rescana.com

A vendor breach incident playbook: the first 24 hours

A practitioner runbook for when a vendor that holds your data is breached: triage, scoping, containment, the notification ...
rescana.com

TPRM metrics and KPIs: what to measure, and which numbers to retire

Which metrics a third-party risk management program can defend to a board or regulator: coverage, timeliness, evidence ...
rescana.com

Security Watchtower

Rescana simplifies third-party and external risk management, putting defenders firmly in control. Our platform validates vendor claims against live attack-surface signal and chases findings to closure ...
rescana.com

Apple CVE-2024-27834: Pointer Authentication Bypass Added to CISA KEV — What to Check

NVD CVSS 3.1: 5.5 (Medium) | CVE: CVE-2024-27834 | CISA KEV: listed 4 Nov 2026 (due 18 Nov) | Fixed: 13 May 2024 On 4 November 2026 CISA added CVE-2024-27834, a WebKit flaw in Apple platforms, to its ...
rescana.com

TPRM capabilities: what modern third-party risk tooling actually does

A hub for the capabilities behind modern third-party risk management - continuous monitoring, attack surface monitoring, ...
rescana.com

FedRAMP and third-party risk: what the Authorization Act actually requires

What FedRAMP requires when a cloud service provider is in a federal agency's supply chain: the FedRAMP Authorization Act (44 ...
rescana.com

Android November 2026 Security Bulletin: Critical No-Interaction RCE (CVE-2026-58868) — Prepare Mobile Fleets Now

The November 2026 Android Security Bulletin (Android Security Bulletin—November 2026) lists 216 CVEs: 23 rated Critical and 193 rated High. In Google's words, the most severe is "a critical security ...
rescana.com

DigiCert Archived Customer Data Access: Prepare Now Without Reissuing Certificates

DigiCert says its Certificate Authority (CA) services, CertCentral, and DigiCert ONE were unaffected by unauthorized access to an internal archive business system. Customer login credentials and ...
rescana.com

Europe Supermarket Refrigeration Cyberattacks: What Retailers and Cold-Chain Vendors Should Do Now

Overnight from 1 to 2 November 2026, supermarkets in at least seven European countries (Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden) saw temperatures in their fridges ...
rescana.com

SolarWinds Dameware CVE-2026-28336: Authenticated Command Injection (CVSS 9.9) — Prepare Now

SolarWinds published an advisory on 3 November 2026 for CVE-2026-28336, a command injection vulnerability in SolarWinds Dameware, its remote-support and remote-control product. SolarWinds rates it ...
rescana.com

Collabora Online Built-in CODE Server for Nextcloud (CVE-2026-110447): Exploited Flaw Added to CISA KEV, Upgrade or Remove the App

CVE-2026-110447 is an unauthenticated OS command injection in Collabora Online - Built-in CODE Server, an optional Nextcloud app with the package name richdocumentscode. Collabora's advisory says a ...
rescana.com

ManageEngine Log360 and EventLog Analyzer CVE-2026-13594: Unauthorized Access Flaw — Prepare Now

ManageEngine product advisory calls the issue High. CNA (Zohocorp) CVSS 3.1: 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE: CVE-2026-13594. Fixed ...