Making AI work in production takes more than clever prompts. When thousands of users interact with a model, every mistake – wrong tone, bad data, off response – multiplies fast. That's why companies now rely on “evals,” systems that test and score models the same way engineers test code. Tools like Braintrust let teams log real user inputs, compare outputs against expected answers, and continuously tune models based on results. It's how Notion, Ramp, and Stripe keep AI features reliable as they scale.
Palo Alto's $25B deal for CyberArk is more than another big cybersecurity acquisition—it's a signal that identity is becoming the center of enterprise defense. CyberArk has long been the go-to for protecting the most powerful accounts inside companies, while Palo Alto built its reputation securing networks and clouds. Together, they can turn identity into the main line of defense, deciding who gets access, when, and under what conditions. The hard part will be keeping CyberArk's trusted focus intact as Palo Alto folds it into a much larger platform.
2025.10.24·
softwareanalyst.substack.com·6 min read·TLDR Founders
Eve raised $103 million in Series B funding, led by Spark Capital, reaching a $1 billion valuation. The AI platform now serves over 450 law firms, processing 200,000 legal cases annually and assisting in recovering over $3.5 billion in settlements. Eve's rapidly growing legal AI platform aims to reimagine plaintiff firms' operations by enhancing efficiency and scaling case capacity.
Scammers increase their odds by going after people are at their most vulnerable. This makes job seekers a perfect target for offers that are too good to be true. The easiest way to keep yourself safe is by knowing the signs of a scam and having an email security solution – like Sublime – that keeps them out of your inbox. You can't be fooled by a message you never see. Learn about a recent Google Careers scam [4] with convincing brand imitation and indications of attack iteration, both signals of cutting edge attacks.
Threat actors are actively exploiting CVE-2025-54236 (SessionReaper, CVSS 9.1), a critical nested deserialization vulnerability in Adobe Commerce and Magento that enables remote code execution and customer account takeover via the Commerce REST API, with over 250 attacks recorded in 24 hours. Attackers from five known IP addresses are deploying PHP webshells through ‘/customer/address_file/upload' and probing phpinfo, while 62% of Magento stores remain unpatched six weeks after Adobe's fix was released. Security teams must immediately patch all Adobe Commerce and Magento instances, block the listed attacker IPs (34.227.25.4, 44.212.43.34, 54.205.171.35, 155.117.84.134, and 159.89.12.166), and monitor for unauthorized file uploads, as this is the second critical deserialization flaw in these platforms within two years following CosmicSting (CVE-2024-34102).
Security researchers discovered a critical path traversal vulnerability in Smithery.ai, a popular MCP server hosting service. The researchers discovered that they could exploit a path traversal vulnerability in the dockerBuildPath configuration value to read files outside of their project. The researchers used this vulnerability to find a fly.io API token that granted root access to more than 3k applications.
LG Uplus, one of South Korea's major mobile carriers, reported a data breach. The announcement follows a report from Phrack that a threat actor infiltrated LG Uplus' internal network and seized data from nearly 9k servers, including data of 42,256 accounts and 167 employees.
Organizations are transitioning from static secrets (API keys, passwords, and tokens) to managed identities, achieving a 95% reduction in credential management time and a 75% reduction in learning platform-specific authentication. Major cloud providers (AWS IAM Roles, Azure Managed Identities, and GCP Service Accounts) now offer automated, short-lived credential provisioning that eliminates manual rotation and leakage risks. However, legacy systems and third-party APIs still require traditional secret management. Security teams should prioritize discovering existing credentials using NHI (Non-Human Identity) platforms before migration, aiming to reduce their secret footprint by 70-80% while maintaining robust secret management for remaining use cases.
Frida enables powerful mobile app modifications by injecting custom agents into running processes. However, distributing these modifications for use by others—especially on non-rooted Android devices—requires embedding Frida's gadget library directly inside the APK. Using a demo app, this post walks through preparing an agent script that always rolls a 'one' in a dice app, compiling it, and patching the APK to include Frida's gadget for autonomous script execution.
Unified logs are a forensic resource for iOS that includes granular background activity that can't be obtained in any other forensic artifact. The logs can be collected manually on a Mac via libimobiledevice or automatically using a script written by the author. The author provides suggestions for commercial and open-source tools to read the .logarchive, a structured bundle containing binary .tracev3 files.
Join IAM and cyber experts at Gartner IAM Summit 2025 [12]. With 80+ expert-led sessions on everything from agentic AI to IAM data management, this is your chance to make career-building connections with global pros. Plus, secure a 1:1 with a Gartner expert to get guidance tailored to your challenges. >> Use code IAM20P3 to save $345 on the standard rate [13].
ssh-audit is an open-source Python tool that audits SSH server and client configurations by analyzing cryptographic algorithms, key exchanges, host keys, ciphers, and MACs against security best practices, with support for policy compliance testing and vulnerability detection, including Terrapin (CVE-2023-48795) and DHEat (CVE-2002-20001). The tool provides comprehensive analysis, including RSA/DH key length testing, algorithm recommendations, multi-threaded scanning, and built-in hardening guides for OpenSSH, Ubuntu, Debian, and Rocky Linux platforms. It now flags SHA-1 algorithms as failures, warns about quantum computing resistance, and includes built-in policies accessible via -L/--list-policies with custom policy creation via -M/--make-policy.
Keycard provides an identity and access management platform for AI agents, enabling organizations to assign, track, and control AI agent permissions using cryptography, dynamic tokens, and runtime contextual access policies for secure, scalable agent deployment and visibility.
Meta introduced enhanced scam protections for WhatsApp and Messenger, including screen-sharing warnings during video calls with unknown contacts and on-device behavioral analysis to flag suspicious messages, with optional cloud-based AI review that breaks end-to-end encryption. The company removed over 21,000 fake customer support Facebook pages targeting users through comment monitoring on legitimate airline, travel agency, and bank accounts, part of broader scam trends targeting seniors with fake home remodeling and government debt relief schemes. Security teams should educate users, especially vulnerable populations, about enabling these protections, including Passkeys and Security Checkup features, while noting that cloud-based AI analysis compromises message encryption.
A coordinated malware campaign on YouTube, known as the Ghost Network, exploited hijacked accounts to post fake tutorials promising cracked software and gaming cheats. These videos lured users into downloading infostealers, which stole credentials and crypto wallets. The operation relied on fake engagement and resilient tactics, leading Google and Check Point to remove over 3,000 malicious videos in a major crackdown.
AI code generation enables rapid, large-scale software creation, but speed and flawed judgment are the real risks. While AI-made code has vulnerability rates similar to human work, issues like ineffective coding practices and skipped reviews mean more exposure to breaches, so experts urge integrating security directly into AI workflows and cultivating best usage practices.
You can think of CMMC as the DoD's new standard cybersecurity background check for its supply chain. The new rule will require stricter verification for contractor security standards. Read the
Microsoft's new Gaming Copilot, built on Recall-like Copilot Vision technology, is being silently deployed to Windows 11 PCs without user consent or onboarding.
Looking for an honest look at what it takes to thrive in B2B social? You'll find over 150 actionable lessons, strategies, and tips in B2B Social's Rising 30 Guide [4].
AI adoption is still in its earliest stage, comparable to the internet in 1995, meaning there is a significant opportunity for new companies to emerge. Despite the current surge in AI products, the industry is likely only in the first inning of a decades-long cycle, with 2025-2027 expected to produce many billion-dollar companies at the application layer. Historical examples show that technology adoption takes much longer than expected: e-commerce is still only 20% of retail, 40% of companies are not fully cloud-based, and EVs make up just 10% of new US car sales. Long-term value creation and durable moats will matter more than rapid, unsustainable growth as AI continues to mature.
Brands seeking cultural influence should stop chasing trends and focus on setting them. Trend-jumping may bring short-term visibility, but audiences, especially Gen Z, recognize inauthentic content and quickly lose interest. Impact comes from a clear brand voice, purpose, and perspective used to lead conversations. Thoughtful, original social activations help brands stand out in a crowded digital landscape.
Ad budgets are rising faster than results. Shutterstock's 2025 Creative Impact Report shows a 33% jump in marketing spend but only a 17% lift in purchase intent since 2023. The widening 20% impact gap signals a broken model, especially for brands leaning on high-volume output. Today's environment demands carefully curated and culturally aware creatives.
Most B2B newsletters fail because they're self-promotional or irrelevant. A good newsletter builds trust, educates buyers, and converts by delivering useful content to an engaged audience. Write from a real person, focus on the reader's needs, solve problems, and keep content skimmable with clear formatting and purposeful visuals. Skip generic subject lines and hard sells and treat your offer like a friendly postscript. Publish regularly, repurpose content, and promote subscriptions across channels.
Aimply Briefs grew its personalized AI-powered newsletter to 50K subscribers in 3 months by using intent-based marketing. The team targeted LinkedIn and Twitter threads where influencers offered lead magnets, scraped lists of commenters showing interest, and sent personalized emails offering a newsletter on that topic. As the product could adapt to any interest, each thread became a source of qualified leads, driving rapid subscriber growth and high engagement.
SEOGets is an SEO analytics platform that expands Google Search Console data, tracking up to 120K pages and providing up to 50X more insights. It offers features like topic clustering, content-decay heatmaps, cannibalization reports, branded keyword filters, and shared dashboards with client portals. It serves as a more powerful alternative to GSC with both free and paid plans.
The “Partnerships” feature helps brands find and promote relevant posts for thought leadership campaigns. Located in the LinkedIn Ads' dashboard, it displays posts mentioning a brand and allows promotion requests directly from the interface. Posts can be filtered by media type, date range, creator, or keyword, and searches can expand beyond brand mentions to surface broader industry conversations. This tool simplifies how marketers identify and boost quality content for thought leadership ads. The feature is still rolling out, but it marks a major upgrade for LinkedIn advertisers.
MLB's social content strategy is focused on making people fall in love with the game. Its team blends fast-paced coverage with creative storytelling, using each platform to show baseball's culture and personality. They pull from pop culture, Reddit commentary, and player reactions to deliver content that resonates. Their World Series plan includes custom graphics, historic context, and a giveaway that puts fan messages on game-used balls. This approach helps transform casual viewers into loyal fans by making the sport feel both exciting and personal.
BookTok has created an echo chamber in the literary world that prioritizes marketability over originality. As authors tailor their writing to mimic popular titles promoted through social media, literary diversity and quality decline. The trend has major commercial impact, with BookTok driving about 59 million US print book sales in 2025, up from 46 million in 2023, and accounting for 8% of all sales in 2024. This cycle limits opportunities for new authors and narrows readers' exposure to unique voices and challenging literature.
Microsoft's 1997 investment and settlement with Apple was less a rescue and more a calculated strategy that benefited both companies. Apple was losing $1 billion a year and had less than 90 days of cash, but it used multiple patent lawsuits to pressure Microsoft into a broader deal worth between $500 million and $2 billion in licensing fees. The agreement included a $150 million equity investment, cross-licensing of patents, guaranteed Microsoft Office support for Mac, and dropped lawsuits that removed billions in potential liabilities. The deal kept Apple alive long enough to launch the iMac and later the iPhone, doubling its desktop market share from 5% to 10% and setting the stage for it to become the world's most valuable company.
In this live webinar with Metronome [4], Martin Casado, General Partner at Andreessen Horowitz, will share how both startups and public companies are shifting from subscriptions [4] to results-based, hybrid monetization for AI.
Our systems, optimized for efficiency and scale, have become fragile. Whether in data, manufacturing, or information, the drive for lower costs and centralization has sacrificed resiliency. Rebuilding it will require expensive shifts toward redundancy and local control.
The Second Amendment is America's original right to technology, the tool that enforces our freedoms. From Cold War missile labs to modern Silicon Valley, US innovation has always balanced ideals with strength. Our tech sector must remember its duty to protect both.
Most leaders know their pricing isn't perfect, and that's normal. Every model has tradeoffs, so the goal isn't to overhaul it but to adjust it. Add clear tiers, smart upsells, and flexible levers that better match your product's value and growth story.
Prioritization is strategy. Every ranking of value or urgency reflects a choice about where to build or defend advantage. By mapping benefits, drivers, and enduring “powers,” teams can focus less on quick wins and more on investments that compound over time.