Loading story…
Recent research from Bugcrowd has revealed a dramatic increase in hardware, API, and network vulnerabilities, prompting cybersecurity professionals to reevaluate their defense strategies. The proliferation of Internet of Things (IoT) devices has contributed to an 88% rise in hardware vulnerabilities, as more organizations deploy connected sensors, appliances, and medical equipment. Security researchers have reported that 81% discovered new hardware flaws over the past year, highlighting the scale of the problem. Network vulnerabilities have doubled, and API bugs have increased by 10%, further expanding the attack surface for enterprises. Critical vulnerabilities, particularly those involving broken access control and sensitive data exposure, have seen significant growth, with payouts for these flaws rising by 32%. Broken access control alone has increased by 36%, while sensitive data exposure vulnerabilities have grown by 42%, underscoring persistent foundational security issues. The rapid adoption of AI-assisted software development is accelerating release cycles but also introducing new security gaps, especially in access control and data protection. As applications become more complex and agentic AI systems gain autonomy, managing access control becomes increasingly challenging. IoT security remains a major concern, as many devices are not designed to receive timely vulnerability patches or updates, leaving them exposed to attacks such as distributed denial-of-service (DDoS) and data theft. Attackers are exploiting the remote control capabilities of IoT devices, targeting everything from smart office lighting to advanced medical equipment and agricultural machinery. Efforts to improve IoT security include legislative initiatives and voluntary programs like the US Cyber Trust Mark, which aims to encourage device-makers to adopt better security practices. However, progress on these initiatives has been slow, and it remains uncertain when or if they will have a significant impact. The expanding use of nonhuman identities, such as API keys and machine accounts, further complicates the security landscape, as these digital identities often have broad access and are difficult to monitor. Security leaders are increasingly aware that agentic AI and the growing complexity of interconnected systems are likely to accelerate existing vulnerability trends. As a result, organizations are being urged to rethink their security strategies, focusing on foundational issues like access control, data protection, and the secure management of digital identities. The convergence of these trends signals a need for more robust, adaptive, and proactive security measures to address the evolving threat landscape.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Industry commentary accompanying the research said broken access control remains the top vulnerability category and warned that agentic AI, faster release cycles, and constrained budgets are making traditional defense approaches less effective. The analysis argues CISOs are being pushed toward more agile, business-aligned, and continuously offensive security strategies.
Bugcrowd research found an 88% increase in hardware vulnerabilities, network vulnerabilities roughly doubling, and API bugs rising 10% over the past year. The report links the expanding attack surface in part to growth in IoT and AI-assisted software development, and notes a 32% increase in payouts for critical issues.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent industry reports and expert commentary highlight a surge in targeted cyber threats exploiting weak passwords, API and hardware vulnerabilities, and the exposure of executive data, while also emphasizing the growing importance of advanced training and AI-driven defenses. Attackers are increasingly focusing on less traditional targets such as APIs and hardware, with an 88% rise in hardware vulnerabilities and a 10% increase in API flaws, according to Bugcrowd. Fortune 500 executives face heightened phishing risks due to the abundance of personal data available online, making them prime targets for sophisticated social engineering. Meanwhile, weak password practices continue to enable large-scale data breaches, with nearly 94 million records leaked in a single quarter of 2025. To counter these evolving threats, organizations are investing in cyber range training, which has proven especially effective for early-career professionals, and leveraging AI to enhance SOC operations by detecting subtle anomalies that traditional methods miss.
Jun 29, 2026
Artificial intelligence is rapidly transforming both the threat landscape and defensive strategies in cybersecurity, prompting CISOs and security leaders to rethink their approaches. A global study by Gigamon found that 86% of CISOs now view metadata and packet-level data as essential for detecting threats in complex hybrid cloud environments, but 97% admit to making trade-offs that leave visibility gaps. The rise of AI-driven attacks is fueling demand for real-time visibility and observability tools, with 75% of CISOs regarding public cloud as their highest security risk and 73% considering moving workloads back to private clouds. Security teams are investing heavily in AI-specific security tools, with 73% of companies spending over $1 million annually, yet 70% cite the rapid pace of AI development as their top concern. Recent high-profile breaches, such as those at LexisNexis Risk Solutions and McLaren Health Care, illustrate the increasing scale and sophistication of attacks, often amplified by AI. AI is accelerating the reconnaissance phase of attacks, enabling adversaries to map environments and identify vulnerabilities with unprecedented speed and precision, though human direction remains necessary for effective exploitation. The proliferation of AI-generated code, including through practices like 'vibe coding,' introduces new risks as less experienced developers may overlook security fundamentals, leading to insecure applications. Agentic AI systems, which act autonomously or on behalf of users, present urgent challenges in authentication, authorization, and identity management, with experts calling for scalable frameworks and robust credentials to prevent security lapses. CISOs are urged to build security into the design phase of software development, leveraging platform-native controls and enforcing policies like Row Level Security to minimize risk. The integration of AI into security operations is seen as both an opportunity and a challenge, requiring adaptive access solutions, post-quantum cryptography, and continuous monitoring. As AI reshapes digital transformation, organizations must balance the benefits of rapid innovation with the imperative to secure their environments against increasingly sophisticated, AI-powered threats. The consensus among experts is that security must evolve in tandem with AI capabilities, emphasizing proactive risk management, cryptographic agility, and a culture of security awareness across all levels of the organization.
Jun 29, 2026
Organizations are facing a rapidly evolving threat landscape as artificial intelligence accelerates the capabilities of cyber attackers, particularly against critical infrastructure and enterprise environments. Security experts highlight the increasing use of AI by adversaries to identify vulnerabilities in software and APIs, requiring defenders to adopt smarter, adaptive security measures. Industry reports emphasize the importance of patching, real-time anomaly detection, and the deployment of AI security platforms to protect both third-party and custom-built AI applications. Gartner predicts that by 2028, over half of enterprises will use AI security platforms, and preemptive cybersecurity solutions will become a dominant part of security spending as organizations shift from reactive to proactive defense. Geopolitical instability and complex digital supply chains are further amplifying cyber risks, with many organizations underprepared for cascading impacts such as state-sponsored attacks and supply chain vulnerabilities. While risk management strategies are improving, visibility beyond direct partners remains limited, leaving blind spots that attackers can exploit. The convergence of AI-driven threats, geopolitical volatility, and the need for advanced security technologies underscores the urgency for organizations to modernize their cybersecurity approaches to safeguard critical assets and maintain digital trust.
Jun 29, 2026