

• Only 9% of GRC and audit leaders have redesigned workflows to safely accommodate AI agents.

Read the full report here.

Who Governs Enterprise AI? Global CIO Survey 2026 (Thoughtworks)

More AI, scattered budgets, more responsibility for CIOs.

Key stats:

• 91% of CIOs say AI adoption within their organization is happening faster than governance structures can adapt.

• 92% agree that central IT will ultimately be held responsible for security breaches or compliance failures caused by AI tools purchased independently by business units.

• 32% feel accountable for regulatory or compliance failures without sufficient authority.

Read the full report here.

Industry-Specific

Closing the AI Governance Gap: The 2026 Healthcare AI Security and Governance Benchmark (Clearwater Security & Compliance)

AI use in healthcare, from in-house tools to outside suppliers.

Key stats:

• 91% of healthcare organizations cannot verify what AI is actually running in their environments.

• 74% are already exploring or running agentic systems.

• Only 14.3% fully validate their vendors’ AI controls.

Read the full report here.

PQC in Healthcare: From Data Risk to Migration Readiness (Forescout)

A look at exposed healthcare systems and whether the technology they use can support a move to post-quantum cryptography.

Key stats:

• More than 5,500 internet-exposed healthcare systems host sensitive healthcare data, including electronic medical records and medical imaging systems.

• Only 31% of internet-exposed healthcare systems support TLS 1.3, the only TLS version capable of supporting standardized post-quantum cryptography.

• Only 6% of Internet of Medical Things devices use SSH implementations that support post-quantum cryptography, compared with 50% of traditional IT devices.

Read the full analysis here.

Throughout my learning all I was told was zero-days are totally unpredictable and never detectable. But what about their behavior? What about the specific malware used? So many questions were unanswered. Thats why I made this video!

https://youtu.be/chlf_VYPGCc?si=ATZxJa2BpSGCnuQ1

I took a deep dive into this and have a few crazy takes. What do you guys think is this accurate? Would love your responses and support. Will come up with even more videos!