Zscaler (ZS +2.34%) was one of the market's hottest cybersecurity stocks, reaching an all-time high of $368.78 per share on Nov. 19, 2021. But today, it trades at about $139. Zscaler's stock initially lost its luster as its growth cooled, but macro headwinds -- including rising interest rates and geopolitical conflicts -- further compressed its valuation. Yet after that steep sell-off, Zscaler's stock might be a good contrarian play for patient investors. How fast is Zscaler growing? Zscaler develops "zero trust" tools that treat everyone, including a company's CEO, as a potential threat. Those tools can shield organizations from both internal and external threats while being integrated into larger, more diversified cybersecurity platforms. Before Zscaler was founded in 2007, many organizations installed their zero-trust services on physical appliances -- which took up space, required on-site maintenance, and were difficult to scale. Zscaler addressed those issues by launching its tools as a cloud-native service that locked its users into sticky subscriptions and didn't require any on-site appliances. It subsequently expanded its ecosystem with additional cloud-based cybersecurity tools and now serves more than 9,400 customers, including 40% of the Forbes Global 2000 companies. NASDAQ: ZS Key Data Points From fiscal 2020 to fiscal 2025 (which ended in July 2025), Zscaler's revenue and adjusted net income grew at CAGRs of 44% and 75%, respectively. However, it still isn't profitable by generally accepted accounting principles (GAAP), mainly due to its stock-based compensation expenses and long streak of ecosystem-expanding acquisitions. From fiscal 2025 to fiscal 2028, analysts expect Zscaler's revenue to grow at a 21% CAGR. They also expect it to turn profitable on a GAAP basis in the final year. Its growth is slowing down as its business matures. However, it's still expanding its AI-powered ZDX Copilot platform, deepening its integrations with other cloud-based
Mar 31, 2026 · via fool.com
Los Angeles, California – March 31, 2026 – PRESSADVANTAGE – VendRespect, a Valley Village-based cybersecurity and vendor management company, has introduced a comprehensive scoring system designed to help businesses quantify and manage their digital security risks across their entire vendor ecosystem. The new system addresses a critical challenge facing modern businesses: understanding and managing cybersecurity vulnerabilities not just within their own operations, but throughout their supply chain. With cyber threats becoming increasingly sophisticated and supply chain attacks rising dramatically, organizations need clear metrics to assess their security posture and that of their vendors. VendRespect cybersecurity scoring provides businesses with a dynamic, real-time assessment that changes as vendor security profiles evolve. The system integrates multiple assessment methods, including automated risk evaluations, third-party verifications, and continuous monitoring of vendor security practices. “Businesses today face an unprecedented challenge in managing cybersecurity across their entire vendor network,” said Maksim Avrukin, founder of VendRespect. “Our scoring system transforms complex security data into actionable intelligence that business owners and IT professionals can use to make informed decisions about their digital infrastructure and vendor relationships.” The scoring methodology evaluates multiple security factors including current security practices, vendor security profiles, and third-party verification results. Unlike static assessments that quickly become outdated, the system updates continuously to reflect changes in the threat landscape and vendor security status. For managed service providers and IT consultants, the platform offers integration with existing documentation systems such as IT Glue, enabling seamless incorporation of security scoring into current workflows. This integration allows service providers to leverage existing client data while providing visual documentation that supports security recommendations and compliance requirements. The system also addresses supply chain risk management by identifying critical vendors within an organization’s ecosystem and assessing how their security practices impact overall organizational risk. This comprehensive approach helps businesses understand vulnerabilities
Mar 31, 2026 · via tallahassee.com
Note: This Rapid Response article has been written with AI assistance. Acknowledgments: Special thanks to Jevon Ang, Michael Elford, Jordan Sexton, Armelle French, Stephanie Fairless, Juzzy Allen, Ryan Dowd, Chad Hudson, Lindon Wass, James Maclachlan, James Northey, Josh Kiriakoff, Jai Minton, and Max Rogers for their contributions to this investigation and response. TL;DR: Huntress has observed active exploitation of a supply chain compromise targeting the axios npm package -- one of the most widely used JavaScript libraries, with over 100 million weekly downloads. The attack delivered a cross-platform Remote Access Trojan (RAT) to macOS, Windows, and Linux systems via a malicious dependency injected into backdoored axios releases. Organizations should immediately audit their dependencies for axios@1.14.1 or axios@0.30.4, treat any system that installed either version as compromised, and follow the remediation guidance below. Background On March 31, 2026, a coordinated supply chain attack was executed against the axios npm package. An attacker compromised the npm credentials of the lead maintainer account (jasonsaayman) and manually published two backdoored releases: axios@1.14.1 (tagged latest) and axios@0.30.4 (tagged legacy). These versions introduced a phantom dependency -- plain-crypto-js@4.2.1 ... a package that had not existed before that day and is never actually imported by axios code. Its sole purpose was to execute a postinstall script that drops and runs a cross-platform RAT targeting macOS, Windows, and Linux. axios is a promise-based HTTP client used extensively across the JavaScript and Node.js ecosystem. It is a transitive dependency for countless packages, CI/CD pipelines, developer workstations, and production applications worldwide. The scope of this compromise is significant: any environment that ran npm install and resolved to axios@1.14.1 or axios@0.30.4 during the approximately three-hour exposure window may have executed the malicious payload automatically with no user interaction required. The malicious versions were published during overnight hours (just after midnight UTC,
Mar 31, 2026 · via huntress.com
by Cara Ramer, Student Public Relations Writer After hours of defending simulated networks against coordinated cyberattacks, a team of Cedarville University students secured first place in one of two Midwest Divisions of the NCAE Cyber Games on Feb. 7, 2026 — and one member of the winning team has yet to graduate from high school. For Kieran Klukas, a high school senior from Westerville, Ohio, taking dual enrollment courses at Cedarville, competing in a collegiate-level cybersecurity competition was an unexpected opportunity. After attending the university’s summer cybersecurity camp, Klukas discovered a passion for cybersecurity and began pursuing the field academically. Klukas sought additional hands-on opportunities within Cedarville’s cybersecurity program, which ultimately led to his selection for the NCAE Cyber Games team. Dual enrollment senior excels in collegiate cybersecurity competition The competition follows a red team-blue team format in which industry professionals and graduate students attempt to breach the systems of competing teams. Participants must defend network infrastructure, maintain system uptime and respond to live attacks in a scenario designed to simulate real-world cybersecurity threats facing businesses, government agencies and critical infrastructure. NCAE Cyber Games: red team–blue team live-fire format Over seven hours, the competition operated as a live-fire exercise, with industry professionals deploying real exploits against each team’s systems. From the opening minutes, services were “catching on fire” as the red team exposed vulnerabilities across the machines. Klukas shifted rapidly between systems, patching weaknesses and shutting down access points as they appeared. By the final stretch, Cedarville was one of the only teams still operational, making it a primary target. Klukas spent the last hours of the competition jumping from service to service, eliminating threats and refusing to let their systems go dark. Cedarville winning team roster and majors Cedarville’s winning team included computer engineering, computer science and cyber operations
Mar 31, 2026 · via cedarville.edu
Chinese-speaking users are the target of an active campaign that uses typosquatted domains impersonating trusted software brands to deliver a previously undocumented remote access trojan named AtlasCross RAT. "The operation covers VPN clients, encrypted messengers, video conferencing tools, cryptocurrency trackers, and e-commerce applications, with eleven confirmed delivery domains impersonating brands including Surfshark VPN, Signal, Telegram, Zoom, Microsoft Teams, and others," Germany-based cybersecurity company Hexastrike said in a report published last week. The activity has been attributed to a Chinese cybercrime group called Silver Fox, which is also tracked as SwimSnake, The Great Thief of Valley (or Valley Thief), UTG-Q-1000, and Void Arachne. The discovery of AtlasCross RAT represents an evolution of the threat actor's arsenal from Gh0st RAT derivatives like ValleyRAT (aka Winos 4.0), Gh0stCringe, and HoldingHands RAT (aka Gh0stBins). The attack chains involve using bogus websites as lures to trick users into downloading ZIP archives containing an installer that drops a trojanized Autodesk binary along with the legitimate decoy application. The trojanized AutoDesk installer, in turn, launches a shellcode loader that decrypts an embedded Gh0st RAT configuration to extract the command-and-control (C2) details and then downloads a second-stage shellcode payload from "bifa668[.]com" over TCP on port 9899, ultimately leading to the execution of AtlasCross RAT in memory. The majority of fake websites were registered in a single day on October 27, 2025, indicating a deliberate approach behind the campaign. The list of confirmed malware delivery domains is listed below - - app-zoom.com (Zoom) - eyy-eyy.com (unknown) - kefubao-pc.com (KeFuBao, a Chinese customer service software for e-commerce) - quickq-quickq.com (QuickQ VPN) - signal-signal.com (Signal) - telegrtam.com.cn (Telegram) - trezor-trezor.com (Trezor) - ultraviewer-cn.com (UltraViewer) - wwtalk-app.com (WangWang) - www-surfshark.com (Surfshark VPN) - www-teams.com (Microsoft Teams) All identified installer packages have been found to carry the same stolen Extended Validation code-signing certificate
Mar 31, 2026 · via thehackernews.com
The analyst said that it does not view the code security tool as competition to any of the businesses it covers.
CRWD stock ended Friday’s trade nearly 8% lower, while OKTA shares declined more than 9%.
CRWD stock ended the day nearly 8% lower, while OKTA shares declined more than 9%.
Claude Code Security Anthropic said that its new feature would help security teams detect complex software vulnerabilities and suggest targeted fixes, strengthening defenses against emerging AI-based threats.
CRWD shares have declined more than 10% in the past year, while OKTA shares have dipped more than 21%.
Feb 20, 2026 · via stocktwits.com
The high-profile attacks on M&S and Jaguar Land Rover vividly demonstrate the dangers businesses face.
But a lack of clear data, and daunting software and insurance price hikes, mean a grown-up discussion on the ROI of cyber is long overdue.
by Robert Jeffery
Dec 2, 2025 · via incomms.com
When it opened in 1940, the Pennsylvania Turnpike was the nation’s first superhighway and hailed as an engineering marvel.
The Pennsylvania Turnpike Commission, which maintains the carriageway’s 565 miles for more than 500,000 daily travellers, is embracing modern digital technologies to enhance both customer service and safety.
In driving toward more strategic cyber Capabilities, the Commission focused on understanding the organisation’s key needs.
To make its new strategic approach to cyber even stronger, the Pennsylvania Turnpike Commission worked with Deloitte to put in Place new technologies and processes for cyber incident readiness, response and recovery (CIR3).
By working with Deloitte to bring more strategic cyber Capabilities across multiple areas of its business, the Pennsylvania Turnpike Commission has positioned itself to be an even more resilient enterprise as it continues to improve and innovate its historic highway.
Sep 1, 2024 · via deloitte.com
For the first time, an international cybersecurity challenge for women took place in Dublin earlier this summer.
ENISA directly supported the participation of the female Team Europe in the Women’s International Cybersecurity Challenge 2026 (WICC2026), in close partnership with the European Cybersecurity Competence Centre (ECCC) and the European Commission.
Next upcoming events The next European Cybersecurity Challenge will be hosted by Denmark next year.
About the European Cybersecurity Challenge (ECSC) The European Cybersecurity Challenge (ECSC) is an initiative supported by the European Union Agency for Cybersecurity (ENISA) and aims to enhance cybersecurity talent across Europe and connect high potentials with industry leading organisations.
About the International Cybersecurity Challenge (ICC) As a global Capture the Flag event (CTF), the International Cybersecurity Challenge (ICC) is designed to encourage the development of cybersecurity skills and to foster international cooperation.
Sep 19, 2022 · via enisa.europa.eu