asset inventory

CISA and the UK’s NCSC have published a joint technical guidance package that tells owners and operators how to build and maintain a single, continuously refreshed “definitive view” of their operational technology (OT) architecture — a practical step intended to close the visibility gap that...

Westermo’s WeOS 5 series has a newly disclosed high‑severity vulnerability that deserves immediate attention from industrial network operators and Windows network teams responsible for OT‑IT convergence, because it can be used to inject operating‑system commands when an attacker can reach an...

CISA has added CVE-2025-5086 — a critical deserialization of untrusted data vulnerability in Dassault Systèmes DELMIA Apriso — to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation that elevates remediation priority under Binding Operational Directive (BOD)...

CISA’s latest bulletin — a compact but consequential package released on September 11, 2025 — flags eleven Industrial Control Systems (ICS) advisories affecting major automation vendors and field devices, including multiple Siemens engineering and network products, several Schneider Electric...

With the clock counting down to October 14, 2025, millions of PCs face a stark choice: upgrade to Windows 11, pay for a short-term safety net, or keep running an increasingly risky, unsupported Windows 10—while the debate over hardware compatibility, drivers and sustainability suddenly looks...

CISA’s September additions to the Known Exploited Vulnerabilities (KEV) Catalog — the TP‑Link TL‑WA855RE missing‑authentication flaw (CVE‑2020‑24363) and the WhatsApp incorrect‑authorization weakness (CVE‑2025‑55177) — are a reminder that adversaries continue to exploit both legacy IoT devices...

Mitsubishi Electric’s MELSEC iQ‑F family of CPU modules has been formally flagged with a network‑accessible vulnerability that allows unauthenticated remote actors to read and write device values — and in some deployments to halt program execution — because the affected product’s Modbus/TCP...

Sixty days may feel like a lot — until you remember the work still required to move millions of endpoints off an operating system that will stop receiving free security updates on October 14, 2025. Background Microsoft has announced that Windows 10 will reach end of support on October 14, 2025...

CISA’s August 14 advisory bundle is a wake-up call for every industrial operator: thirty-two separate Industrial Control Systems (ICS) advisories were published, covering a sweeping range of Siemens and Rockwell products — from PLC simulators and engineering platforms to rugged network gear and...

Siemens RUGGEDCOM ROX II devices are the subject of a newly cataloged vulnerability — tracked as CVE-2025-40761 — that allows an attacker with physical access to the device’s serial interface to bypass authentication through the device’s Built-In-Self-Test (BIST) mode and obtain a root shell, a...

Microsoft has unveiled a new chapter in its security journey: the launch of the Secure Future Initiative (SFI) patterns and practices—a practical, actionable library aimed at enabling organizations to implement robust security measures at scale. This resource distills Microsoft’s own...

As the clock ticks toward October 14, 2025, millions of organizations and consumers worldwide are confronted with a monumental crossroads for their computing environments: the end of mainstream support for Windows 10. By this deadline, Microsoft will no longer provide free updates or security...

Hello there. As we prepare for September’s two security updates, we’d like to remind you about an important change to Windows’ certificate requirements included in Security Advisory 2661254 (Update For Minimum Certificate Key Length). In June, we began communicating this...