DNV A.I CyberSecurity Scoring
02/04/2026
Access Monitoring Plan
Access Monitoring Plan
No incidents recorded for DNV in 2026.
No incidents recorded for DNV in 2026.
No incidents recorded for DNV in 2026.
For 100 years, DEKRA has been a trusted name in safety. Founded in 1925 with the original goal of improving road safety through vehicle inspections, DEKRA has grown to become the world's largest independent, non-listed expert organization in the field of testing, inspection, and certification. Today, as a global partner, the company supports its customers with comprehensive services and solutions to drive safety and sustainability forward—fully aligned with DEKRA’s anniversary motto, "Securing the Future." In 2024, DEKRA generated revenue of 4.3 billion euros. Around 48,000 employees are providing qualified and independent expert services in approximately 60 countries across five continents. DEKRA holds a Platinum rating from EcoVadis, placing it among the top 1% of the world’s most sustainable companies. IMPRINT / PRIVACY STATEMENT: https://www.dekra.com/en/data-protection-social-media/
Neutral, independent third party For more than 150 years, TÜV Rheinland has stood for ensuring quality, safety, and efficiency in conjunction with people, the environment, and technology. As a neutral, independent third party, we test, accompany, develop, promote and certify products, plants, processes and management systems as well as services based on legal requirements and other relevant performance benchmarks and standards. In addition, TÜV Rheinland qualifies specialists and trains people for numerous companies and areas of business and life. Using knowledge meaningfully Our greatest capital is based on over 20,000 clever minds: concentrated knowledge. It is our enormous pool of experience from which the people at TÜV Rheinland create exceptional substance and inspiration for their meaningful work. The results of their work can be discovered everywhere: in tested elevators or rides, on certified toys or technical equipment, in our advice or training. No matter where - our international teams have been setting standards in terms of safety, quality and efficiency for many years.
TÜV SÜD is the trusted partner of choice for safety, security and sustainability solutions. Our community of experts is passionate about technology and united by the belief that technology should better people’s lives. We work alongside our customers to anticipate and capitalize on technological developments. We specialize in testing, certification, auditing, and advisory services for different industries. Since 1866, we have remained committed to our purpose of enabling progress by protecting people, the environment, and assets from technology related risks. Innovation brings sweeping changes and impacts our work and live in countless ways. At TÜV SÜD, we are dedicated to being a part of that progress. By anticipating technological developments and facilitating change, we inspire trust. Going beyond regulatory compliance, we inspire trust in a physical and digital world to create a safer and more sustainable future. We do not just dream about the future; we actively shape it. Through more than 28,000 employees across over 1,000 locations, we add value to customers and partners by enabling market access and managing risks. We never stop challenging ourselves for the safety of people and society as a whole. We breathe technology, we strive for professional excellence, and we leave a mark. #FutureInYourHands #AddValue #InspireTrust Further information is available at www.tuvsud.com TÜV SÜD AG: Board of Management: Patrick Vollmer Ishan Palit Sabine Nitzsche Imprint: https://www.tuvsud.com/en/imprint Data privacy: https://www.tuvsud.com/en/privacy-statement
Latest updates, reports, and threat intel affecting the global network.
Global identity security technology vendor ARCON and DNV Cyber formed a new partnership that will strengthen ARCON's presence in the Nordics...
Moxa Network and Communication Devices Certified With DNV Type Approval of Security Profile 2 and IEC 61162-460. Moxa's EDR-G9010 and EDR-8010 Series...
CyberOwl, a DNV company, uncovered a sophisticated phishing and malware campaign targeting Iranian oil and gas trading organizations,...
Maritime cybersecurity is not just a technical challenge, but a strategic imperative that affects safety, operations, and reputation.
Furuno successfully completed the compliance assessment for DNV security profile 1 to meet the requirements specified in IACS UR E27.
The European Solar Manufacturing Council (ESMC) urges immediate EU action to address cybersecurity threats posed by Chinese-made PV...
The energy transition is not secure without the safe proliferation of AI, argues Shaun Reardon at DNV. Across the energy industry,...
Ship systems are integrated, making vessels potentially far more vulnerable to cyber-attack, a DNV expert said this week.
DNV's annual survey and analysis finds that even as the energy industry becomes more mature in its cybersecurity posture, it needs to continue to strengthen...
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Message modules) allows a denial of service via a gzip decompression bomb. This vulnerability is associated with program files lib/grpc/compressor/gzip.ex, lib/grpc/message.ex and program routines 'Elixir.GRPC.Compressor.Gzip':decompress/1, 'Elixir.GRPC.Message':from_data/2. 'Elixir.GRPC.Compressor.Gzip':decompress/1 calls :zlib.gunzip/1 directly on attacker-controlled bytes with no decompressed-size limit, ratio check, or incremental decoding. Because this module is the registered gzip GRPC.Compressor implementation, it is invoked automatically whenever an incoming gRPC frame carries the grpc-encoding: gzip header. :zlib.gunzip/1 allocates the entire decompressed result as a single binary, so a small highly compressible payload (for example a few kilobytes of zeros, which gzip compresses at roughly 1000:1) expands to multiple gigabytes inside a single call. The max_receive_message_length limit is enforced only against the already-decompressed message, so it provides no protection. An unauthenticated remote peer can send a single crafted frame to exhaust the BEAM node's heap and trigger an out-of-memory kill. This issue affects grpc: from 0.4.0 before 1.0.0.
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3 (lib/grpc/server/adapters/cowboy/handler.ex) accumulates every received chunk into a single growing binary with no size cap. Additionally, when the client omits the grpc-timeout header, the per-chunk read timeout resolves to :infinity, allowing a slow-trickle client to keep the connection alive indefinitely while memory grows. A single connection is sufficient to exhaust server memory and crash the node. This issue affects grpc from 0.3.1 before 1.0.0.
Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. 'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process. This issue affects grpc from 0.4.0 before 1.0.0.
The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress_config_file configuration parameter. In readCypressConfigUtil.js, the loadJsFile() function constructs a shell command by interpolating the user-controlled cypress_config_filepath value into a template literal, then executes it via child_process.execSync(). Shell metacharacters in the config path (specifically " and ;) allow breaking out of the quoted argument and injecting arbitrary commands. This issue has been fixed in version 1.36.6.
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body. In 'Elixir.GRPC.Server.Transcode':map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {"user_id": "victim"} when body: "*") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed. This issue affects grpc from 0.8.0 before 1.0.0.
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.