“If I found an iOS exploit… I might just sell it and retire.” iOS exploits are rare, expensive, and usually not something you just stumble across. Leron Gray & Thomas Wilson on: • why iOS is harder to exploit • who typically has access • the tradeoff between security & openness

Some puzzles take time. Happy Pi Day from Bishop Fox 🥧

Bishop Fox will be well represented at #HackGDL this week! Our team is presenting research and workshops on cloud security, hardware hacking, application security, reverse engineering, and career growth in cybersecurity. bishopfox.com/events/bisho...

AI agents inside developer environments introduce a new trust question: How much autonomy should they actually have? In this clip, Shad Malloy explains why applying least autonomy to agents may be the safest approach, essentially extending the idea of least privilege to AI systems.

Introducing CloudFox GCP A new extension of CloudFox designed to help practitioners assess Google Cloud environments from an attacker’s perspective. Now on GitHub: bishopfox.com/blog/introdu...

Enterprise application portfolios are bigger and more complex than ever. But most testing models were built for a much smaller world. Join our session with Zach Moreno on how AI-assisted testing can help security teams scale coverage across modern enterprise environments. March 24 | 2 p.m. ET

Most underrated engineering principle? YAGNI. If you’re building for a future that doesn’t exist yet, you’re adding complexity. From our recent tool building workshop on Discord.

Smart TVs are part of your attack surface. We identified an arbitrary command injection issue in Samsung Tizen OS (through 9.0) that allows OS-level command execution in developer mode. Details: bishopfox.com/blog/samsung...

AI risk doesn’t behave like traditional software risk in that: It’s probabilistic. It’s supply-chain dependent. It’s difficult to fully enumerate. In this clip from our AI & Security Risks panel, @kriskimmerle.bsky.social of RealPage, Inc. breaks down why governance needs a different framing.

Bot traffic spikes on a ghost website. It's a weird headline. But the real defender question is: When you see activity in one area, is that the target or the distraction? From the latest Initial Access with Dan Petro and Justin Greis of acceligence.

Christie Terrill (CISO, Bishop Fox) will speak at the Official Cybersecurity Summit on how diversity strengthens cybersecurity teams, improving innovation, threat detection, and long-term resilience. Complimentary registration with code CSS26-FAIR. Up to 8 CPE credits. Feb. 25 | New York

Good step for RCS security! We've got a ways to go still, but this is progress.

If you’ve ever wondered why AppSec coverage never seems to catch up with reality, this is a good read. At its core, it's an operating model problem. This post by Principal Technology Strategist Rob Ragan walks through why most apps never get tested and what actually changes that.

AI-powered impersonation into Live Zoom calls into ClickFix malware. Senior Security Consultant Brandon Kovacs explains how deepfake tech is now being used to gain real initial access into enterprise environments.

Trusted marketplace integrations can still be attack paths. Senior Security Consultant Leron Gray explains why if you’re not reviewing your Azure enterprise apps and Outlook add-ins regularly, you probably should be.

Social engineering our way into your heart. 🤍🩶🖤❤️ Just kidding. We’d rather earn your trust the right way. Happy Valentine’s Day from Bishop Fox.

The security ecosystem is packed with tools. But sometimes the right move is to sit down and build exactly what you need. Tom Hudson (@tomnomnom.com ) is hosting a live Discord workshop on when to build, when not to, and how to approach tool-building without overengineering.

Be honest: When you picked your last Red Team vendor, what mattered most?

Happening now AI & Security Risks: A Cyber Leadership Panel Real talk from security and AI leaders on where AI risk is showing up right now and what teams are doing about it. bishopfox.com/resources/ai...

Last call 🚨 AI risk is real and ownership, cost, and security are still catching up. Join us tomorrow for a candid leadership panel on what’s actually working (and what isn’t). Feb 11 | 2p.m. ET / 7p.m. GMT bishopfox.com/resources/ai...

AI is becoming a real part of security work. Today, Bishop Fox introduces Cosmos AI: a proprietary engine that powers AI-augmented application penetration testing while keeping human judgment central to the results. bishopfox.com/news/bishop-...

AI-powered security can't stop at automation. Tomorrow, we’re opening a new door to human expertise...

Most disappointing pen tests fail because no one aligned on what questions needed answering. Here’s how application testing creates clarity (especially with AI in the mix): bishopfox.com/blog/get-the...

This short-lived but massive DDoS attack is a big change from what many teams planned for even a year or two ago.

AI is already embedded across organizations, often faster than security and governance can respond. On Feb 11, security and AI leaders come together for an honest conversation about where AI risk is actually showing up, what’s working, and what isn’t: bishopfox.com/resources/ai...

We are so ready. See you all there! 🌵🎉

We’re excited to see Wes Wright representing Bishop Fox at the Texas A&M Engineering Extension Service (TEEX) Cyber Readiness Summit, February 3–5 in College Station, TX. Register: teex.org/teex-cyber-r...

AI isn’t waiting for your governance model to catch up. Security leaders from EPSD, Inc, Bishop Fox, acceligence, RealPage, and Ventrilo.ai break down what’s actually working (and what isn’t) when it comes to AI risk. Feb 11, 2026 @ 2 p.m. ET Save a seat: bishopfox.com/resources/ai...

We’re heading to @cactuscon.com 14! Bishop Fox is sponsoring again this year, with talks from Dan Petro and Nate Robb on EDR evasion and real-world CVE prioritization. And we’ll be around all weekend to talk tradecraft, research, and offsec! Feb 6-7 | Mesa, AZ

Happening tomorrow! Join @datadoghq.com’s State of Cloud Security livestream with Senior Security Consultant @alethe.bsky.social for an attacker-focused breakdown of what the cloud security data is really showing. Jan 27 | 12 p.m. ET

Cloud environments are so noisy. CloudFox helps surface the good stuff: real attack paths in AWS and GCP. Try it on GitHub: github.com/BishopFox/cl...

We're excited to see Senior Security Consultant @alethe.bsky.social joining @datadoghq.com later this month for a live discussion on their State of Cloud Security Report. January 27 @ 12 p.m. EST

Choosing a red team vendor is really about who delivers clarity when decisions matter.

If you’re doing an application pen test, it should actually help you understand risk. On Jan 21, Dan Petro walks through how app pen tests work in practice, common gaps, and how to get better results in modern, API-heavy environments. bishopfox.com/resources/ap...

Pen tests work best when security and engineering are on the same page. This free guide explains how application penetration testing fits into modern development, what good testing looks like, and how to use results to improve security over time: bishopfox.com/resources/ap...

And just like that… 2025 is a wrap. Check out our top research, virtual sessions, blogs, and new tools of the year! Special acknowledgements: @alethe.bsky.social, @br4inde4d.bsky.social, @noperator.bsky.social

Tool Spotlight: IAM Vulnerable IAM Vulnerable is an open source playground that spins up intentionally vulnerable IAM configs so you can practice finding and exploiting real privesc paths safely. Try it: github.com/BishopFox/ia... More info: bishopfox.com/tools/iam-vu...

AADAPT gives us a shared language for attacks on digital-asset systems. This post walks through how red teams can use AADAPT as a practical roadmap, starting with value flows and ending with real detection signals. bishopfox.com/blog/mitre-a...

Latest on #drThe Edge: Why a 17-Year-Old Built an AI to Expose #Deepfake Maps https://www.darkreading.com/threat-intelligence/why-17-year-old-built-ai-expose-deepfake-maps #cybersecurity #darkreading #thekidsareallright

In the latest episode of The Entropy Podcast, Senior Security Consultant @alethe.bsky.social joins Francis Gorman to talk social engineering, DEF CON, ethics, mentorship, and how AI is changing the way attackers (and defenders) think about people: www.buzzsprout.com/2445415

If you’re likely going to set up/fix everyone’s new gadgets this holiday season, you deserve something cool too. We just dropped a Hacker Holiday Gift Guide with gear, books, and tools hackers actually want, all sourced from our team and community. bishopfox.com/blog/hacker-...

Tool Spotlight: Unredacter Pixelation ≠ redaction. Unredacter proves it. Play with the tool → bishopfox.com/tools/unreda...

AI is shaking up cybersecurity, and if you’re still red teaming like it’s 2020… why? Attackers definitely aren’t. AI is making them faster and way more creative. Join Trevin Edgeworth tomorrow to hear how we’re evolving our Red Teaming to keep up: bishopfox.com/resources/re...

We’re LIVE! Sliver Workshop Part 3: Building Better Encoders is starting now. Join us to learn how Sliver handles traffic encoding and how to build custom WebAssembly-based encoders: bishopfox.com/resources/sl...

New guide out today: Fortifying Applications: A Security Guide to Penetration Testing. It explains what a modern application pen test should include, how to ask the right questions, and how to get real value from your engagement. Full guide here: bishopfox.com/resources/ap...

Happening tomorrow! Sliver Workshop: Building Better Encoders 2 p.m. ET / 7 p.m. GMT Join via Discord or our site. Tim Makram Ghatas will cover Sliver’s encoding defaults, WebAssembly, and how to design/test custom encoders.

We dug into the Arista NG Firewall CVEs and found the impact goes far beyond the initial advisory, including a viable XSS to RCE chain and a patch that doesn’t fully mitigate the underlying issues.

Tool Spotlight: GitGot Quickly scan GitHub for exposed secrets using flexible filtering and fuzzy matching. Built to make large search results easier to work through.

2026 is going to push security teams harder than any year before it. More AI. More connected systems. More attacker automation. Our leadership team breaks down the forces that will reshape pen testing, CISO priorities, hardware security, and Red Team specialization next year.

My team confirmed that recently disclosed Arista NGFW vulnerabilities are fully exploitable! RCE is possible with victim interaction. More details coming soon to our blog: bishopfox.com/blog