Erik Nost
Senior Analyst
Author Insights
Blog
PHP2Shell Had Teeth, But The Real Story Is The Eclectic Mayhem
The week of October 20 was unusually chaotic, even without the PHP news. Not only did teams need to scramble to identify and understand the impact of emergency PHP vulnerabilities, but there were also critical vulnerabilities in Node.js, cryptographically weak keys issues by a certificate authority, exploited vulns in network security equipment, and potentially accidental […]
Blog
PHP2Shell And The IT Visibility Crisis: Do You Know What You Have?
IT Visibility Is No Longer A “Nice To Have” The PHP2Shell security event is rapidly becoming a board-level conversation. Two critical PHP vulnerabilities allow unauthenticated remote code execution, and security authorities are urging organizations to patch immediately. CISA has told organizations to “identify and inventory systems running any version of PHP” while warning that PHP […]
Hear more from Erik Nost
Upcoming Events
Security & Risk Forum
Upcoming Webinars
Check back soon for upcoming webinars.OnDemand Webinars
Check back soon for on-demand webinarsBlog
Break Out Of The Vulnerability Matrix At Forrester’s Security & Risk Forum 2026
Security teams are hearing two competing stories. In one, AI completely rewrites the rules of vulnerability discovery, exploitation, and remediation. In the other, AI simply adds speed and scale to problems that security programs already understand. The reality lies somewhere in between. Discovery Is Accelerating Faster Than Decision-Making AI analyzes code, generates findings, and proposes […]
Blog
PHP2Shell Leak Sends Security Teams Scrambling
At 14:00 UTC on October 21, PHP released patches to two critical CVEs, both of which can lead to remote code execution. CVE-2026-109618 addresses an RCE through an out-of-memory error, and CVE-2026-109619 addresses an RCE through a stale global-state issue. The flaws were discovered by researchers at Wiz and Calif, the latter as part of […]
Blog
Thursdays With Erik: Educating Myself On Proactive Security Platforms
As a research director, I manage a team of analysts who cover a range of technologies outside my primary area of expertise (identity and access management). I’ve had to educate myself on these areas so I can oversee the quality of the analysts’ respective research and direct their research agendas. One area of personal interest […]
Blog
Announcing The Forrester Wave™: Proactive Security Platforms, Q3 2026
Last week, we released The Forrester Wave™: Proactive Security Platforms, Q3 2026. This is the first evaluation of this market under this title, which has evolved from attack surface management and unified vulnerability management. Security teams have increasingly turned to vulnerability risk management, attack surface management, and exposure management to decide which weaknesses matter most. […]
Blog
Harness Up For Our Black Hat 2026 Recap
Black Hat 2026 generated more questions than it answered. Are we headed for a vulnerability apocalypse (aka vulnpocalypse), or are we clearing a backlog of flaws that AI can now find with ease? Can organizations patch fast enough? What should buyers expect from vendors when software can reason? Will AI be our undoing or our […]
Blog
Total Recall: A Cautionary Fable Of Anthropic And The US Government
On Friday, June 12, the same model class covered by our previous blog post went dark. Anthropic suspended Fable 5 and Mythos 5 worldwide after the US Department of Commerce issued an export control directive, which led to requests from prominent cybersecurity pros to undo the action. The bypass that triggered the export controls, per […]
Blog
How Fable 5 And Mythos 5 Change AI Security, Data Retention, And Vendor Risk
Anthropic’s Fable 5 and Mythos 5 is the most 2026 product launch you’ll read this year. The same model can find nation-state zero days, design novel drug candidates, and play FireRed on a Gameboy Advance with nothing but screenshots. And for the gaming fans out there, yes, we got Fable 5 before Fable 4. These […]
Blog
Context Is The New Competitive Edge: Takeaways From ServiceNow Knowledge 2026
ServiceNow Knowledge 2026 showcased how ServiceNow is expanding its role in enterprise AI, workflow automation, and digital workplace transformation.
Blog
OpenAI’s Daybreak Promises To Improve AppSec But Introduces A New Pricing Model: Five Buyer-Side Implications For CISOs
OpenAI recently announced Daybreak, its vision for making agentic application security faster and more capable. While promising, Daybreak will also make security more expensive per unit of work. In this model, customers will pay for tokens and multiagent workflows burn tokens. CISOs and CIOs should budget for application security (AppSec) line-item inflation, not deflation, with […]
Blog
Project Glasswing Shows That AI Will Break The Vulnerability Management Playbook
Anthropic, along with 11 other companies, recently announced Project Glasswing — an initiative that aims to secure software in the wake of advances in AI capabilities, most notably Anthropic’s Claude Mythos Preview frontier model. Project Glasswing is made up of a who’s who of tech companies, cybersecurity vendors, and others: Amazon Web Services, Anthropic, Apple, […]
Blog
Claude Code Security Causes A SaaS-pocalypse In Cybersecurity
We have seen this pattern before, even if the specifics look different. Think back to the day AWS introduced GuardDuty, when Microsoft folded Defender for Endpoint into its enterprise licensing commitments and launched Microsoft Sentinel, or when Google acquired Mandiant and eventually Wiz. Sure, the launch of fully autonomous AI agents that can ingest entire […]
Blog
The Success Of Your Proactive Security Strategy Depends On Your Answer To Six Questions
Proactive security has always been based on three principles: visibility, prioritization, and remediation. But in the age of AI, each principle will continue to experience challenges. In our latest research, The Future Of Proactive Security, we found that the future of proactive security hinges on how well teams answer six foundational questions across each principle: what, when, where, why, how, and who. Since AI accelerates […]
Blog
ServiceNow Buys Armis To Improve Its Proactive Security Platform
ServiceNow has announced its intent to acquire proactive security platform vendor Armis in a cash deal valued at $7.75 billion.
Blog
SAFE Acquires Balbix
Cyber risk quantification (CRQ) vendor SAFE announced that it acquired unified vulnerability management vendor Balbix. The acquisition helps SAFE grow its proactive security platform. Proactive security platforms support all three principles of proactive security: visibility, prioritization, and remediation. Balbix ingests data from other vulnerability sources for visibility, prioritizes high-risk vulnerability and misconfigurations, and helps orchestrate […]
Blog
Proactive Security Platforms Will Cumulate Visibility, Prioritization, And Remediation
Last year, we released our inaugural Forrester Wave™ on attack surface management (ASM) solutions. The ASM Wave primarily focused on visibility — the first of the three principles of proactive security. ASM’s visibility is achieved through external asset discovery and ingestion of third-party information regarding asset attributes, and both features are becoming increasingly commoditized. Yet the ubiquity of […]
Blog
Declaring Zero Trust Without Testing Is A Lie
Zero Trust without real-world testing is a false sense of security. Learn how MITRE ATT&CK-driven adversarial trials turn Zero Trust from theory into proof.
Blog
How F5 And SonicWall Revealed The Fragility Of The Software Supply Chain
The recent breaches at F5 and SonicWall illustrate how attackers are targeting the very infrastructure that enterprises rely on to secure and deliver digital services.
Blog
Black Hat 2025: Troop Forrester Goes To Hacker Summer Camp
2025 marks the 28th year of Black Hat, and although it remains on the edgier side of corporate-focused cybersecurity conferences, it sometimes feels like the event is considering completely ditching its hoodie in favor of a collared shirt.
More posts