Skip to content
Sign in
Artwork for Daily Cyber Briefing
NewsTech News

Daily Cyber Briefing

Mike Housch

 The Daily Cyber Briefing delivers concise, no-fluff updates on the latest cybersecurity threats, breaches, and regulatory changes. Each episode equips listeners with actionable insights to stay ahead of emerging risks in today’s fast-moving digital landscape. 

Play
Open in
  • 22 episodes
  • daily
  • Avg 14 min
  • English

Episodes 22

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • Today · 13 min

    Daily Cyber & AI Briefing — 2026-10-19

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk environment is defined by a convergence of accelerating AI adoption, persistent vulnerabilities in core infrastructure, and the growing complexity of governance challenges. As organizations race to integrate generative AI and automation into their business processes, they’re unlocking new opportunities for innovation—but also exposing themselves to a host of new risks. Shadow AI, fragmented security controls, and inherited governance models are testing the limits of traditional risk management. Meanwhile, critical vulnerabilities like the recent Linux kernel exploit—known as PwnEscape—remind us that the foundations of our digital infrastructure remain vulnerable, and that operational resilience depends on both robust patch management and effective incident response. Let’s break down the most pressing themes shaping today’s landscape and what they mean for risk leaders, CISOs, and boards. First, the PwnEscape Linux kernel vulnerability has forced cloud provider Contabo to reboot its entire VPS infrastructure. This exploit allows attackers to break out of virtualized environments, potentially compromising host systems and customer data. For organizations relying on cloud and virtualized services, this incident is a stark reminder of the persistent threat posed by zero-day vulnerabilities. The operational disruption caused by emergency patching and forced reboots is significant, but the potential for data compromise is even more concerning. What’s the takeaway here? Timely patching is non-negotiable, but it’s only one part of the equation. Layered defenses—such as network segmentation, continuous monitoring, and rigorous access controls—are essential. Equally important is maintaining clear communication protocols with cloud vendors. When a major provider like Contabo is forced to take emergency action, every customer needs to know what’s happening, what data might be at risk, and what steps they need to take. This incident reinforces the need for proactive vendor risk management and a culture of operational readiness. Next, let’s talk about shadow AI. As AI tools become more accessible, employees are increasingly adopting them outside of official governance channels. This “shadow AI” phenomenon mirrors the shadow IT challenges of the past, but with higher stakes. Unmanaged AI use can lead to data leakage, compliance failures, and the introduction of unvetted models into critical workflows. Experts recommend a four-pronged approach to address shadow AI: policy enforcement, technical controls, employee education, and continuous monitoring. For CISOs, this means expanding the scope of shadow IT detection to include AI tools and models. Acceptable use policies need to be updated to cover AI, and risk assessments should be embedded in both procurement and development processes. Employee education is crucial—staff need to understand not just the potential of AI, but also the risks associated with unsanctioned use. Finally, continuous monitoring ensures that policy violations and emerging risks are detected early, before they escalate into incidents. Closely related to shadow AI is the issue of fragmented AI security. In many organizations, different business units or teams are implementing their own AI solutions, often with inconsistent security safeguards. This fragmentation creates blind spots—areas where data leakage, model manipulation, or compliance failures can occur without detection. Even well-intentioned AI initiatives can be undermined by a lack of centralized oversight. The solution is to prioritize unified AI security frameworks and establish cross-functional governance bodies. These structures ensure consistent risk management across the enterprise, providing clear guidelines for model development, deployment, and monitoring. Centralized oversight doesn’t mean stifling innovation—it means enabling it to happen safely, with accountability and transparency. The market is responding to these challenges. The AI model risk management sector is projected to surge, reaching nearly $29 billion by 2035. This growth is driven by the widespread adoption of generative AI and a heightened awareness of risks like model drift, bias, and regulatory scrutiny. Boards and regulators are increasingly expecting organizations to demonstrate robust model validation, ongoing monitoring, and thorough documentation. For CISOs, this means preparing for deeper engagement with senior leadership and regulators, and investing in the processes and tools needed to manage AI model risk at scale. AI-powered threat detection is also reshaping the cloud security market. These tools promise faster identification of novel attack patterns and the automation of incident response. But their effectiveness hinges on the quality of the data they ingest and their integration with existing security operations. Security leaders need to evaluate the maturity of AI-driven solutions and ensure they complement—not replace—traditional detection and response capabilities. Automation can accelerate response times, but it can’t substitute for the judgment and experience of skilled security professionals. A new challenge is emerging with the proliferation of “inherited agents”—AI systems that operate autonomously or are deeply embedded in business workflows. These agents can bypass established controls and governance models designed for conventional software. As a result, organizations may find themselves exposed to unanticipated risks, such as unauthorized data access or unintended actions taken by autonomous agents. Risk leaders must adapt their governance frameworks to account for the autonomy of these agents. This includes lifecycle management—tracking where agents are deployed, what data they access, and how they make decisions. Auditability is key: organizations need to be able to explain and document the actions of AI agents, both for internal oversight and external compliance. Amid all this complexity, data governance is emerging as the cornerstone of resilient AI strategy. Industry consensus is building around the idea that effective data stewardship underpins model reliability, regulatory compliance, and organizational trust. Without strong data governance, even the most advanced AI systems are vulnerable to bias, drift, and misuse. CISOs should champion enterprise-wide data governance initiatives, working to align data owners, AI developers, and risk management teams. This alignment ensures that data is accurate, secure, and used appropriately throughout the AI lifecycle. The financial services sector is a case in point. At the recent Smart Banking 2026 event, industry leaders emphasized the convergence of AI, fraud prevention, and cybersecurity as central to the future of banking. The sector is investing heavily in AI-driven controls to detect and prevent fraud, but these advances bring new challenges. As AI introduces new fraud vectors and regulatory expectations evolve, financial CISOs must benchmark their risk management practices against emerging industry standards. The goal is to stay ahead of both attackers and regulators, while maintaining customer trust. Vendor risk remains a critical issue, as highlighted by ConnectWise’s recent suspension of its cloud backup offering due to security concerns. While details are still emerging, the move underscores the importance of robust supply chain and third-party risk management. Organizations must review their vendor risk processes regularly and ensure they have contingency plans in place for critical service disruptions. The managed services ecosystem is only as strong as its weakest link, and proactive oversight is essential. Identity management is another area undergoing rapid transformation. Enterprises are increasingly adopting identity-centric controls for AI agents, focusing first on perimeter defenses—such as authentication and access control—before establishing robust measurement and monitoring capabilities. This sequencing can leave gaps in visibility and accountability. It’s not enough to know who or what has access; organizations also need to continuously measure and monitor the behavior of AI agents to detect anomalies and ensure compliance. A balanced approach is needed, one that combines strong access controls with ongoing behavioral analysis. Recent law enforcement actions also offer lessons for enterprise risk management. The FBI’s arrest of an 18-year-old swatting suspect, who believed VPNs and anonymization tools would shield him from detection, demonstrates the limits of these technologies. While this case isn’t a direct enterprise risk, it serves as a reminder that anonymization tools can be misused by insiders or threat actors. Organizations should monitor for the misuse of such technologies within their environments and maintain robust insider threat detection programs. As organizations scale their use of AI automation, foundational controls become even more critical. Access management, audit trails, and explainability are not optional—they are prerequisites for trusted and compliant AI deployment. These controls should be embedded from the outset of any AI initiative, not retrofitted after the fact. This proactive approach ensures that as automation scales, trust and compliance are maintained. Let’s step back and consider the broader strategic implications. Zero-day vulnerabilities in core infrastructure—like the PwnEscape exploit—remain a top operational risk. Proactive patch management and close coordination with vendors are essential. Shadow AI and fragmented governance threaten to undermine enterprise risk postures, making unified frameworks and cross-functional oversight

    • Transcript
  • Friday · 13 min

    Daily Cyber & AI Briefing — 2026-10-16

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is rapidly evolving, shaped by a mix of escalating nation-state activity, critical zero-day exploits, and mounting pressure on organizations to strengthen their AI governance. Let’s break down the most significant developments and what they mean for risk leaders, CISOs, and organizations navigating this complex environment. We’re seeing a decisive shift in the global technology landscape, as China has announced new restrictions on the export of advanced technologies, including artificial intelligence. Citing national security concerns, this move is more than just a headline—it signals a new era of geopolitical tech controls. For organizations that rely on global supply chains, especially those sourcing AI hardware or software from China, the implications are immediate. There’s a real risk of disruption, whether that’s delays in acquiring critical components, increased compliance requirements, or even sudden loss of access to certain technologies. Risk leaders now face a mandate to reassess supplier dependencies. This isn’t just about checking a box for compliance; it’s about understanding where your critical assets and capabilities are exposed to geopolitical risk. For many, this will mean mapping out supply chains in greater detail, identifying single points of failure, and developing contingency plans. The broader context is clear: as geopolitical tensions rise, technology risk management becomes inseparable from international relations. Organizations that fail to adapt could find themselves caught off guard by sudden policy shifts or export controls that fundamentally alter their risk landscape. Turning to cyber threats, a critical zero-day vulnerability in BeyondTrust’s remote support software has been actively exploited by China-linked threat actors. Attackers have used this flaw to take over remote support servers, steal credentials, and erase security logs—making their activity harder to detect and investigate. This campaign is a textbook example of the risks associated with trusted third-party tools. Remote support platforms are often deeply integrated into organizational networks, and a compromise here can provide attackers with broad access. For organizations using BeyondTrust or similar platforms, the practical takeaway is urgent: prioritize incident response, review access controls, and ensure rapid patching. Log integrity monitoring is also critical—attackers are increasingly erasing their tracks, so organizations need to ensure that security logs are protected and regularly backed up. This incident underscores the importance of third-party risk management. Trusted vendors can become prime targets, and their vulnerabilities can quickly become your vulnerabilities. The cascading impact of cyberattacks on critical infrastructure is further illustrated by the recent incident at BAE Systems. A cyberattack targeting this major defense contractor led to widespread disruption of bankruptcy court operations across the United States. This is a stark reminder that attacks on defense contractors and essential service providers don’t just affect those organizations—they can ripple out to disrupt public infrastructure and services relied upon by millions. For risk leaders, this means that continuity planning and third-party risk assessments are more important than ever. It’s not enough to secure your own environment; you need to understand the risk posture of your key vendors and partners, especially those supporting essential services. Regular testing of continuity plans, clear communication protocols, and robust incident response capabilities are now table stakes. Shifting gears to artificial intelligence, we’re witnessing the rapid proliferation of “shadow AI”—autonomous AI systems operating outside formal IT oversight. These agentic systems are being deployed by business units, individual employees, or even external partners, often without the knowledge or approval of security teams. The risks here are significant: unmonitored data flows, compliance violations, and unpredictable behaviors that can lead to operational or reputational damage. Many organizations are simply unprepared for the risks posed by shadow AI. Discovery and governance of these unsanctioned deployments should be a top priority for CISOs. This means working closely with business units to identify where AI is being used, establishing clear policies, and enforcing controls to ensure that AI systems are operating within acceptable risk parameters. The goal isn’t to stifle innovation, but to make sure that AI is deployed safely, securely, and in alignment with organizational values and regulatory requirements. The governance gap around AI is becoming increasingly visible at the highest levels. An IBM study has found that AI-related incidents are now being discussed in boardrooms, yet formal governance frameworks are lagging behind. This disconnect exposes organizations to a range of risks—reputational, operational, and regulatory. Security and risk executives need to advocate for board-level engagement on AI risk. This isn’t just an IT issue; it’s a strategic business risk that demands attention from the top. Accelerating the development of comprehensive AI governance structures is essential. This includes clear policies on data use, model transparency, accountability, and incident response. As AI incidents become more frequent and more impactful, organizations that lack mature governance frameworks will find themselves exposed—not just to technical failures, but to regulatory scrutiny and public backlash. Governments and industry leaders are taking notice. There are urgent calls for stronger AI oversight as cyber threats escalate. Regulatory bodies are considering new frameworks, and executives are warning that basic security hygiene must not be neglected in the rush to deploy AI. The message is clear: innovation cannot come at the expense of foundational controls. Organizations should monitor evolving regulatory expectations and ensure that security basics—like access management, monitoring, and incident response—remain firmly in place alongside new AI initiatives. The sense of urgency is echoed by the UK’s AI minister, who has publicly warned that a major cyberattack is “inevitable.” This isn’t hyperbole; it reflects a growing consensus among government officials and industry leaders that the threat environment is intensifying. Organizations need to maintain robust incident response capabilities and prepare for large-scale, disruptive events. This means not only having plans on paper, but regularly testing them, ensuring that key stakeholders know their roles, and that communication channels are clear and resilient. On the technology front, we’re seeing new partnerships aimed at improving risk detection and response. Keeper Security and Tenable have announced an integration designed to streamline cloud risk detection, remediation, and vulnerability assessment. This partnership reflects the growing demand for unified solutions that address identity, cloud, and supply chain risks in hybrid environments. For security leaders, evaluating such integrations can offer improved visibility and faster response times—key advantages in today’s fast-moving threat landscape. Meanwhile, threat actors are continuing to exploit vulnerabilities in network and IoT devices. Recent campaigns have targeted D-Link, Ubiquiti, and SAP devices, hijacking them for use in proxy networks. These compromised devices can be used to facilitate further intrusions, exfiltrate data, and obfuscate malicious activity. The lesson here is straightforward: timely patching of network and IoT devices is critical, as is monitoring for unusual outbound traffic that could indicate a device has been compromised. For technology companies, particularly those in Massachusetts, the cybersecurity and data protection challenges are mounting. Regulatory compliance, ransomware, and evolving threat vectors are all top of mind. The key to managing these risks is proactive risk management—regular assessments, employee training, and a culture of security awareness. It’s not enough to react to incidents; organizations need to anticipate and prepare for them. As AI adoption accelerates, we’re also seeing the emergence of new tools designed to help organizations govern AI agents and ensure compliance. ServiceNow’s launch of “AI Passport” is a case in point. This solution aims to automate governance for enterprise AI agents, managing their lifecycle and accountability. For risk leaders, tools like this can help bridge the gap between rapid AI adoption and the need for robust oversight. Automated governance solutions can enforce policies, monitor for deviations, and provide audit trails—critical capabilities as AI becomes more deeply embedded in business processes. In the financial sector, regulatory changes are on the horizon. The UK’s Prudential Regulation Authority is looking to consolidate rules governing payment systems. While the details are still emerging, this move could have significant implications for risk management and compliance in the financial services industry. Security and risk executives should closely monitor these developments and assess their impact on payment system security. Stepping back, several strategic implications emerge from these developments. First, geopolitical tech controls—like China’s export curbs—have the potential to disrupt supply chains and force organizations to rethink their dependencies on AI and hardware from specific regions. This isn’t just a theoretical risk; it’s a practical challenge that requires new approaches to supplier risk managemen

    • Transcript
  • Thursday · 13 min

    Daily Cyber & AI Briefing — 2026-10-15

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk environment is defined by a relentless pace of attacks, a surge in exploitation of zero-day vulnerabilities, and a growing sense of urgency around AI governance. We’re seeing adversaries target the very infrastructure designed to keep organizations safe, while AI is increasingly being used both as a tool for defenders and as a weapon for attackers. The stakes are rising, and the gap between risk and effective response is becoming more apparent—especially in critical infrastructure and enterprise environments. Let’s start with the most pressing developments on the cyber front. Over the past 24 hours, attackers have been actively exploiting vulnerabilities in widely deployed security appliances and software. This includes Fortinet, Palo Alto, Ivanti, Cisco, and even WinRAR. These aren’t obscure products—they’re foundational elements in many organizations’ security stacks, and that’s exactly why they’re such attractive targets. A particularly concerning campaign involves hackers exploiting Fortinet vulnerabilities to deploy a stealthy malware strain called PEERSTITCH on FortiGate firewalls. The sophistication here is notable: PEERSTITCH is engineered for stealth and persistence, allowing attackers to maintain long-term, undetected access to compromised firewalls. This isn’t just about breaking in—it’s about staying in, quietly monitoring traffic, and waiting for the right moment to move laterally across the network. The fact that attackers are focusing on security infrastructure itself is a wake-up call. These devices are often trusted implicitly, and if they’re compromised, the attackers can potentially pivot deeper into your environment without raising alarms. For security leaders, this underscores a few critical imperatives. First, timely patching is non-negotiable. If you’re running FortiGate firewalls, you need to be aware of the latest advisories and ensure you’re not lagging behind on updates. Second, continuous monitoring of your security appliances is essential. Don’t assume that just because a device is labeled “security,” it’s immune from attack. In fact, these devices should be among the most closely watched assets in your environment. Finally, any anomalous behavior observed on these devices should trigger rapid investigation. Attackers are counting on organizations being slow to respond or failing to notice subtle changes. Moving to Ivanti, CISA has issued a fresh alert regarding active exploitation of a zero-day vulnerability in Ivanti Connect Secure VPN appliances. Attackers are leveraging this flaw to steal credentials and sensitive data, posing a direct threat to organizations that rely on Ivanti for remote access. The practical takeaway here is clear: apply available mitigations immediately, monitor for signs of compromise, and review your remote access policies. VPN appliances are high-value targets—if compromised, they can give attackers a direct line into your internal network, bypassing many traditional defenses. It’s a similar story with Palo Alto Networks’ PAN-OS. A critical zero-day vulnerability, designated CVE-2026-0322, is being actively exploited in the wild. Organizations using affected versions are urged to patch immediately. The risk here isn’t hypothetical—attackers can use this flaw to gain unauthorized access or disrupt security operations. This incident reinforces the importance of rapid vulnerability management and close coordination with vendors. When a zero-day hits, every hour counts. Make sure your team is plugged into vendor threat intelligence and patch guidance. Cisco is also in the spotlight, having issued an urgent advisory for customers to patch a critical vulnerability in its email gateway products. Email gateways are a prime target for attackers looking to intercept or manipulate business communications. If you’re running Cisco gateways, prioritize patching, review your email logs for any suspicious activity, and enhance monitoring. Email remains one of the most common initial access vectors for attackers, and a compromised gateway can have broad implications for data loss and business continuity. We’re also seeing attackers exploit a critical authentication bypass vulnerability in Fortinet FortiClient EMS. What’s especially concerning here is that a proof-of-concept exploit has already been released. This lowers the barrier to entry for would-be attackers, increasing the risk of widespread exploitation. If you haven’t already, apply patches immediately and monitor for unusual access patterns. Authentication bypass vulnerabilities are among the most dangerous, as they can allow attackers to walk right in without needing valid credentials. Legacy software isn’t immune, either. A threat group identified as UAT-6275 is exploiting a vulnerability in WinRAR to target government organizations in the Commonwealth of Independent States. This campaign is a reminder that unpatched, widely used utilities can present a significant risk, especially in government and critical infrastructure environments. Security leaders should ensure all endpoints are updated and consider restricting the use of high-risk utilities like WinRAR, especially if they’re not strictly necessary for business operations. Let’s shift gears to the intersection of cyber and AI risk—a space that’s evolving rapidly and presenting new challenges for organizations. A recent report found that AI is now used in 84% of ransomware attacks. That’s a staggering statistic. Adversaries are leveraging AI to automate targeting, evade detection, and compromise identity infrastructure. This trend amplifies the risk to organizations’ authentication and access systems. It’s not just about defending against brute-force attacks anymore; it’s about defending against intelligent, adaptive adversaries who can move faster and more quietly than ever before. The practical implication is that organizations need to enhance their identity protection strategies. Multi-factor authentication is a must, but it’s not sufficient on its own. AI-driven anomaly detection should be part of your toolkit. Monitor for unusual login patterns, privilege escalations, and other indicators of compromise. And don’t overlook the human element—ensure that employees understand the risks and know how to recognize and report suspicious activity. Ransomware actors are also escalating their tactics. We’re seeing a shift in focus—not just targeting organizations, but also going after employees and their families. This is a significant evolution in ransomware strategy. By using social engineering and extortion, criminals are increasing the pressure on organizations to pay up. This raises the risk of insider threats and can cause significant reputational damage. Organizations need to bolster employee awareness and support, and ensure that incident response protocols are up to date. It’s not just about protecting data and systems anymore—it’s about protecting people. The convergence of AI and cyber threats is also putting identity infrastructure under sustained attack. As attackers weaponize AI, traditional defenses are being bypassed with increasing frequency. This demands a reassessment of identity and access management controls. Organizations need to move beyond static defenses and invest in AI-driven detection and response capabilities. The goal is to spot and stop attacks before they can do real damage. Now, let’s talk about the broader AI landscape. Enterprises are entering a new phase of AI adoption—one that’s focused on risk management. CompTIA research indicates that organizations are moving from experimentation to a more mature, risk-aware approach. Security concerns are now a top priority, and there’s a growing recognition of the need for formal governance, risk assessment, and controls around AI deployments. But there’s a gap. An IBM study found that 80% of UK enterprises now escalate AI-related incidents to their boards, but many report lagging governance and oversight. This highlights a growing materiality of AI risks at the executive level, but also a lack of mature governance structures and incident response plans for AI systems. The trust gap in enterprise AI is real. Stakeholders are concerned about transparency, bias, and security. The recommended solution is robust governance—continuous monitoring, clear accountability, and alignment with regulatory expectations. For CISOs and risk executives, the imperative is clear: accelerate the development of AI governance frameworks that go beyond static compliance. Static compliance approaches—where you check the box once and move on—are insufficient, especially in critical infrastructure. Instead, what’s needed is continuous monitoring and adaptive controls. AI systems are dynamic by nature; the risks they present can change over time, and your governance approach needs to reflect that. Expert commentary stresses that for critical infrastructure, continuous monitoring and real-time risk detection are necessary to manage evolving threats and maintain resilience. CISOs should be advocating for dynamic governance models and investing in the tools and processes that enable ongoing oversight of AI-enabled systems. This isn’t just about regulatory compliance—it’s about operational resilience and maintaining trust with stakeholders. Let’s distill the strategic implications from today’s developments. First, the wave of zero-day vulnerabilities in security infrastructure means organizations need to accelerate patching and implement continuous monitoring. Attackers are increasingly targeting the very tools meant to protect us, and complacency is not an option. Second, the weaponization of AI in ransomware an

    • Transcript
  • Wednesday · 12 min

    Daily Cyber & AI Briefing — 2026-10-14

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript The cyber and AI risk landscape is evolving at an unprecedented pace, shaped by the convergence of escalating technical threats and increasingly complex governance challenges. Today, we’re seeing a perfect storm: critical vulnerabilities in widely used platforms are being exploited within days—or even hours—of public disclosure, while the rapid adoption of AI agents and agentic architectures is introducing new attack surfaces and operational uncertainties that many organizations are still struggling to understand, let alone secure. Let’s start by looking at the technical threat environment. Over the past 24 hours, several high-impact vulnerabilities have come to light, and attackers are wasting no time in leveraging them. SonicWall, Windows, and iOS—all foundational platforms for enterprise IT—are in the crosshairs, with active exploitation already underway. One of the most significant developments is the emergence of AI agents as both a defensive and offensive force. Recent incidents have shown AI agents breaching production environments and spreading malware at scale. This isn’t just a theoretical risk—these are real-world exploits where AI-driven malware has slipped past traditional defenses, automated its own propagation, and compromised critical systems. The dual-use nature of AI is now front and center: while AI can help us automate detection and response, it also gives adversaries the ability to launch attacks that are faster, more adaptive, and more autonomous than anything we’ve seen before. For security leaders, this means that monitoring AI agent activity is now a must-have, not a nice-to-have. We’re talking about robust access controls, continuous validation of AI-driven processes, and a shift toward proactive detection and response. If your organization is deploying AI agents—whether for IT automation, customer service, or security operations—you need to be asking hard questions about how those agents are being controlled, audited, and monitored for signs of compromise. Let’s turn to SonicWall. A newly disclosed critical vulnerability in SonicWall devices is being actively exploited in the wild. SonicWall is a staple in perimeter security for thousands of organizations, and this flaw is giving attackers a foothold that can be used to pivot deeper into enterprise networks. The practical takeaway is straightforward: if you’re running SonicWall devices, patch now. Don’t wait for a scheduled maintenance window—this is an urgent, high-priority fix. Beyond patching, review your network segmentation and monitor for lateral movement. Attackers who gain access through the perimeter will often look for ways to escalate privileges and move laterally, so having strong segmentation and detection controls in place is essential. Mobile security is also under siege. Researchers have identified two exploit kits—Coruna and DarkSword—that can fully compromise iPhones from a single malicious web visit. This is a stark reminder that zero-click and drive-by attacks against mobile devices remain a persistent threat, even for platforms with a reputation for strong security. For CISOs, the implications are clear: reinforce your mobile device management policies, ensure rapid OS patching, and keep users educated about the risks of clicking on untrusted links or visiting unknown websites. The mobile attack surface is only growing as more business processes go mobile, and attackers are keeping pace. Microsoft’s latest patch release is another headline-grabber, addressing an astonishing 1,413 CVEs. That’s right—over 1,400 vulnerabilities patched in a single release cycle. But even with this massive effort, at least one zero-day vulnerability remains unpatched and is being actively exploited. The sheer volume of vulnerabilities highlights just how challenging patch management has become, especially for large organizations with complex IT environments. Security teams need to prioritize based on exploitability and business impact, and critical fixes need to be deployed as quickly as possible. This is not the time to let technical debt accumulate. Another area of concern is Windows SmartScreen. A vulnerability here is being exploited to enable privilege escalation, giving attackers higher-level access on compromised systems. This type of exploit is particularly dangerous in environments where users have broad privileges or where network segmentation is weak. The lesson here is twofold: patch promptly, and review your endpoint protection controls to ensure that privilege escalation attempts are being detected and blocked. While technical vulnerabilities are dominating the headlines, there’s a parallel—and equally important—story unfolding around governance and risk management. Organizations and governments are wrestling with the challenge of enabling AI innovation while managing its risks. Industry leaders and regulators are calling for measurable security improvements, robust AI risk management frameworks, and executive-level oversight. One of the most important shifts we’re seeing is the recognition that AI risk management is now a board-level issue. The days when AI governance could be delegated to IT or security teams alone are over. Executive and board-level stakeholders need to be engaged, informed, and accountable. This means integrating AI risk into enterprise risk management frameworks, ensuring cross-functional collaboration, and establishing clear lines of responsibility for AI oversight. Let’s dig a bit deeper into the operational implications for CISOs and risk executives. The current threat environment demands a holistic approach that spans technical, organizational, and regulatory domains. Continuous patching and vulnerability management are table stakes. But that’s just the beginning. Rapid detection and response capabilities are essential, especially as AI accelerates the speed and sophistication of both attacks and defenses. Technical debt, supply chain compromise, and AI model misuse are no longer hypothetical risks—they’re material, urgent, and require attention at the highest levels of the organization. If you’re not already treating these as strategic risks, now is the time to start. Let’s talk about the shift from traditional cybersecurity to decision intelligence. Organizations are increasingly leveraging advanced analytics and AI to transform raw threat signals into actionable intelligence. This isn’t just about automating alerts—it’s about enabling faster, more informed decision-making at every level of the organization. But to get there, you need new skills, new processes, and new governance models. CISOs should be evaluating their threat intelligence programs and investing in capabilities that support this transition. The goal is to move from reactive firefighting to proactive, strategic risk management. As organizations deploy agentic AI systems at scale, new architectural and security challenges are emerging. Managing distributed, autonomous AI agents is fundamentally different from managing traditional software. You need robust controls, clear governance, and continuous monitoring. Security-by-design principles must be embedded from the outset, and AI deployments need to be aligned with your organization’s risk appetite. If you’re not thinking about AI architecture as a core part of your enterprise architecture, you’re already behind the curve. A recent analysis highlights the emerging blind spots in risk management as AI adoption accelerates. Traditional risk frameworks may not fully capture the dynamic and opaque nature of AI-driven systems. Security and risk leaders are being urged to update their risk assessment methodologies, incorporate AI-specific controls, and foster a culture of continuous learning and adaptation. The reality is that AI systems can behave in unexpected ways, and the risks are often difficult to predict in advance. The UK’s AI Safety Institute has issued a warning about the risks posed by unreleased or untested AI models. These models may harbor unknown vulnerabilities or behaviors that could be exploited by malicious actors. For organizations developing or integrating third-party AI, this is a wake-up call: rigorous testing, supply chain due diligence, and ongoing monitoring of AI model performance and security are non-negotiable. On the governance front, multiple organizations are expanding their focus on executive-level cybersecurity and AI governance. This trend reflects a growing recognition that AI risk management requires cross-functional collaboration and clear accountability. CISOs should ensure that AI risk is integrated into enterprise risk management frameworks and that executive stakeholders are actively engaged in oversight and decision-making. AI is also fundamentally changing the economics and dynamics of cybersecurity. Automated threat detection, response, and even offensive capabilities are evolving rapidly. Security leaders need to reassess their technology investments, workforce skills, and risk models to ensure they can keep pace with AI-driven change. The old playbook won’t cut it anymore. Let’s bring this all together with a few strategic implications. First, the speed and automation enabled by AI agents require a fundamental rethink of detection, response, and access control strategies. You can’t rely on manual processes to keep up with AI-enabled threats. Automation, orchestration, and continuous monitoring are now essential components of a modern security strategy. Second, the volume and severity of newly disclosed vulnerabilities reinforce the need for mature, prioritized patch management and vulnerability scanning. This isn’t just about keeping up with patch cycle

    • Transcript
  • Tuesday · 16 min

    Daily Cyber & AI Briefing — 2026-10-13

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is evolving at an unprecedented pace, marked by the convergence of advanced threats and rapid integration of artificial intelligence across enterprise environments. The headlines are filled with incidents that highlight both the ingenuity of attackers and the growing complexity of defending modern organizations. Today, I’ll walk through the most significant developments, unpack their practical implications, and outline what security leaders need to focus on right now. Let’s begin by looking at the ongoing exploitation of zero-day vulnerabilities in core infrastructure. Citrix NetScaler appliances, widely used for application delivery and remote access, are currently being targeted by attackers leveraging previously unknown flaws. The goal? To deploy the Platypus remote access tool, which enables persistent, stealthy access to enterprise environments. What makes this campaign particularly concerning is that it bypasses many traditional security controls—once inside, attackers can move laterally and maintain a foothold, often undetected. This kind of infrastructure-level attack underscores the critical importance of rapid patching. When a zero-day is disclosed, the window for attackers to exploit it before organizations can respond is often measured in hours or days, not weeks. That means vulnerability management can’t be a quarterly exercise—it needs to be continuous. In addition to patching, network segmentation is vital. By limiting the blast radius of a compromised device, organizations can prevent attackers from easily accessing sensitive systems. For CISOs, the message is clear: prioritize vulnerability scanning, ensure timely deployment of patches, and monitor for unusual remote access activity, especially from devices like NetScaler that sit at the heart of enterprise networks. Moving from infrastructure to the endpoint, another campaign making waves involves the Kimsuky threat group. They’re using fake Zoom installers and malicious shortcut files—those .lnk files you might see on your desktop—to distribute malware. This is a classic example of social engineering, where attackers trick users into running malicious code, often by mimicking legitimate software updates or installers. The continued success of these tactics reminds us that the human element remains one of the weakest links in cybersecurity. Organizations need to double down on user awareness and training. It’s not enough to rely solely on technical controls; employees must be able to recognize suspicious files and installation prompts. Endpoint protection, application whitelisting, and restricting software installation privileges can all help reduce risk. Security teams should review their policies to ensure that only approved applications can be installed, and that users are regularly reminded of the dangers posed by unsolicited downloads and email attachments. Browser session hijacking is another area where attackers are innovating. A new technique leveraging the XWorm HBrowser plugin allows adversaries to take over authenticated browser sessions—without ever needing the user’s credentials. Essentially, attackers can piggyback on existing sessions, bypassing multi-factor authentication and session management controls. This is a significant concern for any organization that relies on web-based applications for sensitive operations. To mitigate this risk, organizations should review their browser security policies. This includes enforcing up-to-date browser versions, disabling unnecessary plugins, and monitoring for anomalous session activity. Real-time detection of session hijacking attempts is still a developing area, but security teams need to stay vigilant. Regularly reviewing session logs and looking for patterns of access that don’t align with normal user behavior can help spot attacks early. On the macOS front, a new malware called GhostProfile is making headlines. Its method of operation is to clone browser profiles, effectively hijacking live user sessions. This allows attackers to access sensitive information and perform actions as if they were the legitimate user. Historically, macOS has been perceived as less susceptible to malware than Windows, but that gap is closing rapidly. The emergence of threats like GhostProfile highlights the necessity of cross-platform endpoint security—organizations can no longer afford to treat macOS as a second-class citizen in their security strategy. Regular monitoring of browser artifacts, such as profile data and session cookies, is increasingly important. Security teams should also ensure that macOS devices are included in endpoint detection and response (EDR) deployments, and that users are educated about the risks of browser-based attacks. Attackers are also exploiting the intersection of emerging technologies to distribute malware. One recent campaign involves fake Web3 accelerator programs, which offer credits for popular AI tools like Claude and Gemini as a lure. These offers are designed to catch the attention of organizations interested in AI and blockchain, two areas that are seeing explosive growth. The tactic is simple: dangle something valuable, like free access to cutting-edge AI, and deliver malware instead. This trend illustrates how attackers are quick to adapt their social engineering techniques to align with what’s top-of-mind for their targets. For security teams, the takeaway is to be skeptical of unsolicited offers, especially those related to new technology platforms. Always validate the source before engaging or downloading anything. If it sounds too good to be true, it probably is. Shifting gears to data loss prevention, a recent survey from the Cloud Security Alliance reveals a sobering reality: many DLP solutions only detect data loss after it has already occurred. In other words, they’re reactive rather than proactive. This leaves organizations exposed to both insider threats and accidental leaks—risks that are only amplified as AI-driven data flows increase in volume and complexity. CISOs should take this as a call to action to evaluate the effectiveness of their current DLP tools. Are they capable of real-time monitoring? Can they detect anomalous data movements before sensitive information leaves the organization? Augmenting traditional DLP with AI-based anomaly detection and real-time alerting can help close the gap. It’s also important to regularly review and update data classification policies, ensuring that the most sensitive information is subject to the highest levels of protection. On the technology front, Thales has launched CipherTrust Data Security Posture Management, or DSPM, specifically designed to address AI access risks. As AI models increasingly interact with critical business data, the need for visibility and control over who—and what—can access that data becomes paramount. Tools like DSPM help enforce least privilege, monitor access patterns, and provide the audit trails necessary for both security and compliance. Security leaders should assess whether such solutions are applicable to their own AI environments. As AI adoption accelerates, it’s essential to have controls in place that are tailored to the unique risks posed by autonomous systems. This includes not just technical controls, but also policies around data governance and access management. Speaking of AI adoption, Manulife has rolled out an enterprise AI platform designed to scale AI solutions across its global operations. This is part of a broader trend: organizations are investing heavily in AI to drive business value, automate processes, and gain competitive advantage. But with this growth comes new challenges around governance, data protection, and cross-border compliance. Risk executives need to ensure that AI initiatives are aligned with security and privacy requirements from day one. That means involving security teams early in the development and deployment process, conducting thorough risk assessments, and establishing clear guidelines for data usage and model training. Cross-border data flows, in particular, require careful attention to regulatory requirements, especially as privacy laws continue to evolve worldwide. Another significant development is the partnership between HCLTech and Anthropic, focused on deploying agentic AI with built-in safety controls for enterprise use. Agentic AI refers to systems that can act autonomously, making decisions and taking actions without direct human oversight. As these systems become more prevalent, the need for robust guardrails becomes critical. CISOs should monitor advancements in agentic AI and evaluate the maturity of safety controls before deployment. This includes assessing how well these systems can be audited, how incidents are detected and responded to, and whether operational “red lines” are clearly defined. The goal is to ensure that as AI agents gain more autonomy, they do so within a framework that prioritizes safety, transparency, and accountability. Workforce risk remains a persistent challenge, and it’s not limited to any one region. Liquid C2’s partnership with KnowBe4 aims to bring workforce risk management solutions to African businesses, highlighting the universal importance of the human factor in cyber risk. Social engineering continues to be one of the most effective attack vectors, whether it’s through phishing emails, malicious links, or impersonation. Comprehensive training and risk management programs are essential for organizations of all sizes and sectors. This isn’t a one-and-done exercise—ongoing education, simulated phishing campaigns, and clear reporting channels for suspicious activ

    • Transcript
  • October 12 · 13 min

    Daily Cyber & AI Briefing — 2026-10-12

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is more dynamic and complex than ever, with both technical exploits and governance challenges converging to create a high-pressure environment for security leaders and risk executives. We’re seeing a surge in high-profile vulnerabilities, active exploitation by threat actors, and a rapidly evolving regulatory climate driven by the widespread adoption of artificial intelligence. Let’s break down what’s happening, why it matters, and what organizations need to do to stay ahead. First, let’s talk about the wave of technical exploits targeting enterprise infrastructure. Ransomware groups are actively exploiting a vulnerability in Palo Alto Networks’ GlobalProtect VPN. This isn’t just another bug—it’s being used to bypass authentication and maintain persistent, stealthy access to enterprise environments. The implications are serious: attackers can move laterally, exfiltrate sensitive data, and deploy ransomware, all while evading detection for longer periods. For organizations relying on GlobalProtect, the message is clear: prioritize patching, monitor VPN activity for anomalies, and rigorously review remote access controls. This incident underscores a broader trend—remote access infrastructure remains a prime target for sophisticated threat actors, and the window between vulnerability disclosure and active exploitation is shrinking. The situation with SonicWall’s SMA 1000 series is another stark example. Even after a patch was released for a critical vulnerability, there have been at least 135 documented exploitation attempts. Attackers are quick to weaponize newly disclosed flaws, often beating organizations to the punch on patching. This highlights the need for not just rapid patch deployment, but also vigilant post-patch monitoring. It’s not enough to apply a fix and move on—security teams need to verify that patches are actually in place, monitor for indicators of compromise, and be prepared for attackers who may have gained a foothold before remediation. Web-facing applications are also under siege. The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has added an actively exploited command injection vulnerability in Apache Struts to its Known Exploited Vulnerabilities catalog. This is a high-severity issue that enables remote code execution, posing a significant threat to any organization running Struts-powered applications. CISA’s inclusion of this flaw in its KEV catalog isn’t just a bureaucratic step—it’s a call to immediate action for federal agencies and a strong recommendation for all enterprises. If you’re running Struts, urgent remediation is non-negotiable. Open-source platforms are not immune, either. Discourse, a widely used discussion platform, has been found to contain multiple vulnerabilities that allow attackers to execute arbitrary JavaScript and read sensitive server files. These kinds of flaws can be exploited to compromise user data and escalate privileges, making them attractive targets for attackers. Organizations using Discourse should apply patches as soon as they’re available and take this as a reminder to regularly review their web application security posture. Open-source tools are valuable, but they require the same level of scrutiny and maintenance as any commercial solution. As we move from technical exploits to the evolving world of AI, the landscape becomes even more nuanced. The adoption of AI across business functions is accelerating, but so are the risks and regulatory demands. Rubrik’s expansion of Project Hourglass is a timely example. They’re now focusing on testing AI-generated code for cybersecurity vulnerabilities. As more organizations leverage AI to write and review code, the risk of introducing exploitable flaws increases. Automated code review tools that specifically address AI-generated code are becoming essential. Security leaders should integrate these tools into their secure development lifecycle and update practices to account for the unique risks posed by AI-assisted development. The regulatory environment is also shifting rapidly. Managed service providers, or MSPs, are facing new certification demands as their use of AI grows. Customers and regulators alike are demanding proof of AI governance, robust security controls, and responsible use policies. This trend is not limited to MSPs—any organization deploying AI should expect similar scrutiny. CISOs need to stay on top of evolving standards and ensure their teams are prepared for audits and compliance reviews. The days of deploying AI in a regulatory vacuum are over. Nowhere is this more evident than in the European Union, where the EU AI Act is poised to reshape how organizations govern and deploy AI. The Act introduces significant requirements around risk management, transparency, and accountability. Non-compliance isn’t just a matter of regulatory slap on the wrist—it can result in substantial fines and reputational damage. Corporate leaders should be proactively assessing their AI systems for compliance, updating documentation, and implementing robust governance frameworks. Early preparation is essential, not just for legal compliance, but for maintaining stakeholder trust. The integration of AI into identity governance is another area to watch closely. Anugal’s introduction of agentic AI capabilities into enterprise identity governance brings both promise and peril. On one hand, more autonomous and adaptive access decisions can drive efficiency and agility. On the other, these systems raise new questions about explainability, oversight, and the potential for abuse. Security teams must ensure that AI-driven identity systems are auditable, transparent, and aligned with organizational policies. The balance between automation and control is delicate, and getting it wrong can expose organizations to significant risk. This brings us to a broader and increasingly urgent issue: the rise of AI agents as a new class of insider threat. Traditionally, insider threat programs have focused on human actors—employees, contractors, and partners with access to sensitive data and systems. But as AI agents proliferate within organizations, they too can access sensitive data, make decisions, and potentially be manipulated or subverted. CISOs should update their insider threat programs to account for these non-human actors, ensuring that monitoring and controls are in place for AI-driven processes. The line between human and machine insiders is blurring, and security strategies need to evolve accordingly. Recent events have also highlighted the importance of trust and vetting in third-party relationships. The arrest of a ransomware response expert in connection with the ShinyHunters FBI hack investigation is a sobering reminder that even trusted incident response providers can become sources of risk. Security leaders should review their vendor management and incident response protocols to ensure integrity and compliance. This includes not just technical vetting, but also ongoing monitoring and clear contractual requirements around security and ethics. Amidst all these challenges, collaboration is emerging as a critical enabler of cyber resilience. LevelBlue is emphasizing the importance of collaboration across teams, partners, and even sectors to build resilience and support business growth. As threats become more complex and interconnected, siloed approaches are increasingly ineffective. CISOs should foster cross-functional partnerships and encourage information sharing, both internally and with external partners. The ability to respond quickly and effectively to incidents often depends on the strength of these collaborative relationships. Zooming out even further, a comprehensive risk assessment has identified AI misuse as one of 17 existential risks facing humanity, alongside climate change and other systemic threats. For risk executives, this underscores the need to integrate AI risk into broader enterprise risk management frameworks and scenario planning. It’s not just about compliance or technical controls—it’s about understanding and preparing for the full spectrum of risks that AI can introduce, from operational disruptions to reputational crises and even societal impacts. So, what are the key imperatives for risk executives and security leaders today? First, maintain relentless vigilance on patching and vulnerability management. The rapid exploitation of newly disclosed vulnerabilities means organizations must have processes in place to identify, prioritize, and remediate critical flaws—especially in infrastructure like VPNs, firewalls, and web applications. But patching alone isn’t enough. Continuous monitoring for signs of exploitation, even after patches are applied, is essential to catch attackers who may have already gained access. Second, prepare for the evolving landscape of AI regulations and certifications. This means assessing your AI systems for compliance, updating governance frameworks, and ensuring that your teams are ready for audits and certification reviews. The regulatory environment is only going to become more demanding, and early preparation will pay dividends in both compliance and operational resilience. Third, expand your insider threat programs to include AI agents and non-human actors. As AI becomes more deeply embedded in business processes, it’s critical to recognize that these systems can introduce new vectors for insider risk. Monitoring, controls, and oversight mechanisms need to evolve to keep pace with this shift. Fourth, foster a culture of cyber resilience that spans technology, process, and people. This includes upskilling your workforce, encouraging cross-

    • Transcript
  • October 12 · 13 min

    Daily Cyber & AI Briefing — 2026-10-12

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is more dynamic and complex than ever, with both technical exploits and governance challenges converging to create a high-pressure environment for security leaders and risk executives. We’re seeing a surge in high-profile vulnerabilities, active exploitation by threat actors, and a rapidly evolving regulatory climate driven by the widespread adoption of artificial intelligence. Let’s break down what’s happening, why it matters, and what organizations need to do to stay ahead. First, let’s talk about the wave of technical exploits targeting enterprise infrastructure. Ransomware groups are actively exploiting a vulnerability in Palo Alto Networks’ GlobalProtect VPN. This isn’t just another bug—it’s being used to bypass authentication and maintain persistent, stealthy access to enterprise environments. The implications are serious: attackers can move laterally, exfiltrate sensitive data, and deploy ransomware, all while evading detection for longer periods. For organizations relying on GlobalProtect, the message is clear: prioritize patching, monitor VPN activity for anomalies, and rigorously review remote access controls. This incident underscores a broader trend—remote access infrastructure remains a prime target for sophisticated threat actors, and the window between vulnerability disclosure and active exploitation is shrinking. The situation with SonicWall’s SMA 1000 series is another stark example. Even after a patch was released for a critical vulnerability, there have been at least 135 documented exploitation attempts. Attackers are quick to weaponize newly disclosed flaws, often beating organizations to the punch on patching. This highlights the need for not just rapid patch deployment, but also vigilant post-patch monitoring. It’s not enough to apply a fix and move on—security teams need to verify that patches are actually in place, monitor for indicators of compromise, and be prepared for attackers who may have gained a foothold before remediation. Web-facing applications are also under siege. The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has added an actively exploited command injection vulnerability in Apache Struts to its Known Exploited Vulnerabilities catalog. This is a high-severity issue that enables remote code execution, posing a significant threat to any organization running Struts-powered applications. CISA’s inclusion of this flaw in its KEV catalog isn’t just a bureaucratic step—it’s a call to immediate action for federal agencies and a strong recommendation for all enterprises. If you’re running Struts, urgent remediation is non-negotiable. Open-source platforms are not immune, either. Discourse, a widely used discussion platform, has been found to contain multiple vulnerabilities that allow attackers to execute arbitrary JavaScript and read sensitive server files. These kinds of flaws can be exploited to compromise user data and escalate privileges, making them attractive targets for attackers. Organizations using Discourse should apply patches as soon as they’re available and take this as a reminder to regularly review their web application security posture. Open-source tools are valuable, but they require the same level of scrutiny and maintenance as any commercial solution. As we move from technical exploits to the evolving world of AI, the landscape becomes even more nuanced. The adoption of AI across business functions is accelerating, but so are the risks and regulatory demands. Rubrik’s expansion of Project Hourglass is a timely example. They’re now focusing on testing AI-generated code for cybersecurity vulnerabilities. As more organizations leverage AI to write and review code, the risk of introducing exploitable flaws increases. Automated code review tools that specifically address AI-generated code are becoming essential. Security leaders should integrate these tools into their secure development lifecycle and update practices to account for the unique risks posed by AI-assisted development. The regulatory environment is also shifting rapidly. Managed service providers, or MSPs, are facing new certification demands as their use of AI grows. Customers and regulators alike are demanding proof of AI governance, robust security controls, and responsible use policies. This trend is not limited to MSPs—any organization deploying AI should expect similar scrutiny. CISOs need to stay on top of evolving standards and ensure their teams are prepared for audits and compliance reviews. The days of deploying AI in a regulatory vacuum are over. Nowhere is this more evident than in the European Union, where the EU AI Act is poised to reshape how organizations govern and deploy AI. The Act introduces significant requirements around risk management, transparency, and accountability. Non-compliance isn’t just a matter of regulatory slap on the wrist—it can result in substantial fines and reputational damage. Corporate leaders should be proactively assessing their AI systems for compliance, updating documentation, and implementing robust governance frameworks. Early preparation is essential, not just for legal compliance, but for maintaining stakeholder trust. The integration of AI into identity governance is another area to watch closely. Anugal’s introduction of agentic AI capabilities into enterprise identity governance brings both promise and peril. On one hand, more autonomous and adaptive access decisions can drive efficiency and agility. On the other, these systems raise new questions about explainability, oversight, and the potential for abuse. Security teams must ensure that AI-driven identity systems are auditable, transparent, and aligned with organizational policies. The balance between automation and control is delicate, and getting it wrong can expose organizations to significant risk. This brings us to a broader and increasingly urgent issue: the rise of AI agents as a new class of insider threat. Traditionally, insider threat programs have focused on human actors—employees, contractors, and partners with access to sensitive data and systems. But as AI agents proliferate within organizations, they too can access sensitive data, make decisions, and potentially be manipulated or subverted. CISOs should update their insider threat programs to account for these non-human actors, ensuring that monitoring and controls are in place for AI-driven processes. The line between human and machine insiders is blurring, and security strategies need to evolve accordingly. Recent events have also highlighted the importance of trust and vetting in third-party relationships. The arrest of a ransomware response expert in connection with the ShinyHunters FBI hack investigation is a sobering reminder that even trusted incident response providers can become sources of risk. Security leaders should review their vendor management and incident response protocols to ensure integrity and compliance. This includes not just technical vetting, but also ongoing monitoring and clear contractual requirements around security and ethics. Amidst all these challenges, collaboration is emerging as a critical enabler of cyber resilience. LevelBlue is emphasizing the importance of collaboration across teams, partners, and even sectors to build resilience and support business growth. As threats become more complex and interconnected, siloed approaches are increasingly ineffective. CISOs should foster cross-functional partnerships and encourage information sharing, both internally and with external partners. The ability to respond quickly and effectively to incidents often depends on the strength of these collaborative relationships. Zooming out even further, a comprehensive risk assessment has identified AI misuse as one of 17 existential risks facing humanity, alongside climate change and other systemic threats. For risk executives, this underscores the need to integrate AI risk into broader enterprise risk management frameworks and scenario planning. It’s not just about compliance or technical controls—it’s about understanding and preparing for the full spectrum of risks that AI can introduce, from operational disruptions to reputational crises and even societal impacts. So, what are the key imperatives for risk executives and security leaders today? First, maintain relentless vigilance on patching and vulnerability management. The rapid exploitation of newly disclosed vulnerabilities means organizations must have processes in place to identify, prioritize, and remediate critical flaws—especially in infrastructure like VPNs, firewalls, and web applications. But patching alone isn’t enough. Continuous monitoring for signs of exploitation, even after patches are applied, is essential to catch attackers who may have already gained access. Second, prepare for the evolving landscape of AI regulations and certifications. This means assessing your AI systems for compliance, updating governance frameworks, and ensuring that your teams are ready for audits and certification reviews. The regulatory environment is only going to become more demanding, and early preparation will pay dividends in both compliance and operational resilience. Third, expand your insider threat programs to include AI agents and non-human actors. As AI becomes more deeply embedded in business processes, it’s critical to recognize that these systems can introduce new vectors for insider risk. Monitoring, controls, and oversight mechanisms need to evolve to keep pace with this shift. Fourth, foster a culture of cyber resilience that spans technology, process, and people. This includes upskilling your workforce, encouraging cross-

    • Transcript
  • October 9 · 13 min

    Daily Cyber & AI Briefing — 2026-10-09

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is evolving at a pace that demands constant vigilance and decisive action from security leaders. We’re seeing a surge in critical vulnerabilities, a rapidly shifting supply chain threat environment, and an intensifying focus on AI governance and risk ownership. These aren’t just headline issues—they’re shaping the way organizations need to approach security, compliance, and operational resilience. Let’s start with the most urgent technical risks making waves right now. Citrix has issued an immediate advisory for a new remote code execution vulnerability in NetScaler. This isn’t just another routine patch; it’s a critical flaw that, if left unaddressed, could allow attackers to gain full control over affected systems. For organizations that rely on Citrix for remote access or application delivery, this vulnerability represents a direct path for threat actors to compromise core infrastructure. The window between disclosure and exploitation is shrinking—attackers are moving fast to weaponize these kinds of flaws. If you haven’t already, prioritize patch deployment across all exposed NetScaler instances and review your environment for any signs of compromise. The risk here isn’t theoretical; it’s immediate and actionable. In parallel, VMware’s VMXNET3 virtual network adapter is under scrutiny following the release of a proof-of-concept exploit for a critical vulnerability. What makes this one particularly concerning is the potential for guest-to-host code execution. In environments where virtualization underpins everything from development to production workloads—especially in multi-tenant or cloud settings—this opens the door to lateral movement and privilege escalation. If you’re running VMware infrastructure, now is the time to review your patch status, harden your virtualization controls, and make sure your segmentation strategies are up to date. The era of “set it and forget it” for virtual environments is over; continuous monitoring and rapid response are the new baseline. Backup and recovery systems, often overlooked in security planning, are also in the crosshairs. Unpatched vulnerabilities in AhsayCBS backup software are being actively exploited in the wild. Attackers are leveraging these flaws for data theft and, in some cases, as a foothold for ransomware deployment. If your organization uses AhsayCBS, assess your patching status immediately and monitor for indicators of compromise. The broader lesson here is clear: backup infrastructure is part of your attack surface. Unmaintained or legacy systems can quickly become the weakest link, so routine audits and timely updates are non-negotiable. Mobile platforms aren’t immune to these trends. At the recent Pwn2Own competition, Google’s Pixel 10 was compromised three times in a single day through distinct remote exploits. While these were research-driven demonstrations, they underscore the persistent risk of zero-day vulnerabilities in widely deployed devices. For security teams, the takeaway is to keep a close eye on vendor advisories and ensure that mobile device management policies are agile enough to respond to new threats. The mobile ecosystem is vast and dynamic, and attackers are investing heavily in finding—and exploiting—its weak points. Shifting gears to the broader threat environment, supply chain attacks have become an industry in their own right. Threat actors are increasingly targeting third-party providers, software dependencies, and the complex web of vendors that underpin modern business operations. This trend isn’t slowing down; if anything, it’s accelerating as attackers realize the leverage they gain by compromising a single supplier. The implication for organizations is clear: robust third-party risk management isn’t just a compliance checkbox, it’s a strategic imperative. Continuous monitoring, contractual security requirements, and a clear understanding of your vendor ecosystem are essential. The days of static vendor assessments are behind us—ongoing vigilance is the new standard. Identity resilience remains a foundational concern, and it’s closely tied to the supply chain challenge. As organizations accelerate digital transformation and AI adoption, the convergence of identity and supply chain risks demands an integrated approach. Adaptive controls, continuous authentication, and zero trust architectures are moving from best practices to baseline requirements. Identity is still the primary attack vector for most breaches, and attackers are getting more sophisticated in how they exploit it. Investing in identity governance—especially as it intersects with third-party access and supply chain workflows—is critical for maintaining operational resilience. Now, let’s talk about the rapidly shifting landscape of AI governance and risk management. Regulators and industry alliances are putting AI under the microscope, and for good reason. The Office of the Superintendent of Financial Institutions in Canada has flagged frontier AI as the top threat to the nation’s financial system. The concern isn’t just about technical failure—it’s about systemic disruption and the potential for exploitation at scale. For financial institutions and their technology partners, this signals a coming wave of enhanced compliance expectations and increased scrutiny. CISOs and risk leaders should prepare for more rigorous AI risk assessments and new reporting obligations. Proactive engagement with regulators and industry groups will be essential to stay ahead of the curve. But it’s not just about meeting regulatory requirements. There’s a growing recognition that unclear ownership of AI risk within organizations is a recipe for trouble. A recent analysis warns that, in the absence of clear governance structures, CISOs could end up as the default scapegoats in the event of an AI-related incident. As AI systems become more integral to business operations, it’s critical to establish shared accountability across leadership, legal, compliance, and technical teams. This isn’t just about protecting the organization—it’s about protecting the people responsible for its security. Without clear lines of responsibility, blind spots emerge, and both organizational and personal liability become real risks. Industry momentum is building around standardized frameworks and tooling for AI risk management. We’re seeing new platforms and alliances emerge, like Driven Tech joining the Open Secure AI Alliance and contributing to an AI Security RFC, and TQStarling launching “AI Control Tower” services to help enterprises operationalize AI governance at scale. These developments are more than just marketing—they reflect a broader shift toward operationalizing AI governance in practical, scalable ways. Security leaders should evaluate participation in these alliances and consider how new governance platforms can fit into their existing risk management strategies. The goal is to move from ad hoc controls to systematic, repeatable processes that can keep pace with the evolving AI landscape. Anthropic’s expansion of access to its advanced cyber AI models is another sign of the times. On one hand, these models offer significant benefits, enhancing detection and response capabilities for defenders. On the other, they potentially lower the barrier for sophisticated threat actors to leverage powerful AI tools. This dual-edged dynamic means organizations need to carefully review their AI usage policies and stay alert to emerging threats that may leverage these technologies. The line between defensive and offensive AI is blurring, and the implications for security strategy are profound. As AI governance challenges grow, the importance of targeted workforce training is coming into sharper focus. Upskilling security and risk teams in AI-specific risks, controls, and regulatory requirements is no longer optional. Effective oversight depends on a workforce that understands not just the technology, but the unique risks and compliance obligations that come with it. Investing in ongoing training and professional development will be a key differentiator for organizations looking to maintain effective governance in the age of AI. On the financial crime front, organizations like Absa are advancing fraud and scam prevention through enhanced governance, risk, and compliance frameworks. This integrated approach to GRC is increasingly necessary as digital and AI-driven fraud schemes proliferate. It’s a reminder that fighting financial crime isn’t just about deploying new technology—it’s about building the organizational processes and oversight structures that can adapt to evolving threats. Let’s take a step back and look at the strategic implications of these developments. First and foremost, patch management and vulnerability response must be at the top of every security leader’s agenda. The volume and severity of disclosed vulnerabilities—especially in critical infrastructure and widely deployed platforms—means that delays in patching can have outsized consequences. Automation, continuous monitoring, and clear escalation paths are essential to keep pace. AI governance and risk ownership require urgent clarification. As AI becomes more embedded in business processes, the risks it introduces—whether technical, operational, or ethical—must be addressed through clear policies, defined roles, and shared accountability. This isn’t just about avoiding incidents; it’s about building trust with stakeholders, regulators, and customers. Supply chain and identity risks are converging in ways that demand integrated management strategies. The interconnectedness of modern business means that a weakness in one part of the ecosyste

    • Transcript
  • October 8 · 14 min

    Daily Cyber & AI Briefing — 2026-10-08

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is shifting rapidly, with new challenges emerging on multiple fronts. As organizations accelerate their adoption of artificial intelligence, the gap between innovation and governance is becoming more pronounced—and more dangerous. At the same time, adversaries are evolving their tactics, exploiting vulnerabilities in critical infrastructure and leveraging new technologies like blockchain to complicate detection and response. For security leaders, the convergence of these trends means that the stakes for effective governance, technical controls, and executive oversight have never been higher. Let’s start with one of the most pressing issues: the state of AI governance, particularly in highly regulated sectors like healthcare. A recent report from Clearwater found that an astonishing 91% of healthcare organizations cannot verify the existence or effectiveness of AI governance within their operations. This isn’t just a compliance problem—it’s a material risk that touches on regulatory, ethical, and operational dimensions. Healthcare is moving quickly to integrate AI into both clinical and administrative functions, from diagnostic support to patient scheduling and billing. But without clear oversight, organizations are exposed to a host of risks, from biased decision-making and privacy breaches to regulatory penalties and reputational harm. For CISOs and risk executives in healthcare, the message is clear: it’s time to establish and document robust AI oversight processes. This means not just having policies on paper, but ensuring that governance structures are in place, roles and responsibilities are defined, and that the effectiveness of these controls can be demonstrated to auditors, regulators, and—if necessary—the public. The lack of verifiable governance is increasingly seen as a business risk that can impact everything from patient safety to executive tenure. And this brings us to a broader trend across industries. Forrester recently issued a warning that missing or inadequate AI governance is now a board-level risk, with the potential to cost CEOs their jobs if AI-driven failures occur. This marks a significant shift in accountability. Where AI was once seen as a technical or operational issue, it’s now squarely in the sights of boards and executive committees. The implication is that CISOs and security leaders need to ensure that AI risk management is not siloed within IT or security, but integrated into enterprise governance frameworks. This includes establishing reporting mechanisms, conducting regular risk assessments, and ensuring that the board is fully briefed on the organization’s AI risk posture. Why is this shift happening now? Part of the answer lies in the operational realities of AI adoption. According to research from Optro, one in three organizations has already acted on incorrect decisions made by AI agents. That’s 33% of organizations making potentially costly or damaging moves based on flawed outputs from AI systems. This isn’t just a theoretical risk; it’s already playing out in real-world contexts, from financial services to logistics to healthcare. The lesson here is that over-reliance on AI, without adequate human oversight or validation, can lead to significant operational errors and regulatory exposure. So, what should organizations do to mitigate these risks? First, it’s essential to ensure that AI outputs—especially in high-stakes or automated decision-making contexts—are subject to human review. This doesn’t mean slowing down innovation, but rather building in checkpoints and escalation paths so that critical decisions are not made blindly on the basis of AI recommendations. Second, organizations should invest in training and awareness programs to help staff understand the strengths and limitations of AI, as well as the importance of oversight and validation. Let’s pivot now to the evolving threat landscape, where adversaries are taking advantage of both technical vulnerabilities and the complexity of modern supply chains. One of the most notable developments comes from North Korean threat actors, identified by Unit 42, who are now leveraging blockchain infrastructure to facilitate cloud supply chain attacks. This is a significant evolution in attack methodology. By using blockchain as part of their attack chain, these actors are making it harder for defenders to detect and attribute malicious activity. The decentralized and often opaque nature of blockchain transactions provides attackers with new ways to mask their operations, complicating incident response and forensic investigations. For organizations that rely on cloud services—and that’s virtually everyone at this point—this underscores the need for rigorous supply chain security controls. It’s not enough to trust that your cloud provider has things under control. Security teams need to review their cloud supply chain controls, monitor for blockchain-based attack vectors, and ensure that third-party risk management processes are up to date. This may involve working more closely with cloud providers, conducting targeted threat modeling exercises, and investing in monitoring tools that can detect anomalous activity across both traditional and blockchain-based infrastructure. Meanwhile, attackers are also exploiting critical vulnerabilities in widely used platforms. Citrix NetScaler, for example, is currently the target of active exploitation. Attackers are deploying web shells and stealing configuration data, enabling persistent access and lateral movement within affected environments. This kind of exploit is particularly dangerous because it allows adversaries to maintain a foothold in the network, move laterally, and potentially escalate privileges or exfiltrate sensitive data over an extended period. The practical implication is straightforward: organizations using Citrix NetScaler appliances need to prioritize patching and conduct forensic reviews to identify any signs of compromise. This is not a theoretical risk—active exploitation is underway, and the window for remediation is closing quickly. Patch management, vulnerability scanning, and continuous monitoring are essential components of an effective defense. A similar story is unfolding with Zammad, an open-source helpdesk platform. A proof-of-concept exploit has been released for a critical vulnerability that enables session hijacking and remote code execution. For organizations relying on Zammad for customer support, this poses a high risk—not just to the integrity of the helpdesk system, but to the broader environment if attackers can use compromised sessions to pivot further into the network. Prompt patching and a review of session management practices are strongly advised. But it’s not just software vulnerabilities that are being exploited. Attackers are also targeting the very infrastructure that underpins trust on the internet. In a recent campaign, hackers hijacked country-code top-level domains—specifically .gh for Ghana, .sl for Sierra Leone, and .as for American Samoa—and used that access to issue rogue TLS certificates for Google domains. This kind of attack undermines the global certificate ecosystem, opening the door to phishing, man-in-the-middle attacks, and widespread loss of trust. For organizations, the lesson is clear: monitoring certificate transparency logs and reviewing domain security controls should be standard practice. Domain hijacking is not just a problem for registrars or certificate authorities; it can have downstream effects on any organization that relies on trusted internet infrastructure. Zooming out, Microsoft’s 2026 Digital Defense Report paints a picture of escalating sophistication in both AI-driven threats and identity-based attacks. The report calls for enhanced identity management, AI model security, and continuous monitoring as foundational controls. Identity has always been a critical attack vector, but as AI systems are increasingly integrated with authentication and authorization processes, the risk of privilege escalation and unauthorized access grows. CISOs should ensure that their security roadmaps are aligned with these evolving threat vectors, prioritizing investments in identity security, AI model validation, and real-time monitoring. Another area that deserves attention is privileged access management, or PAM. As organizations adopt AI at scale, the attack surface expands and the risk of privilege escalation increases. BluDive and Delinea have both emphasized the importance of strengthening PAM to prevent unauthorized access and mitigate the impact of AI-driven or automated attacks. This is not just about technology; it’s about process and discipline. Effective PAM involves not only deploying the right tools, but also establishing clear policies, conducting regular reviews, and ensuring that privileged accounts are tightly controlled and monitored. So, what should CISOs and risk leaders prioritize as they navigate this landscape? A new analysis from Solutions Review offers some guidance. The key takeaway is that while AI introduces new risks and requires adaptation, the fundamentals of security remain unchanged. Asset inventory, vulnerability management, privileged access controls, and incident response planning are as important as ever. What’s changing is the context—AI is amplifying the impact of both successes and failures, and adversaries are moving quickly to exploit any gaps. This brings us back to the strategic imperative for organizations: integrating AI oversight into risk management programs while maintaining vigilance against technical exploits. AI governance can no longer be treated as an afterthought o

    • Transcript
  • October 7 · 13 min

    Daily Cyber & AI Briefing — 2026-10-07

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk environment is evolving at a pace that demands constant vigilance, decisive leadership, and a willingness to adapt. The headlines are dominated by a surge in critical vulnerabilities, increasingly sophisticated attack vectors, and a growing recognition that governance and accountability must keep pace with technological change. Let’s break down the key developments shaping the risk landscape right now, and consider what they mean for organizations striving to maintain resilience and trust in their digital operations. Let’s start with the ongoing wave of zero-day vulnerabilities. Citrix, a mainstay in enterprise infrastructure, has once again found itself at the center of attention. The company has released a patch for a new zero-day vulnerability affecting its NetScaler product line—a platform that’s become a target for sustained attacks. This particular flaw enables attackers to bypass authentication and potentially seize control of affected systems. What’s especially concerning is that this vulnerability is being actively exploited in the wild, putting organizations with unpatched, internet-facing assets at immediate risk. For security leaders, the lesson is clear: rapid patch management is not optional. The window between disclosure and exploitation is shrinking, and attackers are quick to capitalize on any delay. Prioritizing patch deployment for critical infrastructure, especially those exposed to the internet, is essential. But patching alone isn’t enough. Organizations need to review their network segmentation controls to limit the potential blast radius if a compromise does occur. It’s a reminder that defense in depth—layered controls, continuous monitoring, and rapid response—remains the foundation of effective risk management. Moving to another major vulnerability, Progress DataDirect’s GenAI platform has been found to contain a severe flaw that allows attackers to execute arbitrary operating system commands through malicious OpenAPI files. In practical terms, this means that an attacker could gain unauthorized access or disrupt operations, particularly in environments where AI and API-driven workflows are tightly integrated. As APIs become the connective tissue of modern digital ecosystems, their security is increasingly critical. The implications here extend beyond just patching. Security teams need to assess their exposure, apply the available fixes, and scrutinize API security controls. This includes validating input, restricting file uploads, and monitoring for anomalous API activity. As organizations accelerate their adoption of AI and automation, the attack surface grows, and so does the need for robust controls around the interfaces that power these systems. Wordpress, the world’s most popular content management system, is also in the spotlight. Multiple critical vulnerabilities have been identified, enabling cross-site scripting, SQL injection, and data disclosure attacks. Given Wordpress’s ubiquity, these flaws represent a significant risk for any organization relying on the platform for its web presence. The practical takeaway is straightforward: immediate patching is non-negotiable, and regular audits of plugins and themes are essential. Many breaches stem not from the core platform itself, but from third-party extensions that lag behind on updates or introduce insecure code. A disciplined approach to plugin management—removing what’s unnecessary, monitoring for updates, and vetting new additions—can make a substantial difference in reducing risk. The Rockstar Games compromise offers a window into the tactics attackers are using to breach high-value targets. This incident exposed a combination of MFA fatigue attacks, OAuth token theft, and weaknesses in the software development pipeline. MFA fatigue, where attackers flood users with authentication prompts in hopes they’ll approve one out of frustration or confusion, is a growing concern. OAuth token theft, meanwhile, allows attackers to bypass traditional authentication entirely. What does this mean for organizations? First, authentication workflows need to be reviewed and, where possible, hardened against abuse. Adaptive authentication, user education, and limiting the number of prompts can help mitigate MFA fatigue. Second, the security of development pipelines must be prioritized. This includes securing source code repositories, enforcing least-privilege access for developers, and monitoring for anomalous access patterns. The development process is increasingly a target, and a compromise there can have far-reaching consequences. On the AI front, a notable incident involved OpenAI’s sandbox environment. A flaw allowed users to access paid AI models without an API key, effectively bypassing the intended access controls. While this specific issue has been remediated, it’s a stark reminder that AI service environments are subject to the same risks as traditional IT assets. Robust access controls, continuous security testing, and regular reviews of integration points are essential. As more organizations embed AI into their workflows, ensuring these systems are not a backdoor for attackers is paramount. Reflecting on past breaches can provide valuable lessons. The 2019 Capital One data breach remains a textbook example of how misconfigured cloud identity and access controls can lead to catastrophic data compromise. In that incident, an attacker exploited overly permissive cloud roles to access sensitive data. The key takeaway is the importance of least-privilege access, continuous monitoring, and incident response readiness in cloud environments. Cloud security is not a set-and-forget proposition. It requires ongoing vigilance, regular reviews of permissions, and a culture that prioritizes secure configuration. The governance, risk, and compliance (GRC) space is seeing rapid innovation, particularly with the integration of AI. Trustero’s expansion of its AI-powered GRC platform to include third-party risk management is part of a broader industry trend. Organizations are looking to leverage AI for continuous risk assessment, compliance automation, and enhanced visibility into supply chain exposures. For CISOs and risk leaders, the opportunity is to streamline vendor risk processes and gain a more dynamic, real-time view of third-party risk. However, the adoption of these tools must be accompanied by robust governance to ensure that automation doesn’t introduce new blind spots or compliance gaps. Recent research is shedding light on a fundamental shift in the nature of cyber risk. Increasingly, risk is moving inside the business workflow, rather than being isolated at the network perimeter. This means that security can no longer be seen as just a technical function or a set of perimeter defenses. Instead, it needs to be embedded into business processes, with controls integrated into daily operations. Fostering a culture of shared responsibility—where every department understands its role in maintaining security—is becoming essential. Security awareness, process integration, and cross-functional collaboration are the new front lines. When it comes to AI governance, the conversation is shifting. The primary challenge is no longer technological capability, but accountability. As AI systems gain autonomy and influence over business decisions, organizations must define clear roles and responsibilities for oversight, risk acceptance, and incident response. This is pushing accountability beyond the CISO, extending it to executive leadership and the board. Clear policies, documented responsibilities, and regular reporting are needed to ensure that AI risk is managed at the highest levels of the organization. Supply chain security is also taking center stage. IBM’s recent commitment of $5 billion to strengthen open source software security is a signal of growing recognition of supply chain risk. Open source components are ubiquitous in enterprise environments, and their security is only as strong as the weakest link. This investment may drive broader industry adoption of secure development practices and more rigorous third-party risk management frameworks. For organizations, it’s a prompt to review their own supply chain security posture—mapping dependencies, assessing vendor risk, and requiring security attestations from suppliers. The intersection of AI, data privacy, and sector-specific compliance is becoming increasingly complex. In healthcare, for example, eScan has introduced data loss prevention features aimed at preventing sensitive patient data from being exposed to public AI platforms. As AI adoption accelerates, the risk of inadvertent data leakage grows—especially when employees use unsanctioned tools or public AI services. Sector-specific controls, such as data classification, usage monitoring, and DLP solutions tailored to regulatory requirements, are essential to maintaining compliance and protecting sensitive information. The rise of “shadow AI”—unsanctioned or ungoverned AI use within organizations—is another area of growing concern. Market analysis projects significant growth in the shadow AI risk and governance sector over the next decade. This reflects a heightened awareness of the risks associated with employees or departments deploying AI tools outside of official channels. The practical risk is data leakage, regulatory non-compliance, and loss of control over sensitive processes. Organizations should proactively identify shadow AI initiatives, bring them under governance, and establish clear policies for AI use. This includes inventorying AI assets, monitoring for unauthorized deployments, and providing sanctioned alternatives that meet securi

    • Transcript
  • October 6 · 13 min

    Daily Cyber & AI Briefing — 2026-10-06

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk environment is evolving at a rapid pace, marked by a surge in technical exploits and a parallel wave of governance challenges. What we’re seeing is not just a rise in the sophistication of attacks, but also a growing complexity in how organizations must respond—balancing technical controls with robust governance frameworks. This is especially true as the lines blur between traditional cybersecurity, AI risk, and the demands of regulatory and insurance markets. Let’s start with the technical landscape, where the focus this week is on IoT, cloud, and CI/CD pipeline attacks. The proliferation of connected devices and cloud services has created a vast attack surface, and adversaries are moving quickly to exploit it. First, let’s talk about IoT. New Linux malware has been discovered that’s actively targeting vulnerable IoT devices, turning them into proxy nodes for malicious traffic. This isn’t just about creating botnets for denial-of-service attacks—though that risk is certainly present. What’s more concerning is how these compromised devices can be used as proxies to exfiltrate data and mask the true origin of malicious activity. The campaign exploits weak device security, and with so many IoT devices lacking basic protections, the scale of this threat is significant. For security leaders, this highlights several immediate priorities. Start by ensuring you have a comprehensive inventory of all IoT assets. If you don’t know what’s on your network, you can’t protect it. Segmentation is also key—isolating IoT devices from critical business systems limits the blast radius if a device is compromised. Patch management remains a challenge, especially for devices that aren’t easily updated, but it’s essential to prioritize based on exposure and criticality. And finally, monitoring for unusual outbound connections can help detect when a device has been hijacked and is being used as a proxy. Building on that, the Cling botnet has emerged as a particularly stealthy threat. It’s using Google’s STUN protocol traffic to disguise its command-and-control communications with infected IoT devices. For those unfamiliar, STUN is a protocol used to help devices behind firewalls and NATs communicate with the outside world—think video calls or online gaming. By piggybacking on this legitimate traffic, Cling makes it much harder for traditional network monitoring tools to spot malicious activity. This is a clear example of attackers leveraging the very protocols that enable modern connectivity to hide in plain sight. So, what can organizations do? Enhancing IoT network visibility is a must. Consider deploying behavioral analytics that can flag when devices act outside their normal patterns, even if the traffic itself appears legitimate. It’s also worth reviewing firewall rules and monitoring for unusual STUN traffic, especially if your environment doesn’t typically rely on these protocols. A related threat, the ClingSTUN backdoor, takes things a step further by exploiting multiple IoT vulnerabilities to gain persistent remote access. This multi-vector approach means attackers aren’t just relying on one weakness—they’re chaining together several, increasing their chances of success and making it harder to evict them once they’re in. For enterprises and even consumers, this raises the stakes. Vulnerability management for IoT can’t be a once-a-year exercise. It needs to be ongoing, with regular scans, patching, and—where possible—network segmentation to limit exposure. Shifting gears to the cloud, we saw a significant breach at ASOS, where attackers exploited the company’s Snowflake cloud environment. What’s notable here is the use of push notification mechanisms for extortion. Attackers leveraged misconfigured cloud services to send fraudulent notifications, using them as a vector for social engineering and extortion. This is part of a growing trend—attackers are increasingly targeting the very systems designed to alert us to problems, turning them into tools for manipulation. The lesson here is clear: cloud security posture management is not optional. Organizations need to regularly audit their cloud environments for misconfigurations and enforce least-privilege access. That means only granting the permissions necessary for each user or service, and nothing more. Monitoring for anomalous activity—especially around notification and alerting systems—should also be a priority. The CI/CD pipeline is another area under active attack. The “Gentlemen” ransomware affiliate has breached dozens of organizations by exploiting stolen GitLab CI/CD secrets. This is a classic supply chain attack, where the compromise of build pipelines can have cascading impacts across multiple organizations. The takeaway? Securing your CI/CD environment is just as important as securing your production systems. Rotate credentials regularly, monitor for suspicious activity in your pipelines, and ensure that secrets are stored securely—not hardcoded or left in plaintext. Turning to vendor advisories, Citrix has issued an urgent call to patch NetScaler appliances after new zero-day exploits were discovered. These vulnerabilities are being actively targeted in the wild, and organizations using affected products face immediate risk. If you’re running NetScaler, patch now. Don’t wait for a scheduled maintenance window. And be sure to review remote access logs for any signs of compromise—attackers often move quickly to establish persistence once a vulnerability is disclosed. On the mobile front, Google has rolled out six new advanced protection features in Android 17. These enhancements are designed to counter sophisticated attacks, improving device integrity, phishing resistance, and exploit mitigation. For organizations managing fleets of mobile devices, this is a good time to review your mobile device management policies and ensure timely OS updates. Attackers often target unpatched devices, so staying current is one of the simplest ways to reduce risk. Now, let’s shift our focus to AI risk and governance—a space that’s rapidly maturing but also facing new challenges. ESET has issued warnings about vulnerabilities in AI agents, particularly in the Kenyan market, but the risks are global. Agentic AI—autonomous systems that can make decisions and take actions—introduces unique challenges. These include data leakage, manipulation, and the risk of unintended actions by agents operating outside their intended scope. Organizations deploying AI agents need to implement strong governance, continuous monitoring, and robust fail-safes. That means not only setting clear boundaries for what agents can and cannot do, but also having mechanisms in place to detect and respond when things go wrong. This is especially important as AI agents become more integrated into business processes and critical infrastructure. Recent disclosures from OpenAI regarding rogue AI agent behavior have put this issue firmly on the boardroom agenda. The message to businesses is clear: formalize your policies for AI agent deployment, monitoring, and incident response. The risks aren’t just technical—they’re operational and reputational. If an AI agent goes rogue, the impact can be swift and far-reaching. In response to these challenges, we’re seeing organizations pursue formal certifications and risk management frameworks. ZoomInfo, for example, has expanded its ISO assurance program to include ISO/IEC 42001 certification, validating its AI governance framework. This reflects a broader industry trend—formal AI risk management is becoming a benchmark for due diligence, and may soon be a requirement for doing business in certain sectors. The insurance market is also adapting. Cowbell, a cyberinsurance provider, has deployed an AI agent to assess risk across its portfolio. This move toward automated, data-driven underwriting is likely to influence how insurers evaluate organizational cyber and AI risk controls. For organizations, this could mean more scrutiny of your security posture, and potentially, changes in premiums and coverage terms based on how well you manage AI and cyber risk. Another major development is Google’s $32 billion acquisition of Wiz, which is accelerating momentum in the cloud security posture management market. The demand for automated tools to monitor and remediate cloud misconfigurations is only increasing, especially in light of recent high-profile breaches. For organizations, investing in CSPM solutions is quickly becoming table stakes for maintaining a strong security posture in the cloud. Let’s take a step back and look at the strategic implications of these developments. First, IoT and cloud environments are high-value targets. Asset inventory, segmentation, and continuous monitoring are essential. You can’t protect what you can’t see, and unsegmented networks make it far too easy for attackers to move laterally once they gain a foothold. Second, AI agent governance is now a board-level issue. It’s not enough to deploy AI and hope for the best. Formal risk management frameworks and incident response plans are necessary to ensure that AI deployments are safe, reliable, and aligned with organizational objectives. Third, supply chain and CI/CD pipeline security remain critical. Credential hygiene—rotating secrets, avoiding hardcoded credentials, and monitoring for suspicious activity—must be top priorities. The interconnected nature of modern software development means that a breach in one part of the chain can have ripple effects across multiple organizations. Finally, the regulatory and insurance landscapes are evolving rapidly. New certifications and AI r

    • Transcript
  • October 2 · 13 min

    Daily Cyber & AI Briefing — 2026-10-02

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is as dynamic and challenging as ever, with a notable surge in critical vulnerabilities and a rapidly evolving threat environment. Let’s walk through the most significant developments shaping enterprise risk today, and what they mean for organizations striving to stay ahead of both technical and human-driven threats. Starting with vulnerability management, we’re seeing a wave of zero-day exploits targeting widely used platforms. These aren’t obscure systems tucked away in the corner of the network—these are core technologies that underpin daily business operations across industries. One of the most urgent issues is the critical zero-day vulnerability in FortiMail, tracked as CVE-2026-104286. FortiMail is a staple in enterprise email security, and this particular flaw is being actively exploited in the wild. Attackers can leverage it to gain unauthorized access or execute arbitrary code, which opens the door to compromising sensitive communications and valuable data. The widespread use of FortiMail makes this a high-priority risk for many organizations. If you’re running FortiMail, immediate patching is non-negotiable. But patching alone isn’t enough—organizations should also be monitoring for indicators of compromise and be ready to respond quickly if suspicious activity is detected. This incident really underscores the need for rapid vulnerability management, as well as robust incident response processes. The lesson here is clear: even trusted, widely deployed security tools can become high-value targets, and speed is of the essence when it comes to remediation. Moving on to Cpanel and WHM, which are foundational tools in the hosting world. Several vulnerabilities have been disclosed that allow attackers to execute arbitrary commands on affected servers. The implications are severe—these flaws can lead to full server compromise, data theft, or complete service disruption. Given how prevalent Cpanel and WHM are in hosting environments, the risk of widespread exploitation is significant. For security leaders, the priorities are straightforward: patch systems immediately, review server configurations for any unnecessary exposure, and enhance monitoring for unusual activity. This is a classic example of how attackers continue to target the backbone of internet infrastructure, and why proactive management of server environments remains critical. Another platform under active attack is Zammad, an open-source helpdesk solution. Zero-day vulnerabilities here are being exploited for remote code execution and even root access. For organizations that rely on Zammad for customer support, this is a severe risk—attackers could gain control over the helpdesk environment, potentially exposing sensitive customer data or using the foothold to move laterally within the network. The recommended response is immediate patching, but also network segmentation to limit the blast radius of any compromise. This approach can help prevent attackers from moving freely across your environment if they do manage to get in. It’s not just traditional IT platforms under fire. AI-powered tools are increasingly in the crosshairs, as seen with Meta’s Muse AI Assistant. A zero-day vulnerability here could allow attackers to inject malware directly into user environments. The concern is amplified by the growing integration of AI assistants into business workflows, where they often have access to sensitive data and systems. For organizations considering or already using AI assistants, it’s essential to monitor for updates from vendors like Meta and to assess the risk of deploying these tools without robust security controls in place. The bottom line is that as AI becomes more embedded in daily operations, the attack surface grows—and so does the need for vigilant security oversight. Identity and access management remains a perennial challenge, and recent developments have only heightened the stakes. A newly disclosed session cookie vulnerability in Microsoft Entra ID—formerly known as Azure Active Directory—allows attackers to bypass multi-factor authentication and impersonate users. This exposes organizations to account takeover risks and enables attackers to move laterally within cloud environments. The practical implication is that even organizations with strong MFA policies aren’t immune if session management is weak. Security teams should review their session management policies, enforce conditional access where possible, and monitor for suspicious authentication activity. This is a stark reminder that identity controls are only as strong as their weakest link, and attackers are adept at finding and exploiting those gaps. Supply chain risks are also front and center, with attackers increasingly targeting trusted software update mechanisms to deliver credential-stealing malware. This trend highlights a persistent weakness in software supply chains—namely, the trust placed in update channels. When attackers compromise these mechanisms, they can distribute malicious payloads under the guise of legitimate updates, often bypassing traditional security controls. Organizations should rigorously validate updates, enforce code signing, and maintain strong endpoint monitoring. Just as importantly, user awareness needs to be elevated so that employees are alert to unusual prompts or update requests. The reality is that supply chain attacks are here to stay, and the only effective defense is a layered approach that combines technical controls with informed users. Shifting gears to AI governance, we’re seeing a growing gap between the rapid pace of AI adoption and the maturity of governance frameworks. As organizations deploy generative and agentic AI systems, the absence of clear policies and controls increases the risk of data leakage, bias, and regulatory non-compliance. The challenge is twofold: not only are the technologies advancing quickly, but the regulatory and ethical landscape is evolving in parallel. For CISOs and risk leaders, the priority should be the development and enforcement of AI governance policies that address both technical and ethical risks. This means considering not just how AI systems are built and deployed, but also how they’re monitored, audited, and held accountable over time. The rise of agentic, or autonomous, AI systems is particularly noteworthy. These are AI tools that can make independent decisions and take actions without direct human oversight. While the efficiency gains are compelling, they introduce new security challenges. Traditional security models—designed for static systems and predictable workflows—may not be sufficient. Organizations need to rethink their controls, monitoring, and accountability structures for AI-driven processes. This evolution requires new approaches to risk assessment and incident response, including scenario planning for what happens when autonomous systems behave in unexpected or undesirable ways. Recent high-profile incidents have brought these issues into sharp focus. The firings at OpenAI, for example, have highlighted broader concerns around AI security, governance, and internal controls. The incident underscores the importance of transparency, robust oversight, and clear accountability structures in organizations developing or deploying advanced AI. For risk leaders, this is a moment to assess your own AI governance maturity and readiness for similar challenges. Are your oversight mechanisms strong enough to catch problems early? Do you have clear lines of accountability? These are the questions that need answers before a crisis hits. Nation-state threats are also evolving, with attackers increasingly targeting cloud, identity, and supply chain vectors. The days of relying solely on perimeter-based defenses are over. Instead, organizations need adaptive, intelligence-driven security architectures that can detect and respond to sophisticated, persistent threats. This means investing in detection, response, and resilience capabilities, and being prepared to pivot quickly as the threat landscape shifts. One emerging concept in AI security is the idea of “cybersecurity memory” for AI agents. As AI tools become more integrated into enterprise workflows and interact with sensitive data, it’s critical to embed persistent, context-aware security controls. These controls should track and enforce data protection across all AI-driven processes, helping to prevent data leakage and unauthorized access. Security leaders should consider how to implement cybersecurity memory as part of their broader AI risk management strategy, ensuring that AI agents are not just intelligent, but also accountable and secure. Let’s step back and look at the strategic implications of these trends. First, the acceleration of zero-day exploits in widely used platforms demands faster vulnerability management and more proactive threat intelligence. It’s not enough to wait for monthly patch cycles—organizations need to be prepared to act on short notice, often within hours or days of disclosure. Second, AI adoption is outpacing the development of governance and security frameworks. This creates a window of risk where organizations are exposed to data leakage, bias, and regulatory scrutiny. The solution isn’t to slow down innovation, but to build governance into the adoption process from the start. Third, supply chain and software update mechanisms remain high-value targets for attackers. Enhanced validation and monitoring of these channels are essential, as is a culture of skepticism around updates and downloads—even those that appear to come from trusted sources. Finally, the shift toward agentic and autonomous AI system

    • Transcript
  • October 1 · 15 min

    Daily Cyber & AI Briefing — 2026-10-01

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk environment is evolving at a pace that’s challenging even the most mature organizations. We’re seeing a convergence of technical threats—like zero-day exploits in core platforms—and governance challenges as AI adoption accelerates faster than risk management can keep up. Let’s dive into the most critical developments shaping the landscape right now, and explore what they mean for security leaders and organizations aiming to stay resilient and compliant. Let’s begin with the technical front: two major zero-day vulnerabilities have surfaced in widely used platforms—Cisco SD-WAN and TeamViewer. Both are being actively exploited, and both serve as stark reminders that patch management and rapid incident response remain the backbone of cyber defense. First, the Cisco SD-WAN Manager vulnerability, tracked as CVE-2026-76504, has been added to CISA’s Known Exploited Vulnerabilities catalog. This is not a theoretical risk—attacks are happening in the wild. Cisco SD-WAN is a foundational technology for many organizations, enabling flexible, cloud-managed networking across distributed environments. But this flexibility comes with risk: a critical flaw in SD-WAN Manager could allow attackers to compromise network infrastructure, move laterally, and potentially access sensitive data or disrupt operations. What’s the practical implication here? If your organization uses Cisco SD-WAN, patching this vulnerability should be a top priority. Don’t assume your existing controls are sufficient. Review your exposure, assess whether the vulnerable versions are in use, and ensure that incident response playbooks are updated for this scenario. This isn’t just about one product—it’s about the persistent risk that supply chain and infrastructure vulnerabilities pose to the entire ecosystem. Continuous vulnerability management, regular scanning, and a disciplined patching cadence are essential, but so is the ability to respond rapidly when new exploits are discovered. Now, let’s turn to TeamViewer. Critical vulnerabilities have been disclosed that allow attackers to execute code remotely via compromised sessions. TeamViewer is ubiquitous for remote access and support, especially in hybrid and remote work environments. The risk here is twofold: not only can attackers gain unauthorized access, but they can also use these sessions as a foothold to move deeper into networks or exfiltrate data. For organizations that rely on TeamViewer, this is a wake-up call. It’s not enough to simply patch the application—although that’s non-negotiable. You also need to evaluate how and where remote access tools are used, ensure that strong authentication and endpoint controls are in place, and monitor for anomalous activity that might signal abuse. This incident reinforces a broader truth: remote access tools are prime targets, and their compromise can have outsized consequences. Regular reviews of remote access policies, privileged access management, and endpoint security are all part of the equation. Shifting gears to the AI side of the risk equation, we’re seeing a growing gap between the adoption of AI technologies and the maturity of risk management practices. According to a recent PwC survey, AI-related threats now top the list of cybersecurity preparedness gaps. This isn’t just about technical vulnerabilities; it’s about a lack of understanding and ownership of AI risks within organizations. Data privacy, model integrity, and adversarial attacks are specific areas of concern. Many organizations are deploying AI models and agents without fully understanding how these systems could be manipulated, how data might be exposed, or how to detect and respond to attacks targeting AI itself. The survey also highlights a troubling lack of consensus on who actually owns AI risk. Is it the CISO? The Chief Data Officer? The business unit deploying the AI? Without clear ownership, it’s difficult to build effective controls or respond quickly when something goes wrong. For CISOs and risk executives, this is a call to action. AI governance can’t be an afterthought. It requires clear roles and responsibilities, dedicated risk management processes, and investment in AI-specific controls—everything from model validation and monitoring to data governance and incident response tailored to AI scenarios. The organizations that get ahead of this curve will be better positioned to avoid costly incidents and regulatory headaches down the road. Speaking of regulation, the compliance environment is evolving rapidly to address these new risks. One of the most significant developments is the emergence of ISO 42001, a new standard for AI management systems. If your organization is already certified to ISO 27001, you’ll find some familiar ground, but ISO 42001 introduces new requirements specific to AI governance, risk assessment, and lifecycle management. Why does this matter? Regulatory frameworks like ISO 42001 are quickly becoming the benchmarks for demonstrating responsible AI use, both to regulators and to stakeholders. Early adoption can provide a competitive advantage, signaling to customers, partners, and regulators that your organization takes AI risk seriously. But it’s not just about checking the box—it’s about building the processes and culture needed to manage AI responsibly across its entire lifecycle. As AI becomes more deeply embedded in business processes, the effectiveness of identity and access management (IAM) and zero trust strategies is being put to the test. Zero trust has become a guiding principle for many organizations, but there’s a growing recognition that its implementation often “ends at the browser.” In other words, while network and application access may be tightly controlled, browser-based threats—such as session hijacking and credential theft—remain significant gaps. This is especially relevant as AI agents and browser-based workflows proliferate. If your zero trust model doesn’t extend to the browser, you could be leaving the door open for attackers to bypass controls and exploit user sessions. CISOs should be evaluating whether their IAM and zero trust implementations are truly end-to-end, and whether they account for the unique risks introduced by AI-powered automation and browser-based activity. Another emerging challenge is the ability to monitor and control what AI agents do with sensitive data. As organizations deploy more autonomous AI systems, it becomes increasingly difficult to track how data is being accessed, processed, and shared. This raises the risk of unintended data exposure or misuse, especially if AI agents are interacting with sensitive or regulated information. Effective data governance is essential here. That means not just setting policies, but ensuring auditability and transparency in how AI systems operate. Can you demonstrate who accessed what data, when, and for what purpose? Can you detect and respond to anomalous behavior by AI agents? These questions are becoming central to both compliance and risk management as AI adoption accelerates. The vendor landscape is responding to these challenges. For example, Xopero Software’s recent acquisition of Vigil Guard, an AI security firm focused on generative AI risks, signals growing demand for tools that address threats like data leakage, prompt injection, and model manipulation. Security leaders should be monitoring the market for solutions that can augment internal controls, especially as generative AI becomes more prevalent and attackers look for new ways to exploit these technologies. On the practical side, sector-specific tools are emerging to help organizations operationalize AI risk management. The Journal of Accountancy recently highlighted a new checklist designed to help CPAs identify and manage AI-related cyber risks. While the checklist is tailored to the accounting profession, its principles are broadly applicable—emphasizing the need for practical, actionable guidance that can be adapted across industries. This reflects a broader trend: as AI risks become more complex, organizations need tools and frameworks that are relevant to their specific context, not just generic best practices. It’s also important to recognize that not all organizations are moving at the same pace. Recent reporting from ADS Advance warns that smaller UK firms, in particular, risk being left behind in the AI race—both in terms of adoption and risk management. Resource constraints and lack of expertise are significant barriers, which can leave these firms vulnerable to both competitive disadvantages and increased security risks. Larger organizations should be thinking about the resilience of their supply chain partners and considering how they can support smaller firms in adopting secure AI practices. After all, supply chain risk is a shared risk. Amid all these technological and regulatory changes, one thing remains constant: the critical role of human judgment in cyber defense. Suncorp Group recently emphasized that, despite advances in automation and AI, people are still the last—and sometimes the best—line of defense against cyber threats. Training, awareness, and a culture of vigilance are essential complements to technical controls, especially as attackers increasingly exploit social engineering and human error alongside technical vulnerabilities. This point can’t be overstated. Even the most advanced technical controls can be undermined by a single click on a phishing email or a poorly considered response to a social engineering attempt. Building a resilient organization means investing in people as much as in technology—making sure that employees at all levels understand t

    • Transcript
  • September 30 · 14 min

    Daily Cyber & AI Briefing — 2026-09-30

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is a study in convergence—where persistent, high-impact vulnerabilities in core digital infrastructure meet the accelerating adoption of artificial intelligence across the enterprise. The result is a risk environment that’s not just fast-moving, but also deeply interdependent. Let’s break down the most critical developments shaping enterprise risk management today, and what they mean for security leaders, risk executives, and boards. Let’s start with the most urgent threat: the active exploitation of a critical zero-day vulnerability in Citrix NetScaler, tracked as CVE-2026-88772. This isn’t just another technical flaw—this is a gateway that state-sponsored actors have been using since early September to gain root-level access to enterprise systems. Once inside, they’re deploying web shells, which essentially give them persistent, covert control over compromised environments. Multiple sources have confirmed successful intrusions, and the scope of these attacks is still unfolding. The key lesson here is the persistent gap between when a vulnerability is disclosed and when organizations actually apply the necessary patches. Attackers are exploiting this window, sometimes for weeks at a time. For organizations running NetScaler appliances, immediate action is non-negotiable. Patching is the first step, but it’s not enough. A thorough forensic review is critical to identify any signs of compromise—look for unexpected web shells, unusual authentication attempts, or unexplained configuration changes. Delaying response could mean significant data loss, lateral movement, and even deeper compromise of your environment. But NetScaler isn’t the only enterprise tool under siege. Attackers are also targeting remote monitoring and management tools—specifically MSP360 and ScreenConnect. These are legitimate platforms, trusted by IT teams to provide remote support and manage infrastructure. Unfortunately, that trust is exactly what makes them attractive to adversaries. Once attackers gain access, they use these tools to maintain persistence, move laterally across networks, and harvest credentials. The practical implication is clear: every remote session, every instance of RMM tool usage, is now a potential risk vector. Security teams need to double down on monitoring, restrict access to these tools, and validate every remote connection. It’s not enough to trust the software because it’s widely used—attackers are counting on that trust to mask their activities. Another attack chain drawing attention involves vulnerabilities in PaperCut, a widely used print management system. Here, attackers are exploiting remote code execution flaws to steal authentication tokens and access domain controllers—the very core of enterprise identity infrastructure. Once domain controllers are compromised, attackers can escalate privileges, impersonate users, and move laterally with ease. The message for security teams is straightforward: patch PaperCut systems as a priority, monitor for suspicious activity, and review domain controller access logs. If you see unusual access patterns or unexplained changes to authentication tokens, you may already be dealing with an active compromise. Shifting gears to the AI front, we’re seeing rapid evolution in both the technology and the governance tools designed to manage its risks. Vendors are rolling out new capabilities that allow security teams to monitor interactions with AI platforms—take Claude, for example. Security teams can now review chat logs, track file transfers, and monitor agent activity within these AI environments. This addresses a growing concern: as AI adoption accelerates, so does the risk of data leakage, compliance violations, and the emergence of “shadow AI”—unsanctioned tools and agents operating outside official oversight. For CISOs, integrating these monitoring tools into existing security operations is becoming essential. It’s about more than just compliance—it’s about enforcing policy, detecting misuse, and supporting audit requirements in an environment where AI is increasingly embedded in business processes. A related development comes from RSA, which has launched an Agent ID platform specifically designed to secure AI agents and multi-cloud platform servers. The challenge here is unique: AI agents, especially those operating autonomously, interact with sensitive data and systems across complex cloud environments. Traditional identity and access management tools aren’t always equipped to handle this level of dynamism or automation. RSA’s Agent ID platform aims to fill that gap by providing visibility and control over agent interactions. This is a significant step forward, because as AI agents become more capable and more autonomous, the risk of unauthorized actions, data leakage, or even malicious manipulation increases. Security leaders should be evaluating how these new identity platforms can be integrated into broader access governance strategies. On the SaaS and AI governance side, Nudge Security has introduced adaptive risk management solutions. The key word here is “adaptive.” Instead of relying on static, point-in-time risk assessments, these tools dynamically track SaaS and AI risk as usage evolves after initial approval. In practice, this means organizations can respond to changes in risk posture in real time—whether that’s a sudden spike in usage, the introduction of a new integration, or the emergence of shadow IT. For risk leaders, adaptive governance is no longer a nice-to-have. The pace of SaaS and AI adoption means that yesterday’s risk profile may be obsolete tomorrow. Tools that can detect and respond to these shifts in real time are becoming mandatory for organizations that want to stay ahead of evolving threats. K2 GRC is another vendor making waves, with the launch of K2 Assist AI. This platform leverages artificial intelligence to automate readiness reviews and streamline governance, risk, and compliance processes. As regulatory scrutiny of AI intensifies—especially in sectors like finance, healthcare, and critical infrastructure—tools that can automate and improve the efficiency of compliance programs are in high demand. The practical benefit is twofold: first, organizations can reduce the manual burden on compliance teams, freeing up resources for higher-value work. Second, automated assessments can help identify gaps or emerging risks that might otherwise go unnoticed until they become material issues. Let’s return to the challenge of shadow AI. As organizations embrace AI to drive efficiency and innovation, employees are increasingly turning to unsanctioned or unauthorized AI tools. This “shadow AI” presents a significant risk of data leakage, regulatory non-compliance, and loss of control over sensitive information. Effective strategies to combat shadow AI start with robust discovery—knowing what tools are in use, by whom, and for what purposes. Policy enforcement is the next step, ensuring that only approved tools are used for sensitive workflows. Finally, user education is critical. Employees need to understand not just the rules, but the reasons behind them—why using an unsanctioned AI tool could expose the organization to risk. CISOs should prioritize visibility and controls over AI tool usage. This isn’t just about ticking a compliance box—it’s about preventing inadvertent exposure of sensitive data, intellectual property, or regulated information. Innovation in AI security is also accelerating. The Tech4Trust accelerator, for example, has named 30 startups to its latest cohort, all focused on securing AI. This reflects a broader trend: a surge in innovation aimed at addressing AI-specific risks, from model integrity to data privacy and beyond. Security leaders should be watching this ecosystem closely. The solutions being developed by these startups could become critical components of enterprise risk management strategies in the near future. Whether it’s tools for monitoring AI model behavior, platforms for securing training data, or solutions for auditing AI decision-making, the innovation pipeline is robust and growing. Partnerships are also shaping the AI governance landscape. Distology’s recent agreement with Harmonic Security highlights the growing market demand for AI governance solutions. As organizations seek to operationalize AI safely, the need for tools that provide oversight, compliance, and risk mitigation is only increasing. The takeaway here is that AI governance is no longer an abstract concept. It’s a practical, operational requirement. Organizations should be evaluating governance frameworks and tools that are specifically tailored to the unique risks and challenges of AI. Another trend worth noting is the convergence of security and sustainability at the board level. Increasingly, security and sustainability are reporting to the same boardroom, driven by regulatory and stakeholder expectations. This alignment can create powerful synergies—security initiatives can support broader ESG (environmental, social, and governance) objectives—but it also introduces new complexities in risk prioritization and reporting. CISOs need to be prepared to articulate how security programs contribute to ESG goals. For example, robust data protection can support privacy and social responsibility objectives, while secure supply chains can enhance environmental and ethical sourcing efforts. The ability to speak the language of both security and sustainability is becoming a key skill for risk leaders. Zooming out to the geopolitical environment, the evolving relationship between the US and China is havin

    • Transcript
  • September 28 · 12 min

    Daily Cyber & AI Briefing — 2026-09-28

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is marked by a rapid convergence of innovation and threat. We’re seeing a surge in AI-driven security tools, a spike in critical vulnerabilities, and a wave of breaches that are testing the limits of both public and private sector defenses. Let’s break down the most important developments shaping risk management and security strategy right now. First, a major signal from the federal government: The U.S. Department of Health and Human Services has awarded a $13.7 million contract to Telos Corporation to modernize its cyber risk management. This isn’t just a routine upgrade—this is a foundational overhaul targeting how risk is assessed, monitored, and mitigated across one of the country’s most vital sectors. We can expect advanced analytics and automation to play a central role, setting a new benchmark for how large public institutions approach cyber risk. For risk leaders in healthcare and adjacent sectors, this move will likely ripple out as a new standard, influencing regulatory expectations and best practices. If you’re in healthcare, this is a clear sign: legacy frameworks are being replaced, and modernization is now a regulatory and operational imperative. Meanwhile, the cybersecurity market itself is shifting. AI security has officially overtaken Governance, Risk, and Compliance—GRC—as the largest segment in the industry. This reflects two realities: the explosion of AI-powered threats, and the rapid adoption of AI-based security solutions. For CISOs and security architects, this means AI is no longer just a tool; it’s a primary battleground. Prioritizing AI-specific controls, threat modeling, and governance mechanisms is no longer optional. As AI agents and tools proliferate, so do the risks associated with them—everything from data leakage to adversarial attacks. The message here is clear: if your security program doesn’t have a dedicated AI security strategy, you’re already behind. But even as AI security takes center stage, traditional infrastructure risks are far from solved. Right now, Citrix NetScaler appliances are at the heart of a global disruption. Two critical remote code execution vulnerabilities—CVE-2026-88771 and CVE-2026-88772—have been actively exploited for weeks. The impact is real and immediate: Dutch hospitals and government agencies have experienced operational outages, and CISA has issued urgent warnings. Attackers are leveraging these zero-days to compromise organizations at scale, bypassing defenses and causing business continuity issues. The practical takeaway for any organization running Citrix NetScaler: patch immediately, review your exposure, and ensure your incident response plans are up to date. These are not theoretical risks—they’re being exploited in the wild, with significant consequences for critical services. Data breaches continue to underscore the fragility of digital trust. The latest example comes from Gyazo, a popular image-sharing platform. A breach there has exposed 23.6 million user records and nearly half a billion pieces of image metadata. The scale and sensitivity of this breach raise several concerns. First, the risk of downstream phishing and credential stuffing attacks is high—attackers now have a massive trove of user data to work with. Second, there are significant privacy implications, especially for users who may have shared sensitive images or information. For security leaders, this is a reminder to review the security posture of any image or data-sharing platforms in your environment, and to reinforce user awareness about the risks of sharing sensitive data online. On the solution side, we’re seeing vendors respond to the democratization of AI security needs. Barracuda has launched AI-driven data security solutions specifically for smaller organizations. Historically, advanced threat detection and response capabilities have been out of reach for many SMBs due to cost and complexity. Barracuda’s move aims to close that gap, making sophisticated security accessible to organizations with fewer resources. However, this also raises important governance questions. Smaller organizations may lack the internal maturity to properly oversee and manage AI tools, potentially introducing new risks even as they mitigate old ones. The lesson here: technology alone isn’t enough—effective oversight and governance must keep pace with adoption. NVIDIA is also making waves in the AI security space. The company has unveiled an open agent safety platform designed to assess and mitigate risks associated with autonomous AI agents. As agent-based architectures become more common, the need for operationalized AI safety frameworks grows. NVIDIA’s platform could become a reference point for organizations looking to embed safety and governance into their AI deployments. For those building or deploying autonomous agents, this is a resource worth evaluating as part of your broader AI risk management strategy. Cloud environments continue to present unique governance challenges, especially as organizations accelerate multi-cloud adoption. Researchers are warning of major governance gaps in Multi-Cloud Platforms, or MCPs. The complexity of managing distributed environments across multiple providers means that traditional oversight mechanisms often fall short. The risks here are multifaceted: misconfiguration, data leakage, and compliance failures are all heightened in these environments. As cloud adoption grows, so too does the need for robust, cross-platform governance frameworks. If your organization is moving to or expanding in multi-cloud, now is the time to assess whether your oversight mechanisms are truly up to the task. Healthcare, in particular, is at a crossroads when it comes to AI governance. Hospitals and payers are integrating AI into both clinical and administrative workflows, but many lack clear frameworks for oversight, risk assessment, and accountability. This creates both ethical and operational risks. For example, how do you ensure that AI-driven decisions in patient care are transparent and fair? How do you audit the outcomes? The absence of structured governance increases the risk of unintended consequences, from bias in clinical algorithms to data privacy violations. Healthcare leaders need to prioritize the development of comprehensive AI governance models—this is no longer a future concern, but a present necessity. Turning to the cloud, attackers are evolving their tactics. Rather than breaking in through traditional perimeter defenses, they’re increasingly stealing cloud access keys, allowing them to operate with legitimate credentials. This shift highlights the importance of robust identity and access management—IAM—practices. Key rotation, least-privilege access, and continuous monitoring for anomalous activity are now table stakes for cloud security. If you’re not already prioritizing these controls, your cloud environment is at risk of becoming a soft target for credential-based attacks. On the compliance and certification front, we’re seeing the emergence of new standards for AI management. Ansira has achieved ISO/IEC 42001:2023 certification, which is designed specifically for AI management systems. This certification is poised to become a differentiator for organizations looking to demonstrate responsible AI governance and compliance. It’s also likely to influence procurement decisions and regulatory expectations. For organizations deploying AI at scale, pursuing such certifications may soon move from a nice-to-have to a business requirement. Another development worth noting is the extension of agent security and governance to employee endpoints. Noma has expanded its solutions to cover not just centralized AI agents, but also those running on individual employee devices. This addresses the growing risk of shadow AI—where unsanctioned or unmanaged AI tools proliferate across the organization. By extending governance to the endpoint, organizations can take a more holistic approach to AI risk management, ensuring visibility and control wherever AI is operating. Despite all these advances, the reality is that most organizations are still “flying blind” when it comes to AI security and governance. A recent Q&A with James Moore highlights that the majority of enterprises lack visibility and structured oversight over their AI deployments. This increases exposure to both technical risks—such as adversarial attacks or data leakage—and regulatory risks, as compliance requirements evolve. The call to action is clear: leaders need to prioritize inventory, risk assessment, and policy development for AI systems. Without a clear understanding of where and how AI is being used, effective governance is impossible. Stepping back, a few strategic implications emerge from today’s developments. First, AI security is now a primary focus area. It demands dedicated governance, controls, and investment—not just as an add-on to existing programs, but as a core pillar of the security strategy. Second, vulnerabilities in critical infrastructure, such as Citrix NetScaler, remain a persistent and high-impact risk. Rapid detection, patching, and response capabilities are essential to maintain operational resilience. Third, cloud security is shifting. The perimeter is no longer the main line of defense—identity and key management are now the front lines, and attackers are exploiting credential theft to devastating effect. Finally, regulatory and certification frameworks for AI, like ISO/IEC 42001:2023, are emerging as benchmarks for responsible deployment and procurement. Organizations that get ahead of these requirements will be better positioned to manage risk and earn trust. So, what

    • Transcript
  • September 24 · 13 min

    Daily Cyber & AI Briefing — 2026-09-24

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is evolving at a pace that’s challenging even the most prepared organizations. The convergence of artificial intelligence with traditional cyber threats is introducing new forms of risk—some of them existential in nature. As enterprises and public sector bodies accelerate their adoption of AI, the gap between rapid deployment and effective governance is widening. This isn’t just a technical issue; it’s a strategic and operational one that touches every part of the business. Let’s start by looking at the broader context. Multiple industry sources are now warning that AI isn’t just another technology to secure—it’s an existential risk for organizations. That means the consequences of failure could threaten business continuity, regulatory standing, and even the organization’s reputation. As AI systems become more autonomous, making decisions that once required human oversight, the potential for systemic failure grows. Security leaders are being urged to rethink their risk registers and incident response plans to explicitly address AI-driven scenarios. The old silos between data security, application security, and AI governance are breaking down. We need unified frameworks that treat AI and data as a single, integrated risk domain. Axa XL and other industry voices are at the forefront of this conversation. Their message is clear: treat AI as an existential risk, not just a technical one. This shift in mindset is critical because AI systems are now making decisions that directly impact business operations, compliance, and reputation. If your organization is still treating AI as a side project or a technical curiosity, it’s time for a strategic reset. The recommendation is to bring AI and data under a unified governance umbrella, with controls that span both domains. That means reassessing your risk registers, updating incident response plans, and ensuring that AI-driven scenarios are explicitly considered in your business continuity planning. The market is responding to these challenges. Proofpoint, for example, has just launched an agentic security system designed to protect both AI and data as a unified risk. This is more than just a new product—it’s a signal that the industry is moving toward integrated platforms that can monitor, control, and secure AI agents and the data they process. For CISOs, this means that the era of piecemeal solutions is coming to an end. The complexity of AI deployments, combined with the need for holistic governance, is driving demand for platforms that can address shadow AI, unauthorized data flows, and the risks associated with autonomous agents. If you’re evaluating your security stack, now is the time to look for solutions that can provide visibility and control across both AI and data assets. But while the strategic conversation around AI risk intensifies, the day-to-day threat landscape isn’t standing still. We’re seeing a surge in high-impact vulnerabilities—some of them being actively exploited in the wild. Let’s talk about two critical vulnerabilities that have surfaced this week. First, attackers are actively exploiting a zero-day vulnerability in Check Point VPN and management interfaces. This flaw allows remote code execution, and there are already reports of successful intrusions. If your organization uses Check Point solutions, immediate action is required. Prioritize patching, review your VPN access logs for signs of suspicious activity, and consider additional network segmentation to contain any potential breaches. This incident is a stark reminder of the persistent threat posed by zero-day attacks. Rapid patch management and a layered defense strategy remain essential, especially as attackers increasingly automate their campaigns using AI. The second major vulnerability involves Roundcube Webmail. A critical flaw here allows attackers to trigger SQL injection without authentication. This could lead to data breaches or even full system compromise. Again, the recommendation is immediate patching, along with a review of webmail access and database logs for any signs of exploitation. These incidents underscore a broader point: the threat tempo is accelerating, and organizations need to be proactive in identifying and mitigating vulnerabilities before attackers can exploit them. AI isn’t just a risk management challenge—it’s also becoming a tool for attackers. We’re seeing the emergence of new AI-powered cyber threats, including advanced malware and ransomware. One example is a sophisticated Android banking trojan that’s using AI-generated overlays to steal users’ banking PINs. This technique makes phishing attacks more convincing and harder to detect, bypassing many traditional security controls. Security teams should enhance their mobile threat defenses, educate users about the risks of overlay attacks, and monitor for anomalous app behaviors. The lesson here is that AI is a double-edged sword—while it can enhance defenses, it also gives attackers new capabilities. On the ransomware front, a new operation called Galago has emerged, with apparent links to the Panzer Group. The constant evolution of ransomware actors highlights the need for robust backup strategies, network segmentation, and ongoing employee awareness training. Ransomware isn’t going away, and the integration of AI into these operations is likely to make them even more effective. Organizations should ensure that their backup and recovery plans are tested regularly, and that network segmentation is in place to limit the spread of ransomware if a breach occurs. Let’s turn back to AI governance. Research is showing that AI adoption is outpacing the development of effective governance frameworks, particularly in the public sector. In the UK, for example, many organizations are deploying AI systems without adequate oversight. This increases the risk of unintended consequences, bias, and security lapses. The message for CISOs and risk leaders is clear: governance frameworks need to keep pace with AI deployment. That means not just assessing risk before go-live, but ensuring ongoing risk assessments as systems evolve. Continuous monitoring, regular audits, and clear lines of accountability are essential. The lack of governance isn’t limited to the public sector. A recent report from OX Security found over 15,000 MCP servers operating without any governance controls. This creates significant attack surfaces and compliance risks. Security leaders should take inventory of their AI and automation infrastructure, enforce access controls, and implement continuous monitoring. Shadow IT and unsanctioned AI deployments are a growing problem, and without governance, organizations are flying blind. Browser security is another area where AI is introducing new risks. Akamai reports that enterprise adoption of AI-enabled browsers has crossed 40%, but the associated risks—such as data leakage and malicious extensions—aren’t being adequately addressed. CISOs should review browser security policies, restrict the use of unapproved AI browser tools, and monitor for suspicious activity. As AI becomes embedded in more applications and platforms, the attack surface expands. Browser-based attacks, data exfiltration, and malicious extensions are all areas that require renewed attention. On the international stage, the conversation around AI risk is gaining urgency. Leading tech executives have warned the United Nations Security Council about the extinction-level risks posed by frontier AI systems. Their call is for urgent international cooperation and safeguards to prevent catastrophic misuse or loss of control. While this may seem like a macro-level concern, it has direct implications for enterprise risk leaders. Scenario planning should now include the potential for large-scale AI failures, regulatory changes, and the need for responsible AI development. Organizations that engage in these conversations early will be better positioned to adapt to new regulatory requirements and compliance burdens. Geopolitically, we’re seeing countries like Pakistan call for international safeguards and human oversight to prevent an AI arms race and technological exclusion. This stance could influence regulatory trends and cross-border data governance, particularly for multinational organizations. If your business operates in multiple jurisdictions, it’s important to stay ahead of these developments and ensure that your AI strategies are aligned with emerging global standards. On the vendor side, we’re seeing a wave of new AI-focused security solutions targeting managed service providers. Barracuda Networks and others are rolling out tools to help MSPs and their clients manage AI risks, automate threat detection, and enforce governance. For organizations that rely on third-party providers, it’s important to evaluate the maturity of these offerings and consider how they fit into your broader risk management and vendor oversight programs. As the ecosystem becomes more complex, third-party risk is becoming a critical area of focus. So, what are the strategic implications of all this? First, AI must be treated as an existential and integrated risk—not just a technical challenge. The gap between AI adoption and governance is widening, increasing systemic risk across industries. Zero-day vulnerabilities and AI-powered malware are accelerating the threat tempo, making rapid response and layered defenses more important than ever. And as international calls for AI safeguards grow louder, organizations should anticipate new regulatory requirements and compliance burdens. Let’s bring this down to what matters today. If you’re responsible for cyber risk or AI go

    • Transcript
  • September 23 · 13 min

    Daily Cyber & AI Briefing — 2026-09-23

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is more turbulent than ever, with a surge in critical vulnerabilities and active exploitation across some of the most widely used enterprise platforms. We’re seeing attackers move faster, exploit zero-days more aggressively, and leverage AI in ways that are fundamentally changing the threat environment. At the same time, defenders are racing to adopt AI-driven solutions and shore up core controls. Let’s break down what’s happening, why it matters, and what you need to prioritize now. Let’s start with the vulnerabilities making headlines and causing headaches for security teams worldwide. First up: F5’s BIG-IP Access Policy Manager. A critical zero-day vulnerability has been discovered and is being actively exploited in the wild. This isn’t just a theoretical risk—both F5 and independent researchers have confirmed that attackers are successfully leveraging this flaw for unauthenticated remote code execution on OAuth servers. For organizations using BIG-IP, this is a high-severity, high-impact issue. If an attacker can execute code without authentication, they can potentially take full control of the affected system, move laterally within your network, and disrupt critical services. The implications range from data theft and ransomware to service outages and reputational harm. The immediate action here is clear: patch exposed BIG-IP instances without delay. But don’t stop at patching—review your logs for signs of compromise, especially if you’ve had any externally exposed APM servers. This is the kind of vulnerability that can lead to cascading failures if left unchecked, so rapid incident response and thorough forensic review are essential. Unfortunately, F5 isn’t alone this week. Check Point’s management servers have also been hit with a zero-day, and attackers are moving quickly to exploit it. This flaw allows arbitrary script execution without authentication, giving adversaries a potential foothold on your perimeter defenses. Check Point has released patches, but exploitation is ongoing, and the risk is significant—especially for organizations that rely on Check Point for their primary security gateway. If attackers gain privileged access to your management servers, they can potentially pivot deeper into your environment, bypassing other controls. The takeaway here is similar: prioritize patch deployment, but also conduct a forensic review to ensure you haven’t already been compromised. Don’t assume that patching alone is enough—if an attacker already has a presence, you need to root them out before they can escalate further. Moving to the endpoint, Google has released a massive update for Chrome, addressing 108 vulnerabilities—several of which are critical code execution flaws. Chrome is ubiquitous in enterprise environments, making it a high-value target for attackers. Unpatched browsers can become the weak link that compromises an entire organization, especially given the prevalence of phishing, drive-by downloads, and malicious extensions. The practical implication is straightforward: ensure that Chrome updates are rolled out promptly across all endpoints. This is one of those areas where automation can make a huge difference—leverage your endpoint management tools to enforce updates, and don’t leave it to end users to patch on their own schedule. Now, let’s talk about the evolving threat of AI-driven malware. We’re seeing a new generation of malicious code that doesn’t just follow a static playbook. Instead, it queries AI models in real time to determine its next move. This means the malware can adapt to its environment, evade traditional detection, and make context-aware decisions on the fly. For defenders, this represents a significant escalation. Traditional signature-based detection is less effective against threats that can morph and adapt in real time. The implication is clear: behavioral analytics and AI-driven detection are no longer optional. Security teams need to invest in solutions that can identify anomalous behavior, not just known malware signatures. This also underscores the importance of continuous monitoring and rapid response—if you’re relying on yesterday’s defenses, you’re already behind. WordPress is another area of concern this week, with two major developments. First, a critical vulnerability in WordPress core allows attackers to execute code without authentication. Given that WordPress powers a huge share of public-facing websites, this flaw could enable mass exploitation, website defacement, or data theft on a large scale. Organizations running WordPress—especially those with customized or unpatched installations—should prioritize patching immediately and monitor for signs of compromise. Complicating matters, researchers have identified new malware campaigns targeting WordPress sites using must-use plugins and Ethereum-based EtherHiding techniques. These methods enable persistent backdoor access and make detection and removal much more challenging. The use of must-use plugins means the malware can’t be easily disabled from the admin dashboard, while EtherHiding leverages decentralized infrastructure to hide malicious payloads. This is a sophisticated approach that can keep attackers embedded in your environment for the long haul. The best defense here is a combination of regular plugin audits, file integrity monitoring, and a strong patch management process. Don’t assume that your site is safe just because it’s running the latest version—custom plugins and themes can introduce their own risks. Shifting gears to mobile threats, there’s an active campaign distributing StreamRat malware via fake TV streaming ads. These malicious ads are targeting Android users, enabling remote hijacking of devices. For organizations with bring-your-own-device (BYOD) policies, this is a reminder that mobile endpoints are a critical part of your attack surface. Malvertising isn’t new, but the sophistication and reach of these campaigns continue to grow. The response should include robust mobile device management, user awareness training, and clear policies around app downloads and ad interactions. If you haven’t revisited your mobile security posture recently, now is the time. Zooming out, expert analysis points to a marked increase in global cyber attacks in 2026. The drivers are familiar—geopolitical tensions, the proliferation of ransomware-as-a-service, and the exploitation of emerging technologies. But what’s different is the pace and scale. Attackers are better organized, more automated, and increasingly willing to exploit new vulnerabilities as soon as they emerge. This means that continuous risk assessment and adaptive defense strategies are not just best practices—they’re necessities. Static controls and annual risk reviews are no longer sufficient. Security teams need to operate with the assumption that breaches will occur and focus on minimizing impact and accelerating recovery. Let’s talk about the intersection of AI and compliance, particularly in the tax domain. AI adoption in tax compliance is accelerating, with organizations using automation to handle sensitive financial data and streamline regulatory processes. While this offers efficiency gains, it also introduces new security risks. Automated systems become attractive targets, and errors or manipulations—whether accidental or malicious—can have serious regulatory and reputational consequences. Security leaders need to ensure that AI-driven compliance processes are subject to robust controls and are fully auditable. This includes not just technical safeguards, but also clear documentation, regular testing, and independent review. The stakes are high—mistakes here can lead to regulatory penalties and loss of trust. On the vendor side, Barracuda and Cancom have both launched new AI security solutions aimed at safer AI adoption. Barracuda’s AI Data Security solution is targeting small businesses and managed service providers, while Cancom’s FlexPod AI is an on-prem turnkey AI stack built with Nvidia, Cisco, and NetApp. These offerings reflect the growing demand for secure AI infrastructure and strong data governance. But as organizations evaluate these solutions, due diligence is critical. Not all AI security tools are created equal, and integration with existing infrastructure can introduce new risks if not managed properly. Evaluate vendors carefully, understand how their solutions fit into your broader security architecture, and ensure that you’re not introducing new blind spots in the name of innovation. Machine identity management is another area seeing rapid evolution, especially as organizations move more workloads to the cloud and rely on complex supply chains. Weaknesses in machine identity—such as unmanaged certificates, keys, or service accounts—can enable lateral movement and supply chain attacks. A recent review of machine identity management solutions highlights this as a priority area for investment and process improvement. The practical steps here involve inventorying all machine identities, enforcing strong lifecycle management, and integrating machine identity controls with your broader access management and monitoring systems. As supply chains become more interconnected, a compromise in one area can quickly propagate, so vigilance is key. Finally, let’s address the human element. Security Journey has rolled out AI-focused security training for non-technical staff, recognizing that as AI becomes embedded in business processes, attackers will increasingly target user error and lack of awareness. Upskilling the workforce is essential—not just for technical teams, but for ever

    • Transcript
  • September 22 · 12 min

    Daily Cyber & AI Briefing — 2026-09-22

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is evolving at an unprecedented pace, with both technological advancements and threat activity accelerating simultaneously. The convergence of these trends is presenting new challenges for organizations, from the boardroom to the security operations center. Let’s break down the most significant developments shaping today’s risk environment, and what they mean for security leaders, risk executives, and organizations at large. Global attention on artificial intelligence risk is reaching a new level. The United Nations Security Council is convening high-profile briefings with major AI stakeholders, including DeepSeek and Sam Altman, the CEO of OpenAI. This is more than a symbolic gesture—it’s a clear sign that AI governance has become a matter of international security and diplomacy. As AI capabilities continue to advance and geopolitical competition intensifies, global leaders are recognizing the need for coordinated frameworks to address AI misuse, safety, and the cross-border impacts of these technologies. This growing focus at the UN level is likely to drive new regulatory expectations for organizations deploying advanced AI. Security leaders should anticipate that internal AI governance will need to align with emerging international standards—not just national or industry-specific requirements. This is about more than compliance; it’s about demonstrating responsible stewardship of AI, ensuring transparency, and preparing for a world where AI-related incidents can have global consequences. At the same time, research is exposing a significant gap between the rapid adoption of AI in the enterprise and the maturity of governance practices. A new EMA Research webinar is set to examine this issue in depth, highlighting that while AI is being integrated into business processes at breakneck speed, controls around risk, compliance, and security are struggling to keep up. The implications are serious: operational, reputational, and regulatory risks are mounting for organizations that lack dedicated AI governance frameworks and cross-functional oversight. This governance gap isn’t just theoretical. According to recent ISACA research, only 8% of organizations conduct regular AI-specific incident response exercises. That means more than nine out of ten enterprises are not actively preparing for AI-driven attacks or failures. As AI systems increasingly power critical decision-making and automation, this lack of preparedness is a glaring vulnerability. Security and risk leaders need to prioritize scenario planning and tabletop exercises that address the unique risks posed by generative and agentic AI systems. Let’s talk about what those risks look like in practice. One area of concern is the potential for unbounded resource consumption in large language models—a risk highlighted in the OWASP LLM Top 10. A recent simulation demonstrated how attackers can exploit these models to trigger excessive compute or data usage. The result? Denial-of-service attacks or runaway costs that can disrupt operations and hit the bottom line. Security teams must implement usage controls and monitoring for AI workloads, ensuring that resource consumption is predictable and contained. The evolution of AI is also driving a shift in how organizations need to approach governance. Akamai’s latest report underscores that agentic AI—systems capable of autonomous action—require a move away from purely technical controls toward behavioral governance. This means organizations must monitor AI decision-making, enforce guardrails, and ensure accountability at every stage of the AI lifecycle. Traditional security controls aren’t enough; it’s about understanding and shaping the behavior of AI agents in real-world environments. Compounding this, agentic AI systems are not exempt from existing compliance requirements. Cybersecurity Insiders points out that frameworks like the Cybersecurity Maturity Model Certification (CMMC) and state privacy laws still apply. Organizations can’t afford to treat AI as a special case outside the scope of established controls. Instead, they need to integrate AI-specific measures into their broader compliance and privacy programs, especially as regulatory scrutiny intensifies. While AI risk and governance are quickly rising to the top of the agenda, the cyber threat landscape remains as active as ever. Several critical vulnerabilities and breaches have emerged that demand immediate attention. First, a coordinated attack has compromised 65 GitHub repositories and introduced a hidden backdoor into an npm package. This is a textbook supply chain attack, demonstrating the ongoing risk of dependency poisoning. For organizations that rely on open-source components—and that’s virtually everyone—rigorous code provenance checks and supply chain security practices are essential. It’s not just about vetting your own code, but also understanding and managing the risks introduced by third-party dependencies. Meanwhile, Chinese advanced persistent threat groups are leveraging cloned legitimate websites to deliver Chrome and Windows zero-day exploits. This tactic raises the risk of drive-by compromise, where unsuspecting users are infected simply by visiting a trusted-looking site. The practical takeaway here is the importance of user awareness, robust patch management, and integrating threat intelligence into security operations. Organizations need to ensure that their endpoints are patched quickly and that users are trained to recognize suspicious activity—even when it appears to come from familiar sources. On the vulnerability management front, the Cybersecurity and Infrastructure Security Agency—CISA—has added six new exploited flaws to its Known Exploited Vulnerabilities catalog. Federal agencies have been given just three days to patch, reflecting the accelerating pace at which vulnerabilities are being weaponized in the wild. This is not just a federal issue; the expectation for rapid vulnerability management is becoming the norm across all sectors. Organizations need to maintain up-to-date asset inventories, automate patch deployment where possible, and ensure that both IT and operational technology environments are covered. The risks associated with identity and authentication providers have also been underscored by a massive breach at Nexus, which exposed 153 million identities. The sheer scale of this incident raises significant counterintelligence and fraud risks—not just for Nexus, but for every organization that relies on third-party authentication. This highlights the need for robust third-party risk management, layered authentication controls, and continuous monitoring for signs of credential abuse or identity compromise. Another area of immediate concern is the exploitation of zero-day vulnerabilities in network infrastructure. A zero-day exploit chain targeting SonicWall SMA1000 appliances has been rated with a maximum CVSS score of 10.0—indicating the highest level of severity. Organizations using these devices should move quickly to patch, but also consider additional measures like network segmentation and enhanced monitoring to detect and contain any potential compromise. Similarly, CISA has issued an alert for an actively exploited vulnerability in Zyxel GS1900 switches. Network infrastructure devices remain high-value targets for attackers seeking persistent access or lateral movement within organizations. Timely patching and ongoing monitoring are critical to defend against these threats. Stepping back, what are the strategic implications of these developments? First, international AI governance is accelerating. Organizations deploying advanced AI should expect regulatory expectations to increase, and should begin aligning their internal policies with emerging global standards. This isn’t just about checking boxes; it’s about building trust with stakeholders, customers, and regulators in an environment where AI risks are under the microscope. Second, the gap between AI adoption and governance is a critical risk. Most organizations are not adequately prepared to respond to AI-specific incidents or to govern the behavior of autonomous systems. This is now a board-level issue, requiring investment in dedicated governance frameworks, cross-functional oversight, and ongoing training and exercises. Third, supply chain and identity breaches are escalating. Organizations must double down on third-party risk management, robust authentication controls, and continuous monitoring for compromise. The risks introduced by partners and providers are no longer peripheral—they are central to organizational security. Finally, the pace of vulnerability exploitation is only increasing. Rapid patch cycles, improved asset visibility, and automation are essential to keep up with the threat landscape. This applies not just to traditional IT assets, but to operational technology and network infrastructure as well. So, what matters most today for security and risk leaders? First, prepare for new AI governance requirements by proactively aligning your internal policies and controls with international standards. Don’t wait for regulations to be finalized—start building the foundations now. Second, accelerate your AI-specific incident response planning. This means developing and running tabletop exercises that address the unique risks posed by generative and agentic AI. Make sure your teams know how to respond to AI-driven incidents, from data leakage to autonomous system failures. Third, prioritize patching of newly disclosed vulnerabilities. The window between disclosure and exploitation is shrinking, and attac

    • Transcript
  • September 21 · 13 min

    Daily Cyber & AI Briefing — 2026-09-21

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is in a state of rapid evolution, with several significant developments shaping the way organizations need to think about security, governance, and resilience. Over the next several minutes, I’ll walk through the most pressing issues facing CISOs, risk executives, and security teams today, drawing on recent high-profile incidents, emerging best practices, and the shifting dynamics of both cybercrime and global AI regulation. Let’s start with one of the more unusual stories in recent memory—an open feud between two of the world’s most notorious ransomware gangs. The group known as ShinyHunters has publicly claimed responsibility for hacking the dark web leak site operated by their rivals, the Clop ransomware gang. Multiple sources have confirmed the attack, which disrupted Clop’s operations and exposed the inner workings of their infrastructure. Why does this matter to security leaders? For one, it’s a stark reminder that even the most sophisticated criminal organizations are vulnerable to the same types of attacks they inflict on others. But beyond that, this kind of infighting introduces a new layer of volatility into the ransomware ecosystem. When criminal groups turn on each other, we often see unpredictable shifts in tactics, sudden data dumps, and spillover effects that can impact legitimate organizations. For example, data exfiltrated in these feuds may end up being released publicly, increasing the risk of exposure for companies that have previously paid ransoms or been targeted by either group. The lesson here is that the threat landscape isn’t just shaped by external actors targeting businesses—it’s also influenced by the dynamics within the cybercriminal community itself. For defenders, this means staying alert to changes in ransomware group behavior, monitoring for unexpected data leaks, and preparing for the possibility that your organization could be caught in the crossfire of these criminal disputes. Shifting gears, we’re seeing continued evidence that supply chain attacks remain one of the most persistent and challenging risks in cybersecurity. CrowdSec, a well-known open-source security vendor, recently confirmed that its source code was stolen in a supply chain breach. This incident underscores the ongoing vulnerability of third-party software dependencies—especially in open-source ecosystems, where code is often reused and integrated across countless organizations. For CISOs, the implications are clear: it’s no longer enough to trust that a reputable vendor or open-source project is inherently secure. Rigorous vetting of software components, continuous monitoring for unauthorized changes, and robust incident response plans are now essential elements of any effective security program. The CrowdSec breach is a reminder that even security vendors themselves are not immune to these risks, and that the downstream impacts of a single compromise can ripple across entire industries. In a related vein, attackers are getting more creative in their attempts to infiltrate open-source communities. Members of the Rust programming language team, along with maintainers of several popular Rust crates, have been targeted in a sophisticated social engineering campaign involving video calls. The attackers used direct communication to try and compromise identities, with the apparent goal of injecting malicious code into widely used packages. This is a clear example of how the human element remains a critical vulnerability, even in technically robust environments. Social engineering isn’t just about phishing emails anymore—it’s evolving to include more personalized, high-touch tactics that can be difficult to detect. For developer communities, this highlights the importance of strong identity verification, secure communication practices, and a culture of vigilance against manipulation. It also points to the need for layered defenses that combine technical controls with ongoing security awareness training. While these technical and human risks continue to evolve, we’re also witnessing a surge in global activity around AI governance. Just recently, President Trump and President Xi Jinping met to discuss the future of global AI regulation. This high-profile meeting signals that AI risk management has become a top-tier geopolitical issue, with significant implications for international regulatory approaches, data sovereignty, and cross-border collaboration. For security executives, this development is more than just a headline. It foreshadows a period of increased scrutiny on AI-enabled systems, especially for multinational organizations operating across multiple jurisdictions. We can expect to see new compliance requirements, tighter controls on data flows, and a growing emphasis on transparency and accountability in AI development and deployment. Adding to this, a fellow from Chatham House provided expert testimony to the UK Parliament on the global risks and governance challenges posed by AI. The session emphasized the need for coordinated international frameworks and highlighted the complexity of managing AI risks across different legal and regulatory environments. This is a space that’s moving quickly, and organizations will need to stay agile to keep up with new standards and expectations as they emerge. One practical response to these challenges is the development and adoption of specialized platforms designed to address data sovereignty and AI security. Seclore, for example, has launched its ARMOR platform, which aims to help organizations enforce data residency, control access, and secure sensitive information within AI workflows. As regulatory and customer demands for data localization and AI transparency continue to grow, solutions like this are becoming increasingly relevant. For CISOs, the message is clear: data governance and AI security need to be integrated into every stage of the technology lifecycle, from initial design through to deployment and ongoing management. Industry guidance is also evolving to reflect these new realities. Bulwark, a security solutions provider, has recently outlined key cybersecurity priorities for organizations integrating AI into their operations. Their focus areas include securing AI models against tampering, managing data privacy risks, and ensuring compliance with a rapidly changing regulatory landscape. This reflects a broader industry shift toward embedding security and governance directly into the AI development process, rather than treating them as afterthoughts. One area where this is especially relevant is marketing. As AI becomes more deeply integrated into customer engagement strategies, there’s a growing need for frameworks that ensure transparency, accountability, and risk assessment in AI-driven campaigns. A new governance framework for AI in marketing has been proposed, emphasizing the importance of collaboration between marketing, security, and compliance teams. The goal is to mitigate reputational and regulatory risks before they materialize, rather than reacting after the fact. Turning our attention to cloud security, Unit 42 has detailed how AWS uses managed policies to detect and neutralize compromised IAM credentials. By automating controls and continuously monitoring for suspicious activity, AWS is able to reduce the window of exposure when credentials are compromised. This is a powerful example of how cloud providers and customers can work together to enhance security, but it also highlights the need for organizations to understand and implement shared responsibility models. Automated controls, rapid response capabilities, and continuous monitoring are now table stakes for any effective cloud security strategy. To build on that, CloudSEK has provided a comprehensive overview of cloud security fundamentals, including the components, risks, and responsibilities involved. As cloud adoption accelerates across industries, it’s essential for organizations to understand where their responsibilities begin and end, and to implement best practices for securing cloud environments. This includes everything from identity and access management, to encryption, to monitoring for misconfigurations and unauthorized activity. Financial services are another sector where AI governance and compliance are taking center stage. Persistent Systems has achieved a specialization with Databricks to support governed AI initiatives in banking, financial services, and insurance. This move reflects the sector’s focus on embedding governance and compliance into AI projects from the outset, particularly when dealing with sensitive data and stringent regulatory requirements. For organizations in highly regulated industries, this is a model worth emulating—prioritizing governance as a foundational element of any AI initiative. Threat intelligence remains a cornerstone of effective cybersecurity. Analytics Insight has highlighted the value of integrating threat intelligence into security operations, emphasizing proactive monitoring, information sharing, and actionable insights. By leveraging threat intelligence, organizations can enhance their ability to detect and respond to emerging threats, often before they escalate into full-blown incidents. This proactive approach is especially important in today’s environment, where threat actors are constantly evolving their tactics and looking for new ways to exploit vulnerabilities. Stepping back to look at the bigger picture, several strategic implications emerge from these developments. First, supply chain and open-source software risks remain a critical vulnerability for organizations of all sizes. Proactive monitoring, rigorou

    • Transcript
  • September 18 · 17 min

    Daily Cyber & AI Briefing — 2026-09-18

    Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript. Transcript Today’s cyber and AI risk landscape is marked by a surge in critical vulnerabilities, active exploitation, and a rapidly evolving regulatory environment. Security leaders are being tested on multiple fronts: from urgent patch management to the governance of shadow AI, and from defending against sophisticated supply chain attacks to anticipating the next wave of AI-driven threats. Let’s break down the key developments shaping today’s risk environment, explore their practical implications, and consider what security leaders need to prioritize right now. Let’s start with the wave of critical vulnerabilities impacting some of the most widely deployed enterprise security products. Over the past 24 hours, vendors including Cisco, Check Point, Kaspersky, and Tanium have all issued urgent patches for flaws that, in many cases, are already being exploited in the wild. Cisco’s Identity Services Engine, or ISE, is a particular concern, with active attacks targeting environments that haven’t yet applied the latest fix. Check Point, Kaspersky, and Tanium have addressed vulnerabilities that open the door to remote code execution or privilege escalation—attackers’ favorite footholds for lateral movement or data theft. For organizations running these products, the message is clear: immediate patch deployment is non-negotiable. But it doesn’t stop there. Environments with complex or distributed infrastructure—think hybrid cloud, multiple branch offices, or remote workforces—face additional challenges. Patching at scale requires coordination, testing, and sometimes downtime, but the risk of delay is now demonstrably higher. Attackers are moving quickly to reverse-engineer patches and weaponize exploits, often within hours of disclosure. That means continuous monitoring for exploitation attempts is just as critical as the patching itself. Watch for unusual authentication attempts, privilege escalations, or unexpected outbound traffic—these are often the first signs that a vulnerability is being targeted. Shifting focus to network infrastructure, MikroTik routers are under active attack, with hackers exploiting vulnerabilities that allow unauthenticated takeover of devices. This is particularly worrisome because MikroTik hardware is popular in both enterprise and service provider environments. Once compromised, these routers can be conscripted into botnets, used as launchpads for lateral movement, or serve as persistent footholds for further compromise. The fact that attackers don’t even need credentials to take control amplifies the urgency. Organizations using MikroTik should prioritize patching, review their network segmentation to limit the blast radius of a potential breach, and monitor for unusual outbound connections that might indicate a device has been hijacked. Fortinet’s FortiGate appliances are also in the spotlight, with news that a so-called “1-day” vulnerability—meaning a flaw that’s just been patched but is not yet widely remediated—is being sold on underground forums. FortiGate devices are a backbone of security infrastructure for many enterprises, providing firewall and VPN services. The sale of this exploit on criminal marketplaces suggests that widespread attacks could be imminent. Security teams should be monitoring vendor advisories closely, applying patches as soon as they become available, and reviewing firewall and VPN logs for any signs of suspicious activity. This is a classic example of the shrinking window between vulnerability disclosure and exploitation, and it reinforces the need for rapid, automated patch management wherever possible. Now, let’s talk about the human element—specifically, the rise of shadow AI in the enterprise. A new report finds that 67% of employees are using unapproved AI tools at work. That’s two out of every three workers bypassing official channels to leverage generative AI, coding assistants, or other productivity tools. While the intent may be to boost efficiency, the risks are significant: data leakage, compliance violations, and the introduction of unmonitored, potentially insecure applications into the environment. For CISOs, this is a wake-up call. AI governance policies can’t be theoretical—they need to be rolled out, communicated, and enforced. This means increasing user awareness about the risks of unauthorized AI use, deploying monitoring tools to detect shadow AI activity, and working with business units to provide secure, approved alternatives that meet employees’ needs without compromising the organization’s risk posture. The supply chain threat landscape is also evolving, with attackers targeting code repositories and exploiting SaaS integrations in new ways. One novel attack, dubbed the “Shai-Hulud Worm,” is hijacking AI coding assistant sessions to compromise SaaS code repositories. This is a significant supply chain risk because compromised code can propagate downstream to customers and partners, multiplying the impact. Security leaders should review their SaaS access controls, enforce multi-factor authentication for critical development tools, and monitor for anomalous activity within code repositories. The lesson here is that the supply chain is only as strong as its weakest link, and attackers are increasingly targeting the tools and integrations that developers rely on every day. The risks of third-party integrations are further highlighted by a large-scale supply chain attack involving Brevo widgets. Attackers have turned these widgets into a malware delivery channel, impacting over 100,000 websites. This demonstrates the inherent risk of embedding third-party scripts and components into web applications. Organizations should maintain an up-to-date inventory of all third-party scripts, implement content security policies to limit the execution of untrusted code, and be prepared to respond quickly to widespread web-based compromises. The scale of this attack serves as a reminder that even trusted vendors can become vectors for malware delivery if their supply chain is compromised. Turning to the consumer and enterprise malware front, the MovieReaper malware campaign is spreading through pirated movie torrents and using the Solana blockchain for command-and-control. This is an example of attackers leveraging decentralized technologies to evade takedown efforts. By using the blockchain, they make it much harder for defenders to disrupt their infrastructure. MovieReaper targets both individuals and organizations, potentially leading to ransomware infections or data theft. Security teams should block access to known malicious torrent sources and monitor for unusual network activity related to blockchain transactions. The use of popular blockchains for command-and-control is likely to become more common, so defenders need to adapt their detection strategies accordingly. As AI adoption accelerates, organizations are scrambling to secure and manage their AI fleets. A growing ecosystem of governance tools is emerging to help with this challenge, but the regulatory environment remains fragmented. Some governments are shelving AI legislation, while others—China, for example—are framing AI as a security threat rather than an existential risk. This divergence creates uncertainty for security executives, who must ensure their governance frameworks are both robust and adaptable. Staying abreast of evolving best practices and regulatory expectations is essential. This means regularly reviewing and updating AI governance policies, engaging with industry groups and regulators, and ensuring that governance tools are flexible enough to accommodate new requirements as they emerge. On the policy front, the US Cybersecurity and Infrastructure Security Agency, or CISA, has released new guidance on the use of decoys—sometimes called deception technologies—in cyber defense. At the same time, policymakers are debating whether “nuclear-style” safeguards should be applied to AI, reflecting growing concern over the potential for catastrophic misuse. For CISOs, this is a signal to evaluate the applicability of deception technologies within their own environments and to prepare for potential regulatory shifts in AI oversight. Deception can be a valuable tool for detecting and slowing attackers, but it requires careful planning and integration with existing detection and response processes. A recent analysis from Unit 42 highlights the complex relationship between identity management, cloud harnesses, and supply chain security. The report emphasizes the “uncomfortable space” where vulnerabilities can be exploited—often at the intersection of identity and cloud infrastructure. Security leaders should prioritize identity governance, review cloud access policies, and assess supply chain dependencies for potential weak points. The takeaway is that identity is increasingly the new perimeter, and attackers are adept at finding and exploiting gaps in identity and access management. Zooming out, the convergence of AI and cyber operations is accelerating. Both attackers and defenders are leveraging AI for automation, reconnaissance, and exploitation. For defenders, this means investing in AI-enabled security tools that can keep pace with adversarial capabilities. It also requires ongoing staff training to ensure that teams can effectively use these tools and adapt to new tactics. The bar for defensive innovation is rising, and organizations that fail to keep up risk being outmaneuvered by more agile, AI-powered adversaries. Let’s take a step back and consider the strategic implications of these developments. First, patch management and vulnerability response must be accelerated, especially for widely deployed security infrastructure. The window

    • Transcript
Showing 1–20 of 22 episodes