Enterprise password audits made practical for busy security teams

Security teams carry a heavy load, and password risk is one of the most overlooked parts of that workload. Every year new systems, cloud tools, and shared services add more credentials into the mix. Some sit in proper vaults, others drift into documents, chat threads, or temporary workspaces.

An enterprise password audit gives teams a way to understand how messy this landscape has become. It also helps set the stage for better password practices across the company.

This guide explains how to run a practical enterprise password audit, what to look for, and how a password manager supports the process. Passwork is used throughout as an example of a great tool that fits into this workflow.

Why password audits matter inside large environments

Enterprises deal with layers of technology. Legacy servers, cloud applications, vendor systems, and internal tools all rely on passwords. A single weak credential can open many doors for attackers. The scale of these environments adds risk because passwords often get reused, shared informally, or left unmanaged when projects end.

Guidance from NIST and the UK’s National Cyber Security Centre helps organizations build better password policies. NIST’s Digital Identity guidelines encourage security teams to focus on practical strength and checks for compromised passwords rather than strict, outdated rules. The NCSC points out that long, memorable passwords and secure storage reduce user frustration and lead to better outcomes. These resources offer helpful context for shaping audit criteria.

An audit puts these ideas into motion by showing where gaps exist between guidance and daily practice.

Start by mapping where passwords live

Before assessing strength, teams need to understand where passwords are stored. In large companies, credentials often spread across shared drives, ticketing systems, personal notes, old onboarding guides, unmanaged vaults, project wikis, and third party tools. This spread is one of the main reasons password audits reveal risk that no one expects.

A password manager can make this step easier since it gives teams a central view. Passwork, for example, consolidates shared and personal vaults and offers structured spaces where teams group credentials by environment or project. Introducing a manager at this stage does not alter the audit, but it helps reduce the number of unmanaged places that must be checked manually.

Review how users create and store passwords

User behavior drives many password weaknesses. Forced rotation rules often push employees to fall back on minor changes that attackers can guess. Short length limits on older systems encourage weak strings. Urgent work prompts users to send credentials through chat or email when they need quick access to a shared resource. When teams look closely, they often find a mix of old habits and shortcuts that weaken even the strongest policies.

During the audit, look for how people create passwords, how often they change them, where they store them, how they share them during fast paced work, and how accounts are provisioned or retired. These observations reveal where policy and practice diverge.

Alex Muntyan, CEO at Passwork, sees this pattern across many organizations. “Teams often do their best under time pressure. When they do not have a secure place to store or share a password, it ends up in a note or message that persists long after the task is done,” he says.

Test password strength and uniqueness

With the landscape mapped, teams can move to the technical review. A strength assessment should examine length, character variety, predictable patterns, dictionary matches, checks against known breaches, vendor defaults, and whether passwords are reused across multiple accounts. This phase shows how exposed systems are to brute force attempts, guessing, or credential stuffing.

Password managers help here as well since they promote unique, generated passwords and reduce the chance of reuse. Passwork supports password generation and central storage, which means audits begin with a healthier baseline when teams rely on the tool.

Look closely at privileged accounts

Privileged accounts hold sensitive power. Domain admins, cloud control plane users, database owners, and root level credentials must be handled with extra care. These accounts often sit untouched for long periods and may have shared passwords or outdated rotation schedules.

The audit should identify how many privileged accounts exist, who can access them, how their passwords are stored, and whether any shared admin accounts remain in use. Look for signs that emergency access procedures lack documentation or that no logging exists for privileged sessions. Each of these findings signals a path that attackers could exploit.

Removing unused privileged accounts or transferring them into a managed vault strengthens the environment without major disruption.

Examine how passwords tie into identity systems

Enterprises often blend passwords with single sign on, multi factor authentication (MFA), identity providers, and network based controls. A password audit should assess how these layers interact. Sometimes passwords remain enabled for systems that could use SSO. In other cases, MFA fails to cover accounts that need stronger protection. Service accounts may sit outside identity workflows entirely.

Understanding these connections helps teams simplify access and remove unnecessary credentials. It also highlights where identity plans have not kept up with growth inside departments.

Review the lifecycle of passwords

Passwords weaken over time when no one tracks their lifecycle. Projects start and end. Contractors join and leave. Integration accounts get created for tests, then forgotten. Shadow IT adds more complexity. During the audit, track how accounts are created, how passwords are changed, how offboarding works, and whether old accounts get deleted or left in the environment.

A password manager supports lifecycle management by granting temporary access, automating removal, and limiting how far credentials spread across teams. Passwork gives administrators the ability to set rights that expire and to log activity for future audits.

Produce an audit summary for leadership

Leadership needs a summary that explains risk without drowning them in technical detail. A scorecard helps communicate this. It can describe the proportion of passwords that meet policy, the amount of reuse, the number of weak or breached credentials, the systems that still rely on unmanaged storage, and the main privileged account findings. It should also highlight needed remediation and suggest a timeframe for follow up.

Muntyan notes that password risk grows quickly. “Even with strong policies, new systems and user habits introduce new gaps. A password manager helps because it guides users toward safer behavior and reduces the time spent chasing unmanaged credentials,” he says.

Why a password manager strengthens the audit process

Password audits often uncover scattered storage, bad sharing habits, reused passwords, and inconsistent lifecycle management. A password manager helps address these weaknesses by providing a structured, secure home for credentials. Passwork offers a central vault with team spaces, granular rights, access logs, and deployment options for enterprises that want predictable governance across departments.

Using a manager after the audit simplifies remediation. It helps teams remove unmanaged locations, promote stronger password creation, encourage secure sharing, and maintain consistent hygiene. Over time, this reduces the scope of each future audit since many issues become easier to track.

Build a repeatable cycle

Audits work best when they become routine. Map passwords, test them, review findings, train teams, and adjust policies. Then schedule the next cycle. Enterprises that repeat this process gain visibility, reduce risk, and support healthier security habits across the organization.

A password manager like Passwork helps maintain this cycle by centralizing storage, organizing credentials, and reducing the time spent untangling password practices. With the right structure in place, security teams can keep password risk under control while focusing on higher value work.

Free trial options and Black Friday offers

A full-featured trial available with no feature limitations. This provides an opportunity to evaluate the platform against your actual infrastructure, security policies, and team workflows before committing.

If the trial meets your requirements, A Black Friday promotion runs from November 26 through December 3, 2025, with discounts reaching 50%. Organizations already planning credential management implementations may find value in testing now and purchasing during this period.

For businesses seeking to consolidate credential management, strengthen security posture, and establish audit-ready access governance, Passwork 7 provides a comprehensive solution designed for rapid deployment with minimal operational disruption.

Start your free trial today and save with our Black Friday discount — available November 26 to December 3, 2025.

from Help Net Security https://ift.tt/31wTfun

The weekend is prime time for ransomware

Over half of organizations that experienced a ransomware event in the past year were hit during a weekend or holiday, according to a Semperis report. Those periods often come with thin staffing, slower investigation, and fewer eyes on identity systems. Intruders know that reduced attention allows them to move deeper before alarms are raised.

60% of incidents happened after a merger, acquisition, restructuring, or similar shift inside the business. The most common trigger was an M&A effort. When identity environments are being consolidated, inconsistencies appear. Attackers look for these weak points and move quickly when they find them.

Global results vary by region and sector, but the pattern is the same. Threat groups prefer moments when internal teams are busy, distracted, or reorganizing critical systems.

SOC staffing choices create gaps

Three quarters of respondents operate an in house SOC. Staffing drops sharply during weekends and holidays. 78% cut SOC coverage by at least half during those periods, and 6% leave the SOC empty.

The most common reason for reduced coverage is the desire to support work-life balance. Another frequent reason is that the organization is closed outside the workweek. A smaller group believes an attack is unlikely during those hours. That assumption continues to decline, which signals some movement toward an assume breach mindset.

“Threat actors continue to take advantage of reduced cybersecurity staffing on holidays and weekends to launch ransomware attacks. Vigilance during these times is more critical than ever because the persistence and patience attackers have can lead to long lasting business disruptions,” said Chris Inglis, the first U.S. National Cyber Director and Semperis Strategic Advisor.

These staffing patterns create openings that adversaries understand. Automated alerting helps, as do outsourced monitoring arrangements and triage processes. What does not help is an extended stretch with no one watching identity systems while attackers are active during off hours.

Detection is strong, recovery lags

Identity security has become a standard part of ransomware defense. 90% of respondents have an identity threat detection and response strategy. Most perform vulnerability scans across their identity platforms, which reduces exposure to credential misuse.

The gap appears in follow through. Only 45% have procedures to fix the weaknesses they discover. Without remediation, visibility alone cannot stop attackers. Intruders need only one exposed path. If fixes sit unattended, that path stays open.

Recovery planning follows a similar trend. Two thirds include Active Directory recovery in disaster plans. Fewer include recovery processes for cloud identity systems. 63% automate identity recovery. Manual rebuilds are slow and often extend downtime. Past incidents have shown that the speed of identity restoration determines how quickly the business can function again.

Identity complexity during mergers increases risk

When two organizations combine, leaders often focus on business conditions and cost alignment, while identity design receives attention later. During domain consolidation and trust changes, inconsistencies appear, including stale accounts, weak controls, and unclear access paths.

Early identity planning during transactions would reduce these issues. Treating identity as part of due diligence rather than a late integration step would uncover problems before they embed themselves in the merged environment.

Teams are exploring AI driven tools to reduce pressure on SOC analysts. These tools can help with triage and correlation tasks. They do not replace staffing during high risk periods. Security leaders should understand where automation is helpful and where it cannot fill coverage gaps. AI agents also introduce new machine identities that must be secured.

from Help Net Security https://ift.tt/rYHivUs

Week in review: Fake “Windows Update” fuels malware, Salesforce details Gainsight breach

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

Quantum encryption is pushing satellite hardware to its limits
In this Help Net Security interview, Colonel Ludovic Monnerat, Commander Space Command, Swiss Armed Forces, discusses how securing space assets is advancing in response to emerging quantum threats. He explains why satellite systems must move beyond traditional cryptography to remain protected. Monnerat also describes how future communication architectures will need to integrate quantum-safe methods without disrupting operations.

How an AI meltdown could reset enterprise expectations
In this Help Net Security interview, Graham McMillan, CTO at Redgate Software, discusses AI, security, and the future of enterprise oversight. He explains why past incidents haven’t pushed the industry to mature. McMillan also outlines the structural shifts he expects once failures start to have business impact.

Heineken CISO champions a new risk mindset to unlock innovation
In this Help Net Security interview, Marina Marceta, CISO at Heineken, discusses what it takes for CISOs to be seen as business-aligned leaders rather than technical overseers. She shares how connecting security to business impact can shift perceptions and strengthen partnerships across the company. Marceta focuses on the value of a security culture that supports innovation while keeping risk in check.

Fake “Windows Update” screens fuels new wave of ClickFix attacks
A convincing (but fake) “Windows Update” screen can be the perfect lure for tricking users into infecting their computers with malware. Add a multi-stage delivery chain with some offbeat techniques, and infostealer operators have everything they need to slip past defenses.

Popular code formatting sites are exposing credentials and other secrets
Widely used code formatting sites JSONFormatter and CodeBeautify are exposing sensitive credentials, API keys, private keys, configuration files and other secrets, watchTowr researchers discovered.

New “HashJack” attack can hijack AI browsers and assistants
Security researchers at Cato Networks have uncovered a new indirect prompt injection technique that can force popular AI browsers and assistants to deliver phishing links or disinformation (e.g., incorrect medicine dosage guidance or investment advice), send sensitive data to the attacker, or push users to perform risky actions.

Gainsight breach: Salesforce details attack window, issues investigation guidance
The number of Salesforce customers affected by the recent compromise of Gainsight-published applications is yet to be publicly confirmed, but Salesforce released indicators of compromise (IoCs) and simultaneously shed some light on when the attack likely started. The provided list includes IP addresses and User Agents, showing that the first reconnaissance and unauthorized access activity started on November 8.

Black Friday 2025 for InfoSec: How to spot real value and avoid the noise
Your inbox is probably drowning in Black Friday emails right now. Another “limited time offer” that’ll reappear next month, countdown timer creating artificial urgency. You’re right to be skeptical — most of it is noise. But buried beneath the marketing chaos, Black Friday can represent genuine opportunities to save significantly.

How board members think about cyber risk and what CISOs should tell them
In this Help Net Security video, Jonathan Trull, EVP & CISO at Qualys, discusses which cybersecurity metrics matter most to a board of directors. Drawing on more than two decades in the field, he explains how boards think about their duty to oversee risk and how CISOs can present information in a way that supports that duty.

cnspec: Open-source, cloud-native security and policy project
cnspec is an open source tool that helps when you are trying to keep a sprawling setup of clouds, containers, APIs and endpoints under control. It checks security and compliance across all of it, which makes it easier to see what needs attention.

Aircraft cabin IoT leaves vendor and passenger data exposed
The expansion of IoT devices in shared, multi-vendor environments, such as aircraft cabins, has created tension between the benefits of data collaboration and the risks to passenger privacy, vendor intellectual property, and regulatory compliance.

Microsoft cracks down on malicious meeting invites
Phishing is shifting into places people rarely check. Meeting invites that plant themselves on calendars can survive long after the malicious email is gone. That leaves a quiet opening for attackers. Microsoft has updated Defender for Office 365 so that security teams can now remove those leftover calendar entries when they perform a Hard Delete. Microsoft also added stronger domain blocking for phishing links.

Tor Project is rolling out Counter Galois Onion encryption
People who rely on Tor expect their traffic to move through the network without giving away who they are. That trust depends on the strength of the encryption that protects each hop. Tor developers are preparing a major upgrade called Counter Galois Onion, or CGO, which replaces the long-standing relay encryption method used across the network.

DeepTeam: Open-source LLM red teaming framework
Security teams are pushing large language models into products faster than they can test them, which makes any new red teaming method worth paying attention to. DeepTeam is an open-source framework built to probe these systems before they reach users, and it takes a direct approach to exposing weaknesses.

Small language models step into the fight against phishing sites
Phishing sites keep rising, and security teams are searching for ways to sort suspicious pages at speed. A recent study explores whether small language models (SLMs) can scan raw HTML to catch these threats. The work reviews a range of model sizes and tests how they handle detection tasks while keeping compute demands in check.

Why password management defines PCI DSS success
Most CISOs spend their days dealing with noisy dashboards and vendor pitches that all promise a shortcut to compliance. It can be overwhelming to sort out what matters. When you dig into real incidents involving payment data, a surprising number come down to poor password hygiene. PCI DSS v4.0 raised the bar for authentication, and the responsibility sits with security leaders to turn those requirements into workable daily habits for users and admins. A password manager is one of the few tools that can make this shift possible without adding friction.

New observational auditing framework takes aim at machine learning privacy leaks
Machine learning (ML) privacy concerns continue to surface, as audits show that models can reveal parts of the labels (the user’s choice, expressed preference, or the result of an action) used during training. A new research paper explores a different way to measure this risk, and the authors present findings that may change how companies test their models for leaks.

Email blind spots are back to bite security teams
The threat landscape is forcing CISOs to rethink what they consider normal. The latest Cybersecurity Report 2026 by Hornetsecurity, based on analysis of more than 70 billion emails and broad threat telemetry, shows attackers adopting automation, AI driven social engineering, and new evasion techniques at scale.

What happens when vulnerability scores fall apart?
Security leaders depend on vulnerability data to guide decisions, but the system supplying that data is struggling. An analysis from Sonatype shows that core vulnerability indexes no longer deliver the consistency or speed needed for the current software environment.

The privacy tension driving the medical data shift nobody wants to talk about
Most people assume their medical data sits in quiet storage, protected by familiar rules. That belief gives a sense of safety, but new research argues that the world around healthcare data has changed faster than the policies meant to guide it. As a result, the system is stuck, and the cost of that stagnation is rising for patients, researchers, and innovators.

Supply chain sprawl is rewriting security priorities
Organizations depend on long chains of vendors, but many cybersecurity professionals say these relationships create gaps they cannot see or control. A new ISC2 survey of more than 1,000 cybersecurity professionals shows that supply chain risk sits near the top of their concerns.

Criminal networks industrialize payment fraud operations
Fraud operations are expanding faster than payment defenses can adjust. Criminal groups function like coordinated businesses that develop tools, automate tasks, and scale attacks. New data from a Visa report shows how these shifts are reshaping risk across the financial sector.

The identity mess your customers feel before you do
Customer identity has become one of the most brittle parts of the enterprise security stack. Teams know authentication matters, but organizations keep using methods that frustrate users and increase risk. New research from Descope shows how companies manage customer identity and the issues that have been building in the background.

Your critical infrastructure is running out of time
Cyber attackers often succeed not because they are inventive, but because the systems they target are old. A new report by Cisco shows how unsupported technology inside national infrastructure creates openings that attackers can exploit repeatedly. The findings show how widespread this problem has become and how much it influences national resilience.

Hottest cybersecurity open-source tools of the month: November 2025
This month’s roundup features exceptional open-source cybersecurity tools that are gaining attention for strengthening security across various environments.

Fragmented tooling slows vulnerability management
Security leaders know vulnerability backlogs are rising, but new data shows how quickly the gap between exposures and available resources is widening, according to a new report by Hackuity.

Social data puts user passwords at risk in unexpected ways
Many CISOs already assume that social media creates new openings for password guessing, but new research helps show what that risk looks like in practice. The findings reveal how much information can be reconstructed from public profiles and how that data influences the strength of user passwords. The study also examines how LLMs behave when asked to generate or evaluate passwords based on that same personal information.

Black Friday 2025 cybersecurity deals to explore
Black Friday 2025 is shaping up to be a good moment for anyone thinking about tightening their cybersecurity. A few solid deals are popping up that make it easier to improve protection for systems and data without stretching your budget. If you have been waiting for the right time to upgrade or add new tools, these four offers are simple, practical options that are worth a look.

The breaches everyone gets hit by (and how to stop them)
Headlines scream about zero-days and nation-state attacks, but the reality is far less glamorous. The majority of breaches start with predictable, low-tech methods: stolen credentials, phishing, and unpatched systems. These aren’t rare, they’re routine, and they’re winning.

Cybersecurity jobs available right now: November 25, 2025
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

Infosec products of the month: November 2025
Here’s a look at the most interesting products from the past month, featuring releases from: 1touch.io, Action1, Barracuda Networks, Bedrock Data, Bitdefender, Cyware, Firewalla, Forescout, Immersive, Kentik, Komodor, Minimus, Nokod Security, and Synack.

from Help Net Security https://ift.tt/GF9VQDc

The Two Best Streaming Services for Movie Nerds Are Discounted for Black Friday

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

Black Friday sales officially start Friday, November 28, and run through Cyber Monday, December 1, and Lifehacker is sharing the best sales based on product reviews, comparisons, and price-tracking tools before it's over. 

• Follow our live blog to stay up-to-date on the best sales we find.

• Browse our editors’ picks for a curated list of our favorite sales on laptops, fitness tech, appliances, and more.

• Subscribe to our shopping newsletter, Add to Cart, for the best sales sent to your inbox.

• Sales are accurate at the time of publication, but prices and inventory are always subject to change.

---

On Netflix right now, you can stream the 2025 Richard Linklater film Nouvelle Vague, a low-key hangout movie about the making of Jean-Luc Godard's 1960 French New Wave masterpiece Breathless, but you cannot stream Breathless itself. This is because Netflix owns the rights to the former, but doesn't much care about licensing the latter. And that's the modern streaming landscape in a nutshell.

While I would never suggest streaming hasn't been great for the true cinephiles out there—if I can think of a film, there's a very good chance there's a way I can start watching it within seconds, even if I have to pay for a rental or buy a digital copy—the major streaming services haven't always done right by film fans. While Netflix grows increasingly uninterested in hosting anything that isn't a Netflix exclusive, the likes of Warner Bros. and Paramount are removing many classics from their streaming services to emphasize newer "content."

But all is not lost—if you look beyond the major media corporations, there are great niche streaming options out there for film freaks. And right now, annual subscriptions to two of the very best are heavily discounted for Black Friday.

The Criterion Channel and MUBI are indispensable for film fans

I've written before about my love for The Criterion Channel, the streaming offshoot of The Criterion Collection, a boutique media label that has spent more than four decades cultivating a reputation as the ultimate tastemaker for movie obsessives, releasing top shelf home video editions of "important classic and contemporary films" spanning the last century and the entire world. In 2019 Criterion launched The Criterion Channel, which brings the same selective film snob ethos to a monthly streaming service.

MUBI, meanwhile, is a British streaming service-turned-film distributor that actually got its start with the help of Criterion back in the mid-2000s. While it has recently become well-known for bringing art house fare like The Substance and Die My Love to theaters, it also operates a highly curated streaming service focused on independent world cinema.

It's hard to choose between the two streaming services, because they have such a different focus: The Criterion Channel is essential if you're interested in developing a broad knowledge of classic cinema, with an ever-changing catalog spanning decades, while MUBI tends to be focused on more recent but also more obscure films from around the globe.

So why choose?

Both are $75 for Black Friday

Usually a subscription to The Criterion Channel will run you $100/year (or $11/month), while MUBI is a bit pricier at $120/year (or $15/month). As I try to keep my monthly streaming budget to a reasonable level, I usually limit myself to one of these, but thanks to their concurrent Black Friday sales, I'm going all out in 2026.

Right now, you can get a year of either service for a cool $75, or $6.25 per month annualized. That means you can get both for $12.50, or $6 less than the cost of a month of HBO Max without ads.

• From now through Dec. 1, MUBI's deal is $75 for an annual subscription, with the deal accessible directly from its homepage (though note that you'll auto-renew next year at the usual $120 price). The deal is open to all new and past subscribers.

• Also through Dec. 1, The Criterion Channel is also $75, but you'll need to use the code BLACKFRIDAY25 at checkout. Your subscription will start after a 7-day free trial, and will auto-renew next year at the usual $100 rate. One caveat: This deal is for your "first year," so if you're a current or former subscriber, you're out of luck unless you want to create a new account with a different email and credit card, and sacrifice your watch history.

Whichever option you choose (again, I suggest going big and getting both if you can swing it), you'll have a great year of movie-watching ahead of you.

---

What stores have the best sales on Black Friday?

Nowadays, both large retailers and small businesses compete for Black Friday shoppers, so you can expect practically every store to run sales through Monday, December 1, 2025. The “best” sales depend on your needs, but in general, the biggest discounts tend to come from larger retailers that can afford lower prices: think places like Amazon, Walmart, Target, Best Buy, and Home Depot. You can find all the best sales from major retailers on our live blog. 

Are Black Friday deals worth it?

In short, yes, Black Friday still offers discounts that can be rare throughout the rest of the year. If there’s something you want to buy, or you’re shopping for gifts, it’s a good time to look for discounts on what you need, especially tech sales, home improvement supplies, and fitness tech. Of course, if you need to save money, the best way to save is to not buy anything. 

Are Cyber Monday deals better than Black Friday?

Black Friday used to be bigger for major retailers and more expensive tech and appliances, while Cyber Monday was for cheaper tech and gave smaller businesses a chance to compete online. Nowadays, though, the distinction is almost meaningless. Every major retailer will offer sales on both days, and the smart move is to know what you want, use price trackers or refer to guides like our live blog that use price trackers for you, and don’t stress over finding the perfect timing.

Apple AirPods Pro 3 Noise Cancelling Heart Rate Wireless Earbuds — $219.99 (List Price $249.00)

Apple iPad 11" 128GB A16 WiFi Tablet (Blue, 2025) — $274.00 (List Price $349.00)

Amazon Fire HD 10 (2023) — $69.99 (List Price $139.99)

Sony WH-1000XM5 — $248.00 (List Price $399.99)

Blink Outdoor 4 1080p Wireless Security Camera (5-Pack) — $159.99 (List Price $399.99)

Amazon Fire TV Stick 4K Plus — $24.99 (List Price $49.99)

Shark AI Ultra Matrix Clean Mapping Voice Control Robot Vacuum with XL Self-Empty Base — $249.99 (List Price $599.00)

Apple Watch Series 11 (GPS, 42mm, S/M Black Sport Band) — $339.00 (List Price $399.00)

WD 6TB My Passport USB 3.0 Portable External Hard Drive — $138.65 (List Price $179.99)

Dell 14 Premium DA14250 (Intel Core Ultra 7 255H, 512GB SSD, 16GB RAM, 2K Display) — $999.99 (List Price $1,549.99)

Deals are selected by our commerce team

from Lifehacker https://ift.tt/c8P1xAO

Dyson's Wildly Popular Airwrap i.d. Is $150 Off for Black Friday

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

Black Friday sales officially start Friday, November 28, and run through Cyber Monday, December 1, and Lifehacker is sharing the best sales based on product reviews, comparisons, and price-tracking tools before it's over. 

• Follow our live blog to stay up-to-date on the best sales we find.

• Browse our editors’ picks for a curated list of our favorite sales on laptops, fitness tech, appliances, and more.

• Subscribe to our shopping newsletter, Add to Cart, for the best sales sent to your inbox.

• Sales are accurate at the time of publication, but prices and inventory are always subject to change. 

---

The Dyson Airwrap is one of those things people bookmark, revisit, and debate buying for a long time before finally pulling the trigger. So when the new Airwrap i.d. drops in price, it's always worth noting. Right now, the hair-styling device is at its lowest price ever, according to price trackers—$499.99, down from the usual $649.99.

Even with the discount, it’s still very much a premium splurge, but the appeal of the Airwrap starts to make sense once you actually use it. This is not a simple blow-dryer: It is a multi-styler built around airflow rather than extreme heat, which matters if you style often and want to avoid frying your hair in the process. For some buyers, that alone justifies the cost, especially if they have thick or color-treated hair that reacts badly to heat plates.

The Airwrap i.d. builds on Dyson’s standard attachments and adds Bluetooth pairing through the MyDyson app, which may seem like a strange match for a hair tool. But in practice, it comes in handy when you’re figuring out what works for you by letting you save styling preferences by hair type, length, and texture. The app also offers step-by-step styling guides and recommends attachments based on your desired look. Compared with the standard Airwrap, the i.d. stands out mostly for this personalization. Where the tool falls short is the same place older versions do. It is still expensive, even with this discount, and travel cases or extra attachments raise that cost.

The kit includes six attachments: a smoothing dryer, two curling barrels (for each direction), a round volumizing brush, and two paddle brushes. It also dries and styles at the same time, which cuts down the usual back and forth with multiple tools. That said, the learning curve is real, especially if you’re used to traditional curlers. The results depend a lot on your hair texture and patience, and not everyone ends up with salon-level curls in the first week. Still, for anyone seeking gentler, customizable hair styling, this deal on the Airwrap i.d. is one of the more meaningful price drops of the season.

How long do Black Friday deals really last?

Black Friday sales officially begin Friday, November 28, 2025, and run throughout “Cyber Week,” the five-day period that runs from Thanksgiving through Cyber Monday, December 1, 2025. But Black Friday and Cyber Monday dates have expanded as retailers compete for customers. Expect sales to wind down by December 3, 2025. 

Does Amazon have Black Friday deals?

Yes, Amazon has Black Friday sales, but prices aren’t always what they seem. Use a price tracker to make sure you’re getting the best deal, or refer to guides like our live blog that use price trackers for you. And if you have an Amazon Prime membership, make the most of it.

What stores have the best sales on Black Friday?

Nowadays, both large retailers and small businesses compete for Black Friday shoppers, so you can expect practically every store to run sales through Monday, December 1, 2025. The “best” sales depend on your needs, but in general, the biggest discounts tend to come from larger retailers that can afford lower prices: think places like Amazon, Walmart, Target, Best Buy, and Home Depot. You can find all the best sales from major retailers on our live blog. 

Are Black Friday deals worth it?

In short, yes, Black Friday still offers discounts that can be rare throughout the rest of the year. If there’s something you want to buy, or you’re shopping for gifts, it’s a good time to look for discounts on what you need, especially tech sales, home improvement supplies, and fitness tech. Of course, if you need to save money, the best way to save is to not buy anything. 

Are Cyber Monday deals better than Black Friday?

Black Friday used to be bigger for major retailers and more expensive tech and appliances, while Cyber Monday was for cheaper tech and gave smaller businesses a chance to compete online. Nowadays, though, the distinction is almost meaningless. Every major retailer will offer sales on both days, and the smart move is to know what you want, use price trackers or refer to guides like our live blog that use price trackers for you, and don’t stress over finding the perfect timing.

Our Best Editor-Vetted Black Friday Deals Right Now

Apple AirPods Pro 3 Noise Cancelling Heart Rate Wireless Earbuds — $219.99 (List Price $249.00)

Apple iPad 11" 128GB A16 WiFi Tablet (Blue, 2025) — $274.00 (List Price $349.00)

Amazon Fire HD 10 (2023) — $69.99 (List Price $139.99)

Sony WH-1000XM5 — $248.00 (List Price $399.99)

Blink Outdoor 4 1080p Wireless Security Camera (5-Pack) — $159.99 (List Price $399.99)

Amazon Fire TV Stick 4K Plus — $24.99 (List Price $49.99)

Shark AI Ultra Matrix Clean Mapping Voice Control Robot Vacuum with XL Self-Empty Base — $249.99 (List Price $599.00)

Apple Watch Series 11 (GPS, 42mm, S/M Black Sport Band) — $339.00 (List Price $399.00)

WD 6TB My Passport USB 3.0 Portable External Hard Drive — $138.65 (List Price $179.99)

Dell 14 Premium DA14250 (Intel Core Ultra 7 255H, 512GB SSD, 16GB RAM, 2K Display) — $999.99 (List Price $1,549.99)

Deals are selected by our commerce team

from Lifehacker https://ift.tt/ZHAU9Il

Why password management defines PCI DSS success

Most CISOs spend their days dealing with noisy dashboards and vendor pitches that all promise a shortcut to compliance. It can be overwhelming to sort out what matters.

When you dig into real incidents involving payment data, a surprising number come down to poor password hygiene. PCI DSS v4.0 raised the bar for authentication, and the responsibility sits with security leaders to turn those requirements into workable daily habits for users and admins. A password manager is one of the few tools that can make this shift possible without adding friction.

Passwork enters this picture as a controlled, role based vault that helps teams apply PCI expectations in a predictable way. As the company’s CEO Alex Muntyan puts it, “Most organizations do not struggle with understanding PCI DSS. They struggle because passwords are scattered across tickets, chat threads and shared drives. A central vault changes the equation because you can begin to enforce policy instead of chasing exceptions.”

This article breaks down the core PCI DSS password requirements, maps them to guidance from NIST and OWASP and explains how Passwork supports a practical compliance workflow.

Password controls that sit at the heart of PCI DSS

PCI DSS v4.0 sets out its authentication expectations in Requirement 8, which focuses on identification, credential storage and user behavior. Several parts of this requirement seem simple on paper, but they create operational trouble inside large teams that have multiple admin accounts and rotating contractors.

Requirement 8 asks organizations to verify the identity of every user with strong authentication, make sure passwords and passphrases meet defined strength rules, prevent credential reuse, limit attempts, and store credentials securely. Passwords need to be at least 12 characters long, or at least 8 characters when a system cannot support longer strings.

These rules line up with guidance from NIST SP 800 63B, which recommends longer passphrases, resistance against common word lists and hashing methods that protect stored secrets. The OWASP Authentication Cheat Sheet translates these ideas into application patterns, including support for long passphrases, controls around password resets and server side checks that detect common or breached passwords.

PCI DSS v4.0 also expands on monitoring and lifecycle control. Requirement 8.3 asks for strong authentication for administrative access. Requirement 8.4 covers password policies and rotation logic. Requirement 8.5 adds expectations around storing authentication secrets in a secure form. These details create the real operational load for CISOs because every piece introduces more user actions, more audit data and stricter governance.

Why manual password management breaks compliance

Many organizations still rely on spreadsheets, encrypted notes, and rotating shared credentials for systems that support payment workflows. These patterns create multiple compliance risks. They make it difficult to track who accessed what, they increase the chance of outdated passwords living in forgotten files and they push admins to reuse credentials because there is no central system that helps them generate and store long strings.

PCI DSS requires that access be traceable to an individual and that shared accounts be minimized and controlled. When passwords live across multiple channels, it becomes nearly impossible to show auditors reliable evidence of access history. Even if the team is trying hard, the workflow itself creates gaps that no policy document can fix.

This is where password managers start to deliver value. They move password logic out of scattered channels and into a controlled system with audit trails, user roles and policy enforcement. A vault becomes a single place where password generation rules match organizational policy and where sensitive credentials never appear in plain text outside approved workflows. This helps security leaders turn Requirement 8 from theory into repeatable practice.

Turning PCI DSS password rules into daily routines

A password manager supports compliance by applying structure. Several PCI DSS expectations map almost directly to password vault features.

Strong password generation. NIST SP 800-63B-4 recommends long, user friendly passphrases or random high entropy strings. The OWASP guidance explains that applications should accept long passwords and avoid arbitrary character composition rules. With a password manager, security teams can enforce templates that align with these recommendations without forcing users to memorize complex strings.

Credential storage. PCI DSS requires secure storage of authentication data. A password manager stores secrets in encrypted vaults so users never save them in plain text files or chat logs. This reduces exposure risk and supports the requirement to protect credentials throughout their lifecycle.

Role based access control. Requirement 7 and Requirement 8 both expect organizations to restrict access to what is necessary for each role. Password managers let administrators assign vaults or folders to specific teams. This design keeps sensitive credentials away from users who do not need them.

Audit and monitoring. PCI DSS v4.0 puts emphasis on logging and tracking access to cardholder data systems. A password manager records access to individual items, changes to secrets and user activity. This gives CISOs a reliable evidence trail for audits.

Password rotation and lifecycle management. Requirement 8.4 outlines how often passwords need to be changed based on risk. A vault centralizes those updates and gives teams a place to store new keys without losing historical context.

Passwork’s enterprise version adds controls that help administrators define password policies, enforce multi factor authentication, record access events and delegate rights through structured roles. These features line up well with the expectations in Requirement 8 and help close common gaps that appear in internal audits.

How Passwork supports PCI DSS expectations

Passwork is built for organizations that need structured access control for shared credentials. Its layout makes it easy to create groups, vaults and rules that match internal access models. When a team needs to comply with PCI DSS, this structure supports several requirements at once.

Central control over password hygiene. Passwork lets administrators enforce length rules, complexity expectations and generation templates that match PCI DSS v4.0 and NIST recommendations. Users never need to create their own passwords for critical systems, which reduces errors and weak strings.

Segmentation for high value credential sets. Payment systems often sit inside segmented network zones. Passwork mirrors this segmentation through separate vaults for different teams. A CDE admin group can have its own isolated vault that requires strong authentication and strict role control. This helps satisfy the requirement to separate duties and limit access.

Detailed audit records. PCI DSS expects organizations to track credential use. Passwork keeps logs of who viewed, edited or shared each secret. These logs help security teams demonstrate compliance during audits and internal checks.

Strong authentication for administrators. Requirement 8.3 calls for strong authentication for all admin access. Passwork supports MFA options that align with these expectations and removes the need to store any primary credential outside the vault.

Controlled sharing. One of the biggest compliance risks comes from informal password sharing. Passwork lets teams share credentials without revealing the actual secret. Users can access systems through integration flows or temporary shares that expire automatically.

Muntyan explains this advantage: “PCI DSS expects organizations to keep track of who had access to which credential at which time. If you rely on manual methods, that record does not exist. Passwork gives teams an audit trail at the password level, and that level of visibility is essential when dealing with high value systems.”

Combining PCI DSS with NIST and OWASP guidance

PCI DSS provides the baseline for organizations that handle cardholder data. NIST and OWASP offer patterns that help companies build password logic that lasts longer than a single audit cycle.

NIST recommends allowing long passphrases and avoiding unnecessary composition rules, which reduces user friction. OWASP guidance helps developers design applications that accept long strings and handle resets safely. Both reinforce the idea that strong passwords need strong storage and lifecycle control.

Passwork helps teams put these ideas into practice because it removes the burden of remembering or storing long secrets. It creates an environment where NIST style passphrases and PCI DSS password rules become routine instead of exceptions.

Why CISOs should treat password managers as part of their PCI strategy

Some CISOs view password managers as convenience tools. PCI DSS v4.0 shows that they are closer to compliance tools because they make it possible to enforce identity controls across an organization. A password manager does not replace MFA or identity governance, but it complements both by controlling the secrets that allow systems to function.

Passwork fits into this framework because it gives organizations a predictable way to centralize credentials, track usage and enforce policy. This reduces audit friction and improves daily security behavior. For teams that manage administrative accounts, VPN keys and application passwords, a vault provides consistency that policy documents alone cannot deliver.

Free trial options and Black Friday offers

A full-featured trial available with no feature limitations. This provides an opportunity to evaluate the platform against your actual infrastructure, security policies, and team workflows before committing.

If the trial meets your requirements, A Black Friday promotion runs from November 26 through December 3, 2025, with discounts reaching 50%. Organizations already planning credential management implementations may find value in testing now and purchasing during this period.

For businesses seeking to consolidate credential management, strengthen security posture, and establish audit-ready access governance, Passwork 7 provides a comprehensive solution designed for rapid deployment with minimal operational disruption.

Start your free trial today and save with our Black Friday discount — available November 26 to December 3, 2025.

from Help Net Security https://ift.tt/3k1VFEI

Fragmented tooling slows vulnerability management

Security leaders know vulnerability backlogs are rising, but new data shows how quickly the gap between exposures and available resources is widening, according to a new report by Hackuity.

Fragmented detection and slow remediation

Organizations use a formalized approach to manage vulnerabilities, but their tooling remains fragmented. Respondents rely on an average of four detection tools, and cloud or container configuration audits are the most common at 85%. This mix suggests broad coverage, but it also explains why teams struggle with visibility, correlation of findings, and consistent prioritization.

Mean time to remediate (MTTR) for critical issues averages four weeks. Organizations with formal workflows and higher automation move faster, but many still rely on manual cycles that depend on heavy triage work.

Over half assign remediation to cybersecurity or SOC teams. This structure tends to produce faster response times because these teams are closer to active threats and can interpret findings with more context than infrastructure groups. Organizations with shorter MTTR often follow this model.

97% of organizations have remediation Ser vice Level Agreements (SLAs) linked to severity levels, and most say they meet them. These SLAs show structure and expectations, but actual remediation times reveal how hard it is to keep pace with the volume of issues.

The push toward better prioritization

Prioritization practices vary. 43% still follow compliance driven models because they are easy to measure and often required. A third use risk based approaches that weigh exploitability, asset value, and business impact.

Threat intelligence has become a key factor. Four in five organizations enrich their decisions with external data such as active exploits or CERT alerts. The strongest use of threat intelligence appears in organizations with higher automation and well defined workflows.

Automation continues to separate faster moving organizations from slower ones. 56% say they have automated vulnerability management, while the rest rely on moderate or basic levels. High automation correlates with faster remediation, fewer false positives, and more confidence in scaling operations.

“We know that teams are feeling the pressure right now – but what’s most concerning is the knock-on effect this is having on organisations and on the team’s well-being. From missed alerts to fines, there are consequences at play when vulnerabilities aren’t managed in a way that’s making the best use of team’s time and expertise,” said Sylvain Cortes VP Strategy at Hackuity.

Teams with limited automation spend extra time validating findings, often worry about wasted effort, and report higher burnout risk. Rising vulnerability volume makes it difficult for manual workflows to keep up.

Adoption of CTEM and VOC models

65% have fully adopted Continuous Threat Exposure Management (CTEM), and very few have no plans to consider it. Larger organizations and those with higher automation are further ahead with continuous assessment and real time prioritization.

The shift to vulnerability operations centre (VOC) models is less advanced. Slightly more than half say they have fully implemented a VOC based approach, while others are still transitioning. Organizations with formalized and automated workflows show the strongest progress.

Respondents cite increased automation and improved prioritization as the key benefits of advanced vulnerability management or CTEM platforms. Real time visibility and continuous assessment follow closely.

The cost of rising volume

Rising vulnerability volume is putting pressure on security operations. 56% report added strain on staff resources, and others point to difficulty prioritizing issues, time lost to false positives, and slower incident response.

The business feels the effect as well. Half of the organizations are upgrading security tools in response to higher exposure levels, and a similar share say leadership is taking a closer look at internal processes. This suggests that vulnerability management is gaining attention at senior levels.

Security leaders face practical constraints when trying to improve vulnerability management. Operational limitations and budget pressures top the list at 43% and 41%. Technology complexity, resistance to change, and skills shortages create additional challenges.

Even though respondents agree that automation reduces human error and improves efficiency, a large share say progress remains slow because resources are limited. 60% also admit that vulnerability management does not receive the same level of attention as other security initiatives. This lack of prioritization limits investment in processes and tools.

from Help Net Security https://ift.tt/VhHMF9W

Infosec products of the month: November 2025

Here’s a look at the most interesting products from the past month, featuring releases from: 1touch.io, Action1, Barracuda Networks, Bedrock Data, Bitdefender, Cyware, Firewalla, Forescout, Immersive, Kentik, Komodor, Minimus, Nokod Security, and Synack.

Action1 addresses Intune gaps with patching and risk-based vulnerability prioritization

Action1 announced new integrations that extend Microsoft Intune with advanced patching and vulnerability management. The enhancements close security and compliance gaps in Intune by adding comprehensive third-party application patching, risk-based vulnerability prioritization, and real-time visibility across Windows, macOS, and Linux.

Bitdefender GravityZone Security Data Lake unifies telemetry from multiple tools

Security Data Lake empowers both in-house security teams and Bitdefender MDR analysts to instantly search recent and historical data, correlate external telemetry with native GravityZone signals, and add context that improves detection accuracy and speeds response across the business.

1touch.io Kontxtual provides LLM-driven control over sensitive data

1touch.io unveils Kontxtual, an AI-driven data platform engineered for the AI era. Built to accelerate enterprise innovation without compromising control, Kontxtual harnesses the power of AI and LLMs to deliver real-time data, identity, usage, and risk insights, assuring sovereignty and security throughout the entire AI lifecycle.

Barracuda Assistant accelerates security operations

Barracuda Assistant accelerates threat response by reducing investigation time, cutting costly errors and streamlining workflows. It eliminates disruptive context switching, allowing security teams to transition effortlessly between vulnerability assessments, incident reviews and more. With these efficiencies, teams can focus on high-impact, strategic priorities.

Bedrock Data expands platform with AI governance and natural-language policy enforcement

Bedrock Data announced Bedrock Data ArgusAI and Natural Language Policy. ArgusAI is a new product that expands the company’s capabilities into artificial intelligence governance. It allows enterprises to understand what data their AI models and agents access during training and inference, and evaluates whether existing guardrails prevent sensitive data leakage.

Cyware enhances cyber defense with AI Fabric merging generative and agentic AI

Cyware Quarterback AI receives a major upgrade, described as an AI Fabric that weaves together a set of generative, agentic and in-product AI capabilities designed to accelerate threat intelligence and security operations workflows.

Firewalla unveils MSP 2.9 to simplify multi-device network management

Firewalla has announced the release of MSP 2.9, the latest update to its Managed Security Portal (MSP). The update is now available to all MSP Early Access users. Firewalla MSP is a web-based platform designed for security and infosec professionals to manage multiple Firewalla devices. Version 2.9 introduces new features and improvements to simplify network management, enhance security, and give IT teams greater control.

Forescout eyeSentry platform delivers continuous, cloud-based exposure management

eyeSentry continuously discovers, contextualizes, and prioritizes risk across every connected device, managed or unmanaged. By pinpointing their most critical risks early and often, security teams can act decisively before threats escalate, all from the convenience of the cloud.

Immersive unveils Dynamic Threat Range to transform cyber readiness testing

Immersive announced the general availability of Dynamic Threat Range, a new capability within its Immersive One platform that transforms how organizations validate and improve cyber readiness.

Kentik AI Advisor brings intelligence and automation to network design and operations

Kentik has launched the Kentik AI Advisor, an agentic AI solution that understands enterprise and service provider networks, thinks critically, and offers guidance for designing, operating, and protecting infrastructure at scale.

Komodor’s self-healing capabilities remediate issues with or without a human in the loop

Komodor released autonomous self-healing and cost optimization capabilities that simplify operations for SRE, DevOps, and Platform teams managing large-scale Kubernetes environments.

Minimus debuts Image Creator for building secure, hardened container images

Minimus announced the general availability of Image Creator, a new feature that empowers customers to build their own hardened container images, fully powered and secured by Minimus’ container security software and software supply chain security technology.

Nokod Security launches Adaptive Agent Security to protect AI agents across the entire ADLC

Nokod Security announced the launch of Adaptive Agent Security, a solution that delivers real-time visibility, governance, and protection from threats across the Agent Development Lifecycle (ADLC).

Synack unveils Sara Pentest to accelerate scalable AI-driven penetration testing

Synack has announced Sara Pentest, a new agentic AI product built on the Synack Autonomous Red Agent (Sara) architecture. Sara Pentest performs penetration testing on hosts and web applications, speeding up vulnerability detection and remediation and reducing the window of exposure from months to days. Organizations gain better overall test coverage and can meet the threat from AI-powered adversaries using open source agents to speed up their own offensive security operations.

from Help Net Security https://ift.tt/SrlYFau