Michael Kochanik

This week’s Reachability Watch covers nearly 440 new CVEs, an unauthenticated script endpoint in LMCache, and how Vulnerability Cloaking closes the gap....

Vulnerability cloaking removes an unpatched service's open ports. See how outbound-only, identity-based connections leave attackers nothing to scan or exploit....

Sandbox AI agents with deny-by-default, per-executable network policy enforced by eBPF in the Linux kernel. No container changes, no sidecar proxies....

Network segmentation trusts the address, so attackers with stolen credentials walk right past it. See how cryptographic segmentation ties access to identity....

479 new network-exploitable CVEs, an AI agent platform whose quickstart ships with login off, and how Identity-First Reachability closes the gap....

Risk-acceptance waivers defer vulnerabilities and leave the exposure open. Each renewal costs audit credibility. A compensating control ends the cycle....

Licensing is the cheapest part of microsegmentation. See where operating cost hides in firewall rule upkeep and how identity-first policy keeps it...

NetFoundry's Reachability Watch tracks new network-exploitable CVEs and KEV-bound vulnerabilities every week — this week: IBM Guardium's access-control bypass and 596 new...