Petrus Vasenius

Beyond the Perimeter: Mastering Data Deception in the Cloud Era - The Security Everywhere I recently had the distinct pleasure of presenting at the Disobey 2026 event in Helsinki. My session, titled Data Honeytokens […]

I created a blog post based on my talk in #Disobey2026:

vasenius.fi/beyond-the-p...

#CyberSecurity #DataSecurity #Honeytokens

The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time We discuss a novel AI-augmented attack method where malicious webpages use LLM services to generate dynamic code in real-time within a browser.

We analyze novel attack vectors where malicious JavaScript is dynamically generated at runtime. This process leverages client-side API calls to trusted LLM services, initiated from an initially benign webpage (hiding malicious code in a text prompt). Read the threat brief here: bit.ly/4qQW0Cp

We have a new badge competition starting ...now! Create a game or (mini)app for the badge! Join and win awesome (disclaimer: with relative degrees of "awesome") prizes at Disobey 2026! To find out more, visit: disobey.fi/2026/competi...

DNS OverDoS: Are Private Endpoints Too Private? We've identified an aspect of Azure’s Private Endpoint architecture that could expose Azure resources to denial of service (DoS) attacks.

Our research has identified a characteristic within Azure Private Endpoint deployments that could expose Azure resources to denial of service conditions. This finding pertains to the Azure Private Link mechanism: bit.ly/4r1nzZd

Threat Brief: MongoDB Vulnerability (CVE-2025-14847) Database platform MongoDB disclosed CVE-2025-14847, called MongoBleed. This is an unauthenticated memory disclosure vulnerability with a CVSS score of 8.7.

#MongoBleed vulnerability CVE-2025-14847 can expose sensitive data from heap memory. This includes cleartext credentials, API keys, session tokens and PII. Read our latest Threat Brief for details: bit.ly/4qVOkOM

Securing Vibe Coding Tools: Scaling Productivity Without Scaling Risk AI-generated code looks flawless until it isn't. Unit 42 breaks down how to expose these invisible flaws before they turn into your next breach.

Vibe Coding and Vulnerability: Why Security Can’t Keep Up

The promise of AI-assisted development, or “vibe coding,” is undeniable: unprecedented speed and productivity for development teams.

unit42.paloaltonetworks.com/securing-vib...

#VibeCoding #AISecurity #RiskManagement #Unit42

How To Secure AI Services to comply with EU AI Act in Azure - The Security Everywhere Context: I held a talk with the same topic in CloudBrew 2025 in Belgium, about this subject and now I […]

I wrote a new blog post based on my talk on #CloudBrew2025.

vasenius.fi/how-to-secur...

Russia Hits Critical Orgs Via Misconfigured Edge Devices Amazon detailed a long-running campaign by Russia against critical infrastructure organizations, particularly in the energy sector.

Russia Hits Critical Orgs Via Misconfigured Edge Devices - www.darkreading.com/endpoint-sec...

Starting the new week strong! 👏

We are excited to announce the sessions for our #Security track! And what a power house of speakers and sessions! 🤩

Get your tickets here:
🎫 cloudtechtallinn.com
🗓️ cloudtechtallinn.com/agenda

#VisitTallinn #CTTT26

2026 Cybersecurity Predictions Secure the autonomous enterprise. Get 6 essential predictions detailing the new rules of cybersecurity required to innovate confidently in the AI-native economy.

6 Predictions for the AI Economy:
2026's New Rules of Cybersecurity

www.paloaltonetworks.com/perspectives...

Microsoft is increasing prices for many of its products due to changes in its Enterprise Agreement (EA) volume licensing, effective November 1, 2025. The company is eliminating tiered discounts. This change will result in a cost increase of 6% to 12% for many.

www.microsoft.com/en-us/licens...

Struggling to manage it all at work? 5 ways to delegate like a pro - and lighten your load

Leading isn't easy. Five business leaders share how to hand off responsibility, build trust, and focus on long-term success.
#hackernews #news

If you want to learn more about how to use the #entraid advanced features for your blue team, check out my talk on Thursday at 11.45 AM! #iam #CyberSecurity #tallinn

Amazon Outage is Waking People up Regarding Our Slavery to the Internet - U.S. Government Failing in Defense Against Cyberattacks
medicalkidnap.com/2025/10/23/a...

Foreign hackers breached a US nuclear weapons plant via SharePoint flaws A foreign actor infiltrated the National Nuclear Security Administration’s Kansas City National Security Campus through vulnerabilities in Microsoft’s SharePoint browser-based app, raising questions a...

A foreign actor infiltrated the National Nuclear Security Administration’s Kansas City National Security Campus through vulnerabilities in Microsoft’s SharePoint browser-based app, raising questions about the need to solidify further federal security protections. www.csoonline.com/article/4074...

ConnectWise fixes Automate bug allowing AiTM update attacks

ConnectWise released a security update to address vulnerabilities, one of them with critical severity, in Automate product that could expose sensitive communications to interception and modification. [...]

#hackernews #news

Week 42 – 2025 Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

Week 42 - 2025 #DFIR thisweekin4n6.com/2025/10/19/w...

China accuses US of cyberattack: Beijing says sensitive info stolen; what is National Time Center?

Representative image (AI) China on Sunday accused the US National Security Agency (NSA) of carrying out cyberattacks on its National Time Service Center. It further warned that any damage to the…

Enhancing Microsoft Azure's Security Suite with Palo Alto Networks and Unit 42 - The Security Everywhere Disclaimer: This post reflects my personal perspective as I begin my new role at Unit 42. The views expressed here […]

Just shared a new blog post on how Microsoft Azure’s Security Suite gets even stronger with Palo Alto Networks’ tech and Unit 42’s intelligence.
It’s about collaboration, visibility, and resilience across every layer of defense.

Read here 👇
vasenius.fi/enhancing-mi...

NDSS 2025 – Keynote 2: Towards Resilient Systems In An Increasingly Hostile World

Author, Creator & Presenter: Dr. Kathleen Fisher PhD, Director, Information Innovation Office (I2O), US Defense Advanced Research Projects Agency (DARPA)

Our thanks to the Network and Distributed …

#hackernews #news

Financial, Other Industries Urged to Prepare for Quantum Computers Despite daunting technical challenges, a quantum computer capable of breaking public-key encryption systems may only be a decade or two off.

Financial, Other Industries Urged to Prepare for Quantum Computers

PoC Exploit Unveiled for Lenovo Code Execution Vulnerability Enabling Privilege Escalation

PoC Exploit Unveiled for Lenovo Code Execution Vulnerability Enabling Privilege Escalation

Evo Finland #27 - Security & AI In Practice

Excited to be part of the new Evo Finland podcast episode on Security x AI 🎙️

We dive into when to build vs. buy AI tools, the newest AI-native threats, and why human oversight still matters.

🎧 Listen here: open.spotify.com/episode/5JbU...

#AI #CyberSecurity #EvoFinland

How to Choose the Right Microsoft Purview Deployment Model - The Security Everywhere Rolling out Purview doesn’t have to feel like a maze. Microsoft has packaged its guidance into short, scenario driven “deployment […]

Rolling out Microsoft Purview just got easier. This friendly deployment guide turns the latest models and the lightweight blueprint into a simple good, better, best path. Start fast, protect data, grow with confidence. Read more: vasenius.fi/how-to-choos... #MicrosoftPurview #DataSec

Anatomy of a Billion-Download NPM Supply-Chain Attack A massive NPM supply chain attack has compromised foundational packages like Chalk, affecting over 1 billion weekly downloads. We dissect the crypto-stealing malware and show you how to protect your p...

Anatomy of a Billion-Download NPM Supply-Chain Attack
open.substack.com/pub/jdstaerk...

Microsoft Purview with Unified SecOps - Powerful Combination? - The Security Everywhere Unify SecOps with Sentinel Data Lake and Defender XDR. Learn RBAC hardening, onboarding, incident correlation, Purview audit logging, and cost aware retention.

Unify SecOps with Sentinel Data Lake and Defender XDR. Learn RBAC hardening, onboarding, incident correlation, Purview audit logging, and cost aware retention.

vasenius.fi/microsoft-pu...

#MicrosoftSecurity #SecOps #SecurityOperations #MicrosoftSentinel #MicrosoftPurview

Russian APT28 Deploys “NotDoor” Outlook Backdoor Against Companies in NATO Countries APT28 deploys NotDoor Outlook backdoor via OneDrive DLL side-loading, enabling email-based data theft in NATO firms.

Russian APT28 Deploys "NotDoor" Outlook Backdoor Against Companies in NATO Countries thehackernews.com/2025/09/russ...

Cloud sovereignty = ensuring data stays under local laws while benefiting from cloud scale + innovation.

Learn more:
🔹 Azure: learn.microsoft.com/en-us/indust...

🔹 AWS: aws.amazon.com/compliance/d...

🔹 Gaia-X: gaia-x.eu

#CloudSovereignty #DataControl

This MVP Award kit is so cool! Hope to get some more disks into this in future. #MVPBuzz