Operations | Monitoring | ITSM | DevOps | Cloud

The latest News and Information on CyberSecurity for Applications, Services and Infrastructure, and related technologies.

The Essential Eight: Patching Applications and Operating Systems at Maturity Level Two

Why do so many patching programs pass every internal check and still come back from an Essential Eight assessment rated at Maturity Level One? The answer is rarely speed. Teams that miss the mark are usually patching their servers, browsers, and office suites on schedule, then losing the rating on the fifty applications nobody put on a list. Maturity Level Two is where the Essential Eight stops asking how fast you patch and starts asking how much you can see.

SBOMs are easy for one project, monumental at scale

Think of an SBOM as your ingredient list. A common language describing everything that goes into a piece of software, every dependency and version, in one place. This video covers why SBOMs have gone from niche to mandatory, and why they're harder to pull off than the concept suggests: The concept is simple. Operationalizing it across a large, diverse tech stack is where it gets hard.

AI Agents on Kubernetes 101: From Laptop Script to Production Pod

In short, this is a beginner’s guide to deploying an AI agent on Kubernetes. You will containerize an agent, store its API key as a Kubernetes secret, write a deployment with health probes and resource limits, expose it with a service, and lock down its network egress, in that order, with a working manifest at every step. On a local kind cluster the whole walkthrough takes about an hour.

PCI DSS Requirement 10: Logging and Monitoring in v4.0.1

Version 4.0 renumbered PCI DSS Requirement 10 from end to end, and the Council retired v3.2.1 on 31 March 2024. Sub-requirement numbers written before then mostly point somewhere else now. Four more Requirement 10 rules changed status on 31 March 2025, automated log review among them. Checking your numbering against v4.0.1 costs an afternoon and saves a finding. In this blog, you will: PCI DSS Requirement 10 covers audit logging and monitoring across the cardholder data environment.

Why Most Security Firms Miss Their Incident Prevention Window

Security operations managers face a critical paradox: their teams are designed to respond to incidents, but the incidents that matter most are the ones that never happen. The difference between a security firm that prevents problems and one that merely responds to them comes down to a single, often-overlooked factor: whether they can see what their guards are actually doing in real time. When operators lack live visibility into patrol locations, guard status, and emerging threats, they're always one step behind.

How to Cut SIEM Ingest by 90% Without Losing Detection Coverage

Every SOC team knows the trade-off. Send everything to the SIEM platform and pay for it. Or filter aggressively and risk missing something. Filter lists are written once, during onboarding. Detection content keeps moving after that. Smart Engine, the new core of the VirtualMetric DataStream pipeline, takes the guesswork out of that decision. It reduces SIEM ingest using your registered detection rules. An event that no registered detection could match is dropped.

Microsoft Took 8 Months to Fix This Copilot Vulnerability

Microsoft finally patched a critical Copilot vulnerability nearly eight months after researchers first disclosed it — and the way the attack worked raises some unsettling questions about AI memory. The vulnerability chained together multiple flaws that could allow a malicious prompt hidden inside a webpage to be pulled into Copilot simply by asking it to summarize the page. From there, the attack could potentially access connected data from services like Gmail, Google Drive, and Google Calendar and exfiltrate that information using Copilot’s own capabilities. But the most concerning part may have been persistence.

What is IPsec?

Our Megaport technical expert, Steve Tu explains what IPsec is, how it secures network traffic, and where it’s used across VPN and cloud connectivity. About Megaport Deploying infrastructure should be fast and simple. Megaport’s software-defined platform provides private compute, network, and storage — so you can build secure, scalable infrastructure for cloud, enterprise, and global AI inference workloads. Trusted by the world’s leading enterprises, Megaport operates across 1,200+ enabled locations globally.

Headless vs. Traditional Web Architecture: What DevOps Teams Need to Consider

DevOps teams face a critical architectural decision when building modern web applications: should they stick with traditional, monolithic systems or embrace headless architecture? This choice affects everything from deployment workflows to team collaboration, performance optimization, and long-term maintenance costs. Understanding the technical and operational implications of each approach helps teams make informed decisions that align with their specific requirements.