Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

State Bank of India (SBI) has individually notified customers whose information was identified in a recent cyber incident, sending alerts through email and WhatsApp.

In its latest advisory on October 23, the bank said customer account balances and funds remain safe while investigators examine the suspected exposure of personal information found on the dark web.

The update shifts the bank’s response from an initial public disclosure to direct communication with customers. According to The Economic Times, SBI said it had informed all customers whose data was identified as involved.

The bank also warned users to stay alert for suspicious calls, messages, and emails, and never share passwords, PINs, or one-time passwords.

SBI’s preliminary review examined approximately 375,000 records available on the dark web and identified 3,897 customer records containing personally identifiable information.

These figures represent different measures. The larger number describes the records reviewed, not a confirmed count of affected SBI customers or compromised bank accounts.

SBI Notifies Customers Impacted By Cyber Incident

The information reportedly included names, registered mobile numbers, dates of birth, email addresses and home addresses. Other fields included gender, branch details, Customer Information File identifiers, and information linked to loan inquiries and lead records. These details can identify customers and provide context about their banking relationships.

As covered in Cybersecurity News’ earlier report on the SBI data loss incident, the disclosure did not establish how the information was obtained.

It also did not confirm that attackers had entered SBI’s core banking systems. No publicly identified entry point, exploited software flaw, or malware family explained the incident.

SBI received alerts on October 16 from its threat intelligence service provider, the Defense Cyber Agency, and the Indian Computer Emergency Response Team, known as CERT-In.

The bank activated its incident response and containment procedures and appointed an independent cybersecurity agency impaneled with CERT-In to investigate.

Investigators are examining the authenticity, source and extent of the exposed information. SBI has said the incident caused no material impact on its core operations, financial performance or business continuity. Banking services continued without disruption, according to the bank’s disclosure.

An earlier unverified claim about an SBI data breach alleged that customer records and banking documents had been posted online. Those allegations should remain separate from SBI’s confirmed findings while the investigation continues.

Personal data exposure does not automatically mean an account has been taken over. Available reporting does not establish that passwords, PINs, OTPs, or transaction credentials were compromised. However, exposed contact and loan details could help criminals create convincing messages that appear to come from the bank.

Customers should verify unexpected notifications through official banking channels rather than trust a message because it contains accurate personal details. They should avoid unfamiliar links and check statements for unauthorized transactions.

SBI’s official cybersecurity guidance lists report.phishing@sbi.co.in for reporting cyber incidents and directs users to India’s cybercrime helpline, 1930. The bank’s latest warning stresses that customers must never disclose authentication codes or banking passwords to anyone.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post SBI Notifies Customers Impacted by the Recent Cyber Incident appeared first on Cyber Security News.

The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.

The post Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months appeared first on SecurityWeek.

Email encryption has a usability paradox: the strongest cryptography loses to the recipient who gives up at the portal login and asks for the file “some other way.”

The 2026 winners solve for both ends sender-side automation (policies, DLP triggers, one-click protect) and recipient experiences that don’t require a manual.

We scored ten services on exactly that trade, plus control depth (expiry, revoke, audit) and compliance evidence.

Virtru takes 1; Microsoft Purview and Proofpoint complete the podium.

Key Takeaways

• 1 overall: Virtru the lowest-friction path to encrypted mail recipients actually open.

• Podium: Virtru (recipient experience), Purview Message Encryption (M365 gravity), Proofpoint (gateway-policy muscle).

• Consolidation flag: Zix, the compliance-encryption veteran, now lives inside OpenText renewal diligence applies.

• Healthcare lane: Paubox’s no-portal delivery is the HIPAA-workflow standout.

How We Scored (Methodology)

Research-based evaluation: recipient friction (no-portal/no-account paths), policy automation (DLP-triggered, content-aware encryption), sender controls (expiry, revoke, disable-forward, audit), compliance evidence (HIPAA/GDPR-class), platform fit, and pricing structure.

No lab testing; no paid placement; editorial scores excluded from structured data. Weights: recipient friction 30%, policy automation 25%, sender controls 20%, compliance evidence 15%, pricing clarity 10%.

The 2026 Email Encryption Power Rankings

*Editorial research-based scores, not lab results.

1. Virtru — Best Recipient Experience

Snapshot: Published tiers | Gmail/Outlook-native | TDF open standard | Expiry, revoke, watermark

Why it earns 1: Virtru wins where encryption actually fails the recipient: external parties open protected messages in a browser without accounts, plugins, or password ping-pong, while senders get one-click protection plus expiry, revocation, disable-forward, and DLP-triggered automation.

Built on the open Trusted Data Format rather than a proprietary silo, it deploys in days on Gmail or M365 and users keep using it, which is the entire game.

Pros: Lowest recipient friction in the lane; strong sender controls; fast deployment; open standard.

Cons: Gateway-class policy breadth is not the aim.

Bottom line: Encryption people don’t route around.

2. Microsoft Purview Message Encryption — Best M365-Native

Snapshot: E3/E5-bundled | Label and rule-driven | Office-native reading experience

Why it earns 2: For M365 estates, Purview Message Encryption is capability already licensed: encryption triggered by sensitivity labels and transport rules, seamless reading inside the Microsoft world, and a tolerable one-time-passcode path outside it.

Configure this floor before paying anyone then buy only for the friction and control gaps you can still name.

Pros: Bundle economics; label-driven automation; in-ecosystem seamlessness.

Cons: External-recipient OTP flow is serviceable, not delightful; advanced controls fragment across SKUs.

Bottom line: The floor every M365 tenant should fully enable.

3. Proofpoint — Best Gateway-Policy Encryption

Snapshot: Quote/tiered | Encryption inside the leading SEG | Content-aware triggers

Why it earns 3: Proofpoint encrypts as a function of the gateway that already reads every outbound message: DLP dictionaries, smart identifiers, and policy routes trigger encryption automatically no user decisions required with enterprise reporting attached.

For organizations that want encryption as enforced policy rather than user choice, this leading SEG is the lane’s anchor.

Pros: Policy automation depth; DLP integration; enterprise reporting.

Cons: Portal-based recipient experience; platform cost.

Bottom line: Encryption as outbound policy, enforced by the gateway.

4. Paubox — Best No-Portal HIPAA Delivery

Snapshot: Published tiers | TLS-delivered, portal-free | HIPAA-focused, BAA included

Why it earns 4: Paubox’s bet: encrypted email should land in the recipient’s normal inbox, readable like any message no portal, no passcode with secure fallback only when TLS can’t be verified.

For healthcare workflows where patients and partners won’t tolerate portals, that design plus HIPAA-focused, BAA included protections made it the clinic-to-enterprise favorite.

Pros: Zero recipient friction; HIPAA-purposed with BAA; honest fallback design.

Cons: Sender-side controls (revoke/expiry) lighter than rights-based rivals.

Bottom line: HIPAA email that reads like email.

5. Mimecast — Best Suite-Integrated Secure Messaging

Snapshot: Tiered | Secure Messaging inside the email-security suite | Policy-driven

Why it earns 5: Mimecast folds Secure Messaging inside the email-security suite already handling hygiene, continuity, and archiving one admin plane, policy-triggered protection, and a portal flow recipients see across thousands of Mimecast-protected brands. Consolidation value for its large installed base.

Pros: Suite consolidation; policy automation; familiar at scale.

Cons: Portal experience; deepest value only inside the suite.

Bottom line: The suite shop’s encryption checkbox, competently done.

6. Cisco Secure Email Encryption — Best Network-Suite Encryption

Snapshot: Licensed | ESA/CES-integrated encryption service | Enterprise policy ties

Why it earns 6: Cisco’s encryption service rides its email-security estate with an ESA/CES-integrated encryption service, registered-envelope delivery, policy triggers, and the procurement comfort of the networking incumbent a rational pick where Cisco already owns the mail path.

Pros: Cisco-estate integration; enterprise procurement fit.

Cons: Envelope/portal recipient flow; innovation pace.

Bottom line: The Cisco estate’s native encryption lane.

7. Echoworx — Best Encryption-Delivery Specialist

Snapshot: Quote | Encryption-only focus | Multiple delivery methods per recipient

Why it earns 7: Echoworx does one thing with unusual care: delivery-method intelligence that picks the best path per recipient TLS, portal, attachment, certificate with strong branding control and multi-language support, which is why banks and insurers white-label it.

Pros: Delivery-method flexibility; white-label depth; specialist focus.

Cons: Point solution in a suite-consolidating market.

Bottom line: The delivery-intelligence specialist behind big brands.

8. OpenText (Zix) — Best Compliance-Lineage Encryption

Snapshot: Tiered | Zix heritage | Transparent Zix-to-Zix community delivery

Why it earns 8: Zix built the healthcare/finance compliance-encryption franchise including its signature transparent delivery between Zix-community members and now operates inside OpenText’s portfolio.

The installed base is vast; buyers should confirm roadmap investment and packaging under OpenText at renewal.

Pros: Compliance pedigree; community transparent delivery; large regulated base.

Cons: Portfolio-era roadmap diligence.

Bottom line: The compliance veteran, now under a bigger roof.

9. Trend Micro — Best Bundled Email-Security Encryption

Snapshot: Bundled/tiered | Encryption within email security | Hosted key service

Why it earns 9: Trend delivers policy-triggered encryption as part of its email-security bundle a pragmatic checkbox for estates already standardized on Trend’s stack rather than a destination purchase.

Pros: Bundle convenience; policy triggers.

Cons: Not the lane’s innovation driver.

Bottom line: Fine where Trend already guards the mail.

10. Barracuda — Best SMB-Bundle Encryption

Snapshot: Published bundles | Encryption inside Email Protection plans | SMB-friendly

Why it earns 10: Barracuda includes encryption in SMB-priced email-protection bundles simple policies, simple portal, one invoice the honest answer for small teams who need the checkbox met without an encryption project.

Pros: SMB pricing and simplicity.

Cons: Control depth and recipient polish are basic.

Bottom line: The small-business checkbox, affordably ticked.

Full Comparison Table

Yes/No Capability Table

Buying Advice: Send One Message to Your Hardest Recipient

Run the only test that predicts adoption: send an encrypted message to a real external recipient the 70-year-old patient, the counterparty on Gmail, the vendor on Exchange 2016 and count their clicks to reading it.

More than two, and your users will eventually bypass the tool. Configure your bundle floor first (Purview or Workspace rules), then buy for named gaps: recipient friction (Virtru/Paubox-class), gateway-grade policy enforcement (Proofpoint-class), or white-label delivery (Echoworx-class).

Make encryption automatic DLP and label triggers, never user memory because the breach email is always the one someone forgot to protect.

Healthcare: insist on the BAA and test the patient-reply path, not just outbound. And at Zix renewals, price the OpenText-era roadmap against the switching cost honestly.

FAQs

What is the best email encryption service in 2026? Virtru ranks 1 for recipient experience plus sender controls, Microsoft Purview for M365-bundled automation, and Proofpoint for gateway-enforced policy with Paubox the HIPAA no-portal standout.

Is TLS enough for email encryption? Opportunistic TLS protects most hops but fails silently and proves nothing per-message. Compliance-grade programs need enforced encryption with fallback and evidence which is precisely what this category sells.

Do recipients need accounts to read encrypted mail? Not with the leaders: Virtru reads in-browser, Paubox lands inbox-native, Zix is transparent in-community. Portal-and-password flows are the adoption tax to minimize.

What makes email encryption HIPAA-compliant? A BAA with the vendor, enforced encryption policies, audit trails, and workflow fit so staff actually use it. The tool is necessary; the program makes it compliant.

Can I revoke an email after sending? With rights-based services (Virtru-class, Purview in-ecosystem), yes access checks happen at open, so you can kill it after delivery. Gateway/portal models vary; test it before relying on it.

Verdict

Virtru proved usable encryption wins, Purview made the floor nearly free for M365 shops, Proofpoint enforces protection nobody has to remember, and Paubox made HIPAA mail read like mail pick by your hardest recipient’s click count, automate the trigger, and let the bundle-vs-gap math decide the invoice.

Author: [AUTHOR NAME], [credential]. Reviewed by: [REVIEWER NAME]. Last updated: October 2026. Cybersecurity News editorial is independent; no paid placement; scores are research-based, not lab-tested.

Read next on Cybersecurity News:

• Top 10 Best Email Security Solutions

• Top 10 Best DRM & IRM Solutions

• Top 10 Best Secure File Sharing Platforms

• Top 10 Best DLP Software

• Top 10 Best Encryption & Key Management Solutions

• Top 10 Best Anti-Phishing Tools

• Top 10 Best Managed File Transfer Solutions

• Top 10 Best Data Privacy Management Software

• Top 10 Best Security Awareness Training Platforms

• Top 10 Best HSM Solutions

• Top 9 Best Data Classification Tools

The post Top 10 Best Email Encryption Services in 2026 [Ranked & Scored] appeared first on Cyber Security News.

No category has been breached more publicly this decade than managed file transfer mass-exploitation campaigns against MFT products turned quiet integration plumbing into board-level risk, and the 2023–2024 waves rewrote the buying criteria.

In 2026 you evaluate an MFT vendor’s security engineering exposure architecture, patch velocity, hardening posture before its scheduler.

Our sheet listed ten rows, but two of them (GoAnywhere and Globalscape) are both Fortra products, so this is an honest Top 9 vendors.

Axway takes 1; IBM Sterling and Progress MOVEit complete a podium where resilience history is part of the score.

Key Takeaways

• 1 overall: Axway enterprise MFT depth with a security-architecture story intact.

• Podium: Axway (enterprise depth), IBM Sterling (B2B backbone scale), Progress MOVEit (hardened survivor with rebuilt posture).

• Consolidation note: Fortra owns both GoAnywhere and Globalscape EFT one vendor, two products; we rank the vendor once.

• New buying criterion: demand the vendor’s exploitation history, patch SLAs, and secure-deployment reference architecture in writing.

How We Scored (Methodology)

Research-based evaluation: security architecture and track record (internet-exposure design, hardening guidance, disclosure/patch velocity), automation and orchestration depth, B2B protocol breadth (SFTP/AS2/AS4/APIs), compliance evidence, operational scale, and pricing structure.

No lab testing; no paid placement; editorial scores excluded from structured data. Weights: security posture 30%, automation depth 25%, protocol/B2B breadth 20%, operational scale 15%, pricing clarity 10%.

The 2026 MFT Power Rankings

*Editorial research-based scores, not lab results.

1. Axway — Best Enterprise MFT Depth

Snapshot: Quote | Managed File Transfer + Amplify platform | Governance at financial-services scale

Why it earns 1: Axway runs the transfer backbones of banks and logistics giants with central governance over thousands of flows, strong identity integration, and an API-management adjacency that modernizes B2B patterns instead of embalming them while keeping a security-architecture reputation that survived the category’s worst years intact.

Pros: Governance at scale; API/MFT convergence; enterprise references.

Cons: Enterprise weight; quote-only economics.

Bottom line: The backbone-grade incumbent still earning the position.

2. IBM (Sterling) — Best B2B Backbone Scale

Snapshot: Quote | Sterling File Gateway/Connect:Direct | Decades of mission-critical transfer

Why it earns 2: When the requirement is millions of files across thousands of partners with mainframe-to-cloud reach, Sterling’s File Gateway and Connect:Direct lineage remains the reference: high-assurance point-to-point transfer, deep partner-community management, and the operational hardening of forty years in production.

Pros: Unmatched scale pedigree; Connect:Direct assurance; partner-management depth.

Cons: Modernization effort and cost; skills scarcity.

Bottom line: The heavyweight for estates where failure isn’t survivable.

3. Progress (MOVEit) — Hardened Survivor, Rebuilt Posture

Snapshot: Licensed/quote | MOVEit Transfer/Automation | Post-2023 security overhaul

Why it earns 3: MOVEit is the category’s cautionary tale and its stress test: the 2023 mass exploitation forced a security rebuild expanded testing, hardening guidance, bounty and disclosure investment that buyers should verify rather than assume, but the product’s automation depth and compliance toolkit remain first-rank. We rank it on capability plus demonstrated remediation, with the diligence burden stated plainly.

Pros: Automation and reporting depth; large install base; visible post-incident investment.

Cons: Breach history requires explicit diligence; internet-exposure discipline mandatory.

Bottom line: Strong product make the rebuilt posture prove itself in writing.

4. Fortra (GoAnywhere + Globalscape EFT) — Broadest Portfolio, One Vendor

Snapshot: Licensed/quote | Two MFT lines under one roof | Sheet listed both; we count one vendor

Why it earns 4: Fortra owns two of the market’s best-known products GoAnywhere’s automation-rich platform and Globalscape EFT’s Windows-centric depth so our ten-row sheet yields nine vendors.

GoAnywhere’s own 2023 exploitation means the same diligence standard as MOVEit applies: demand patch-velocity evidence and the zero-exposure reference architecture. Portfolio overlap also makes roadmap questions fair game at renewal.

Pros: Two mature products; strong automation (GoAnywhere); portfolio flexibility.

Cons: Exploitation history (GoAnywhere) and two-product roadmap clarity.

Bottom line: One vendor, two products — pick the line, and get the roadmap in writing.

5. Cleo — Best Ecosystem-Integration MFT

Snapshot: Subscription/quote | Cleo Integration Cloud | MFT fused with EDI/API integration

Why it earns 5: Cleo’s bet is that transfers are integrations: its Integration Cloud unifies MFT, EDI, and API flows with end-to-end visibility into the business transaction, not just the file hop the right shape for supply-chain estates where a late file is a late shipment.

Its own 2024 exploitation episode requires the same posture diligence as its peers.

Pros: Transaction-level visibility; EDI/API convergence; supply-chain fit.

Cons: Posture diligence applies here too.

Bottom line: MFT that understands the business document inside the file.

6. SEEBURGER — Best Integration-Suite MFT

Snapshot: Quote | BIS platform | MFT as one engine of a B2B/EDI/API suite

Why it earns 6: SEEBURGER delivers MFT inside its Business Integration Suite one platform spanning EDI, API, and IoT flows with German-engineering governance compelling where the enterprise wants a single integration estate rather than a standalone transfer tool.

Pros: True suite consolidation; strong European/manufacturing base.

Cons: Suite commitment is the price of entry.

Bottom line: For estates consolidating all integration, not just transfers.

7. Kiteworks — Best Governed-Exchange MFT

Snapshot: Quote | MFT inside the private content network | Hardened virtual appliance

Why it earns 7: Kiteworks folds MFT into its governed exchange plane the same policy, audit, and hardened virtual appliance architecture covering email and sharing attractive when the driver is provable third-party-risk governance across every channel rather than scheduler horsepower.

Pros: One audit plane across channels; hardened-deployment design.

Cons: Deep legacy-B2B protocol estates may outgrow it.

Bottom line: MFT as evidence, not just movement.

8. Redwood (JSCAPE) — Best Platform-Agnostic Value

Snapshot: Licensed/quote | JSCAPE MFT Server | Any-platform deployment, now under Redwood

Why it earns 8: JSCAPE’s platform-agnostic server (Windows/Linux/cloud, broad protocol support, clustering) now rides Redwood’s automation ecosystem a pragmatic mid-enterprise choice, with Redwood-era packaging worth confirming.

Pros: Deployment flexibility; protocol breadth; automation-ecosystem ties.

Cons: Brand transition diligence.

Bottom line: Flexible, sensible, and now part of an automation house.

9. Coviant (Diplomat) — Best Focused SFTP Automation Value

Snapshot: Published tiers | Diplomat MFT | PGP-automation specialist

Why it earns 9: Coviant’s Diplomat does the unglamorous core scheduled SFTP with airtight PGP key handling and alerting at published prices and small-team complexity, the honest answer when you need reliable encrypted transfers, not a B2B integration estate.

Pros: Right-sized; strong PGP automation; transparent pricing.

Cons: Not aiming at partner-community scale.

Bottom line: The focused tool that does transfers well and stops there.

Full Comparison Table

Yes/No Capability Table

Buying Advice: Interrogate the Posture Before the Scheduler

The category’s breach history writes your evaluation script. First, exposure architecture: no MFT admin interface internet-facing, ever demand the vendor’s zero-exposure reference design (gateway/proxy tier) and deploy it from day one.

Second, posture evidence: exploitation history handled, patch SLAs, time-to-patch track record for the last three CVEs, bounty program, hardening guide quality in writing, scored like a feature.

Third, operational resilience: can you patch within 24 hours of an advisory without breaking flows (staging environment, rollback plan)? Then and only then compare schedulers, protocol breadth, and partner onboarding.

Inventory your flows before shortlisting ten SFTP jobs point to Coviant/JSCAPE-class value; thousands of partner flows point to Axway/Sterling; EDI-entangled supply chains to Cleo/SEEBURGER; audit-plane governance to Kiteworks.

And wire MFT telemetry into the SOC: these systems are breach targets, so watch them like crown jewels, not plumbing.

FAQs

What is the best managed file transfer solution in 2026? Axway ranks 1 for enterprise depth with posture intact, IBM Sterling for backbone scale, and Progress MOVEit as the hardened survivor whose rebuilt security buyers should verify with Coviant and JSCAPE leading the value lanes.

Why only 9 vendors? Our source sheet listed GoAnywhere and Globalscape separately, but both are Fortra products one vendor, ranked once with both lines noted.

Is MOVEit safe to buy after 2023? The product remains capable and Progress has invested visibly in security since. Buy it the modern way: zero-exposure deployment, contractual patch SLAs, and your own 24-hour-patch capability.

MFT vs secure file sharing which do we need? MFT moves files between systems on schedules and triggers; sharing platforms serve humans collaborating. Most enterprises need both see our secure file sharing ranking for the human side.

What’s the single most important MFT security control? Architecture: no directly internet-exposed admin surface, a gateway tier in the DMZ, and SOC monitoring of the MFT estate itself. Most category breaches exploited exposed services.

Verdict

Axway and Sterling carry the backbones, MOVEit and GoAnywhere carry lessons the whole category paid for, and Cleo and SEEBURGER fold transfers into the integrations they really are buy the security architecture first, the scheduler second, and treat every MFT server as the crown-jewel target attackers already proved it is.

Author: [AUTHOR NAME], [credential]. Reviewed by: [REVIEWER NAME]. Last updated: October 2026. Cybersecurity News editorial is independent; no paid placement; scores are research-based, not lab-tested.

Read next on Cybersecurity News:

• Top 10 Best Secure File Sharing Platforms

• Top 10 Best Email Encryption Services

• Top 10 Best DRM & IRM Solutions

• Top 10 Best DLP Software

• Top 10 Best Vulnerability Management Tools

• Top 10 Best Attack Surface Management Tools

• Top 10 Best Patch Management Tools

• Top 10 Best SIEM Tools

• Top 9 Best Backup & Recovery Solutions

• Top 10 Best Ransomware Recovery Solutions

• Top 10 Best Third-Party Risk Management Tools

The post Top 9 Best Managed File Transfer (MFT) Solutions in 2026 [Ranked & Scored] appeared first on Cyber Security News.

The hackers stole 11 million email addresses from CAPCOM ID and changed the login passwords for 196 accounts.

The post 11 Million Impacted by Capcom Data Breach appeared first on SecurityWeek.