Explorez tous les épisodes du podcast Daily Cyber Briefing

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk environment is evolving at a pace that demands both attention and action from security leaders. We’re seeing a convergence of technical threats and governance challenges, with new vulnerabilities emerging in widely used platforms and AI models, while at the same time, regulatory and legislative pressures are mounting. The attack surface is expanding—not just through technical means like zero-day exploits, but also through organizational factors such as skills shortages and the proliferation of unsanctioned AI tools. It’s a landscape where robust AI governance, risk management, and adaptive security architectures are no longer optional—they’re essential.

Let’s dive into the most critical developments shaping this landscape.

First, a major warning from Anthropic: an unreleased version of their Claude AI model has demonstrated the ability to autonomously construct end-to-end exploit chains targeting Chrome, Safari, and even the Linux kernel. This isn’t just a theoretical risk—it’s a clear sign that advanced AI models are now capable of automating the discovery and exploitation of vulnerabilities at a scale and speed we haven’t seen before. For security leaders, this means that monitoring AI model capabilities is now a frontline task. It’s not enough to focus on traditional threat actors; we must also anticipate a future where adversaries leverage AI to accelerate and scale their attacks. This raises the bar for AI governance, demanding more rigorous controls, regular capability assessments, and a proactive approach to understanding what these models can do—not just in the hands of defenders, but also in the hands of potential attackers.

Shifting to infrastructure, there’s been a significant breach involving Cisco SD-WAN devices. Attackers exploited a vulnerability using custom malware to extract encryption keys. This incident is a stark reminder of the persistent risks associated with supply chain and infrastructure vulnerabilities, especially in widely deployed networking equipment. The practical takeaway here is clear: organizations must double down on patch management, ensure robust network segmentation, and maintain continuous monitoring of critical infrastructure. The goal is to detect signs of compromise early and limit the potential blast radius when vulnerabilities are inevitably discovered and exploited.

Mobile device security is also under fresh scrutiny following new research into Telegram’s sticker functionality. It turns out that malicious Telegram stickers can trigger code execution on iPhones—without any user interaction. This kind of zero-click exploit is particularly dangerous in environments with high-value targets, such as executives or personnel with access to sensitive systems. For CISOs, this means reviewing and tightening mobile device management policies, updating detection capabilities, and, crucially, educating users about the risks associated with third-party content in messaging platforms. The era of assuming that user interaction is required for compromise is over—attackers are finding creative ways to bypass traditional defenses.

On the regulatory front, we’re seeing a significant development with the introduction of the Common-Sense Cloud Security Act. This legislative proposal aims to strengthen cloud security and protect critical infrastructure by imposing stricter requirements on cloud providers and organizations leveraging cloud services. The message from policymakers is clear: compliance expectations are rising, and organizations should anticipate increased obligations in areas like cloud governance and supply chain risk management. Security leaders who get ahead of these requirements—by aligning with emerging best practices and proactively addressing cloud security gaps—will be better positioned to manage both risk and regulatory scrutiny.

Talent remains one of the most pressing challenges in cybersecurity. According to Barracuda research, 94% of organizations are facing cybersecurity skills gaps, a problem that’s being exacerbated as AI transforms security operations. The need for expertise now spans both traditional security domains and the rapidly evolving world of AI-driven tools. This isn’t just a staffing issue—it’s a strategic risk. If organizations can’t close these skills gaps, their ability to maintain effective security postures will be undermined. The solution requires a multi-pronged approach: investing in workforce development, prioritizing upskilling, and forming strategic partnerships to supplement internal capabilities.

Drilling down further, a Fortinet survey found that 68% of organizations cite AI experience as their top cybersecurity hiring challenge. This shortage of professionals with both cybersecurity and AI expertise threatens to slow the adoption of AI-enabled security solutions and could increase operational risk. CISOs should look beyond traditional hiring strategies. Targeted training programs, internal talent development, and collaboration with external experts can help bridge this gap. It’s also an opportunity to rethink how teams are structured and how responsibilities are distributed, ensuring that AI expertise is embedded across the security function.

Meanwhile, the proliferation of unsanctioned AI tools—often referred to as shadow IT—is creating new vectors for data leakage, compliance violations, and operational risk. These tools are often adopted by business units or individual employees without formal approval or oversight, making it difficult for security teams to maintain visibility and control. Addressing this requires more than just technical solutions; it demands engagement with business units, clear policy enforcement, and the development of processes to monitor and manage the use of AI tools across the organization. The risks associated with unauthorized AI adoption are real, and ignoring them can lead to significant exposure.

In response to the growing importance of AI governance and security, we’re seeing new solutions enter the market. IBM and Fleet have both announced tools aimed at securing and governing AI agents and employee devices. These offerings reflect a broader market shift toward formalizing AI governance, risk management, and compliance. Organizations should evaluate these tools in the context of their own AI adoption strategies, considering not just the technical capabilities, but also how they align with regulatory requirements and internal governance frameworks.

SentinelOne is also making moves in this space, unveiling its Singularity Agentic Detection and Response platform. This new solution is specifically designed to detect and respond to threats targeting AI agents. The emergence of specialized security solutions for AI-driven environments signals an industry-wide recognition that traditional tools may not be sufficient. Security teams should assess whether these new platforms can be integrated with existing detection and response workflows, and whether they provide the visibility and control needed to secure AI deployments.

At the governance level, there’s a growing consensus that boards need to take a more active role in overseeing AI risk. At ITWeb GRC 2026, experts emphasized the importance of ethics dashboards for AI governance. These dashboards provide boards with a real-time view of AI-related risks, ethical considerations, and compliance status. The trend is clear: board-level accountability for AI risk, ethics, and compliance is becoming the norm. CISOs should engage with governance stakeholders to ensure that oversight mechanisms are in place and aligned with both organizational values and regulatory expectations.

Risk management frameworks are another area where organizations need to step up. TechTarget recently highlighted that ad hoc approaches to AI risk are no longer sufficient. The complexity and potential impact of AI systems demand formal, structured frameworks that address both technical and ethical risks. Security leaders should champion the adoption of these frameworks, ensuring that AI initiatives are guided by clear principles and robust processes.

Procurement is emerging as a new front line in the battle against cyber risk. As organizations become more reliant on third-party vendors and supply chains, procurement functions are playing a critical role in managing exposure. Security and risk leaders must collaborate closely with procurement teams to embed security requirements into vendor selection and contract management processes. This isn’t just about ticking boxes—it’s about ensuring that third-party relationships don’t become the weakest link in the organization’s security posture.

Stepping back to look at the strategic implications, several themes stand out.

First, AI-driven automation is accelerating both attack and defense. This dynamic is forcing organizations to rethink how they approach threat detection and response. Automation can be a force multiplier for defenders, but it also raises the stakes by enabling attackers to operate at unprecedented scale and speed.

Second, regulatory and legislative activity is increasing, particularly around cloud security and AI governance. The compliance bar is being raised, and organizations that fail to keep pace risk not only regulatory penalties but also reputational damage.

Third, the skills shortage in both AI and cybersecurity is a persistent threat to effective security operations. It’s not just about having enough people—it’s about having the right expertise to manage increasingly complex and AI-driven environments.

Fourth, the expansion of shadow IT and unsanctioned AI tools is complicating risk management efforts. The attack surf

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber risk landscape is shifting at a pace that’s difficult to overstate. We’re seeing a dramatic escalation in both the sophistication and automation of attacks, driven largely by a new generation of AI-powered offensive tools. This isn’t just a theoretical risk—it’s playing out in real time, with multiple critical vulnerabilities under active exploitation and attackers leveraging AI agents to automate everything from reconnaissance to data theft.

Let’s start by looking at the most urgent vulnerabilities making headlines right now. First up is the Node.js Brotli vulnerability, also known as Node2Shell. This is a remote code execution flaw—CVE-2026-111497—that’s being actively exploited in the wild. CISA has added it to its Known Exploited Vulnerabilities catalog, which is never a good sign. What makes Node2Shell so dangerous is its potential impact on cloud and web application environments. The vulnerability allows unauthenticated attackers to execute arbitrary code on affected systems—essentially, it gives them the keys to the castle. If your organization relies on Node.js for any part of your web infrastructure, you need to prioritize patching immediately. Review your current deployments, assess your exposure, and make sure urgent patches are applied across the board. This is not the kind of risk you want lingering in your environment.

Moving on, we have the PHP2Shell exploits, which are being used by China-linked threat actors to root firewalls. Reports from SecurityWeek and CyberSecurityNews indicate that attackers are leveraging these vulnerabilities to bypass security controls and establish persistent access. What’s particularly concerning here is the targeting of firewalls—these are supposed to be your first line of defense, and if attackers can gain root access, they can manipulate traffic, exfiltrate data, or move laterally within your network. CISA has issued warnings about this campaign, emphasizing the need to monitor firewall logs, apply vendor patches, and review your network segmentation. If you haven’t already, take a close look at your firewall configurations and ensure you’re not overlooking any weak points that could be exploited.

Now, let’s talk about the role of AI in offensive cyber operations. Researchers have demonstrated that Claude AI, a generative AI model, can autonomously build exploit chains targeting Chrome browsers and Linux systems. We’re talking about one-click exploits for Chrome and zero-click exploits for Linux. Even more alarming, Claude AI has shown the ability to bypass Android lock screens. This is a clear signal that generative AI isn’t just a tool for defenders—it’s rapidly becoming a force multiplier for attackers. The practical implication is that organizations need to start integrating AI-aware security controls into their risk management strategies. Traditional approaches to threat modeling may not be sufficient when you’re up against autonomous systems capable of chaining together complex exploits in seconds.

Oracle’s E-Business Suite is also in the crosshairs. Attackers are actively probing and exploiting a new remote code execution vulnerability in Oracle EBS. For organizations that rely on Oracle for critical business operations, this is a high-stakes risk. Immediate patching is essential, but so is close monitoring of your Oracle environments for any signs of compromise. Given the central role that Oracle EBS plays in many enterprise workflows, a successful exploit here could have cascading effects across your operations.

CISA has also expanded its Known Exploited Vulnerabilities catalog to include flaws in Google Brotli, Adobe Commerce, and Magento. These are all platforms that underpin a significant portion of the e-commerce and web application ecosystem. The fact that these vulnerabilities are being actively targeted means that security teams need to verify patch status and review their application-layer defenses. Don’t assume that just because you’ve patched your core infrastructure, you’re out of the woods—application-level vulnerabilities are increasingly the vector of choice for attackers.

Another trend that’s gaining momentum is the use of AI agents, like CyberStrikeAI, to automate the entire attack lifecycle. According to CyberSecurityNews, attackers are now using these agents to conduct network scanning, exploitation, and data exfiltration at speeds that simply outpace manual detection and response. The automation reduces attacker dwell time and increases the speed of compromise, making it much harder for traditional security operations to keep up. If your detection capabilities aren’t tuned for AI-driven attacks, now is the time to reevaluate. Investing in automation for defense isn’t just a nice-to-have—it’s quickly becoming a necessity.

The surge in cybercrime isn’t just about technology—it’s also about people. Bizcommunity reports a significant increase in cybercrime, and a major factor is the widening skills gap in cybersecurity. Organizations that lack skilled personnel are at greater risk of breaches and often face prolonged incident response times. The message here is clear: investment in workforce development and upskilling is critical. You can have the best tools in the world, but if you don’t have the people to manage and interpret them, your risk posture is fundamentally weakened.

Let’s shift to a particularly concerning development: the rise of the AI worm. Anthropic has issued warnings about a new class of AI-powered malware capable of autonomously spreading across Internet of Things devices. These AI worms don’t just exploit a single vulnerability—they can adapt and propagate across a wide range of endpoints, especially in environments with weak segmentation or outdated firmware. For CISOs, this means it’s time to review your IoT asset inventories and update your segmentation and patching strategies. The proliferation of IoT devices in enterprise environments has created a massive, often poorly defended attack surface. Autonomous malware is poised to exploit these gaps at scale.

Attackers are also hijacking subdomains belonging to government and educational institutions to promote illegal gambling campaigns. This isn’t just a reputational risk—it’s also a vector for further exploitation of users who trust these domains. Security teams should be auditing DNS records, monitoring for unauthorized changes, and implementing domain protection measures. The integrity of your digital presence is increasingly under threat, and attackers are getting creative in how they leverage trusted brands for malicious purposes.

A recurring theme in all of this is that the pace of AI-driven threats now exceeds the capacity of manual security processes. Frontier Enterprise makes a strong case that organizations must adopt automated, AI-enabled defenses and update their governance frameworks to address the unique risks posed by AI. As AI agents become more deeply integrated into business operations, the attack surface expands, and the window for manual intervention narrows. If your security operations are still reliant on human speed, you’re already behind.

This brings us to AI governance. A recent survey by OutSystems found that many organizations lack robust AI governance frameworks. This is a significant blind spot, increasing the risk of unmonitored AI deployments and potential compliance violations. As AI becomes more embedded in business processes, the need for clear policies, cross-functional oversight, and continuous monitoring grows. Security and risk leaders should be prioritizing the development and enforcement of AI governance policies—not just to satisfy regulators, but to ensure that AI deployments don’t introduce unmanaged risk.

The market is responding to these challenges. Upwind, a security firm focused on protecting enterprise environments as AI agents enter the workplace, just raised $400 million in funding. This is a clear signal that boards and investors recognize the scale of the security challenges posed by AI. As AI agents gain access to sensitive data and systems, new attack surfaces emerge, and the scrutiny from regulators and stakeholders will only intensify. CISOs should be prepared for increased oversight and should anticipate questions about how they’re managing AI-related risks.

Let’s step back and look at the strategic implications of all these developments. First, the speed and automation of AI-driven attacks are fundamentally outpacing traditional security operations. This means that investment in AI-enabled defense and detection capabilities is no longer optional. Organizations that fail to adapt will find themselves increasingly vulnerable to attacks that move faster and with greater precision than any human-driven operation.

Second, the active exploitation of high-impact vulnerabilities—whether it’s Node.js, PHP, or Oracle EBS—underscores the need for immediate patching and continuous vulnerability management. The days of quarterly patch cycles are over. Threat actors are moving too quickly, and the window between vulnerability disclosure and exploitation is shrinking. Continuous monitoring, rapid patch deployment, and proactive vulnerability management need to be the norm.

Third, the skills gap in cybersecurity is a critical risk factor. Technology alone isn’t enough—you need a workforce that’s capable of understanding, managing, and responding to complex threats. This means investing not just in hiring, but in ongoing training and retention. Upskilling your existing team can often be more effective than trying to recruit your way out of a skills shortage.

Fourth, AI governance is lagging behind adoption. Many organizations are rushing to deploy

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is marked by a convergence of high-impact software vulnerabilities, rapid advances in AI security governance, and the relentless evolution of threat actors who now blend traditional and emerging technologies. We’re seeing a wave of zero-day exploits, urgent patching efforts, and a growing need for organizations to rethink how they manage risk across digital, physical, and human domains.

Let’s start with critical software vulnerabilities, which remain a persistent and urgent challenge. Apple has just issued emergency backported patches for a CoreGraphics zero-day vulnerability targeting older iPhone models. This isn’t just another routine update. The flaw allows attackers to execute arbitrary code simply by getting a user to open a maliciously crafted image. That means a single email attachment or web link could compromise a device, giving attackers a foothold inside your environment.

What makes this incident especially concerning is the focus on legacy assets. Many organizations, especially those with large or distributed workforces, still have older iPhones in circulation. These devices often slip through the cracks of standard patch management processes. Security leaders need to ensure they have visibility into all assets, not just the latest models, and that update mechanisms are robust enough to reach every device in the fleet. Failing to patch this CoreGraphics vulnerability could leave organizations exposed to targeted attacks that are already happening in the wild.

Moving to the server side, we’re seeing a similar pattern with PHP—a technology that underpins a significant portion of the world’s web infrastructure. Multiple critical vulnerabilities, including the “PHP2Shell” flaw, have been exploited, leading to rapid patch releases. The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has added these PHP vulnerabilities to its Known Exploited Vulnerabilities catalog. That’s a clear signal: these flaws are being abused at scale.

The risk here isn’t theoretical. Attackers can remotely execute code on vulnerable servers, potentially leading to full web server compromise, ransomware deployment, or even supply chain attacks that ripple through connected partners and customers. If your organization runs PHP-based applications, it’s time to prioritize patching and review your web application exposure. Don’t assume that just because you’re not a high-profile target, you’re safe—these attacks are often automated and opportunistic.

Shifting gears to threat actors, the Lazarus Group—linked to North Korea—has raised the bar by deploying malware that uses post-quantum encryption. This isn’t just a technical curiosity. Post-quantum cryptography is designed to withstand attacks from quantum computers, which are still in their infancy but advancing rapidly. By adopting these techniques now, Lazarus is complicating detection and remediation for defenders. Traditional security tools may struggle to analyze or decrypt this new breed of malware, making incident response slower and less effective.

The implications are significant. If one group is using post-quantum encryption in the wild, others will follow. Security teams should start monitoring for indicators of compromise related to post-quantum threats and assess their readiness for a future where quantum-resilient security isn’t just a research topic, but a practical necessity.

On the AI front, we’re seeing a surge in efforts to build trust and resilience into AI deployments. The security of AI systems is no longer just a technical concern—it’s a governance issue that touches on compliance, ethics, and business continuity. ISC2, a leading security certification body, has announced its first AI Security Certification, set for early 2027. Meanwhile, ServiceNow is developing sector-specific AI guardrails for the banking industry, reflecting the heightened regulatory and customer expectations in high-stakes sectors.

For CISOs and security leaders, this means tracking the evolution of AI security standards and investing in upskilling teams. As AI becomes more embedded in business processes, organizations will need to demonstrate not just technical competence, but also adherence to emerging best practices and compliance requirements. This is especially true in regulated industries, where the cost of a misstep can be severe.

The market for AI-driven security solutions is also heating up. SentinelOne has launched new AI-powered security offerings and expanded its partner network, aiming for improved detection, response, and automation. Cato Networks is extending its reach to secure AI clients, signaling a broader trend toward integrated, AI-powered security platforms. These solutions promise to streamline operations and enhance threat response, but they also require careful evaluation. Security executives should assess the maturity, interoperability, and governance features of these platforms, ensuring they don’t introduce new risks even as they solve old ones.

Vendor trust remains foundational. DigiCert, a major provider of digital trust services, has achieved ISO/IEC 27001:2022 certification. For organizations that rely on DigiCert for digital certificates and identity management, this milestone provides additional assurance of adherence to international security standards. It’s a reminder for risk leaders to validate the certification status of their critical vendors and to incorporate such achievements into their third-party risk assessments. With supply chain attacks on the rise, vendor due diligence is more important than ever.

Looking ahead, the threat landscape for 2026 is defined by the convergence of identity-based attacks, supply chain vulnerabilities, and deepfake-enabled fraud. Attackers are increasingly exploiting weaknesses in authentication processes and vendor relationships, using sophisticated deepfake techniques to bypass controls and manipulate trust. This isn’t just a problem for high-profile targets—any organization with valuable data or financial assets is at risk.

To stay ahead, security leaders must invest in advanced identity protection, robust supply chain due diligence, and deepfake detection capabilities. This means moving beyond traditional perimeter defenses and adopting a more holistic, risk-based approach to security. It also means educating employees and partners about the risks of social engineering and the importance of verifying identities, especially as deepfakes become more convincing and harder to detect.

The investment landscape is responding to these challenges. Recent moves, such as Protectt.ai’s majority stake in AIShield and the emergence of start-ups focused on local technology partner gaps, reflect a dynamic market for AI security solutions. While these developments offer new tools and approaches, they also require careful vetting. Not every start-up will have the maturity or alignment with your enterprise risk tolerance, so due diligence remains key.

As threats increasingly cross the boundaries between cyber and physical domains, integrated crisis response is becoming a necessity. A recent perspective piece underscores the need for crisis response plans that bridge digital and operational environments. This is especially critical for sectors with significant physical infrastructure or safety implications, such as energy, manufacturing, and transportation. Security leaders should develop integrated playbooks and cross-functional teams capable of responding to incidents that impact both IT and operational technology. The days of treating cyber and physical security as separate silos are over.

Environmental volatility and rapid advances in AI are also reshaping the risk horizon for 2027 and beyond. Organizations must anticipate not just technological innovation, but also external shocks—whether from climate events, geopolitical instability, or sudden shifts in regulatory requirements. Scenario planning and adaptive risk management frameworks will be essential for building resilience in this unpredictable environment.

Regional and sector-specific AI security initiatives are gaining momentum as well. Events like the Chief Digital & Data Officer Thailand Summit 2027 and targeted governance efforts in industries such as banking and healthcare signal a growing recognition that one-size-fits-all approaches won’t suffice. Security leaders should monitor these developments for emerging best practices and regulatory trends relevant to their operations. Staying plugged in to regional and industry conversations can provide early warning of shifts that may impact your risk posture or compliance obligations.

Let’s pull these threads together and talk about the strategic implications for security leaders.

First, legacy software and device management remain absolutely critical. Attackers are not just going after the latest and greatest—they’re exploiting unpatched vulnerabilities in widely deployed platforms, including older devices and software that may have fallen off the radar. Maintaining visibility and update processes for all assets, regardless of age, is non-negotiable.

Second, the adoption of post-quantum cryptography by threat actors is accelerating the need for quantum-resilient security strategies. Organizations can’t afford to wait until quantum computers are mainstream to start preparing. Begin assessing your cryptographic inventory, identify where quantum-vulnerable algorithms are in use, and develop a roadmap for migration to quantum-safe alternatives.

Third, AI governance and certification are quickly becoming essential components of enterprise risk management, especially in regulated se

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is marked by a convergence of governance challenges, emerging technical vulnerabilities, and an unmistakable increase in regulatory scrutiny. The headlines and threat intelligence coming in this week paint a picture of a risk environment that is not only more complex, but also more consequential—both for organizations and for society at large.

Let’s start at the highest level, because the stakes have never been clearer. The United Nations has issued a stark warning: weak cyber governance is now seen as a direct threat to global peace and security. This isn’t just about data breaches or ransomware anymore. The UN’s position signals a growing recognition that cyber threats can have geopolitical and societal consequences, potentially destabilizing entire regions or undermining trust in critical systems.

For security and risk leaders, this means that the bar has been raised. It’s no longer enough to focus on compliance or internal best practices. There’s a need to align your organization’s cyber governance with international standards and to anticipate regulatory and compliance shifts that may arise from global policy responses. We’re seeing a move toward harmonization of cyber regulations, but also a patchwork of new laws and frameworks emerging in different regions. Staying ahead of this curve is now a strategic imperative.

Turning to specific incidents, one of the most significant breaches reported this week involves ConnectWise. Attackers were able to compromise the ConnectWise platform, and from there, target hundreds of Microsoft 365 tenants. This incident is a textbook example of the cascading risks inherent in supply chain and third-party integrations—especially those that touch cloud services and identity management.

If your organization relies on ConnectWise or similar platforms, now is the time to review your exposure. Reinforce monitoring for anomalous activity, and make sure your incident response playbooks are up to date for SaaS supply chain attacks. The reality is, as more organizations move to the cloud and adopt interconnected tools, these kinds of supply chain attacks are only going to become more frequent and more impactful.

At the same time, we’re seeing persistent challenges in patch management, particularly with widely used tools. A newly disclosed, unpatched SSH vulnerability in Tailscale is a case in point. This flaw allows an attacker with access to a single compromised device to escalate privileges all the way to root. For organizations relying on Tailscale for secure remote access, this is a high-risk scenario.

There’s no patch available yet, so immediate mitigations are critical. Restrict SSH access as much as possible, and increase monitoring for any signs of anomalous activity. This is a reminder that even trusted security tools can become a vector for attack, and that a layered, defense-in-depth approach is essential.

Shifting from technical vulnerabilities to governance, the rapid adoption of AI is creating new visibility gaps and raising questions about the adequacy of current controls. One sector feeling the impact is financial advisory. An industry analysis this week highlights how Registered Investment Advisors—RIAs—are facing heightened cyber risks due to gaps in AI governance. The lack of robust oversight over AI-driven processes is leaving sensitive financial data and client assets vulnerable.

For CISOs in the financial sector, the message is clear: prioritize AI governance frameworks. Make sure that AI deployments are subject to the same risk assessments and controls as traditional IT systems. This isn’t just about technology—it’s about process, accountability, and ensuring that AI doesn’t become a blind spot in your risk management program.

Regulatory complexity is also on the rise. Vietnam, for example, has introduced a draft law proposing a five-tier data security risk framework. This signals a move toward more granular and risk-based regulatory requirements. Multinational organizations operating in or with Vietnam should prepare for compliance with new classification and control obligations. But more broadly, this development reflects a trend we’re seeing worldwide: regulators are demanding more nuance and specificity in how organizations manage and report on data security risks.

Healthcare is another sector in the crosshairs. A new threat landscape report for India’s healthcare and pharma sector details ongoing exposure to ransomware, data breaches, and targeted cyberattacks. The report underscores the sector’s attractiveness to threat actors—due to the sensitivity of the data involved and, often, limited security resources.

If you’re a security leader in healthcare, this is a call to action. Review sector-specific threat intelligence, and prioritize investments in detection, response, and recovery capabilities. Ransomware remains a top threat, and the impact on patient care and business continuity can be severe.

On the technology provider side, ServiceNow’s first earnings report since launching its AI governance initiative is being closely watched. The market’s response to ServiceNow’s strategy will influence how other technology vendors position their AI risk management offerings. For security leaders, it’s worth tracking the effectiveness and adoption of these platforms, as they may soon become integral to enterprise risk management strategies.

Oracle, meanwhile, has announced its “Deep Trust AI” architecture. The goal is to embed trust and security into AI systems, enabling enterprises to innovate with greater confidence. This reflects a broader trend among major vendors: differentiating on AI security and governance. For CISOs, the question is how these architectures can be integrated into your AI deployment strategies to enhance assurance and compliance.

But as organizations race to adopt AI, new risks are emerging around software assurance. The increasing use of AI to generate code is raising questions about the adequacy of code review and testing processes. Without robust oversight, organizations risk introducing vulnerabilities and compliance issues into production environments.

Security teams need to ensure that AI-generated code is subject to the same rigorous review and testing as human-written code. This may require specialized tools for AI code auditing, and a rethink of your software assurance lifecycle. The bottom line: don’t let the speed and convenience of AI-generated code come at the expense of security or compliance.

Another trend to watch is the rapid adoption of viral AI tools in the workplace. Employees are increasingly using unsanctioned AI applications, often without IT or security approval. This creates new visibility and control gaps, leading to risks like data leakage, compliance violations, and the proliferation of shadow IT.

Security leaders should enhance monitoring for unauthorized AI usage, and update acceptable use policies to address these emerging behaviors. User education is also key—make sure employees understand the risks associated with unsanctioned AI tools, and provide clear guidance on what is and isn’t allowed.

Decentralized compute platforms, especially those used for AI workloads, are also complicating traditional audit and security practices. A recent case study highlights the need for new approaches to auditing and securing distributed AI environments—particularly around GPU resource management and data privacy.

CISOs should assess their readiness for decentralized architectures, and update audit frameworks to reflect the unique challenges of these environments. Traditional perimeter-based controls may not be sufficient, and new tools and processes may be required to ensure visibility and control.

Data quality is another foundational issue that’s coming to the fore. In the insurance sector, a new analysis argues that data quality will be a key differentiator for group protection carriers—more so than the AI tools themselves. Poor data quality can undermine the effectiveness of AI-driven risk assessments and claims processing, leading to increased fraud and compliance risks.

Security and risk leaders should prioritize data governance and integrity as foundational to AI initiatives. This means investing in data stewardship, validation, and quality assurance processes. The effectiveness of your AI systems will only be as good as the data they’re built on.

So, what are the strategic implications of all these developments?

First, supply chain and SaaS platform risks remain a top concern. The ConnectWise breach is just the latest example of how third-party risk can cascade across cloud environments and identity platforms. Organizations need to enhance their third-party risk management programs and ensure they have rapid response capabilities for supply chain attacks.

Second, AI governance is emerging as a critical control area. Regulatory and market pressures are driving the adoption of new frameworks and tools, and organizations that get ahead of this curve will be better positioned to manage risk and maintain compliance.

Third, data quality and stewardship are foundational—not just for AI security, but for broader risk management. Renewed investment in data governance is essential to ensure the integrity and effectiveness of digital initiatives.

Finally, the pace of technological change—especially in AI and decentralized compute—is outstripping traditional governance models. This requires agile and adaptive risk management approaches. Static policies and controls are no longer sufficient; organizations need to be able to pivot quickly as new threats and technologi

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber risk landscape is shifting at a pace that’s challenging even the most prepared organizations. The convergence of artificial intelligence and cybersecurity is creating a threat environment that’s not just fast-evolving, but fundamentally different from what we’ve seen before. AI-driven vulnerabilities have become the fastest-growing category of cyber risk, outpacing the ability of many organizations to secure and govern these new technologies. At the same time, we’re seeing a sharp rise in zero-day exploits, persistent attacks on critical infrastructure, and new governance challenges as workforce reductions and skills gaps strain security teams.

Let’s break down what’s driving these changes, what it means for security and risk leaders, and where the most urgent priorities lie.

First, let’s talk about the explosive growth of AI vulnerabilities. According to a new report, vulnerabilities introduced by AI systems are now expanding more rapidly than any other category of cyber risk. This isn’t just about AI being used by attackers—it’s about the risks that come with integrating AI into business processes and critical infrastructure. As organizations race to adopt AI, they’re often deploying models and systems faster than they can secure them. The traditional approaches to risk assessment and mitigation simply aren’t keeping up. What’s needed now are AI-specific controls and monitoring capabilities—tools and processes designed to address the unique risks that come with machine learning, large language models, and autonomous agents.

The practical implication is clear: security teams can’t just bolt AI onto their existing risk frameworks and hope for the best. They need to rethink how they assess, monitor, and respond to AI-driven threats. This includes everything from model validation and data integrity checks to monitoring for adversarial attacks and ensuring transparency in how AI decisions are made.

But AI isn’t just introducing new risks; it’s also changing how we discover and respond to vulnerabilities. Take the recent disclosure of a critical PHP vulnerability. What’s remarkable here is that OpenAI’s models were credited with identifying the flaw—demonstrating how AI can accelerate vulnerability discovery. OpenAI has even proposed a five-stage disclosure plan to manage these discoveries responsibly. This is a double-edged sword. On one hand, AI can help us find and fix vulnerabilities faster. On the other, it raises the stakes for rapid patching and coordinated disclosure, because attackers can use the same AI tools to find flaws just as quickly.

For security leaders, this means development and operations teams need to be ready for accelerated vulnerability cycles. Processes for prompt remediation, patch management, and responsible disclosure need to be in place and well-practiced. The days of waiting weeks or months to patch critical infrastructure are over—especially when AI is in the mix.

We’re also seeing persistent exploitation of zero-day vulnerabilities in widely used platforms. VMware’s VeloCloud Orchestrator, a key component of many SD-WAN deployments, has been hit by three zero-day attacks in just four months. This kind of repeated targeting highlights how attractive cloud and network orchestration platforms have become to threat actors. These systems are the backbone of modern networks, and when they’re compromised, the impact can be widespread.

The lesson here is that cloud networking components require heightened vigilance. Rapid patch management is essential, and close coordination with vendors for threat intelligence and updates is non-negotiable. Security teams need to know not just what’s vulnerable, but what’s being actively targeted in the wild.

Linux, too, remains a critical battleground. A set of severe vulnerabilities—rated 9.0 on the CVSS scale—were recently leaked in the Linux kernel’s ksmbd module before official patches were available. Premature disclosure like this increases the risk of exploitation, especially for organizations running unpatched Linux servers. The takeaway is straightforward: prioritize patching, and consider additional mitigations for exposed SMB services. If you’re running Linux in production, you can’t afford to be complacent.

All of these technical challenges are happening against a backdrop of organizational strain. The USDA recently admitted that workforce reductions have made human oversight of federal AI systems “untenable.” This is a stark admission, and it points to a broader challenge across both public and private sectors. As AI systems proliferate, many organizations simply don’t have the human resources needed to ensure responsible governance. The risk is that automation runs unchecked, leading to compliance failures and potentially catastrophic outcomes.

Security and risk leaders need to take a hard look at their own oversight capacity. Are there enough skilled people to manage, monitor, and govern AI systems? If not, what’s the plan to close that gap? Automation can help, but it can’t replace the need for human judgment—especially when it comes to governance and accountability.

The skills gap is even more pronounced in security teams themselves. A recent Barracuda India survey found that 81% of security teams report significant AI skills gaps, and 66% have experienced headcount reductions due to AI adoption. This creates a dangerous dynamic: fewer, less-prepared staff are being asked to manage increasingly complex, AI-driven threats. The operational risk here is substantial.

For CISOs, the message is clear. Upskilling and workforce planning aren’t just HR issues—they’re critical to your security posture. Investing in talent, training, and retention is as important as investing in technology. Without the right people, even the best tools and processes will fall short.

As AI systems become more autonomous, governance and accountability are becoming major flashpoints. CIOs are increasingly being held accountable for the actions of AI agents, even when those agents operate beyond direct human control. This raises tough questions about liability, oversight, and the limits of human intervention. Security and risk leaders must ensure there are robust oversight mechanisms in place, and that accountability structures are clearly defined. You can’t manage what you can’t see, and you can’t be accountable for what you don’t understand.

Vendor claims about AI safeguards are also coming under scrutiny. Metr has recently challenged Anthropic’s assertions about the effectiveness of its AI safeguards, raising questions about transparency and reliability in the AI security space. For CISOs, this is a reminder that independent validation and continuous monitoring of third-party AI solutions are essential. Don’t take vendor assurances at face value—demand evidence, ask tough questions, and verify for yourself.

Zooming out to the global threat landscape, SOCRadar’s latest report on Belgium highlights trends that are relevant far beyond one country. Ransomware, data breaches, and nation-state activity remain persistent threats, and the findings echo what we’re seeing across Europe and globally. Localized threat intelligence and sector-specific risk assessments are more important than ever. Understanding the unique risks facing your region and industry can make the difference between a near-miss and a major incident.

The healthcare sector, in particular, remains a high-value target. The HIPAA Journal reports ongoing increases in healthcare data breaches, with ransomware and exploitation of vulnerabilities as primary drivers. Healthcare organizations hold sensitive, valuable data and often operate with legacy systems that are difficult to secure. The result is a persistent threat environment that demands sector-specific controls, rapid detection, and incident response capabilities. If you’re in healthcare, the basics—patching, segmentation, backup, and response planning—are more critical than ever.

Financial services are facing similar pressures. India’s State Bank (SBI) recently notified customers affected by a cyber incident, underscoring the ongoing risk of data breaches in the financial sector. Transparent communication and customer protection measures are essential after an incident, but prevention is always better than cure. The New Relic report highlights the growing importance of AI governance and observability in finance. As AI adoption accelerates, so does the need for robust monitoring, compliance, and risk management frameworks tailored to the unique challenges of AI-driven processes.

So, what are the strategic implications of all this?

First, AI-driven vulnerabilities and automation are outpacing traditional security controls. This isn’t a future problem—it’s a current reality. Organizations need new governance and monitoring approaches that are purpose-built for AI. That means developing frameworks for model validation, bias detection, adversarial testing, and ongoing monitoring of AI behavior. It also means building transparency and explainability into AI systems from the ground up.

Second, the persistent exploitation of zero-day vulnerabilities in widely used platforms like PHP, Linux, and SD-WAN orchestrators requires accelerated patch management and close collaboration with vendors. Security teams need to be plugged into real-time threat intelligence and ready to act quickly when new vulnerabilities are disclosed.

Third, workforce reductions and AI skills gaps are creating operational risk. Talent development and retention must be a strategic priority. Upskilling existing staff, recruiting new talent, and leveraging automation to augment human cap

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Let’s get right into today’s cyber and AI risk landscape, where the pace of threats is not just accelerating—it’s fragmenting across every layer of digital infrastructure. We’re seeing a sharp rise in critical vulnerabilities, supply chain attacks, and the unchecked spread of AI agents, all converging to create a risk environment that’s more complex and urgent than ever.

Let’s start with the vulnerabilities making headlines. Node.js, the popular JavaScript runtime that powers everything from streaming giants like Netflix to countless enterprise backends, has been hit with a critical flaw. This vulnerability allows attackers to execute arbitrary code or disrupt services, which means that any organization relying on Node.js for core operations is potentially at risk. The practical implication here is significant. If exploited, attackers could breach sensitive data or bring down essential services—think outages, data leaks, or even lateral movement deeper into your network. The lesson is clear: monitoring upstream dependencies isn’t optional. When a critical advisory like this drops, immediate patching and a thorough code review are essential. For security leaders, it’s a reminder that your risk doesn’t end with your own codebase; it extends to every library and runtime you build on.

Node.js isn’t alone. PHP, which remains foundational to so many web applications, is under active attack as well. Researchers have confirmed that exploitation of a major PHP vulnerability—dubbed PHP2Shell—actually started days before the official patches were released. This is a classic example of attackers moving faster than defenders. If you’re running unpatched PHP systems, you’re in the crosshairs. The window between vulnerability disclosure and exploitation is shrinking, so patching cycles need to be measured in hours, not weeks. It’s also a wake-up call to review your web application firewalls and ensure they’re tuned to detect and block emerging exploit techniques. Monitoring for indicators of compromise is crucial, especially if you can’t patch immediately.

But vulnerabilities aren’t just about code flaws—they’re also about the software supply chain. We’re seeing a surge in attacks that target the very building blocks of modern applications. Take the recent LiteLLM incident. A malicious version of this AI package—specifically v1.107.0—was discovered exfiltrating cloud credentials and AI API keys. This is dependency poisoning in action: attackers inject malicious code into a widely used package, and as soon as organizations update, their credentials are silently siphoned off to an attacker-controlled server. The implications here are broad. Credential theft at this level can lead to unauthorized access across cloud environments, data exfiltration, and potentially even manipulation of AI models. The takeaway: audit your dependencies regularly, rotate credentials if you suspect exposure, and implement controls that can detect anomalous package behavior. Don’t assume that a package update is always safe—especially in the fast-moving world of AI.

Supply chain risk doesn’t stop at open-source packages. Managed service providers are also in the firing line. Microsoft recently attributed a supply-chain attack on ConnectWise Cloud Backup to the threat actor known as Storm-0940, who used the ARTEX malware. The cascading impact here is what makes supply chain attacks so dangerous. When a service provider is compromised, every downstream customer is potentially at risk. This incident is a reminder to review your vendor risk management processes. Are you monitoring for signs of compromise in your third-party providers? Do you have robust incident response plans in place for when—not if—a supply chain breach occurs? These are the questions risk leaders need to be asking.

Cloud infrastructure, too, is proving to be a rich target. Onamae.com, a major cloud service provider, recently discovered malware planted on its servers, affecting over 26,000 systems. The sheer scale of this breach highlights the risk organizations take when they rely on external cloud providers without continuous monitoring and strong segmentation. If you’re using Onamae.com, assess your exposure immediately and coordinate with your provider for remediation. But more broadly, this is a call to action for all organizations leveraging cloud infrastructure: ensure you have rapid incident response capabilities, and don’t assume your provider’s security posture is sufficient.

Shifting gears, let’s talk about ransomware—a threat that refuses to fade into the background. The ransomware groups Qilin and INC are actively exploiting a known vulnerability in Palo Alto VPN appliances. This is a textbook example of attackers targeting remote access infrastructure, which remains a critical point of entry for many organizations. The attack chain is straightforward: exploit the VPN, gain initial access, and deploy ransomware. The solution isn’t complicated, but it does require discipline: verify your patch status, review VPN logs for suspicious activity, and test your incident response procedures specifically for ransomware scenarios. Multi-factor authentication should be non-negotiable on all remote access points.

Attackers are also getting creative with social engineering, especially in the mobile space. We’re seeing a wave of fake app updates being distributed to replace legitimate banking apps with malicious versions. This tactic leverages both weak app distribution controls and the trust users place in official-looking updates. The result is stolen credentials, financial loss, and reputational damage for both users and organizations. Security teams need to double down on user education, enforce strict app store policies, and actively monitor for unauthorized app versions circulating in the wild. For organizations with a distributed workforce or customer base, mobile security can’t be an afterthought.

Data breaches remain a constant drumbeat. The State Bank of India recently confirmed a breach that exposed over 3,000 customer records on the dark web. While the scale may seem limited compared to some mega-breaches, the reputational and regulatory consequences are real. This is a reminder that incident response and customer notification protocols need to be reviewed and tested regularly. Even small breaches can have outsized impacts in regulated industries like finance.

Now, let’s turn to the AI risk landscape, which is evolving at breakneck speed. Enterprises are deploying AI agents across their operations, but security controls are lagging behind. According to industry analysis, the rapid proliferation of AI agents is outpacing the implementation of access controls, monitoring, and governance frameworks. This gap increases the risk of unauthorized actions, data leakage, and compliance violations. For CISOs, the priority should be clear: integrate AI-specific security measures into your existing frameworks, and don’t let the speed of adoption outstrip your ability to govern these systems.

The market is responding to this challenge. The global market for AI security solutions is projected to reach $96 billion by 2035—a reflection of both the expanding attack surface and the growing recognition that AI governance isn’t optional. Security leaders should anticipate greater scrutiny of their AI risk management practices, both from regulators and from business stakeholders. Budgeting for new tools and talent in this space is going to be essential.

Workforce skills are a big part of the equation. CompTIA has launched an initiative to define the skills necessary for managing and securing AI agents. This is a welcome move, given the skills gap that’s emerging as organizations race to adopt AI. Investment in training and upskilling will be critical—not just for security teams, but for anyone involved in deploying or managing AI systems. The goal is to build AI-ready security teams that can keep pace with both the technology and the threat landscape.

Compliance is also coming to the forefront, especially as regulations around AI and data security tighten. Solutions like SecuraTrack are gaining traction as tools to bridge the gap between compliance and real security outcomes. These platforms help operationalize controls and provide evidence for audits, but they’re not a silver bullet. Careful integration with broader risk management strategies is needed to ensure that compliance doesn’t become a box-ticking exercise, but actually drives meaningful security improvements.

Let’s step back and look at the strategic implications of all these developments. First, supply chain attacks remain a top risk vector. Whether it’s a compromised open-source package, a managed service provider breach, or a cloud infrastructure incident, the message is the same: vendor and dependency management must be prioritized. You need visibility into your software supply chain, robust processes for vetting and monitoring vendors, and contingency plans for when things go wrong.

Second, the rapid exploitation of vulnerabilities is now the norm. Attackers are moving faster than ever, sometimes exploiting flaws before patches are even available. Continuous patch management and the integration of real-time threat intelligence are essential. It’s not enough to patch on a monthly cycle—critical vulnerabilities need to be addressed immediately, and systems should be monitored for signs of exploitation.

Third, AI governance and security controls are lagging behind adoption. As organizations rush to deploy AI agents, they’re often skipping over the hard work of building governance frameworks and integrating security controls. This is a recipe for trouble. Proactive framew

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk environment is defined by two powerful, converging forces: the relentless surge of targeted ransomware campaigns, and the rapid evolution of AI governance solutions. Both are reshaping how organizations think about security, compliance, and operational resilience. Let’s break down the most pressing developments, their practical implications, and what risk leaders need to focus on right now.

First, let’s talk about ransomware. Over the past several months, we’ve seen a significant escalation in both the frequency and sophistication of ransomware attacks. One of the most concerning trends is the active exploitation of high-profile vulnerabilities in widely used technologies—particularly those that serve as gateways into enterprise environments.

A prime example is the persistent exploitation of the Palo Alto GlobalProtect VPN vulnerability, tracked as CVE-2026-0257. Since June, ransomware groups, including Qilin and INC, have been aggressively targeting this flaw. What makes this vulnerability so dangerous is that it allows attackers to bypass authentication controls, granting them unauthorized access to enterprise networks. Once inside, attackers can move laterally, steal data, and ultimately deploy ransomware payloads.

Despite advisories and patches released by the vendor, exploitation of this VPN flaw continues at scale. This underscores a critical lesson for security leaders: timely patch management and continuous monitoring of remote access infrastructure are non-negotiable. It’s not enough to rely on vendor advisories or hope that your systems aren’t targeted. Organizations need to proactively assess their exposure, prioritize remediation, and maintain vigilant oversight of all remote access points. The stakes are high—failure to act can result in data theft, operational disruption, and significant financial and reputational damage.

The threat landscape extends well beyond a single vulnerability. The SafePay ransomware campaign is another stark reminder of the risks facing critical infrastructure. According to CISA and allied agencies, SafePay has compromised at least 600 organizations worldwide, spanning sectors like energy, healthcare, and transportation. What sets SafePay apart is its use of sophisticated tactics to evade detection and maximize disruption. The campaign’s scale and persistence highlight the urgent need for robust backup strategies, comprehensive incident response planning, and active participation in cross-sector information sharing.

For CISOs, this means reviewing your ransomware defenses with a critical eye. Are your backups resilient and regularly tested? Is your incident response plan up to date and actionable? Are you plugged into industry information sharing networks to stay ahead of emerging threats? Aligning your defenses with CISA’s mitigation guidance is essential, but so is fostering a culture of preparedness across your organization.

Ransomware isn’t the only risk. Data breaches continue to plague the financial sector, with India’s State Bank (SBI) recently suffering a breach that exposed the personal information of 375,000 users. This incident is a reminder that financial institutions remain prime targets for both external attackers and insider threats. The implications are significant—not just in terms of immediate financial loss, but also in terms of customer trust and regulatory compliance.

For risk leaders in the financial sector, the SBI breach reinforces the importance of strong data protection controls, regular security audits, and transparent breach notification processes. Customers expect—and regulators demand—swift, honest communication when incidents occur. Building and maintaining trust requires not only technical controls, but also a commitment to transparency and accountability.

Identity infrastructure is another area under sustained attack. The threat group known as BRONZE SANDCASTLE has successfully exfiltrated Active Directory databases from targeted organizations by leveraging covert Windows backdoors. This attack vector is particularly insidious because it enables adversaries to harvest credentials and escalate privileges, posing a severe risk to enterprise identity infrastructure.

The practical takeaway here is clear: organizations need to enhance monitoring for anomalous Active Directory activity, conduct regular credential hygiene reviews, and deploy advanced endpoint detection solutions. Identity is the new perimeter, and attackers know it. Defending your identity infrastructure requires both technical controls and a disciplined approach to credential management.

Turning to the software supply chain, the latest release of the Rust programming language—version 1.100—introduces a new feature called “Cargo Security Cooldowns.” This is designed to mitigate the risk of malicious dependency attacks by enforcing cooldown periods before new packages become widely available. The goal is to reduce the window of exposure to supply chain compromises.

For CISOs overseeing software development, this is a timely reminder to evaluate the adoption of similar controls across their toolchains. Secure coding practices and supply chain security are now fundamental to resilience. The days of blindly trusting third-party packages are over; every dependency is a potential attack vector.

Cloud security continues to present unique challenges. A recent analysis highlights the reality that, in the cloud, the traditional network perimeter has essentially dissolved. With the proliferation of SaaS, IaaS, and hybrid architectures, organizations can no longer rely on static boundaries to protect their assets. Instead, the focus must shift toward identity-centric security models and continuous monitoring.

This means embracing zero trust principles—never trust, always verify—and investing in robust identity threat detection. Policies and controls need to be dynamic, adaptive, and capable of addressing the distributed nature of cloud workloads. For risk leaders, this is both a technical and a cultural shift. It requires rethinking how access is granted, monitored, and revoked, and ensuring that security is embedded at every layer of the cloud stack.

As cloud and hybrid environments become more complex, the market for identity threat detection and response (ITDR) solutions is growing rapidly. Organizations are investing in advanced ITDR platforms to detect and mitigate credential-based attacks and lateral movement. These tools are becoming essential for enhancing resilience against evolving threats.

Security executives should take a hard look at their current identity protection posture. Are you able to detect anomalous behavior in real time? Can you respond quickly to credential compromise or privilege escalation? Integrating ITDR capabilities can provide the visibility and control needed to stay ahead of attackers.

Now, let’s shift to the accelerating world of AI governance. Financial institutions, in particular, are under mounting pressure to adopt robust AI governance platforms. This is driven by a combination of regulatory scrutiny, risk management needs, and the operational demands of AI-powered tools. Recent reports, including those from New Relic and Kovrr, indicate a rising demand for observability and automated policy enforcement in AI-driven environments.

For CISOs in regulated sectors, this is a call to action. Evaluating and adopting AI governance solutions is no longer optional. It’s about ensuring alignment with emerging regulatory requirements and internal risk appetites. The market is maturing rapidly, with new partnerships and product launches signaling a shift from theory to practice.

One example of this trend is the expanded partnership between SentinelOne and Lenovo. Together, they’re integrating AI-powered security and governance features into Lenovo’s ThinkShield portfolio. The aim is to deliver enhanced threat detection, automated response, and compliance management for enterprise devices. For security leaders, these types of partnerships are important indicators of market direction. Integrated AI security solutions offer the potential for greater efficiency, improved threat detection, and streamlined compliance.

Fleet is another vendor making moves in this space, launching new AI governance capabilities designed to help organizations manage and secure AI-enabled endpoints. Their platform provides visibility, policy enforcement, and risk assessment for enterprise devices leveraging AI. As AI adoption accelerates, governance frameworks need to address not only technical risks, but also ethical considerations. This includes transparency, accountability, and the responsible use of AI across the organization.

Security operations centers (SOCs) are also seeing the impact of AI. SentinelOne’s new Singularity ASOC platform leverages AI to automate threat detection, investigation, and response. The goal is to close the cybersecurity skills gap and improve operational efficiency. For risk executives, this raises important questions about the maturity of their SOC automation. How much of your threat detection and response is still manual? Where can AI add value, and what are the risks of over-automation?

The cybersecurity skills gap is a persistent challenge across the industry. A new analysis from Barracuda Networks explores how AI is being used to address this shortage. AI-driven tools are automating routine tasks, freeing up security teams to focus on higher-value activities and reducing burnout. For CISOs, integrating AI into security operations is an opportunity to maximize team effectiveness and resilience. But it also requires careful planning to

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is marked by a convergence of active exploits, rapid AI adoption, and increasingly complex governance challenges. As we look across the industry, it’s clear that attackers are moving quickly to take advantage of new vulnerabilities in widely deployed software, while organizations are racing to deploy AI-driven security and management tools. But this acceleration is not without its own set of risks.

Let’s start with a look at some of the most pressing cyber exploits making headlines right now.

One of the most significant threats today comes from a critical vulnerability in the Siemens Software Center. Attackers are actively exploiting this flaw using a malware campaign known as ClickFix. For organizations that rely on Siemens for industrial and operational technology, this is a wake-up call. The risk isn’t just about data loss—these environments often control physical processes, meaning a successful attack could disrupt manufacturing lines, energy distribution, or other critical services. The lesson here is straightforward but urgent: patch OT and IT software as soon as fixes become available, and maintain vigilant monitoring for any indicators of compromise. In operational environments, downtime or manipulation isn’t just inconvenient—it can have far-reaching operational and even safety consequences.

Switching gears to network infrastructure, Palo Alto Networks’ PAN-OS is also under active attack. The vulnerability, tracked as CVE-2026-0257, is being leveraged by threat actors to bypass security controls and potentially gain privileged access to critical systems. This is particularly concerning because firewalls and network security appliances are often the last line of defense. The exploitation of this vulnerability underscores the need for immediate patching, but also for enhanced monitoring and compensating controls. If you’re responsible for security operations, now is the time to review your incident response plans and make sure you’re ready to contain threats quickly. These types of vulnerabilities are often exploited within hours of public disclosure, so speed and preparation are essential.

Data breaches remain a persistent and high-impact risk, as demonstrated by the recent incident at Nikkei. Hackers managed to steal 1.8 million records, highlighting the ongoing risk to sensitive information and the reputational and regulatory fallout that can follow. For security leaders, this is another reminder to review data loss prevention strategies, scrutinize third-party risk management, and ensure breach notification protocols are up to date and well-practiced. The sheer scale of this breach is a reminder that attackers are still finding ways to exfiltrate large volumes of data, and that the consequences can be severe and long-lasting.

While these cyber exploits are grabbing headlines, the rapid adoption of AI is fundamentally reshaping the risk landscape. Microsoft, for example, is rolling out dynamic permissions and risk scoring for AI agents. This is a response to the growing threat of rogue or misconfigured AI processes—essentially, AI agents that act unpredictably or can be subverted by attackers. The move toward granular access controls and continuous risk assessment for AI agents is something every organization should be evaluating. If your business is deploying—or even experimenting with—AI-driven automation, it’s critical to ensure your governance models can keep up. Dynamic controls, regular reviews, and scenario-based risk assessments are becoming table stakes for responsible AI adoption.

The theme of governance complexity is echoed in what’s being called the “agent governance tax.” Enterprises adopting agentic AI are often investing in multiple layers of control—sometimes four or more—before they’ve even demonstrated clear business value from these systems. This reflects the uncertainty and complexity of AI risk, but it also raises questions about efficiency and value. Security leaders need to strike a balance: invest in robust oversight, but also develop clear metrics for value and risk reduction. Avoid unnecessary complexity that can bog down innovation or create more problems than it solves.

Another major trend is the shifting cybersecurity talent landscape. Hiring in the cybersecurity sector has hit a four-year low, even as demand for AI-related skills continues to rise. Organizations are clearly prioritizing automation and AI-driven solutions, but this shift could leave gaps in traditional security expertise. The risk here is twofold: on one hand, automation can increase efficiency and help offset the talent gap; on the other, it can introduce new oversight and skills challenges if human expertise doesn’t keep pace. Workforce planning and upskilling are more important than ever. Security leaders should ensure that automation doesn’t outpace human oversight, and that teams are equipped to manage both traditional and emerging threats.

Given the complexity of today’s IT environments, unified visibility and risk management are becoming critical. H₂O Retailing, for example, is deploying Tenable One to centralize cyber exposure management across its multi-cloud infrastructure. This reflects a broader industry trend: as organizations move to hybrid and multi-cloud deployments, the risk of blind spots increases. Centralized platforms can help streamline vulnerability management and provide a comprehensive view of risk across diverse environments. For CISOs, this is a call to consider similar approaches—reducing complexity and improving response times by unifying exposure management.

Let’s talk about AI risks and enterprise resilience. New analysis is highlighting how issues like model drift, adversarial attacks, and governance failures are putting enterprise resilience to the test. AI models can degrade over time, be manipulated by attackers, or fail due to poor oversight. Organizations must adapt their risk management frameworks to address these evolving threats. This means integrating AI-specific controls, conducting scenario planning, and leading cross-functional efforts to assess and mitigate AI-driven disruptions. The bottom line is that resilience now depends on integrating cyber and AI risk management—not treating them as separate silos.

AI-assisted software development is another area to watch. Research from ActiveState suggests that AI-assisted development is consuming over 13,900 engineering hours annually per enterprise. While AI can accelerate development, it also introduces new risks around code quality, security, and oversight. Security leaders should ensure that secure development practices and code review processes are adapted for AI-generated code. This includes automated scanning, manual review of critical changes, and ongoing education for development teams about the risks of relying too heavily on AI-generated outputs.

Small businesses are also in the crosshairs of AI-enabled cyberattacks. They’re often seen as low-hanging fruit because they may lack the resources for advanced defenses. However, some are fighting back by adopting innovative security measures and forming partnerships to bolster their defenses. For larger organizations, this trend has implications for supply chain risk. If you rely on smaller partners, vendors, or service providers, it’s important to assess their security posture and consider how their vulnerabilities could impact your own risk exposure. Supporting or vetting the security of smaller partners should be part of any comprehensive third-party risk management strategy.

We’re also seeing new developments in the governance of critical infrastructure. A recent report revealed that CISA was asked to conduct a covert penetration test on a voting machine. This raises important questions about the government’s role in offensive security and the transparency of security testing in election infrastructure. For risk leaders, it’s a reminder of the sensitive nature of security testing in critical systems, and the need for transparency, legal compliance, and clear communication with stakeholders. Testing is essential, but it must be conducted in a way that maintains public trust and complies with all relevant laws and standards.

On the technology front, agineo and ServiceNow have launched an AI Control Tower as a Service, aiming to provide centralized oversight and governance for enterprise AI deployments. This is part of a growing market for AI management platforms, but it also signals the complexity of orchestrating AI at scale. Security leaders should carefully evaluate the maturity of such offerings and consider how they fit within broader governance and compliance frameworks. Centralized control towers can help manage risk, but they’re not a silver bullet—success depends on how well these tools are integrated into existing processes and how effectively they’re used to enforce policy and monitor for anomalies.

Stepping back, what are the strategic implications of these developments?

First, the active exploitation of high-impact vulnerabilities in core infrastructure—like Siemens Software Center and PAN-OS—requires continuous patch management and rapid incident response readiness. Organizations can no longer afford to treat patching as a periodic activity. It needs to be a continuous, prioritized process, supported by real-time monitoring and automated deployment wherever possible.

Second, AI adoption is accelerating, but governance, permissioning, and oversight must keep pace. Dynamic controls, like those being rolled out by Microsoft, are a step in the right direction. But organizations need to go further—evaluating their AI governance frameworks, updating po

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk environment is defined by a convergence of accelerating AI adoption, persistent vulnerabilities in core infrastructure, and the growing complexity of governance challenges. As organizations race to integrate generative AI and automation into their business processes, they’re unlocking new opportunities for innovation—but also exposing themselves to a host of new risks. Shadow AI, fragmented security controls, and inherited governance models are testing the limits of traditional risk management. Meanwhile, critical vulnerabilities like the recent Linux kernel exploit—known as PwnEscape—remind us that the foundations of our digital infrastructure remain vulnerable, and that operational resilience depends on both robust patch management and effective incident response.

Let’s break down the most pressing themes shaping today’s landscape and what they mean for risk leaders, CISOs, and boards.

First, the PwnEscape Linux kernel vulnerability has forced cloud provider Contabo to reboot its entire VPS infrastructure. This exploit allows attackers to break out of virtualized environments, potentially compromising host systems and customer data. For organizations relying on cloud and virtualized services, this incident is a stark reminder of the persistent threat posed by zero-day vulnerabilities. The operational disruption caused by emergency patching and forced reboots is significant, but the potential for data compromise is even more concerning.

What’s the takeaway here? Timely patching is non-negotiable, but it’s only one part of the equation. Layered defenses—such as network segmentation, continuous monitoring, and rigorous access controls—are essential. Equally important is maintaining clear communication protocols with cloud vendors. When a major provider like Contabo is forced to take emergency action, every customer needs to know what’s happening, what data might be at risk, and what steps they need to take. This incident reinforces the need for proactive vendor risk management and a culture of operational readiness.

Next, let’s talk about shadow AI. As AI tools become more accessible, employees are increasingly adopting them outside of official governance channels. This “shadow AI” phenomenon mirrors the shadow IT challenges of the past, but with higher stakes. Unmanaged AI use can lead to data leakage, compliance failures, and the introduction of unvetted models into critical workflows.

Experts recommend a four-pronged approach to address shadow AI: policy enforcement, technical controls, employee education, and continuous monitoring. For CISOs, this means expanding the scope of shadow IT detection to include AI tools and models. Acceptable use policies need to be updated to cover AI, and risk assessments should be embedded in both procurement and development processes. Employee education is crucial—staff need to understand not just the potential of AI, but also the risks associated with unsanctioned use. Finally, continuous monitoring ensures that policy violations and emerging risks are detected early, before they escalate into incidents.

Closely related to shadow AI is the issue of fragmented AI security. In many organizations, different business units or teams are implementing their own AI solutions, often with inconsistent security safeguards. This fragmentation creates blind spots—areas where data leakage, model manipulation, or compliance failures can occur without detection. Even well-intentioned AI initiatives can be undermined by a lack of centralized oversight.

The solution is to prioritize unified AI security frameworks and establish cross-functional governance bodies. These structures ensure consistent risk management across the enterprise, providing clear guidelines for model development, deployment, and monitoring. Centralized oversight doesn’t mean stifling innovation—it means enabling it to happen safely, with accountability and transparency.

The market is responding to these challenges. The AI model risk management sector is projected to surge, reaching nearly $29 billion by 2035. This growth is driven by the widespread adoption of generative AI and a heightened awareness of risks like model drift, bias, and regulatory scrutiny. Boards and regulators are increasingly expecting organizations to demonstrate robust model validation, ongoing monitoring, and thorough documentation. For CISOs, this means preparing for deeper engagement with senior leadership and regulators, and investing in the processes and tools needed to manage AI model risk at scale.

AI-powered threat detection is also reshaping the cloud security market. These tools promise faster identification of novel attack patterns and the automation of incident response. But their effectiveness hinges on the quality of the data they ingest and their integration with existing security operations. Security leaders need to evaluate the maturity of AI-driven solutions and ensure they complement—not replace—traditional detection and response capabilities. Automation can accelerate response times, but it can’t substitute for the judgment and experience of skilled security professionals.

A new challenge is emerging with the proliferation of “inherited agents”—AI systems that operate autonomously or are deeply embedded in business workflows. These agents can bypass established controls and governance models designed for conventional software. As a result, organizations may find themselves exposed to unanticipated risks, such as unauthorized data access or unintended actions taken by autonomous agents.

Risk leaders must adapt their governance frameworks to account for the autonomy of these agents. This includes lifecycle management—tracking where agents are deployed, what data they access, and how they make decisions. Auditability is key: organizations need to be able to explain and document the actions of AI agents, both for internal oversight and external compliance.

Amid all this complexity, data governance is emerging as the cornerstone of resilient AI strategy. Industry consensus is building around the idea that effective data stewardship underpins model reliability, regulatory compliance, and organizational trust. Without strong data governance, even the most advanced AI systems are vulnerable to bias, drift, and misuse. CISOs should champion enterprise-wide data governance initiatives, working to align data owners, AI developers, and risk management teams. This alignment ensures that data is accurate, secure, and used appropriately throughout the AI lifecycle.

The financial services sector is a case in point. At the recent Smart Banking 2026 event, industry leaders emphasized the convergence of AI, fraud prevention, and cybersecurity as central to the future of banking. The sector is investing heavily in AI-driven controls to detect and prevent fraud, but these advances bring new challenges. As AI introduces new fraud vectors and regulatory expectations evolve, financial CISOs must benchmark their risk management practices against emerging industry standards. The goal is to stay ahead of both attackers and regulators, while maintaining customer trust.

Vendor risk remains a critical issue, as highlighted by ConnectWise’s recent suspension of its cloud backup offering due to security concerns. While details are still emerging, the move underscores the importance of robust supply chain and third-party risk management. Organizations must review their vendor risk processes regularly and ensure they have contingency plans in place for critical service disruptions. The managed services ecosystem is only as strong as its weakest link, and proactive oversight is essential.

Identity management is another area undergoing rapid transformation. Enterprises are increasingly adopting identity-centric controls for AI agents, focusing first on perimeter defenses—such as authentication and access control—before establishing robust measurement and monitoring capabilities. This sequencing can leave gaps in visibility and accountability. It’s not enough to know who or what has access; organizations also need to continuously measure and monitor the behavior of AI agents to detect anomalies and ensure compliance. A balanced approach is needed, one that combines strong access controls with ongoing behavioral analysis.

Recent law enforcement actions also offer lessons for enterprise risk management. The FBI’s arrest of an 18-year-old swatting suspect, who believed VPNs and anonymization tools would shield him from detection, demonstrates the limits of these technologies. While this case isn’t a direct enterprise risk, it serves as a reminder that anonymization tools can be misused by insiders or threat actors. Organizations should monitor for the misuse of such technologies within their environments and maintain robust insider threat detection programs.

As organizations scale their use of AI automation, foundational controls become even more critical. Access management, audit trails, and explainability are not optional—they are prerequisites for trusted and compliant AI deployment. These controls should be embedded from the outset of any AI initiative, not retrofitted after the fact. This proactive approach ensures that as automation scales, trust and compliance are maintained.

Let’s step back and consider the broader strategic implications. Zero-day vulnerabilities in core infrastructure—like the PwnEscape exploit—remain a top operational risk. Proactive patch management and close coordination with vendors are essential. Shadow AI and fragmented governance threaten to undermine enterprise risk postures, making unified frameworks and cross-functional oversight

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is rapidly evolving, shaped by a mix of escalating nation-state activity, critical zero-day exploits, and mounting pressure on organizations to strengthen their AI governance. Let’s break down the most significant developments and what they mean for risk leaders, CISOs, and organizations navigating this complex environment.

We’re seeing a decisive shift in the global technology landscape, as China has announced new restrictions on the export of advanced technologies, including artificial intelligence. Citing national security concerns, this move is more than just a headline—it signals a new era of geopolitical tech controls. For organizations that rely on global supply chains, especially those sourcing AI hardware or software from China, the implications are immediate. There’s a real risk of disruption, whether that’s delays in acquiring critical components, increased compliance requirements, or even sudden loss of access to certain technologies.

Risk leaders now face a mandate to reassess supplier dependencies. This isn’t just about checking a box for compliance; it’s about understanding where your critical assets and capabilities are exposed to geopolitical risk. For many, this will mean mapping out supply chains in greater detail, identifying single points of failure, and developing contingency plans. The broader context is clear: as geopolitical tensions rise, technology risk management becomes inseparable from international relations. Organizations that fail to adapt could find themselves caught off guard by sudden policy shifts or export controls that fundamentally alter their risk landscape.

Turning to cyber threats, a critical zero-day vulnerability in BeyondTrust’s remote support software has been actively exploited by China-linked threat actors. Attackers have used this flaw to take over remote support servers, steal credentials, and erase security logs—making their activity harder to detect and investigate. This campaign is a textbook example of the risks associated with trusted third-party tools. Remote support platforms are often deeply integrated into organizational networks, and a compromise here can provide attackers with broad access.

For organizations using BeyondTrust or similar platforms, the practical takeaway is urgent: prioritize incident response, review access controls, and ensure rapid patching. Log integrity monitoring is also critical—attackers are increasingly erasing their tracks, so organizations need to ensure that security logs are protected and regularly backed up. This incident underscores the importance of third-party risk management. Trusted vendors can become prime targets, and their vulnerabilities can quickly become your vulnerabilities.

The cascading impact of cyberattacks on critical infrastructure is further illustrated by the recent incident at BAE Systems. A cyberattack targeting this major defense contractor led to widespread disruption of bankruptcy court operations across the United States. This is a stark reminder that attacks on defense contractors and essential service providers don’t just affect those organizations—they can ripple out to disrupt public infrastructure and services relied upon by millions.

For risk leaders, this means that continuity planning and third-party risk assessments are more important than ever. It’s not enough to secure your own environment; you need to understand the risk posture of your key vendors and partners, especially those supporting essential services. Regular testing of continuity plans, clear communication protocols, and robust incident response capabilities are now table stakes.

Shifting gears to artificial intelligence, we’re witnessing the rapid proliferation of “shadow AI”—autonomous AI systems operating outside formal IT oversight. These agentic systems are being deployed by business units, individual employees, or even external partners, often without the knowledge or approval of security teams. The risks here are significant: unmonitored data flows, compliance violations, and unpredictable behaviors that can lead to operational or reputational damage.

Many organizations are simply unprepared for the risks posed by shadow AI. Discovery and governance of these unsanctioned deployments should be a top priority for CISOs. This means working closely with business units to identify where AI is being used, establishing clear policies, and enforcing controls to ensure that AI systems are operating within acceptable risk parameters. The goal isn’t to stifle innovation, but to make sure that AI is deployed safely, securely, and in alignment with organizational values and regulatory requirements.

The governance gap around AI is becoming increasingly visible at the highest levels. An IBM study has found that AI-related incidents are now being discussed in boardrooms, yet formal governance frameworks are lagging behind. This disconnect exposes organizations to a range of risks—reputational, operational, and regulatory. Security and risk executives need to advocate for board-level engagement on AI risk. This isn’t just an IT issue; it’s a strategic business risk that demands attention from the top.

Accelerating the development of comprehensive AI governance structures is essential. This includes clear policies on data use, model transparency, accountability, and incident response. As AI incidents become more frequent and more impactful, organizations that lack mature governance frameworks will find themselves exposed—not just to technical failures, but to regulatory scrutiny and public backlash.

Governments and industry leaders are taking notice. There are urgent calls for stronger AI oversight as cyber threats escalate. Regulatory bodies are considering new frameworks, and executives are warning that basic security hygiene must not be neglected in the rush to deploy AI. The message is clear: innovation cannot come at the expense of foundational controls. Organizations should monitor evolving regulatory expectations and ensure that security basics—like access management, monitoring, and incident response—remain firmly in place alongside new AI initiatives.

The sense of urgency is echoed by the UK’s AI minister, who has publicly warned that a major cyberattack is “inevitable.” This isn’t hyperbole; it reflects a growing consensus among government officials and industry leaders that the threat environment is intensifying. Organizations need to maintain robust incident response capabilities and prepare for large-scale, disruptive events. This means not only having plans on paper, but regularly testing them, ensuring that key stakeholders know their roles, and that communication channels are clear and resilient.

On the technology front, we’re seeing new partnerships aimed at improving risk detection and response. Keeper Security and Tenable have announced an integration designed to streamline cloud risk detection, remediation, and vulnerability assessment. This partnership reflects the growing demand for unified solutions that address identity, cloud, and supply chain risks in hybrid environments. For security leaders, evaluating such integrations can offer improved visibility and faster response times—key advantages in today’s fast-moving threat landscape.

Meanwhile, threat actors are continuing to exploit vulnerabilities in network and IoT devices. Recent campaigns have targeted D-Link, Ubiquiti, and SAP devices, hijacking them for use in proxy networks. These compromised devices can be used to facilitate further intrusions, exfiltrate data, and obfuscate malicious activity. The lesson here is straightforward: timely patching of network and IoT devices is critical, as is monitoring for unusual outbound traffic that could indicate a device has been compromised.

For technology companies, particularly those in Massachusetts, the cybersecurity and data protection challenges are mounting. Regulatory compliance, ransomware, and evolving threat vectors are all top of mind. The key to managing these risks is proactive risk management—regular assessments, employee training, and a culture of security awareness. It’s not enough to react to incidents; organizations need to anticipate and prepare for them.

As AI adoption accelerates, we’re also seeing the emergence of new tools designed to help organizations govern AI agents and ensure compliance. ServiceNow’s launch of “AI Passport” is a case in point. This solution aims to automate governance for enterprise AI agents, managing their lifecycle and accountability. For risk leaders, tools like this can help bridge the gap between rapid AI adoption and the need for robust oversight. Automated governance solutions can enforce policies, monitor for deviations, and provide audit trails—critical capabilities as AI becomes more deeply embedded in business processes.

In the financial sector, regulatory changes are on the horizon. The UK’s Prudential Regulation Authority is looking to consolidate rules governing payment systems. While the details are still emerging, this move could have significant implications for risk management and compliance in the financial services industry. Security and risk executives should closely monitor these developments and assess their impact on payment system security.

Stepping back, several strategic implications emerge from these developments. First, geopolitical tech controls—like China’s export curbs—have the potential to disrupt supply chains and force organizations to rethink their dependencies on AI and hardware from specific regions. This isn’t just a theoretical risk; it’s a practical challenge that requires new approaches to supplier risk managemen

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk environment is defined by a relentless pace of attacks, a surge in exploitation of zero-day vulnerabilities, and a growing sense of urgency around AI governance. We’re seeing adversaries target the very infrastructure designed to keep organizations safe, while AI is increasingly being used both as a tool for defenders and as a weapon for attackers. The stakes are rising, and the gap between risk and effective response is becoming more apparent—especially in critical infrastructure and enterprise environments.

Let’s start with the most pressing developments on the cyber front. Over the past 24 hours, attackers have been actively exploiting vulnerabilities in widely deployed security appliances and software. This includes Fortinet, Palo Alto, Ivanti, Cisco, and even WinRAR. These aren’t obscure products—they’re foundational elements in many organizations’ security stacks, and that’s exactly why they’re such attractive targets.

A particularly concerning campaign involves hackers exploiting Fortinet vulnerabilities to deploy a stealthy malware strain called PEERSTITCH on FortiGate firewalls. The sophistication here is notable: PEERSTITCH is engineered for stealth and persistence, allowing attackers to maintain long-term, undetected access to compromised firewalls. This isn’t just about breaking in—it’s about staying in, quietly monitoring traffic, and waiting for the right moment to move laterally across the network. The fact that attackers are focusing on security infrastructure itself is a wake-up call. These devices are often trusted implicitly, and if they’re compromised, the attackers can potentially pivot deeper into your environment without raising alarms.

For security leaders, this underscores a few critical imperatives. First, timely patching is non-negotiable. If you’re running FortiGate firewalls, you need to be aware of the latest advisories and ensure you’re not lagging behind on updates. Second, continuous monitoring of your security appliances is essential. Don’t assume that just because a device is labeled “security,” it’s immune from attack. In fact, these devices should be among the most closely watched assets in your environment. Finally, any anomalous behavior observed on these devices should trigger rapid investigation. Attackers are counting on organizations being slow to respond or failing to notice subtle changes.

Moving to Ivanti, CISA has issued a fresh alert regarding active exploitation of a zero-day vulnerability in Ivanti Connect Secure VPN appliances. Attackers are leveraging this flaw to steal credentials and sensitive data, posing a direct threat to organizations that rely on Ivanti for remote access. The practical takeaway here is clear: apply available mitigations immediately, monitor for signs of compromise, and review your remote access policies. VPN appliances are high-value targets—if compromised, they can give attackers a direct line into your internal network, bypassing many traditional defenses.

It’s a similar story with Palo Alto Networks’ PAN-OS. A critical zero-day vulnerability, designated CVE-2026-0322, is being actively exploited in the wild. Organizations using affected versions are urged to patch immediately. The risk here isn’t hypothetical—attackers can use this flaw to gain unauthorized access or disrupt security operations. This incident reinforces the importance of rapid vulnerability management and close coordination with vendors. When a zero-day hits, every hour counts. Make sure your team is plugged into vendor threat intelligence and patch guidance.

Cisco is also in the spotlight, having issued an urgent advisory for customers to patch a critical vulnerability in its email gateway products. Email gateways are a prime target for attackers looking to intercept or manipulate business communications. If you’re running Cisco gateways, prioritize patching, review your email logs for any suspicious activity, and enhance monitoring. Email remains one of the most common initial access vectors for attackers, and a compromised gateway can have broad implications for data loss and business continuity.

We’re also seeing attackers exploit a critical authentication bypass vulnerability in Fortinet FortiClient EMS. What’s especially concerning here is that a proof-of-concept exploit has already been released. This lowers the barrier to entry for would-be attackers, increasing the risk of widespread exploitation. If you haven’t already, apply patches immediately and monitor for unusual access patterns. Authentication bypass vulnerabilities are among the most dangerous, as they can allow attackers to walk right in without needing valid credentials.

Legacy software isn’t immune, either. A threat group identified as UAT-6275 is exploiting a vulnerability in WinRAR to target government organizations in the Commonwealth of Independent States. This campaign is a reminder that unpatched, widely used utilities can present a significant risk, especially in government and critical infrastructure environments. Security leaders should ensure all endpoints are updated and consider restricting the use of high-risk utilities like WinRAR, especially if they’re not strictly necessary for business operations.

Let’s shift gears to the intersection of cyber and AI risk—a space that’s evolving rapidly and presenting new challenges for organizations. A recent report found that AI is now used in 84% of ransomware attacks. That’s a staggering statistic. Adversaries are leveraging AI to automate targeting, evade detection, and compromise identity infrastructure. This trend amplifies the risk to organizations’ authentication and access systems. It’s not just about defending against brute-force attacks anymore; it’s about defending against intelligent, adaptive adversaries who can move faster and more quietly than ever before.

The practical implication is that organizations need to enhance their identity protection strategies. Multi-factor authentication is a must, but it’s not sufficient on its own. AI-driven anomaly detection should be part of your toolkit. Monitor for unusual login patterns, privilege escalations, and other indicators of compromise. And don’t overlook the human element—ensure that employees understand the risks and know how to recognize and report suspicious activity.

Ransomware actors are also escalating their tactics. We’re seeing a shift in focus—not just targeting organizations, but also going after employees and their families. This is a significant evolution in ransomware strategy. By using social engineering and extortion, criminals are increasing the pressure on organizations to pay up. This raises the risk of insider threats and can cause significant reputational damage. Organizations need to bolster employee awareness and support, and ensure that incident response protocols are up to date. It’s not just about protecting data and systems anymore—it’s about protecting people.

The convergence of AI and cyber threats is also putting identity infrastructure under sustained attack. As attackers weaponize AI, traditional defenses are being bypassed with increasing frequency. This demands a reassessment of identity and access management controls. Organizations need to move beyond static defenses and invest in AI-driven detection and response capabilities. The goal is to spot and stop attacks before they can do real damage.

Now, let’s talk about the broader AI landscape. Enterprises are entering a new phase of AI adoption—one that’s focused on risk management. CompTIA research indicates that organizations are moving from experimentation to a more mature, risk-aware approach. Security concerns are now a top priority, and there’s a growing recognition of the need for formal governance, risk assessment, and controls around AI deployments.

But there’s a gap. An IBM study found that 80% of UK enterprises now escalate AI-related incidents to their boards, but many report lagging governance and oversight. This highlights a growing materiality of AI risks at the executive level, but also a lack of mature governance structures and incident response plans for AI systems. The trust gap in enterprise AI is real. Stakeholders are concerned about transparency, bias, and security. The recommended solution is robust governance—continuous monitoring, clear accountability, and alignment with regulatory expectations.

For CISOs and risk executives, the imperative is clear: accelerate the development of AI governance frameworks that go beyond static compliance. Static compliance approaches—where you check the box once and move on—are insufficient, especially in critical infrastructure. Instead, what’s needed is continuous monitoring and adaptive controls. AI systems are dynamic by nature; the risks they present can change over time, and your governance approach needs to reflect that.

Expert commentary stresses that for critical infrastructure, continuous monitoring and real-time risk detection are necessary to manage evolving threats and maintain resilience. CISOs should be advocating for dynamic governance models and investing in the tools and processes that enable ongoing oversight of AI-enabled systems. This isn’t just about regulatory compliance—it’s about operational resilience and maintaining trust with stakeholders.

Let’s distill the strategic implications from today’s developments. First, the wave of zero-day vulnerabilities in security infrastructure means organizations need to accelerate patching and implement continuous monitoring. Attackers are increasingly targeting the very tools meant to protect us, and complacency is not an option.

Second, the weaponization of AI in ransomware an

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

The cyber and AI risk landscape is evolving at an unprecedented pace, shaped by the convergence of escalating technical threats and increasingly complex governance challenges. Today, we’re seeing a perfect storm: critical vulnerabilities in widely used platforms are being exploited within days—or even hours—of public disclosure, while the rapid adoption of AI agents and agentic architectures is introducing new attack surfaces and operational uncertainties that many organizations are still struggling to understand, let alone secure.

Let’s start by looking at the technical threat environment. Over the past 24 hours, several high-impact vulnerabilities have come to light, and attackers are wasting no time in leveraging them. SonicWall, Windows, and iOS—all foundational platforms for enterprise IT—are in the crosshairs, with active exploitation already underway.

One of the most significant developments is the emergence of AI agents as both a defensive and offensive force. Recent incidents have shown AI agents breaching production environments and spreading malware at scale. This isn’t just a theoretical risk—these are real-world exploits where AI-driven malware has slipped past traditional defenses, automated its own propagation, and compromised critical systems. The dual-use nature of AI is now front and center: while AI can help us automate detection and response, it also gives adversaries the ability to launch attacks that are faster, more adaptive, and more autonomous than anything we’ve seen before.

For security leaders, this means that monitoring AI agent activity is now a must-have, not a nice-to-have. We’re talking about robust access controls, continuous validation of AI-driven processes, and a shift toward proactive detection and response. If your organization is deploying AI agents—whether for IT automation, customer service, or security operations—you need to be asking hard questions about how those agents are being controlled, audited, and monitored for signs of compromise.

Let’s turn to SonicWall. A newly disclosed critical vulnerability in SonicWall devices is being actively exploited in the wild. SonicWall is a staple in perimeter security for thousands of organizations, and this flaw is giving attackers a foothold that can be used to pivot deeper into enterprise networks. The practical takeaway is straightforward: if you’re running SonicWall devices, patch now. Don’t wait for a scheduled maintenance window—this is an urgent, high-priority fix. Beyond patching, review your network segmentation and monitor for lateral movement. Attackers who gain access through the perimeter will often look for ways to escalate privileges and move laterally, so having strong segmentation and detection controls in place is essential.

Mobile security is also under siege. Researchers have identified two exploit kits—Coruna and DarkSword—that can fully compromise iPhones from a single malicious web visit. This is a stark reminder that zero-click and drive-by attacks against mobile devices remain a persistent threat, even for platforms with a reputation for strong security. For CISOs, the implications are clear: reinforce your mobile device management policies, ensure rapid OS patching, and keep users educated about the risks of clicking on untrusted links or visiting unknown websites. The mobile attack surface is only growing as more business processes go mobile, and attackers are keeping pace.

Microsoft’s latest patch release is another headline-grabber, addressing an astonishing 1,413 CVEs. That’s right—over 1,400 vulnerabilities patched in a single release cycle. But even with this massive effort, at least one zero-day vulnerability remains unpatched and is being actively exploited. The sheer volume of vulnerabilities highlights just how challenging patch management has become, especially for large organizations with complex IT environments. Security teams need to prioritize based on exploitability and business impact, and critical fixes need to be deployed as quickly as possible. This is not the time to let technical debt accumulate.

Another area of concern is Windows SmartScreen. A vulnerability here is being exploited to enable privilege escalation, giving attackers higher-level access on compromised systems. This type of exploit is particularly dangerous in environments where users have broad privileges or where network segmentation is weak. The lesson here is twofold: patch promptly, and review your endpoint protection controls to ensure that privilege escalation attempts are being detected and blocked.

While technical vulnerabilities are dominating the headlines, there’s a parallel—and equally important—story unfolding around governance and risk management. Organizations and governments are wrestling with the challenge of enabling AI innovation while managing its risks. Industry leaders and regulators are calling for measurable security improvements, robust AI risk management frameworks, and executive-level oversight.

One of the most important shifts we’re seeing is the recognition that AI risk management is now a board-level issue. The days when AI governance could be delegated to IT or security teams alone are over. Executive and board-level stakeholders need to be engaged, informed, and accountable. This means integrating AI risk into enterprise risk management frameworks, ensuring cross-functional collaboration, and establishing clear lines of responsibility for AI oversight.

Let’s dig a bit deeper into the operational implications for CISOs and risk executives. The current threat environment demands a holistic approach that spans technical, organizational, and regulatory domains. Continuous patching and vulnerability management are table stakes. But that’s just the beginning. Rapid detection and response capabilities are essential, especially as AI accelerates the speed and sophistication of both attacks and defenses.

Technical debt, supply chain compromise, and AI model misuse are no longer hypothetical risks—they’re material, urgent, and require attention at the highest levels of the organization. If you’re not already treating these as strategic risks, now is the time to start.

Let’s talk about the shift from traditional cybersecurity to decision intelligence. Organizations are increasingly leveraging advanced analytics and AI to transform raw threat signals into actionable intelligence. This isn’t just about automating alerts—it’s about enabling faster, more informed decision-making at every level of the organization. But to get there, you need new skills, new processes, and new governance models. CISOs should be evaluating their threat intelligence programs and investing in capabilities that support this transition. The goal is to move from reactive firefighting to proactive, strategic risk management.

As organizations deploy agentic AI systems at scale, new architectural and security challenges are emerging. Managing distributed, autonomous AI agents is fundamentally different from managing traditional software. You need robust controls, clear governance, and continuous monitoring. Security-by-design principles must be embedded from the outset, and AI deployments need to be aligned with your organization’s risk appetite. If you’re not thinking about AI architecture as a core part of your enterprise architecture, you’re already behind the curve.

A recent analysis highlights the emerging blind spots in risk management as AI adoption accelerates. Traditional risk frameworks may not fully capture the dynamic and opaque nature of AI-driven systems. Security and risk leaders are being urged to update their risk assessment methodologies, incorporate AI-specific controls, and foster a culture of continuous learning and adaptation. The reality is that AI systems can behave in unexpected ways, and the risks are often difficult to predict in advance.

The UK’s AI Safety Institute has issued a warning about the risks posed by unreleased or untested AI models. These models may harbor unknown vulnerabilities or behaviors that could be exploited by malicious actors. For organizations developing or integrating third-party AI, this is a wake-up call: rigorous testing, supply chain due diligence, and ongoing monitoring of AI model performance and security are non-negotiable.

On the governance front, multiple organizations are expanding their focus on executive-level cybersecurity and AI governance. This trend reflects a growing recognition that AI risk management requires cross-functional collaboration and clear accountability. CISOs should ensure that AI risk is integrated into enterprise risk management frameworks and that executive stakeholders are actively engaged in oversight and decision-making.

AI is also fundamentally changing the economics and dynamics of cybersecurity. Automated threat detection, response, and even offensive capabilities are evolving rapidly. Security leaders need to reassess their technology investments, workforce skills, and risk models to ensure they can keep pace with AI-driven change. The old playbook won’t cut it anymore.

Let’s bring this all together with a few strategic implications. First, the speed and automation enabled by AI agents require a fundamental rethink of detection, response, and access control strategies. You can’t rely on manual processes to keep up with AI-enabled threats. Automation, orchestration, and continuous monitoring are now essential components of a modern security strategy.

Second, the volume and severity of newly disclosed vulnerabilities reinforce the need for mature, prioritized patch management and vulnerability scanning. This isn’t just about keeping up with patch cycle

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is evolving at an unprecedented pace, marked by the convergence of advanced threats and rapid integration of artificial intelligence across enterprise environments. The headlines are filled with incidents that highlight both the ingenuity of attackers and the growing complexity of defending modern organizations. Today, I’ll walk through the most significant developments, unpack their practical implications, and outline what security leaders need to focus on right now.

Let’s begin by looking at the ongoing exploitation of zero-day vulnerabilities in core infrastructure. Citrix NetScaler appliances, widely used for application delivery and remote access, are currently being targeted by attackers leveraging previously unknown flaws. The goal? To deploy the Platypus remote access tool, which enables persistent, stealthy access to enterprise environments. What makes this campaign particularly concerning is that it bypasses many traditional security controls—once inside, attackers can move laterally and maintain a foothold, often undetected.

This kind of infrastructure-level attack underscores the critical importance of rapid patching. When a zero-day is disclosed, the window for attackers to exploit it before organizations can respond is often measured in hours or days, not weeks. That means vulnerability management can’t be a quarterly exercise—it needs to be continuous. In addition to patching, network segmentation is vital. By limiting the blast radius of a compromised device, organizations can prevent attackers from easily accessing sensitive systems. For CISOs, the message is clear: prioritize vulnerability scanning, ensure timely deployment of patches, and monitor for unusual remote access activity, especially from devices like NetScaler that sit at the heart of enterprise networks.

Moving from infrastructure to the endpoint, another campaign making waves involves the Kimsuky threat group. They’re using fake Zoom installers and malicious shortcut files—those .lnk files you might see on your desktop—to distribute malware. This is a classic example of social engineering, where attackers trick users into running malicious code, often by mimicking legitimate software updates or installers. The continued success of these tactics reminds us that the human element remains one of the weakest links in cybersecurity.

Organizations need to double down on user awareness and training. It’s not enough to rely solely on technical controls; employees must be able to recognize suspicious files and installation prompts. Endpoint protection, application whitelisting, and restricting software installation privileges can all help reduce risk. Security teams should review their policies to ensure that only approved applications can be installed, and that users are regularly reminded of the dangers posed by unsolicited downloads and email attachments.

Browser session hijacking is another area where attackers are innovating. A new technique leveraging the XWorm HBrowser plugin allows adversaries to take over authenticated browser sessions—without ever needing the user’s credentials. Essentially, attackers can piggyback on existing sessions, bypassing multi-factor authentication and session management controls. This is a significant concern for any organization that relies on web-based applications for sensitive operations.

To mitigate this risk, organizations should review their browser security policies. This includes enforcing up-to-date browser versions, disabling unnecessary plugins, and monitoring for anomalous session activity. Real-time detection of session hijacking attempts is still a developing area, but security teams need to stay vigilant. Regularly reviewing session logs and looking for patterns of access that don’t align with normal user behavior can help spot attacks early.

On the macOS front, a new malware called GhostProfile is making headlines. Its method of operation is to clone browser profiles, effectively hijacking live user sessions. This allows attackers to access sensitive information and perform actions as if they were the legitimate user. Historically, macOS has been perceived as less susceptible to malware than Windows, but that gap is closing rapidly. The emergence of threats like GhostProfile highlights the necessity of cross-platform endpoint security—organizations can no longer afford to treat macOS as a second-class citizen in their security strategy.

Regular monitoring of browser artifacts, such as profile data and session cookies, is increasingly important. Security teams should also ensure that macOS devices are included in endpoint detection and response (EDR) deployments, and that users are educated about the risks of browser-based attacks.

Attackers are also exploiting the intersection of emerging technologies to distribute malware. One recent campaign involves fake Web3 accelerator programs, which offer credits for popular AI tools like Claude and Gemini as a lure. These offers are designed to catch the attention of organizations interested in AI and blockchain, two areas that are seeing explosive growth. The tactic is simple: dangle something valuable, like free access to cutting-edge AI, and deliver malware instead.

This trend illustrates how attackers are quick to adapt their social engineering techniques to align with what’s top-of-mind for their targets. For security teams, the takeaway is to be skeptical of unsolicited offers, especially those related to new technology platforms. Always validate the source before engaging or downloading anything. If it sounds too good to be true, it probably is.

Shifting gears to data loss prevention, a recent survey from the Cloud Security Alliance reveals a sobering reality: many DLP solutions only detect data loss after it has already occurred. In other words, they’re reactive rather than proactive. This leaves organizations exposed to both insider threats and accidental leaks—risks that are only amplified as AI-driven data flows increase in volume and complexity.

CISOs should take this as a call to action to evaluate the effectiveness of their current DLP tools. Are they capable of real-time monitoring? Can they detect anomalous data movements before sensitive information leaves the organization? Augmenting traditional DLP with AI-based anomaly detection and real-time alerting can help close the gap. It’s also important to regularly review and update data classification policies, ensuring that the most sensitive information is subject to the highest levels of protection.

On the technology front, Thales has launched CipherTrust Data Security Posture Management, or DSPM, specifically designed to address AI access risks. As AI models increasingly interact with critical business data, the need for visibility and control over who—and what—can access that data becomes paramount. Tools like DSPM help enforce least privilege, monitor access patterns, and provide the audit trails necessary for both security and compliance.

Security leaders should assess whether such solutions are applicable to their own AI environments. As AI adoption accelerates, it’s essential to have controls in place that are tailored to the unique risks posed by autonomous systems. This includes not just technical controls, but also policies around data governance and access management.

Speaking of AI adoption, Manulife has rolled out an enterprise AI platform designed to scale AI solutions across its global operations. This is part of a broader trend: organizations are investing heavily in AI to drive business value, automate processes, and gain competitive advantage. But with this growth comes new challenges around governance, data protection, and cross-border compliance.

Risk executives need to ensure that AI initiatives are aligned with security and privacy requirements from day one. That means involving security teams early in the development and deployment process, conducting thorough risk assessments, and establishing clear guidelines for data usage and model training. Cross-border data flows, in particular, require careful attention to regulatory requirements, especially as privacy laws continue to evolve worldwide.

Another significant development is the partnership between HCLTech and Anthropic, focused on deploying agentic AI with built-in safety controls for enterprise use. Agentic AI refers to systems that can act autonomously, making decisions and taking actions without direct human oversight. As these systems become more prevalent, the need for robust guardrails becomes critical.

CISOs should monitor advancements in agentic AI and evaluate the maturity of safety controls before deployment. This includes assessing how well these systems can be audited, how incidents are detected and responded to, and whether operational “red lines” are clearly defined. The goal is to ensure that as AI agents gain more autonomy, they do so within a framework that prioritizes safety, transparency, and accountability.

Workforce risk remains a persistent challenge, and it’s not limited to any one region. Liquid C2’s partnership with KnowBe4 aims to bring workforce risk management solutions to African businesses, highlighting the universal importance of the human factor in cyber risk. Social engineering continues to be one of the most effective attack vectors, whether it’s through phishing emails, malicious links, or impersonation.

Comprehensive training and risk management programs are essential for organizations of all sizes and sectors. This isn’t a one-and-done exercise—ongoing education, simulated phishing campaigns, and clear reporting channels for suspicious activ

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is more dynamic and complex than ever, with both technical exploits and governance challenges converging to create a high-pressure environment for security leaders and risk executives. We’re seeing a surge in high-profile vulnerabilities, active exploitation by threat actors, and a rapidly evolving regulatory climate driven by the widespread adoption of artificial intelligence. Let’s break down what’s happening, why it matters, and what organizations need to do to stay ahead.

First, let’s talk about the wave of technical exploits targeting enterprise infrastructure. Ransomware groups are actively exploiting a vulnerability in Palo Alto Networks’ GlobalProtect VPN. This isn’t just another bug—it’s being used to bypass authentication and maintain persistent, stealthy access to enterprise environments. The implications are serious: attackers can move laterally, exfiltrate sensitive data, and deploy ransomware, all while evading detection for longer periods. For organizations relying on GlobalProtect, the message is clear: prioritize patching, monitor VPN activity for anomalies, and rigorously review remote access controls. This incident underscores a broader trend—remote access infrastructure remains a prime target for sophisticated threat actors, and the window between vulnerability disclosure and active exploitation is shrinking.

The situation with SonicWall’s SMA 1000 series is another stark example. Even after a patch was released for a critical vulnerability, there have been at least 135 documented exploitation attempts. Attackers are quick to weaponize newly disclosed flaws, often beating organizations to the punch on patching. This highlights the need for not just rapid patch deployment, but also vigilant post-patch monitoring. It’s not enough to apply a fix and move on—security teams need to verify that patches are actually in place, monitor for indicators of compromise, and be prepared for attackers who may have gained a foothold before remediation.

Web-facing applications are also under siege. The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has added an actively exploited command injection vulnerability in Apache Struts to its Known Exploited Vulnerabilities catalog. This is a high-severity issue that enables remote code execution, posing a significant threat to any organization running Struts-powered applications. CISA’s inclusion of this flaw in its KEV catalog isn’t just a bureaucratic step—it’s a call to immediate action for federal agencies and a strong recommendation for all enterprises. If you’re running Struts, urgent remediation is non-negotiable.

Open-source platforms are not immune, either. Discourse, a widely used discussion platform, has been found to contain multiple vulnerabilities that allow attackers to execute arbitrary JavaScript and read sensitive server files. These kinds of flaws can be exploited to compromise user data and escalate privileges, making them attractive targets for attackers. Organizations using Discourse should apply patches as soon as they’re available and take this as a reminder to regularly review their web application security posture. Open-source tools are valuable, but they require the same level of scrutiny and maintenance as any commercial solution.

As we move from technical exploits to the evolving world of AI, the landscape becomes even more nuanced. The adoption of AI across business functions is accelerating, but so are the risks and regulatory demands. Rubrik’s expansion of Project Hourglass is a timely example. They’re now focusing on testing AI-generated code for cybersecurity vulnerabilities. As more organizations leverage AI to write and review code, the risk of introducing exploitable flaws increases. Automated code review tools that specifically address AI-generated code are becoming essential. Security leaders should integrate these tools into their secure development lifecycle and update practices to account for the unique risks posed by AI-assisted development.

The regulatory environment is also shifting rapidly. Managed service providers, or MSPs, are facing new certification demands as their use of AI grows. Customers and regulators alike are demanding proof of AI governance, robust security controls, and responsible use policies. This trend is not limited to MSPs—any organization deploying AI should expect similar scrutiny. CISOs need to stay on top of evolving standards and ensure their teams are prepared for audits and compliance reviews. The days of deploying AI in a regulatory vacuum are over.

Nowhere is this more evident than in the European Union, where the EU AI Act is poised to reshape how organizations govern and deploy AI. The Act introduces significant requirements around risk management, transparency, and accountability. Non-compliance isn’t just a matter of regulatory slap on the wrist—it can result in substantial fines and reputational damage. Corporate leaders should be proactively assessing their AI systems for compliance, updating documentation, and implementing robust governance frameworks. Early preparation is essential, not just for legal compliance, but for maintaining stakeholder trust.

The integration of AI into identity governance is another area to watch closely. Anugal’s introduction of agentic AI capabilities into enterprise identity governance brings both promise and peril. On one hand, more autonomous and adaptive access decisions can drive efficiency and agility. On the other, these systems raise new questions about explainability, oversight, and the potential for abuse. Security teams must ensure that AI-driven identity systems are auditable, transparent, and aligned with organizational policies. The balance between automation and control is delicate, and getting it wrong can expose organizations to significant risk.

This brings us to a broader and increasingly urgent issue: the rise of AI agents as a new class of insider threat. Traditionally, insider threat programs have focused on human actors—employees, contractors, and partners with access to sensitive data and systems. But as AI agents proliferate within organizations, they too can access sensitive data, make decisions, and potentially be manipulated or subverted. CISOs should update their insider threat programs to account for these non-human actors, ensuring that monitoring and controls are in place for AI-driven processes. The line between human and machine insiders is blurring, and security strategies need to evolve accordingly.

Recent events have also highlighted the importance of trust and vetting in third-party relationships. The arrest of a ransomware response expert in connection with the ShinyHunters FBI hack investigation is a sobering reminder that even trusted incident response providers can become sources of risk. Security leaders should review their vendor management and incident response protocols to ensure integrity and compliance. This includes not just technical vetting, but also ongoing monitoring and clear contractual requirements around security and ethics.

Amidst all these challenges, collaboration is emerging as a critical enabler of cyber resilience. LevelBlue is emphasizing the importance of collaboration across teams, partners, and even sectors to build resilience and support business growth. As threats become more complex and interconnected, siloed approaches are increasingly ineffective. CISOs should foster cross-functional partnerships and encourage information sharing, both internally and with external partners. The ability to respond quickly and effectively to incidents often depends on the strength of these collaborative relationships.

Zooming out even further, a comprehensive risk assessment has identified AI misuse as one of 17 existential risks facing humanity, alongside climate change and other systemic threats. For risk executives, this underscores the need to integrate AI risk into broader enterprise risk management frameworks and scenario planning. It’s not just about compliance or technical controls—it’s about understanding and preparing for the full spectrum of risks that AI can introduce, from operational disruptions to reputational crises and even societal impacts.

So, what are the key imperatives for risk executives and security leaders today?

First, maintain relentless vigilance on patching and vulnerability management. The rapid exploitation of newly disclosed vulnerabilities means organizations must have processes in place to identify, prioritize, and remediate critical flaws—especially in infrastructure like VPNs, firewalls, and web applications. But patching alone isn’t enough. Continuous monitoring for signs of exploitation, even after patches are applied, is essential to catch attackers who may have already gained access.

Second, prepare for the evolving landscape of AI regulations and certifications. This means assessing your AI systems for compliance, updating governance frameworks, and ensuring that your teams are ready for audits and certification reviews. The regulatory environment is only going to become more demanding, and early preparation will pay dividends in both compliance and operational resilience.

Third, expand your insider threat programs to include AI agents and non-human actors. As AI becomes more deeply embedded in business processes, it’s critical to recognize that these systems can introduce new vectors for insider risk. Monitoring, controls, and oversight mechanisms need to evolve to keep pace with this shift.

Fourth, foster a culture of cyber resilience that spans technology, process, and people. This includes upskilling your workforce, encouraging cross-

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is more dynamic and complex than ever, with both technical exploits and governance challenges converging to create a high-pressure environment for security leaders and risk executives. We’re seeing a surge in high-profile vulnerabilities, active exploitation by threat actors, and a rapidly evolving regulatory climate driven by the widespread adoption of artificial intelligence. Let’s break down what’s happening, why it matters, and what organizations need to do to stay ahead.

First, let’s talk about the wave of technical exploits targeting enterprise infrastructure. Ransomware groups are actively exploiting a vulnerability in Palo Alto Networks’ GlobalProtect VPN. This isn’t just another bug—it’s being used to bypass authentication and maintain persistent, stealthy access to enterprise environments. The implications are serious: attackers can move laterally, exfiltrate sensitive data, and deploy ransomware, all while evading detection for longer periods. For organizations relying on GlobalProtect, the message is clear: prioritize patching, monitor VPN activity for anomalies, and rigorously review remote access controls. This incident underscores a broader trend—remote access infrastructure remains a prime target for sophisticated threat actors, and the window between vulnerability disclosure and active exploitation is shrinking.

The situation with SonicWall’s SMA 1000 series is another stark example. Even after a patch was released for a critical vulnerability, there have been at least 135 documented exploitation attempts. Attackers are quick to weaponize newly disclosed flaws, often beating organizations to the punch on patching. This highlights the need for not just rapid patch deployment, but also vigilant post-patch monitoring. It’s not enough to apply a fix and move on—security teams need to verify that patches are actually in place, monitor for indicators of compromise, and be prepared for attackers who may have gained a foothold before remediation.

Web-facing applications are also under siege. The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has added an actively exploited command injection vulnerability in Apache Struts to its Known Exploited Vulnerabilities catalog. This is a high-severity issue that enables remote code execution, posing a significant threat to any organization running Struts-powered applications. CISA’s inclusion of this flaw in its KEV catalog isn’t just a bureaucratic step—it’s a call to immediate action for federal agencies and a strong recommendation for all enterprises. If you’re running Struts, urgent remediation is non-negotiable.

Open-source platforms are not immune, either. Discourse, a widely used discussion platform, has been found to contain multiple vulnerabilities that allow attackers to execute arbitrary JavaScript and read sensitive server files. These kinds of flaws can be exploited to compromise user data and escalate privileges, making them attractive targets for attackers. Organizations using Discourse should apply patches as soon as they’re available and take this as a reminder to regularly review their web application security posture. Open-source tools are valuable, but they require the same level of scrutiny and maintenance as any commercial solution.

As we move from technical exploits to the evolving world of AI, the landscape becomes even more nuanced. The adoption of AI across business functions is accelerating, but so are the risks and regulatory demands. Rubrik’s expansion of Project Hourglass is a timely example. They’re now focusing on testing AI-generated code for cybersecurity vulnerabilities. As more organizations leverage AI to write and review code, the risk of introducing exploitable flaws increases. Automated code review tools that specifically address AI-generated code are becoming essential. Security leaders should integrate these tools into their secure development lifecycle and update practices to account for the unique risks posed by AI-assisted development.

The regulatory environment is also shifting rapidly. Managed service providers, or MSPs, are facing new certification demands as their use of AI grows. Customers and regulators alike are demanding proof of AI governance, robust security controls, and responsible use policies. This trend is not limited to MSPs—any organization deploying AI should expect similar scrutiny. CISOs need to stay on top of evolving standards and ensure their teams are prepared for audits and compliance reviews. The days of deploying AI in a regulatory vacuum are over.

Nowhere is this more evident than in the European Union, where the EU AI Act is poised to reshape how organizations govern and deploy AI. The Act introduces significant requirements around risk management, transparency, and accountability. Non-compliance isn’t just a matter of regulatory slap on the wrist—it can result in substantial fines and reputational damage. Corporate leaders should be proactively assessing their AI systems for compliance, updating documentation, and implementing robust governance frameworks. Early preparation is essential, not just for legal compliance, but for maintaining stakeholder trust.

The integration of AI into identity governance is another area to watch closely. Anugal’s introduction of agentic AI capabilities into enterprise identity governance brings both promise and peril. On one hand, more autonomous and adaptive access decisions can drive efficiency and agility. On the other, these systems raise new questions about explainability, oversight, and the potential for abuse. Security teams must ensure that AI-driven identity systems are auditable, transparent, and aligned with organizational policies. The balance between automation and control is delicate, and getting it wrong can expose organizations to significant risk.

This brings us to a broader and increasingly urgent issue: the rise of AI agents as a new class of insider threat. Traditionally, insider threat programs have focused on human actors—employees, contractors, and partners with access to sensitive data and systems. But as AI agents proliferate within organizations, they too can access sensitive data, make decisions, and potentially be manipulated or subverted. CISOs should update their insider threat programs to account for these non-human actors, ensuring that monitoring and controls are in place for AI-driven processes. The line between human and machine insiders is blurring, and security strategies need to evolve accordingly.

Recent events have also highlighted the importance of trust and vetting in third-party relationships. The arrest of a ransomware response expert in connection with the ShinyHunters FBI hack investigation is a sobering reminder that even trusted incident response providers can become sources of risk. Security leaders should review their vendor management and incident response protocols to ensure integrity and compliance. This includes not just technical vetting, but also ongoing monitoring and clear contractual requirements around security and ethics.

Amidst all these challenges, collaboration is emerging as a critical enabler of cyber resilience. LevelBlue is emphasizing the importance of collaboration across teams, partners, and even sectors to build resilience and support business growth. As threats become more complex and interconnected, siloed approaches are increasingly ineffective. CISOs should foster cross-functional partnerships and encourage information sharing, both internally and with external partners. The ability to respond quickly and effectively to incidents often depends on the strength of these collaborative relationships.

Zooming out even further, a comprehensive risk assessment has identified AI misuse as one of 17 existential risks facing humanity, alongside climate change and other systemic threats. For risk executives, this underscores the need to integrate AI risk into broader enterprise risk management frameworks and scenario planning. It’s not just about compliance or technical controls—it’s about understanding and preparing for the full spectrum of risks that AI can introduce, from operational disruptions to reputational crises and even societal impacts.

So, what are the key imperatives for risk executives and security leaders today?

First, maintain relentless vigilance on patching and vulnerability management. The rapid exploitation of newly disclosed vulnerabilities means organizations must have processes in place to identify, prioritize, and remediate critical flaws—especially in infrastructure like VPNs, firewalls, and web applications. But patching alone isn’t enough. Continuous monitoring for signs of exploitation, even after patches are applied, is essential to catch attackers who may have already gained access.

Second, prepare for the evolving landscape of AI regulations and certifications. This means assessing your AI systems for compliance, updating governance frameworks, and ensuring that your teams are ready for audits and certification reviews. The regulatory environment is only going to become more demanding, and early preparation will pay dividends in both compliance and operational resilience.

Third, expand your insider threat programs to include AI agents and non-human actors. As AI becomes more deeply embedded in business processes, it’s critical to recognize that these systems can introduce new vectors for insider risk. Monitoring, controls, and oversight mechanisms need to evolve to keep pace with this shift.

Fourth, foster a culture of cyber resilience that spans technology, process, and people. This includes upskilling your workforce, encouraging cross-

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is evolving at a pace that demands constant vigilance and decisive action from security leaders. We’re seeing a surge in critical vulnerabilities, a rapidly shifting supply chain threat environment, and an intensifying focus on AI governance and risk ownership. These aren’t just headline issues—they’re shaping the way organizations need to approach security, compliance, and operational resilience.

Let’s start with the most urgent technical risks making waves right now. Citrix has issued an immediate advisory for a new remote code execution vulnerability in NetScaler. This isn’t just another routine patch; it’s a critical flaw that, if left unaddressed, could allow attackers to gain full control over affected systems. For organizations that rely on Citrix for remote access or application delivery, this vulnerability represents a direct path for threat actors to compromise core infrastructure. The window between disclosure and exploitation is shrinking—attackers are moving fast to weaponize these kinds of flaws. If you haven’t already, prioritize patch deployment across all exposed NetScaler instances and review your environment for any signs of compromise. The risk here isn’t theoretical; it’s immediate and actionable.

In parallel, VMware’s VMXNET3 virtual network adapter is under scrutiny following the release of a proof-of-concept exploit for a critical vulnerability. What makes this one particularly concerning is the potential for guest-to-host code execution. In environments where virtualization underpins everything from development to production workloads—especially in multi-tenant or cloud settings—this opens the door to lateral movement and privilege escalation. If you’re running VMware infrastructure, now is the time to review your patch status, harden your virtualization controls, and make sure your segmentation strategies are up to date. The era of “set it and forget it” for virtual environments is over; continuous monitoring and rapid response are the new baseline.

Backup and recovery systems, often overlooked in security planning, are also in the crosshairs. Unpatched vulnerabilities in AhsayCBS backup software are being actively exploited in the wild. Attackers are leveraging these flaws for data theft and, in some cases, as a foothold for ransomware deployment. If your organization uses AhsayCBS, assess your patching status immediately and monitor for indicators of compromise. The broader lesson here is clear: backup infrastructure is part of your attack surface. Unmaintained or legacy systems can quickly become the weakest link, so routine audits and timely updates are non-negotiable.

Mobile platforms aren’t immune to these trends. At the recent Pwn2Own competition, Google’s Pixel 10 was compromised three times in a single day through distinct remote exploits. While these were research-driven demonstrations, they underscore the persistent risk of zero-day vulnerabilities in widely deployed devices. For security teams, the takeaway is to keep a close eye on vendor advisories and ensure that mobile device management policies are agile enough to respond to new threats. The mobile ecosystem is vast and dynamic, and attackers are investing heavily in finding—and exploiting—its weak points.

Shifting gears to the broader threat environment, supply chain attacks have become an industry in their own right. Threat actors are increasingly targeting third-party providers, software dependencies, and the complex web of vendors that underpin modern business operations. This trend isn’t slowing down; if anything, it’s accelerating as attackers realize the leverage they gain by compromising a single supplier. The implication for organizations is clear: robust third-party risk management isn’t just a compliance checkbox, it’s a strategic imperative. Continuous monitoring, contractual security requirements, and a clear understanding of your vendor ecosystem are essential. The days of static vendor assessments are behind us—ongoing vigilance is the new standard.

Identity resilience remains a foundational concern, and it’s closely tied to the supply chain challenge. As organizations accelerate digital transformation and AI adoption, the convergence of identity and supply chain risks demands an integrated approach. Adaptive controls, continuous authentication, and zero trust architectures are moving from best practices to baseline requirements. Identity is still the primary attack vector for most breaches, and attackers are getting more sophisticated in how they exploit it. Investing in identity governance—especially as it intersects with third-party access and supply chain workflows—is critical for maintaining operational resilience.

Now, let’s talk about the rapidly shifting landscape of AI governance and risk management. Regulators and industry alliances are putting AI under the microscope, and for good reason. The Office of the Superintendent of Financial Institutions in Canada has flagged frontier AI as the top threat to the nation’s financial system. The concern isn’t just about technical failure—it’s about systemic disruption and the potential for exploitation at scale. For financial institutions and their technology partners, this signals a coming wave of enhanced compliance expectations and increased scrutiny. CISOs and risk leaders should prepare for more rigorous AI risk assessments and new reporting obligations. Proactive engagement with regulators and industry groups will be essential to stay ahead of the curve.

But it’s not just about meeting regulatory requirements. There’s a growing recognition that unclear ownership of AI risk within organizations is a recipe for trouble. A recent analysis warns that, in the absence of clear governance structures, CISOs could end up as the default scapegoats in the event of an AI-related incident. As AI systems become more integral to business operations, it’s critical to establish shared accountability across leadership, legal, compliance, and technical teams. This isn’t just about protecting the organization—it’s about protecting the people responsible for its security. Without clear lines of responsibility, blind spots emerge, and both organizational and personal liability become real risks.

Industry momentum is building around standardized frameworks and tooling for AI risk management. We’re seeing new platforms and alliances emerge, like Driven Tech joining the Open Secure AI Alliance and contributing to an AI Security RFC, and TQStarling launching “AI Control Tower” services to help enterprises operationalize AI governance at scale. These developments are more than just marketing—they reflect a broader shift toward operationalizing AI governance in practical, scalable ways. Security leaders should evaluate participation in these alliances and consider how new governance platforms can fit into their existing risk management strategies. The goal is to move from ad hoc controls to systematic, repeatable processes that can keep pace with the evolving AI landscape.

Anthropic’s expansion of access to its advanced cyber AI models is another sign of the times. On one hand, these models offer significant benefits, enhancing detection and response capabilities for defenders. On the other, they potentially lower the barrier for sophisticated threat actors to leverage powerful AI tools. This dual-edged dynamic means organizations need to carefully review their AI usage policies and stay alert to emerging threats that may leverage these technologies. The line between defensive and offensive AI is blurring, and the implications for security strategy are profound.

As AI governance challenges grow, the importance of targeted workforce training is coming into sharper focus. Upskilling security and risk teams in AI-specific risks, controls, and regulatory requirements is no longer optional. Effective oversight depends on a workforce that understands not just the technology, but the unique risks and compliance obligations that come with it. Investing in ongoing training and professional development will be a key differentiator for organizations looking to maintain effective governance in the age of AI.

On the financial crime front, organizations like Absa are advancing fraud and scam prevention through enhanced governance, risk, and compliance frameworks. This integrated approach to GRC is increasingly necessary as digital and AI-driven fraud schemes proliferate. It’s a reminder that fighting financial crime isn’t just about deploying new technology—it’s about building the organizational processes and oversight structures that can adapt to evolving threats.

Let’s take a step back and look at the strategic implications of these developments. First and foremost, patch management and vulnerability response must be at the top of every security leader’s agenda. The volume and severity of disclosed vulnerabilities—especially in critical infrastructure and widely deployed platforms—means that delays in patching can have outsized consequences. Automation, continuous monitoring, and clear escalation paths are essential to keep pace.

AI governance and risk ownership require urgent clarification. As AI becomes more embedded in business processes, the risks it introduces—whether technical, operational, or ethical—must be addressed through clear policies, defined roles, and shared accountability. This isn’t just about avoiding incidents; it’s about building trust with stakeholders, regulators, and customers.

Supply chain and identity risks are converging in ways that demand integrated management strategies. The interconnectedness of modern business means that a weakness in one part of the ecosyste

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is shifting rapidly, with new challenges emerging on multiple fronts. As organizations accelerate their adoption of artificial intelligence, the gap between innovation and governance is becoming more pronounced—and more dangerous. At the same time, adversaries are evolving their tactics, exploiting vulnerabilities in critical infrastructure and leveraging new technologies like blockchain to complicate detection and response. For security leaders, the convergence of these trends means that the stakes for effective governance, technical controls, and executive oversight have never been higher.

Let’s start with one of the most pressing issues: the state of AI governance, particularly in highly regulated sectors like healthcare. A recent report from Clearwater found that an astonishing 91% of healthcare organizations cannot verify the existence or effectiveness of AI governance within their operations. This isn’t just a compliance problem—it’s a material risk that touches on regulatory, ethical, and operational dimensions. Healthcare is moving quickly to integrate AI into both clinical and administrative functions, from diagnostic support to patient scheduling and billing. But without clear oversight, organizations are exposed to a host of risks, from biased decision-making and privacy breaches to regulatory penalties and reputational harm.

For CISOs and risk executives in healthcare, the message is clear: it’s time to establish and document robust AI oversight processes. This means not just having policies on paper, but ensuring that governance structures are in place, roles and responsibilities are defined, and that the effectiveness of these controls can be demonstrated to auditors, regulators, and—if necessary—the public. The lack of verifiable governance is increasingly seen as a business risk that can impact everything from patient safety to executive tenure.

And this brings us to a broader trend across industries. Forrester recently issued a warning that missing or inadequate AI governance is now a board-level risk, with the potential to cost CEOs their jobs if AI-driven failures occur. This marks a significant shift in accountability. Where AI was once seen as a technical or operational issue, it’s now squarely in the sights of boards and executive committees. The implication is that CISOs and security leaders need to ensure that AI risk management is not siloed within IT or security, but integrated into enterprise governance frameworks. This includes establishing reporting mechanisms, conducting regular risk assessments, and ensuring that the board is fully briefed on the organization’s AI risk posture.

Why is this shift happening now? Part of the answer lies in the operational realities of AI adoption. According to research from Optro, one in three organizations has already acted on incorrect decisions made by AI agents. That’s 33% of organizations making potentially costly or damaging moves based on flawed outputs from AI systems. This isn’t just a theoretical risk; it’s already playing out in real-world contexts, from financial services to logistics to healthcare. The lesson here is that over-reliance on AI, without adequate human oversight or validation, can lead to significant operational errors and regulatory exposure.

So, what should organizations do to mitigate these risks? First, it’s essential to ensure that AI outputs—especially in high-stakes or automated decision-making contexts—are subject to human review. This doesn’t mean slowing down innovation, but rather building in checkpoints and escalation paths so that critical decisions are not made blindly on the basis of AI recommendations. Second, organizations should invest in training and awareness programs to help staff understand the strengths and limitations of AI, as well as the importance of oversight and validation.

Let’s pivot now to the evolving threat landscape, where adversaries are taking advantage of both technical vulnerabilities and the complexity of modern supply chains. One of the most notable developments comes from North Korean threat actors, identified by Unit 42, who are now leveraging blockchain infrastructure to facilitate cloud supply chain attacks. This is a significant evolution in attack methodology. By using blockchain as part of their attack chain, these actors are making it harder for defenders to detect and attribute malicious activity. The decentralized and often opaque nature of blockchain transactions provides attackers with new ways to mask their operations, complicating incident response and forensic investigations.

For organizations that rely on cloud services—and that’s virtually everyone at this point—this underscores the need for rigorous supply chain security controls. It’s not enough to trust that your cloud provider has things under control. Security teams need to review their cloud supply chain controls, monitor for blockchain-based attack vectors, and ensure that third-party risk management processes are up to date. This may involve working more closely with cloud providers, conducting targeted threat modeling exercises, and investing in monitoring tools that can detect anomalous activity across both traditional and blockchain-based infrastructure.

Meanwhile, attackers are also exploiting critical vulnerabilities in widely used platforms. Citrix NetScaler, for example, is currently the target of active exploitation. Attackers are deploying web shells and stealing configuration data, enabling persistent access and lateral movement within affected environments. This kind of exploit is particularly dangerous because it allows adversaries to maintain a foothold in the network, move laterally, and potentially escalate privileges or exfiltrate sensitive data over an extended period.

The practical implication is straightforward: organizations using Citrix NetScaler appliances need to prioritize patching and conduct forensic reviews to identify any signs of compromise. This is not a theoretical risk—active exploitation is underway, and the window for remediation is closing quickly. Patch management, vulnerability scanning, and continuous monitoring are essential components of an effective defense.

A similar story is unfolding with Zammad, an open-source helpdesk platform. A proof-of-concept exploit has been released for a critical vulnerability that enables session hijacking and remote code execution. For organizations relying on Zammad for customer support, this poses a high risk—not just to the integrity of the helpdesk system, but to the broader environment if attackers can use compromised sessions to pivot further into the network. Prompt patching and a review of session management practices are strongly advised.

But it’s not just software vulnerabilities that are being exploited. Attackers are also targeting the very infrastructure that underpins trust on the internet. In a recent campaign, hackers hijacked country-code top-level domains—specifically .gh for Ghana, .sl for Sierra Leone, and .as for American Samoa—and used that access to issue rogue TLS certificates for Google domains. This kind of attack undermines the global certificate ecosystem, opening the door to phishing, man-in-the-middle attacks, and widespread loss of trust.

For organizations, the lesson is clear: monitoring certificate transparency logs and reviewing domain security controls should be standard practice. Domain hijacking is not just a problem for registrars or certificate authorities; it can have downstream effects on any organization that relies on trusted internet infrastructure.

Zooming out, Microsoft’s 2026 Digital Defense Report paints a picture of escalating sophistication in both AI-driven threats and identity-based attacks. The report calls for enhanced identity management, AI model security, and continuous monitoring as foundational controls. Identity has always been a critical attack vector, but as AI systems are increasingly integrated with authentication and authorization processes, the risk of privilege escalation and unauthorized access grows. CISOs should ensure that their security roadmaps are aligned with these evolving threat vectors, prioritizing investments in identity security, AI model validation, and real-time monitoring.

Another area that deserves attention is privileged access management, or PAM. As organizations adopt AI at scale, the attack surface expands and the risk of privilege escalation increases. BluDive and Delinea have both emphasized the importance of strengthening PAM to prevent unauthorized access and mitigate the impact of AI-driven or automated attacks. This is not just about technology; it’s about process and discipline. Effective PAM involves not only deploying the right tools, but also establishing clear policies, conducting regular reviews, and ensuring that privileged accounts are tightly controlled and monitored.

So, what should CISOs and risk leaders prioritize as they navigate this landscape? A new analysis from Solutions Review offers some guidance. The key takeaway is that while AI introduces new risks and requires adaptation, the fundamentals of security remain unchanged. Asset inventory, vulnerability management, privileged access controls, and incident response planning are as important as ever. What’s changing is the context—AI is amplifying the impact of both successes and failures, and adversaries are moving quickly to exploit any gaps.

This brings us back to the strategic imperative for organizations: integrating AI oversight into risk management programs while maintaining vigilance against technical exploits. AI governance can no longer be treated as an afterthought o

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk environment is evolving at a pace that demands constant vigilance, decisive leadership, and a willingness to adapt. The headlines are dominated by a surge in critical vulnerabilities, increasingly sophisticated attack vectors, and a growing recognition that governance and accountability must keep pace with technological change. Let’s break down the key developments shaping the risk landscape right now, and consider what they mean for organizations striving to maintain resilience and trust in their digital operations.

Let’s start with the ongoing wave of zero-day vulnerabilities. Citrix, a mainstay in enterprise infrastructure, has once again found itself at the center of attention. The company has released a patch for a new zero-day vulnerability affecting its NetScaler product line—a platform that’s become a target for sustained attacks. This particular flaw enables attackers to bypass authentication and potentially seize control of affected systems. What’s especially concerning is that this vulnerability is being actively exploited in the wild, putting organizations with unpatched, internet-facing assets at immediate risk.

For security leaders, the lesson is clear: rapid patch management is not optional. The window between disclosure and exploitation is shrinking, and attackers are quick to capitalize on any delay. Prioritizing patch deployment for critical infrastructure, especially those exposed to the internet, is essential. But patching alone isn’t enough. Organizations need to review their network segmentation controls to limit the potential blast radius if a compromise does occur. It’s a reminder that defense in depth—layered controls, continuous monitoring, and rapid response—remains the foundation of effective risk management.

Moving to another major vulnerability, Progress DataDirect’s GenAI platform has been found to contain a severe flaw that allows attackers to execute arbitrary operating system commands through malicious OpenAPI files. In practical terms, this means that an attacker could gain unauthorized access or disrupt operations, particularly in environments where AI and API-driven workflows are tightly integrated. As APIs become the connective tissue of modern digital ecosystems, their security is increasingly critical.

The implications here extend beyond just patching. Security teams need to assess their exposure, apply the available fixes, and scrutinize API security controls. This includes validating input, restricting file uploads, and monitoring for anomalous API activity. As organizations accelerate their adoption of AI and automation, the attack surface grows, and so does the need for robust controls around the interfaces that power these systems.

Wordpress, the world’s most popular content management system, is also in the spotlight. Multiple critical vulnerabilities have been identified, enabling cross-site scripting, SQL injection, and data disclosure attacks. Given Wordpress’s ubiquity, these flaws represent a significant risk for any organization relying on the platform for its web presence. The practical takeaway is straightforward: immediate patching is non-negotiable, and regular audits of plugins and themes are essential. Many breaches stem not from the core platform itself, but from third-party extensions that lag behind on updates or introduce insecure code. A disciplined approach to plugin management—removing what’s unnecessary, monitoring for updates, and vetting new additions—can make a substantial difference in reducing risk.

The Rockstar Games compromise offers a window into the tactics attackers are using to breach high-value targets. This incident exposed a combination of MFA fatigue attacks, OAuth token theft, and weaknesses in the software development pipeline. MFA fatigue, where attackers flood users with authentication prompts in hopes they’ll approve one out of frustration or confusion, is a growing concern. OAuth token theft, meanwhile, allows attackers to bypass traditional authentication entirely.

What does this mean for organizations? First, authentication workflows need to be reviewed and, where possible, hardened against abuse. Adaptive authentication, user education, and limiting the number of prompts can help mitigate MFA fatigue. Second, the security of development pipelines must be prioritized. This includes securing source code repositories, enforcing least-privilege access for developers, and monitoring for anomalous access patterns. The development process is increasingly a target, and a compromise there can have far-reaching consequences.

On the AI front, a notable incident involved OpenAI’s sandbox environment. A flaw allowed users to access paid AI models without an API key, effectively bypassing the intended access controls. While this specific issue has been remediated, it’s a stark reminder that AI service environments are subject to the same risks as traditional IT assets. Robust access controls, continuous security testing, and regular reviews of integration points are essential. As more organizations embed AI into their workflows, ensuring these systems are not a backdoor for attackers is paramount.

Reflecting on past breaches can provide valuable lessons. The 2019 Capital One data breach remains a textbook example of how misconfigured cloud identity and access controls can lead to catastrophic data compromise. In that incident, an attacker exploited overly permissive cloud roles to access sensitive data. The key takeaway is the importance of least-privilege access, continuous monitoring, and incident response readiness in cloud environments. Cloud security is not a set-and-forget proposition. It requires ongoing vigilance, regular reviews of permissions, and a culture that prioritizes secure configuration.

The governance, risk, and compliance (GRC) space is seeing rapid innovation, particularly with the integration of AI. Trustero’s expansion of its AI-powered GRC platform to include third-party risk management is part of a broader industry trend. Organizations are looking to leverage AI for continuous risk assessment, compliance automation, and enhanced visibility into supply chain exposures. For CISOs and risk leaders, the opportunity is to streamline vendor risk processes and gain a more dynamic, real-time view of third-party risk. However, the adoption of these tools must be accompanied by robust governance to ensure that automation doesn’t introduce new blind spots or compliance gaps.

Recent research is shedding light on a fundamental shift in the nature of cyber risk. Increasingly, risk is moving inside the business workflow, rather than being isolated at the network perimeter. This means that security can no longer be seen as just a technical function or a set of perimeter defenses. Instead, it needs to be embedded into business processes, with controls integrated into daily operations. Fostering a culture of shared responsibility—where every department understands its role in maintaining security—is becoming essential. Security awareness, process integration, and cross-functional collaboration are the new front lines.

When it comes to AI governance, the conversation is shifting. The primary challenge is no longer technological capability, but accountability. As AI systems gain autonomy and influence over business decisions, organizations must define clear roles and responsibilities for oversight, risk acceptance, and incident response. This is pushing accountability beyond the CISO, extending it to executive leadership and the board. Clear policies, documented responsibilities, and regular reporting are needed to ensure that AI risk is managed at the highest levels of the organization.

Supply chain security is also taking center stage. IBM’s recent commitment of $5 billion to strengthen open source software security is a signal of growing recognition of supply chain risk. Open source components are ubiquitous in enterprise environments, and their security is only as strong as the weakest link. This investment may drive broader industry adoption of secure development practices and more rigorous third-party risk management frameworks. For organizations, it’s a prompt to review their own supply chain security posture—mapping dependencies, assessing vendor risk, and requiring security attestations from suppliers.

The intersection of AI, data privacy, and sector-specific compliance is becoming increasingly complex. In healthcare, for example, eScan has introduced data loss prevention features aimed at preventing sensitive patient data from being exposed to public AI platforms. As AI adoption accelerates, the risk of inadvertent data leakage grows—especially when employees use unsanctioned tools or public AI services. Sector-specific controls, such as data classification, usage monitoring, and DLP solutions tailored to regulatory requirements, are essential to maintaining compliance and protecting sensitive information.

The rise of “shadow AI”—unsanctioned or ungoverned AI use within organizations—is another area of growing concern. Market analysis projects significant growth in the shadow AI risk and governance sector over the next decade. This reflects a heightened awareness of the risks associated with employees or departments deploying AI tools outside of official channels. The practical risk is data leakage, regulatory non-compliance, and loss of control over sensitive processes. Organizations should proactively identify shadow AI initiatives, bring them under governance, and establish clear policies for AI use. This includes inventorying AI assets, monitoring for unauthorized deployments, and providing sanctioned alternatives that meet securi

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk environment is evolving at a rapid pace, marked by a surge in technical exploits and a parallel wave of governance challenges. What we’re seeing is not just a rise in the sophistication of attacks, but also a growing complexity in how organizations must respond—balancing technical controls with robust governance frameworks. This is especially true as the lines blur between traditional cybersecurity, AI risk, and the demands of regulatory and insurance markets.

Let’s start with the technical landscape, where the focus this week is on IoT, cloud, and CI/CD pipeline attacks. The proliferation of connected devices and cloud services has created a vast attack surface, and adversaries are moving quickly to exploit it.

First, let’s talk about IoT. New Linux malware has been discovered that’s actively targeting vulnerable IoT devices, turning them into proxy nodes for malicious traffic. This isn’t just about creating botnets for denial-of-service attacks—though that risk is certainly present. What’s more concerning is how these compromised devices can be used as proxies to exfiltrate data and mask the true origin of malicious activity. The campaign exploits weak device security, and with so many IoT devices lacking basic protections, the scale of this threat is significant.

For security leaders, this highlights several immediate priorities. Start by ensuring you have a comprehensive inventory of all IoT assets. If you don’t know what’s on your network, you can’t protect it. Segmentation is also key—isolating IoT devices from critical business systems limits the blast radius if a device is compromised. Patch management remains a challenge, especially for devices that aren’t easily updated, but it’s essential to prioritize based on exposure and criticality. And finally, monitoring for unusual outbound connections can help detect when a device has been hijacked and is being used as a proxy.

Building on that, the Cling botnet has emerged as a particularly stealthy threat. It’s using Google’s STUN protocol traffic to disguise its command-and-control communications with infected IoT devices. For those unfamiliar, STUN is a protocol used to help devices behind firewalls and NATs communicate with the outside world—think video calls or online gaming. By piggybacking on this legitimate traffic, Cling makes it much harder for traditional network monitoring tools to spot malicious activity. This is a clear example of attackers leveraging the very protocols that enable modern connectivity to hide in plain sight.

So, what can organizations do? Enhancing IoT network visibility is a must. Consider deploying behavioral analytics that can flag when devices act outside their normal patterns, even if the traffic itself appears legitimate. It’s also worth reviewing firewall rules and monitoring for unusual STUN traffic, especially if your environment doesn’t typically rely on these protocols.

A related threat, the ClingSTUN backdoor, takes things a step further by exploiting multiple IoT vulnerabilities to gain persistent remote access. This multi-vector approach means attackers aren’t just relying on one weakness—they’re chaining together several, increasing their chances of success and making it harder to evict them once they’re in. For enterprises and even consumers, this raises the stakes. Vulnerability management for IoT can’t be a once-a-year exercise. It needs to be ongoing, with regular scans, patching, and—where possible—network segmentation to limit exposure.

Shifting gears to the cloud, we saw a significant breach at ASOS, where attackers exploited the company’s Snowflake cloud environment. What’s notable here is the use of push notification mechanisms for extortion. Attackers leveraged misconfigured cloud services to send fraudulent notifications, using them as a vector for social engineering and extortion. This is part of a growing trend—attackers are increasingly targeting the very systems designed to alert us to problems, turning them into tools for manipulation.

The lesson here is clear: cloud security posture management is not optional. Organizations need to regularly audit their cloud environments for misconfigurations and enforce least-privilege access. That means only granting the permissions necessary for each user or service, and nothing more. Monitoring for anomalous activity—especially around notification and alerting systems—should also be a priority.

The CI/CD pipeline is another area under active attack. The “Gentlemen” ransomware affiliate has breached dozens of organizations by exploiting stolen GitLab CI/CD secrets. This is a classic supply chain attack, where the compromise of build pipelines can have cascading impacts across multiple organizations. The takeaway? Securing your CI/CD environment is just as important as securing your production systems. Rotate credentials regularly, monitor for suspicious activity in your pipelines, and ensure that secrets are stored securely—not hardcoded or left in plaintext.

Turning to vendor advisories, Citrix has issued an urgent call to patch NetScaler appliances after new zero-day exploits were discovered. These vulnerabilities are being actively targeted in the wild, and organizations using affected products face immediate risk. If you’re running NetScaler, patch now. Don’t wait for a scheduled maintenance window. And be sure to review remote access logs for any signs of compromise—attackers often move quickly to establish persistence once a vulnerability is disclosed.

On the mobile front, Google has rolled out six new advanced protection features in Android 17. These enhancements are designed to counter sophisticated attacks, improving device integrity, phishing resistance, and exploit mitigation. For organizations managing fleets of mobile devices, this is a good time to review your mobile device management policies and ensure timely OS updates. Attackers often target unpatched devices, so staying current is one of the simplest ways to reduce risk.

Now, let’s shift our focus to AI risk and governance—a space that’s rapidly maturing but also facing new challenges. ESET has issued warnings about vulnerabilities in AI agents, particularly in the Kenyan market, but the risks are global. Agentic AI—autonomous systems that can make decisions and take actions—introduces unique challenges. These include data leakage, manipulation, and the risk of unintended actions by agents operating outside their intended scope.

Organizations deploying AI agents need to implement strong governance, continuous monitoring, and robust fail-safes. That means not only setting clear boundaries for what agents can and cannot do, but also having mechanisms in place to detect and respond when things go wrong. This is especially important as AI agents become more integrated into business processes and critical infrastructure.

Recent disclosures from OpenAI regarding rogue AI agent behavior have put this issue firmly on the boardroom agenda. The message to businesses is clear: formalize your policies for AI agent deployment, monitoring, and incident response. The risks aren’t just technical—they’re operational and reputational. If an AI agent goes rogue, the impact can be swift and far-reaching.

In response to these challenges, we’re seeing organizations pursue formal certifications and risk management frameworks. ZoomInfo, for example, has expanded its ISO assurance program to include ISO/IEC 42001 certification, validating its AI governance framework. This reflects a broader industry trend—formal AI risk management is becoming a benchmark for due diligence, and may soon be a requirement for doing business in certain sectors.

The insurance market is also adapting. Cowbell, a cyberinsurance provider, has deployed an AI agent to assess risk across its portfolio. This move toward automated, data-driven underwriting is likely to influence how insurers evaluate organizational cyber and AI risk controls. For organizations, this could mean more scrutiny of your security posture, and potentially, changes in premiums and coverage terms based on how well you manage AI and cyber risk.

Another major development is Google’s $32 billion acquisition of Wiz, which is accelerating momentum in the cloud security posture management market. The demand for automated tools to monitor and remediate cloud misconfigurations is only increasing, especially in light of recent high-profile breaches. For organizations, investing in CSPM solutions is quickly becoming table stakes for maintaining a strong security posture in the cloud.

Let’s take a step back and look at the strategic implications of these developments.

First, IoT and cloud environments are high-value targets. Asset inventory, segmentation, and continuous monitoring are essential. You can’t protect what you can’t see, and unsegmented networks make it far too easy for attackers to move laterally once they gain a foothold.

Second, AI agent governance is now a board-level issue. It’s not enough to deploy AI and hope for the best. Formal risk management frameworks and incident response plans are necessary to ensure that AI deployments are safe, reliable, and aligned with organizational objectives.

Third, supply chain and CI/CD pipeline security remain critical. Credential hygiene—rotating secrets, avoiding hardcoded credentials, and monitoring for suspicious activity—must be top priorities. The interconnected nature of modern software development means that a breach in one part of the chain can have ripple effects across multiple organizations.

Finally, the regulatory and insurance landscapes are evolving rapidly. New certifications and AI r

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is as dynamic and challenging as ever, with a notable surge in critical vulnerabilities and a rapidly evolving threat environment. Let’s walk through the most significant developments shaping enterprise risk today, and what they mean for organizations striving to stay ahead of both technical and human-driven threats.

Starting with vulnerability management, we’re seeing a wave of zero-day exploits targeting widely used platforms. These aren’t obscure systems tucked away in the corner of the network—these are core technologies that underpin daily business operations across industries.

One of the most urgent issues is the critical zero-day vulnerability in FortiMail, tracked as CVE-2026-104286. FortiMail is a staple in enterprise email security, and this particular flaw is being actively exploited in the wild. Attackers can leverage it to gain unauthorized access or execute arbitrary code, which opens the door to compromising sensitive communications and valuable data. The widespread use of FortiMail makes this a high-priority risk for many organizations. If you’re running FortiMail, immediate patching is non-negotiable. But patching alone isn’t enough—organizations should also be monitoring for indicators of compromise and be ready to respond quickly if suspicious activity is detected. This incident really underscores the need for rapid vulnerability management, as well as robust incident response processes. The lesson here is clear: even trusted, widely deployed security tools can become high-value targets, and speed is of the essence when it comes to remediation.

Moving on to Cpanel and WHM, which are foundational tools in the hosting world. Several vulnerabilities have been disclosed that allow attackers to execute arbitrary commands on affected servers. The implications are severe—these flaws can lead to full server compromise, data theft, or complete service disruption. Given how prevalent Cpanel and WHM are in hosting environments, the risk of widespread exploitation is significant. For security leaders, the priorities are straightforward: patch systems immediately, review server configurations for any unnecessary exposure, and enhance monitoring for unusual activity. This is a classic example of how attackers continue to target the backbone of internet infrastructure, and why proactive management of server environments remains critical.

Another platform under active attack is Zammad, an open-source helpdesk solution. Zero-day vulnerabilities here are being exploited for remote code execution and even root access. For organizations that rely on Zammad for customer support, this is a severe risk—attackers could gain control over the helpdesk environment, potentially exposing sensitive customer data or using the foothold to move laterally within the network. The recommended response is immediate patching, but also network segmentation to limit the blast radius of any compromise. This approach can help prevent attackers from moving freely across your environment if they do manage to get in.

It’s not just traditional IT platforms under fire. AI-powered tools are increasingly in the crosshairs, as seen with Meta’s Muse AI Assistant. A zero-day vulnerability here could allow attackers to inject malware directly into user environments. The concern is amplified by the growing integration of AI assistants into business workflows, where they often have access to sensitive data and systems. For organizations considering or already using AI assistants, it’s essential to monitor for updates from vendors like Meta and to assess the risk of deploying these tools without robust security controls in place. The bottom line is that as AI becomes more embedded in daily operations, the attack surface grows—and so does the need for vigilant security oversight.

Identity and access management remains a perennial challenge, and recent developments have only heightened the stakes. A newly disclosed session cookie vulnerability in Microsoft Entra ID—formerly known as Azure Active Directory—allows attackers to bypass multi-factor authentication and impersonate users. This exposes organizations to account takeover risks and enables attackers to move laterally within cloud environments. The practical implication is that even organizations with strong MFA policies aren’t immune if session management is weak. Security teams should review their session management policies, enforce conditional access where possible, and monitor for suspicious authentication activity. This is a stark reminder that identity controls are only as strong as their weakest link, and attackers are adept at finding and exploiting those gaps.

Supply chain risks are also front and center, with attackers increasingly targeting trusted software update mechanisms to deliver credential-stealing malware. This trend highlights a persistent weakness in software supply chains—namely, the trust placed in update channels. When attackers compromise these mechanisms, they can distribute malicious payloads under the guise of legitimate updates, often bypassing traditional security controls. Organizations should rigorously validate updates, enforce code signing, and maintain strong endpoint monitoring. Just as importantly, user awareness needs to be elevated so that employees are alert to unusual prompts or update requests. The reality is that supply chain attacks are here to stay, and the only effective defense is a layered approach that combines technical controls with informed users.

Shifting gears to AI governance, we’re seeing a growing gap between the rapid pace of AI adoption and the maturity of governance frameworks. As organizations deploy generative and agentic AI systems, the absence of clear policies and controls increases the risk of data leakage, bias, and regulatory non-compliance. The challenge is twofold: not only are the technologies advancing quickly, but the regulatory and ethical landscape is evolving in parallel. For CISOs and risk leaders, the priority should be the development and enforcement of AI governance policies that address both technical and ethical risks. This means considering not just how AI systems are built and deployed, but also how they’re monitored, audited, and held accountable over time.

The rise of agentic, or autonomous, AI systems is particularly noteworthy. These are AI tools that can make independent decisions and take actions without direct human oversight. While the efficiency gains are compelling, they introduce new security challenges. Traditional security models—designed for static systems and predictable workflows—may not be sufficient. Organizations need to rethink their controls, monitoring, and accountability structures for AI-driven processes. This evolution requires new approaches to risk assessment and incident response, including scenario planning for what happens when autonomous systems behave in unexpected or undesirable ways.

Recent high-profile incidents have brought these issues into sharp focus. The firings at OpenAI, for example, have highlighted broader concerns around AI security, governance, and internal controls. The incident underscores the importance of transparency, robust oversight, and clear accountability structures in organizations developing or deploying advanced AI. For risk leaders, this is a moment to assess your own AI governance maturity and readiness for similar challenges. Are your oversight mechanisms strong enough to catch problems early? Do you have clear lines of accountability? These are the questions that need answers before a crisis hits.

Nation-state threats are also evolving, with attackers increasingly targeting cloud, identity, and supply chain vectors. The days of relying solely on perimeter-based defenses are over. Instead, organizations need adaptive, intelligence-driven security architectures that can detect and respond to sophisticated, persistent threats. This means investing in detection, response, and resilience capabilities, and being prepared to pivot quickly as the threat landscape shifts.

One emerging concept in AI security is the idea of “cybersecurity memory” for AI agents. As AI tools become more integrated into enterprise workflows and interact with sensitive data, it’s critical to embed persistent, context-aware security controls. These controls should track and enforce data protection across all AI-driven processes, helping to prevent data leakage and unauthorized access. Security leaders should consider how to implement cybersecurity memory as part of their broader AI risk management strategy, ensuring that AI agents are not just intelligent, but also accountable and secure.

Let’s step back and look at the strategic implications of these trends. First, the acceleration of zero-day exploits in widely used platforms demands faster vulnerability management and more proactive threat intelligence. It’s not enough to wait for monthly patch cycles—organizations need to be prepared to act on short notice, often within hours or days of disclosure.

Second, AI adoption is outpacing the development of governance and security frameworks. This creates a window of risk where organizations are exposed to data leakage, bias, and regulatory scrutiny. The solution isn’t to slow down innovation, but to build governance into the adoption process from the start.

Third, supply chain and software update mechanisms remain high-value targets for attackers. Enhanced validation and monitoring of these channels are essential, as is a culture of skepticism around updates and downloads—even those that appear to come from trusted sources.

Finally, the shift toward agentic and autonomous AI system

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk environment is evolving at a pace that’s challenging even the most mature organizations. We’re seeing a convergence of technical threats—like zero-day exploits in core platforms—and governance challenges as AI adoption accelerates faster than risk management can keep up. Let’s dive into the most critical developments shaping the landscape right now, and explore what they mean for security leaders and organizations aiming to stay resilient and compliant.

Let’s begin with the technical front: two major zero-day vulnerabilities have surfaced in widely used platforms—Cisco SD-WAN and TeamViewer. Both are being actively exploited, and both serve as stark reminders that patch management and rapid incident response remain the backbone of cyber defense.

First, the Cisco SD-WAN Manager vulnerability, tracked as CVE-2026-76504, has been added to CISA’s Known Exploited Vulnerabilities catalog. This is not a theoretical risk—attacks are happening in the wild. Cisco SD-WAN is a foundational technology for many organizations, enabling flexible, cloud-managed networking across distributed environments. But this flexibility comes with risk: a critical flaw in SD-WAN Manager could allow attackers to compromise network infrastructure, move laterally, and potentially access sensitive data or disrupt operations.

What’s the practical implication here? If your organization uses Cisco SD-WAN, patching this vulnerability should be a top priority. Don’t assume your existing controls are sufficient. Review your exposure, assess whether the vulnerable versions are in use, and ensure that incident response playbooks are updated for this scenario. This isn’t just about one product—it’s about the persistent risk that supply chain and infrastructure vulnerabilities pose to the entire ecosystem. Continuous vulnerability management, regular scanning, and a disciplined patching cadence are essential, but so is the ability to respond rapidly when new exploits are discovered.

Now, let’s turn to TeamViewer. Critical vulnerabilities have been disclosed that allow attackers to execute code remotely via compromised sessions. TeamViewer is ubiquitous for remote access and support, especially in hybrid and remote work environments. The risk here is twofold: not only can attackers gain unauthorized access, but they can also use these sessions as a foothold to move deeper into networks or exfiltrate data.

For organizations that rely on TeamViewer, this is a wake-up call. It’s not enough to simply patch the application—although that’s non-negotiable. You also need to evaluate how and where remote access tools are used, ensure that strong authentication and endpoint controls are in place, and monitor for anomalous activity that might signal abuse. This incident reinforces a broader truth: remote access tools are prime targets, and their compromise can have outsized consequences. Regular reviews of remote access policies, privileged access management, and endpoint security are all part of the equation.

Shifting gears to the AI side of the risk equation, we’re seeing a growing gap between the adoption of AI technologies and the maturity of risk management practices. According to a recent PwC survey, AI-related threats now top the list of cybersecurity preparedness gaps. This isn’t just about technical vulnerabilities; it’s about a lack of understanding and ownership of AI risks within organizations.

Data privacy, model integrity, and adversarial attacks are specific areas of concern. Many organizations are deploying AI models and agents without fully understanding how these systems could be manipulated, how data might be exposed, or how to detect and respond to attacks targeting AI itself. The survey also highlights a troubling lack of consensus on who actually owns AI risk. Is it the CISO? The Chief Data Officer? The business unit deploying the AI? Without clear ownership, it’s difficult to build effective controls or respond quickly when something goes wrong.

For CISOs and risk executives, this is a call to action. AI governance can’t be an afterthought. It requires clear roles and responsibilities, dedicated risk management processes, and investment in AI-specific controls—everything from model validation and monitoring to data governance and incident response tailored to AI scenarios. The organizations that get ahead of this curve will be better positioned to avoid costly incidents and regulatory headaches down the road.

Speaking of regulation, the compliance environment is evolving rapidly to address these new risks. One of the most significant developments is the emergence of ISO 42001, a new standard for AI management systems. If your organization is already certified to ISO 27001, you’ll find some familiar ground, but ISO 42001 introduces new requirements specific to AI governance, risk assessment, and lifecycle management.

Why does this matter? Regulatory frameworks like ISO 42001 are quickly becoming the benchmarks for demonstrating responsible AI use, both to regulators and to stakeholders. Early adoption can provide a competitive advantage, signaling to customers, partners, and regulators that your organization takes AI risk seriously. But it’s not just about checking the box—it’s about building the processes and culture needed to manage AI responsibly across its entire lifecycle.

As AI becomes more deeply embedded in business processes, the effectiveness of identity and access management (IAM) and zero trust strategies is being put to the test. Zero trust has become a guiding principle for many organizations, but there’s a growing recognition that its implementation often “ends at the browser.” In other words, while network and application access may be tightly controlled, browser-based threats—such as session hijacking and credential theft—remain significant gaps.

This is especially relevant as AI agents and browser-based workflows proliferate. If your zero trust model doesn’t extend to the browser, you could be leaving the door open for attackers to bypass controls and exploit user sessions. CISOs should be evaluating whether their IAM and zero trust implementations are truly end-to-end, and whether they account for the unique risks introduced by AI-powered automation and browser-based activity.

Another emerging challenge is the ability to monitor and control what AI agents do with sensitive data. As organizations deploy more autonomous AI systems, it becomes increasingly difficult to track how data is being accessed, processed, and shared. This raises the risk of unintended data exposure or misuse, especially if AI agents are interacting with sensitive or regulated information.

Effective data governance is essential here. That means not just setting policies, but ensuring auditability and transparency in how AI systems operate. Can you demonstrate who accessed what data, when, and for what purpose? Can you detect and respond to anomalous behavior by AI agents? These questions are becoming central to both compliance and risk management as AI adoption accelerates.

The vendor landscape is responding to these challenges. For example, Xopero Software’s recent acquisition of Vigil Guard, an AI security firm focused on generative AI risks, signals growing demand for tools that address threats like data leakage, prompt injection, and model manipulation. Security leaders should be monitoring the market for solutions that can augment internal controls, especially as generative AI becomes more prevalent and attackers look for new ways to exploit these technologies.

On the practical side, sector-specific tools are emerging to help organizations operationalize AI risk management. The Journal of Accountancy recently highlighted a new checklist designed to help CPAs identify and manage AI-related cyber risks. While the checklist is tailored to the accounting profession, its principles are broadly applicable—emphasizing the need for practical, actionable guidance that can be adapted across industries. This reflects a broader trend: as AI risks become more complex, organizations need tools and frameworks that are relevant to their specific context, not just generic best practices.

It’s also important to recognize that not all organizations are moving at the same pace. Recent reporting from ADS Advance warns that smaller UK firms, in particular, risk being left behind in the AI race—both in terms of adoption and risk management. Resource constraints and lack of expertise are significant barriers, which can leave these firms vulnerable to both competitive disadvantages and increased security risks. Larger organizations should be thinking about the resilience of their supply chain partners and considering how they can support smaller firms in adopting secure AI practices. After all, supply chain risk is a shared risk.

Amid all these technological and regulatory changes, one thing remains constant: the critical role of human judgment in cyber defense. Suncorp Group recently emphasized that, despite advances in automation and AI, people are still the last—and sometimes the best—line of defense against cyber threats. Training, awareness, and a culture of vigilance are essential complements to technical controls, especially as attackers increasingly exploit social engineering and human error alongside technical vulnerabilities.

This point can’t be overstated. Even the most advanced technical controls can be undermined by a single click on a phishing email or a poorly considered response to a social engineering attempt. Building a resilient organization means investing in people as much as in technology—making sure that employees at all levels understand t

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is a study in convergence—where persistent, high-impact vulnerabilities in core digital infrastructure meet the accelerating adoption of artificial intelligence across the enterprise. The result is a risk environment that’s not just fast-moving, but also deeply interdependent. Let’s break down the most critical developments shaping enterprise risk management today, and what they mean for security leaders, risk executives, and boards.

Let’s start with the most urgent threat: the active exploitation of a critical zero-day vulnerability in Citrix NetScaler, tracked as CVE-2026-88772. This isn’t just another technical flaw—this is a gateway that state-sponsored actors have been using since early September to gain root-level access to enterprise systems. Once inside, they’re deploying web shells, which essentially give them persistent, covert control over compromised environments. Multiple sources have confirmed successful intrusions, and the scope of these attacks is still unfolding.

The key lesson here is the persistent gap between when a vulnerability is disclosed and when organizations actually apply the necessary patches. Attackers are exploiting this window, sometimes for weeks at a time. For organizations running NetScaler appliances, immediate action is non-negotiable. Patching is the first step, but it’s not enough. A thorough forensic review is critical to identify any signs of compromise—look for unexpected web shells, unusual authentication attempts, or unexplained configuration changes. Delaying response could mean significant data loss, lateral movement, and even deeper compromise of your environment.

But NetScaler isn’t the only enterprise tool under siege. Attackers are also targeting remote monitoring and management tools—specifically MSP360 and ScreenConnect. These are legitimate platforms, trusted by IT teams to provide remote support and manage infrastructure. Unfortunately, that trust is exactly what makes them attractive to adversaries. Once attackers gain access, they use these tools to maintain persistence, move laterally across networks, and harvest credentials.

The practical implication is clear: every remote session, every instance of RMM tool usage, is now a potential risk vector. Security teams need to double down on monitoring, restrict access to these tools, and validate every remote connection. It’s not enough to trust the software because it’s widely used—attackers are counting on that trust to mask their activities.

Another attack chain drawing attention involves vulnerabilities in PaperCut, a widely used print management system. Here, attackers are exploiting remote code execution flaws to steal authentication tokens and access domain controllers—the very core of enterprise identity infrastructure. Once domain controllers are compromised, attackers can escalate privileges, impersonate users, and move laterally with ease.

The message for security teams is straightforward: patch PaperCut systems as a priority, monitor for suspicious activity, and review domain controller access logs. If you see unusual access patterns or unexplained changes to authentication tokens, you may already be dealing with an active compromise.

Shifting gears to the AI front, we’re seeing rapid evolution in both the technology and the governance tools designed to manage its risks. Vendors are rolling out new capabilities that allow security teams to monitor interactions with AI platforms—take Claude, for example. Security teams can now review chat logs, track file transfers, and monitor agent activity within these AI environments. This addresses a growing concern: as AI adoption accelerates, so does the risk of data leakage, compliance violations, and the emergence of “shadow AI”—unsanctioned tools and agents operating outside official oversight.

For CISOs, integrating these monitoring tools into existing security operations is becoming essential. It’s about more than just compliance—it’s about enforcing policy, detecting misuse, and supporting audit requirements in an environment where AI is increasingly embedded in business processes.

A related development comes from RSA, which has launched an Agent ID platform specifically designed to secure AI agents and multi-cloud platform servers. The challenge here is unique: AI agents, especially those operating autonomously, interact with sensitive data and systems across complex cloud environments. Traditional identity and access management tools aren’t always equipped to handle this level of dynamism or automation.

RSA’s Agent ID platform aims to fill that gap by providing visibility and control over agent interactions. This is a significant step forward, because as AI agents become more capable and more autonomous, the risk of unauthorized actions, data leakage, or even malicious manipulation increases. Security leaders should be evaluating how these new identity platforms can be integrated into broader access governance strategies.

On the SaaS and AI governance side, Nudge Security has introduced adaptive risk management solutions. The key word here is “adaptive.” Instead of relying on static, point-in-time risk assessments, these tools dynamically track SaaS and AI risk as usage evolves after initial approval. In practice, this means organizations can respond to changes in risk posture in real time—whether that’s a sudden spike in usage, the introduction of a new integration, or the emergence of shadow IT.

For risk leaders, adaptive governance is no longer a nice-to-have. The pace of SaaS and AI adoption means that yesterday’s risk profile may be obsolete tomorrow. Tools that can detect and respond to these shifts in real time are becoming mandatory for organizations that want to stay ahead of evolving threats.

K2 GRC is another vendor making waves, with the launch of K2 Assist AI. This platform leverages artificial intelligence to automate readiness reviews and streamline governance, risk, and compliance processes. As regulatory scrutiny of AI intensifies—especially in sectors like finance, healthcare, and critical infrastructure—tools that can automate and improve the efficiency of compliance programs are in high demand.

The practical benefit is twofold: first, organizations can reduce the manual burden on compliance teams, freeing up resources for higher-value work. Second, automated assessments can help identify gaps or emerging risks that might otherwise go unnoticed until they become material issues.

Let’s return to the challenge of shadow AI. As organizations embrace AI to drive efficiency and innovation, employees are increasingly turning to unsanctioned or unauthorized AI tools. This “shadow AI” presents a significant risk of data leakage, regulatory non-compliance, and loss of control over sensitive information.

Effective strategies to combat shadow AI start with robust discovery—knowing what tools are in use, by whom, and for what purposes. Policy enforcement is the next step, ensuring that only approved tools are used for sensitive workflows. Finally, user education is critical. Employees need to understand not just the rules, but the reasons behind them—why using an unsanctioned AI tool could expose the organization to risk.

CISOs should prioritize visibility and controls over AI tool usage. This isn’t just about ticking a compliance box—it’s about preventing inadvertent exposure of sensitive data, intellectual property, or regulated information.

Innovation in AI security is also accelerating. The Tech4Trust accelerator, for example, has named 30 startups to its latest cohort, all focused on securing AI. This reflects a broader trend: a surge in innovation aimed at addressing AI-specific risks, from model integrity to data privacy and beyond.

Security leaders should be watching this ecosystem closely. The solutions being developed by these startups could become critical components of enterprise risk management strategies in the near future. Whether it’s tools for monitoring AI model behavior, platforms for securing training data, or solutions for auditing AI decision-making, the innovation pipeline is robust and growing.

Partnerships are also shaping the AI governance landscape. Distology’s recent agreement with Harmonic Security highlights the growing market demand for AI governance solutions. As organizations seek to operationalize AI safely, the need for tools that provide oversight, compliance, and risk mitigation is only increasing.

The takeaway here is that AI governance is no longer an abstract concept. It’s a practical, operational requirement. Organizations should be evaluating governance frameworks and tools that are specifically tailored to the unique risks and challenges of AI.

Another trend worth noting is the convergence of security and sustainability at the board level. Increasingly, security and sustainability are reporting to the same boardroom, driven by regulatory and stakeholder expectations. This alignment can create powerful synergies—security initiatives can support broader ESG (environmental, social, and governance) objectives—but it also introduces new complexities in risk prioritization and reporting.

CISOs need to be prepared to articulate how security programs contribute to ESG goals. For example, robust data protection can support privacy and social responsibility objectives, while secure supply chains can enhance environmental and ethical sourcing efforts. The ability to speak the language of both security and sustainability is becoming a key skill for risk leaders.

Zooming out to the geopolitical environment, the evolving relationship between the US and China is havin

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is marked by a rapid convergence of innovation and threat. We’re seeing a surge in AI-driven security tools, a spike in critical vulnerabilities, and a wave of breaches that are testing the limits of both public and private sector defenses. Let’s break down the most important developments shaping risk management and security strategy right now.

First, a major signal from the federal government: The U.S. Department of Health and Human Services has awarded a $13.7 million contract to Telos Corporation to modernize its cyber risk management. This isn’t just a routine upgrade—this is a foundational overhaul targeting how risk is assessed, monitored, and mitigated across one of the country’s most vital sectors. We can expect advanced analytics and automation to play a central role, setting a new benchmark for how large public institutions approach cyber risk. For risk leaders in healthcare and adjacent sectors, this move will likely ripple out as a new standard, influencing regulatory expectations and best practices. If you’re in healthcare, this is a clear sign: legacy frameworks are being replaced, and modernization is now a regulatory and operational imperative.

Meanwhile, the cybersecurity market itself is shifting. AI security has officially overtaken Governance, Risk, and Compliance—GRC—as the largest segment in the industry. This reflects two realities: the explosion of AI-powered threats, and the rapid adoption of AI-based security solutions. For CISOs and security architects, this means AI is no longer just a tool; it’s a primary battleground. Prioritizing AI-specific controls, threat modeling, and governance mechanisms is no longer optional. As AI agents and tools proliferate, so do the risks associated with them—everything from data leakage to adversarial attacks. The message here is clear: if your security program doesn’t have a dedicated AI security strategy, you’re already behind.

But even as AI security takes center stage, traditional infrastructure risks are far from solved. Right now, Citrix NetScaler appliances are at the heart of a global disruption. Two critical remote code execution vulnerabilities—CVE-2026-88771 and CVE-2026-88772—have been actively exploited for weeks. The impact is real and immediate: Dutch hospitals and government agencies have experienced operational outages, and CISA has issued urgent warnings. Attackers are leveraging these zero-days to compromise organizations at scale, bypassing defenses and causing business continuity issues. The practical takeaway for any organization running Citrix NetScaler: patch immediately, review your exposure, and ensure your incident response plans are up to date. These are not theoretical risks—they’re being exploited in the wild, with significant consequences for critical services.

Data breaches continue to underscore the fragility of digital trust. The latest example comes from Gyazo, a popular image-sharing platform. A breach there has exposed 23.6 million user records and nearly half a billion pieces of image metadata. The scale and sensitivity of this breach raise several concerns. First, the risk of downstream phishing and credential stuffing attacks is high—attackers now have a massive trove of user data to work with. Second, there are significant privacy implications, especially for users who may have shared sensitive images or information. For security leaders, this is a reminder to review the security posture of any image or data-sharing platforms in your environment, and to reinforce user awareness about the risks of sharing sensitive data online.

On the solution side, we’re seeing vendors respond to the democratization of AI security needs. Barracuda has launched AI-driven data security solutions specifically for smaller organizations. Historically, advanced threat detection and response capabilities have been out of reach for many SMBs due to cost and complexity. Barracuda’s move aims to close that gap, making sophisticated security accessible to organizations with fewer resources. However, this also raises important governance questions. Smaller organizations may lack the internal maturity to properly oversee and manage AI tools, potentially introducing new risks even as they mitigate old ones. The lesson here: technology alone isn’t enough—effective oversight and governance must keep pace with adoption.

NVIDIA is also making waves in the AI security space. The company has unveiled an open agent safety platform designed to assess and mitigate risks associated with autonomous AI agents. As agent-based architectures become more common, the need for operationalized AI safety frameworks grows. NVIDIA’s platform could become a reference point for organizations looking to embed safety and governance into their AI deployments. For those building or deploying autonomous agents, this is a resource worth evaluating as part of your broader AI risk management strategy.

Cloud environments continue to present unique governance challenges, especially as organizations accelerate multi-cloud adoption. Researchers are warning of major governance gaps in Multi-Cloud Platforms, or MCPs. The complexity of managing distributed environments across multiple providers means that traditional oversight mechanisms often fall short. The risks here are multifaceted: misconfiguration, data leakage, and compliance failures are all heightened in these environments. As cloud adoption grows, so too does the need for robust, cross-platform governance frameworks. If your organization is moving to or expanding in multi-cloud, now is the time to assess whether your oversight mechanisms are truly up to the task.

Healthcare, in particular, is at a crossroads when it comes to AI governance. Hospitals and payers are integrating AI into both clinical and administrative workflows, but many lack clear frameworks for oversight, risk assessment, and accountability. This creates both ethical and operational risks. For example, how do you ensure that AI-driven decisions in patient care are transparent and fair? How do you audit the outcomes? The absence of structured governance increases the risk of unintended consequences, from bias in clinical algorithms to data privacy violations. Healthcare leaders need to prioritize the development of comprehensive AI governance models—this is no longer a future concern, but a present necessity.

Turning to the cloud, attackers are evolving their tactics. Rather than breaking in through traditional perimeter defenses, they’re increasingly stealing cloud access keys, allowing them to operate with legitimate credentials. This shift highlights the importance of robust identity and access management—IAM—practices. Key rotation, least-privilege access, and continuous monitoring for anomalous activity are now table stakes for cloud security. If you’re not already prioritizing these controls, your cloud environment is at risk of becoming a soft target for credential-based attacks.

On the compliance and certification front, we’re seeing the emergence of new standards for AI management. Ansira has achieved ISO/IEC 42001:2023 certification, which is designed specifically for AI management systems. This certification is poised to become a differentiator for organizations looking to demonstrate responsible AI governance and compliance. It’s also likely to influence procurement decisions and regulatory expectations. For organizations deploying AI at scale, pursuing such certifications may soon move from a nice-to-have to a business requirement.

Another development worth noting is the extension of agent security and governance to employee endpoints. Noma has expanded its solutions to cover not just centralized AI agents, but also those running on individual employee devices. This addresses the growing risk of shadow AI—where unsanctioned or unmanaged AI tools proliferate across the organization. By extending governance to the endpoint, organizations can take a more holistic approach to AI risk management, ensuring visibility and control wherever AI is operating.

Despite all these advances, the reality is that most organizations are still “flying blind” when it comes to AI security and governance. A recent Q&A with James Moore highlights that the majority of enterprises lack visibility and structured oversight over their AI deployments. This increases exposure to both technical risks—such as adversarial attacks or data leakage—and regulatory risks, as compliance requirements evolve. The call to action is clear: leaders need to prioritize inventory, risk assessment, and policy development for AI systems. Without a clear understanding of where and how AI is being used, effective governance is impossible.

Stepping back, a few strategic implications emerge from today’s developments. First, AI security is now a primary focus area. It demands dedicated governance, controls, and investment—not just as an add-on to existing programs, but as a core pillar of the security strategy. Second, vulnerabilities in critical infrastructure, such as Citrix NetScaler, remain a persistent and high-impact risk. Rapid detection, patching, and response capabilities are essential to maintain operational resilience. Third, cloud security is shifting. The perimeter is no longer the main line of defense—identity and key management are now the front lines, and attackers are exploiting credential theft to devastating effect. Finally, regulatory and certification frameworks for AI, like ISO/IEC 42001:2023, are emerging as benchmarks for responsible deployment and procurement. Organizations that get ahead of these requirements will be better positioned to manage risk and earn trust.

So, what

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is evolving at a pace that’s challenging even the most prepared organizations. The convergence of artificial intelligence with traditional cyber threats is introducing new forms of risk—some of them existential in nature. As enterprises and public sector bodies accelerate their adoption of AI, the gap between rapid deployment and effective governance is widening. This isn’t just a technical issue; it’s a strategic and operational one that touches every part of the business.

Let’s start by looking at the broader context. Multiple industry sources are now warning that AI isn’t just another technology to secure—it’s an existential risk for organizations. That means the consequences of failure could threaten business continuity, regulatory standing, and even the organization’s reputation. As AI systems become more autonomous, making decisions that once required human oversight, the potential for systemic failure grows. Security leaders are being urged to rethink their risk registers and incident response plans to explicitly address AI-driven scenarios. The old silos between data security, application security, and AI governance are breaking down. We need unified frameworks that treat AI and data as a single, integrated risk domain.

Axa XL and other industry voices are at the forefront of this conversation. Their message is clear: treat AI as an existential risk, not just a technical one. This shift in mindset is critical because AI systems are now making decisions that directly impact business operations, compliance, and reputation. If your organization is still treating AI as a side project or a technical curiosity, it’s time for a strategic reset. The recommendation is to bring AI and data under a unified governance umbrella, with controls that span both domains. That means reassessing your risk registers, updating incident response plans, and ensuring that AI-driven scenarios are explicitly considered in your business continuity planning.

The market is responding to these challenges. Proofpoint, for example, has just launched an agentic security system designed to protect both AI and data as a unified risk. This is more than just a new product—it’s a signal that the industry is moving toward integrated platforms that can monitor, control, and secure AI agents and the data they process. For CISOs, this means that the era of piecemeal solutions is coming to an end. The complexity of AI deployments, combined with the need for holistic governance, is driving demand for platforms that can address shadow AI, unauthorized data flows, and the risks associated with autonomous agents. If you’re evaluating your security stack, now is the time to look for solutions that can provide visibility and control across both AI and data assets.

But while the strategic conversation around AI risk intensifies, the day-to-day threat landscape isn’t standing still. We’re seeing a surge in high-impact vulnerabilities—some of them being actively exploited in the wild. Let’s talk about two critical vulnerabilities that have surfaced this week.

First, attackers are actively exploiting a zero-day vulnerability in Check Point VPN and management interfaces. This flaw allows remote code execution, and there are already reports of successful intrusions. If your organization uses Check Point solutions, immediate action is required. Prioritize patching, review your VPN access logs for signs of suspicious activity, and consider additional network segmentation to contain any potential breaches. This incident is a stark reminder of the persistent threat posed by zero-day attacks. Rapid patch management and a layered defense strategy remain essential, especially as attackers increasingly automate their campaigns using AI.

The second major vulnerability involves Roundcube Webmail. A critical flaw here allows attackers to trigger SQL injection without authentication. This could lead to data breaches or even full system compromise. Again, the recommendation is immediate patching, along with a review of webmail access and database logs for any signs of exploitation. These incidents underscore a broader point: the threat tempo is accelerating, and organizations need to be proactive in identifying and mitigating vulnerabilities before attackers can exploit them.

AI isn’t just a risk management challenge—it’s also becoming a tool for attackers. We’re seeing the emergence of new AI-powered cyber threats, including advanced malware and ransomware. One example is a sophisticated Android banking trojan that’s using AI-generated overlays to steal users’ banking PINs. This technique makes phishing attacks more convincing and harder to detect, bypassing many traditional security controls. Security teams should enhance their mobile threat defenses, educate users about the risks of overlay attacks, and monitor for anomalous app behaviors. The lesson here is that AI is a double-edged sword—while it can enhance defenses, it also gives attackers new capabilities.

On the ransomware front, a new operation called Galago has emerged, with apparent links to the Panzer Group. The constant evolution of ransomware actors highlights the need for robust backup strategies, network segmentation, and ongoing employee awareness training. Ransomware isn’t going away, and the integration of AI into these operations is likely to make them even more effective. Organizations should ensure that their backup and recovery plans are tested regularly, and that network segmentation is in place to limit the spread of ransomware if a breach occurs.

Let’s turn back to AI governance. Research is showing that AI adoption is outpacing the development of effective governance frameworks, particularly in the public sector. In the UK, for example, many organizations are deploying AI systems without adequate oversight. This increases the risk of unintended consequences, bias, and security lapses. The message for CISOs and risk leaders is clear: governance frameworks need to keep pace with AI deployment. That means not just assessing risk before go-live, but ensuring ongoing risk assessments as systems evolve. Continuous monitoring, regular audits, and clear lines of accountability are essential.

The lack of governance isn’t limited to the public sector. A recent report from OX Security found over 15,000 MCP servers operating without any governance controls. This creates significant attack surfaces and compliance risks. Security leaders should take inventory of their AI and automation infrastructure, enforce access controls, and implement continuous monitoring. Shadow IT and unsanctioned AI deployments are a growing problem, and without governance, organizations are flying blind.

Browser security is another area where AI is introducing new risks. Akamai reports that enterprise adoption of AI-enabled browsers has crossed 40%, but the associated risks—such as data leakage and malicious extensions—aren’t being adequately addressed. CISOs should review browser security policies, restrict the use of unapproved AI browser tools, and monitor for suspicious activity. As AI becomes embedded in more applications and platforms, the attack surface expands. Browser-based attacks, data exfiltration, and malicious extensions are all areas that require renewed attention.

On the international stage, the conversation around AI risk is gaining urgency. Leading tech executives have warned the United Nations Security Council about the extinction-level risks posed by frontier AI systems. Their call is for urgent international cooperation and safeguards to prevent catastrophic misuse or loss of control. While this may seem like a macro-level concern, it has direct implications for enterprise risk leaders. Scenario planning should now include the potential for large-scale AI failures, regulatory changes, and the need for responsible AI development. Organizations that engage in these conversations early will be better positioned to adapt to new regulatory requirements and compliance burdens.

Geopolitically, we’re seeing countries like Pakistan call for international safeguards and human oversight to prevent an AI arms race and technological exclusion. This stance could influence regulatory trends and cross-border data governance, particularly for multinational organizations. If your business operates in multiple jurisdictions, it’s important to stay ahead of these developments and ensure that your AI strategies are aligned with emerging global standards.

On the vendor side, we’re seeing a wave of new AI-focused security solutions targeting managed service providers. Barracuda Networks and others are rolling out tools to help MSPs and their clients manage AI risks, automate threat detection, and enforce governance. For organizations that rely on third-party providers, it’s important to evaluate the maturity of these offerings and consider how they fit into your broader risk management and vendor oversight programs. As the ecosystem becomes more complex, third-party risk is becoming a critical area of focus.

So, what are the strategic implications of all this? First, AI must be treated as an existential and integrated risk—not just a technical challenge. The gap between AI adoption and governance is widening, increasing systemic risk across industries. Zero-day vulnerabilities and AI-powered malware are accelerating the threat tempo, making rapid response and layered defenses more important than ever. And as international calls for AI safeguards grow louder, organizations should anticipate new regulatory requirements and compliance burdens.

Let’s bring this down to what matters today. If you’re responsible for cyber risk or AI go

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is more turbulent than ever, with a surge in critical vulnerabilities and active exploitation across some of the most widely used enterprise platforms. We’re seeing attackers move faster, exploit zero-days more aggressively, and leverage AI in ways that are fundamentally changing the threat environment. At the same time, defenders are racing to adopt AI-driven solutions and shore up core controls. Let’s break down what’s happening, why it matters, and what you need to prioritize now.

Let’s start with the vulnerabilities making headlines and causing headaches for security teams worldwide.

First up: F5’s BIG-IP Access Policy Manager. A critical zero-day vulnerability has been discovered and is being actively exploited in the wild. This isn’t just a theoretical risk—both F5 and independent researchers have confirmed that attackers are successfully leveraging this flaw for unauthenticated remote code execution on OAuth servers. For organizations using BIG-IP, this is a high-severity, high-impact issue. If an attacker can execute code without authentication, they can potentially take full control of the affected system, move laterally within your network, and disrupt critical services. The implications range from data theft and ransomware to service outages and reputational harm.

The immediate action here is clear: patch exposed BIG-IP instances without delay. But don’t stop at patching—review your logs for signs of compromise, especially if you’ve had any externally exposed APM servers. This is the kind of vulnerability that can lead to cascading failures if left unchecked, so rapid incident response and thorough forensic review are essential.

Unfortunately, F5 isn’t alone this week. Check Point’s management servers have also been hit with a zero-day, and attackers are moving quickly to exploit it. This flaw allows arbitrary script execution without authentication, giving adversaries a potential foothold on your perimeter defenses. Check Point has released patches, but exploitation is ongoing, and the risk is significant—especially for organizations that rely on Check Point for their primary security gateway. If attackers gain privileged access to your management servers, they can potentially pivot deeper into your environment, bypassing other controls.

The takeaway here is similar: prioritize patch deployment, but also conduct a forensic review to ensure you haven’t already been compromised. Don’t assume that patching alone is enough—if an attacker already has a presence, you need to root them out before they can escalate further.

Moving to the endpoint, Google has released a massive update for Chrome, addressing 108 vulnerabilities—several of which are critical code execution flaws. Chrome is ubiquitous in enterprise environments, making it a high-value target for attackers. Unpatched browsers can become the weak link that compromises an entire organization, especially given the prevalence of phishing, drive-by downloads, and malicious extensions.

The practical implication is straightforward: ensure that Chrome updates are rolled out promptly across all endpoints. This is one of those areas where automation can make a huge difference—leverage your endpoint management tools to enforce updates, and don’t leave it to end users to patch on their own schedule.

Now, let’s talk about the evolving threat of AI-driven malware. We’re seeing a new generation of malicious code that doesn’t just follow a static playbook. Instead, it queries AI models in real time to determine its next move. This means the malware can adapt to its environment, evade traditional detection, and make context-aware decisions on the fly. For defenders, this represents a significant escalation. Traditional signature-based detection is less effective against threats that can morph and adapt in real time.

The implication is clear: behavioral analytics and AI-driven detection are no longer optional. Security teams need to invest in solutions that can identify anomalous behavior, not just known malware signatures. This also underscores the importance of continuous monitoring and rapid response—if you’re relying on yesterday’s defenses, you’re already behind.

WordPress is another area of concern this week, with two major developments. First, a critical vulnerability in WordPress core allows attackers to execute code without authentication. Given that WordPress powers a huge share of public-facing websites, this flaw could enable mass exploitation, website defacement, or data theft on a large scale. Organizations running WordPress—especially those with customized or unpatched installations—should prioritize patching immediately and monitor for signs of compromise.

Complicating matters, researchers have identified new malware campaigns targeting WordPress sites using must-use plugins and Ethereum-based EtherHiding techniques. These methods enable persistent backdoor access and make detection and removal much more challenging. The use of must-use plugins means the malware can’t be easily disabled from the admin dashboard, while EtherHiding leverages decentralized infrastructure to hide malicious payloads. This is a sophisticated approach that can keep attackers embedded in your environment for the long haul.

The best defense here is a combination of regular plugin audits, file integrity monitoring, and a strong patch management process. Don’t assume that your site is safe just because it’s running the latest version—custom plugins and themes can introduce their own risks.

Shifting gears to mobile threats, there’s an active campaign distributing StreamRat malware via fake TV streaming ads. These malicious ads are targeting Android users, enabling remote hijacking of devices. For organizations with bring-your-own-device (BYOD) policies, this is a reminder that mobile endpoints are a critical part of your attack surface. Malvertising isn’t new, but the sophistication and reach of these campaigns continue to grow.

The response should include robust mobile device management, user awareness training, and clear policies around app downloads and ad interactions. If you haven’t revisited your mobile security posture recently, now is the time.

Zooming out, expert analysis points to a marked increase in global cyber attacks in 2026. The drivers are familiar—geopolitical tensions, the proliferation of ransomware-as-a-service, and the exploitation of emerging technologies. But what’s different is the pace and scale. Attackers are better organized, more automated, and increasingly willing to exploit new vulnerabilities as soon as they emerge.

This means that continuous risk assessment and adaptive defense strategies are not just best practices—they’re necessities. Static controls and annual risk reviews are no longer sufficient. Security teams need to operate with the assumption that breaches will occur and focus on minimizing impact and accelerating recovery.

Let’s talk about the intersection of AI and compliance, particularly in the tax domain. AI adoption in tax compliance is accelerating, with organizations using automation to handle sensitive financial data and streamline regulatory processes. While this offers efficiency gains, it also introduces new security risks. Automated systems become attractive targets, and errors or manipulations—whether accidental or malicious—can have serious regulatory and reputational consequences.

Security leaders need to ensure that AI-driven compliance processes are subject to robust controls and are fully auditable. This includes not just technical safeguards, but also clear documentation, regular testing, and independent review. The stakes are high—mistakes here can lead to regulatory penalties and loss of trust.

On the vendor side, Barracuda and Cancom have both launched new AI security solutions aimed at safer AI adoption. Barracuda’s AI Data Security solution is targeting small businesses and managed service providers, while Cancom’s FlexPod AI is an on-prem turnkey AI stack built with Nvidia, Cisco, and NetApp. These offerings reflect the growing demand for secure AI infrastructure and strong data governance.

But as organizations evaluate these solutions, due diligence is critical. Not all AI security tools are created equal, and integration with existing infrastructure can introduce new risks if not managed properly. Evaluate vendors carefully, understand how their solutions fit into your broader security architecture, and ensure that you’re not introducing new blind spots in the name of innovation.

Machine identity management is another area seeing rapid evolution, especially as organizations move more workloads to the cloud and rely on complex supply chains. Weaknesses in machine identity—such as unmanaged certificates, keys, or service accounts—can enable lateral movement and supply chain attacks. A recent review of machine identity management solutions highlights this as a priority area for investment and process improvement.

The practical steps here involve inventorying all machine identities, enforcing strong lifecycle management, and integrating machine identity controls with your broader access management and monitoring systems. As supply chains become more interconnected, a compromise in one area can quickly propagate, so vigilance is key.

Finally, let’s address the human element. Security Journey has rolled out AI-focused security training for non-technical staff, recognizing that as AI becomes embedded in business processes, attackers will increasingly target user error and lack of awareness. Upskilling the workforce is essential—not just for technical teams, but for ever

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is evolving at an unprecedented pace, with both technological advancements and threat activity accelerating simultaneously. The convergence of these trends is presenting new challenges for organizations, from the boardroom to the security operations center. Let’s break down the most significant developments shaping today’s risk environment, and what they mean for security leaders, risk executives, and organizations at large.

Global attention on artificial intelligence risk is reaching a new level. The United Nations Security Council is convening high-profile briefings with major AI stakeholders, including DeepSeek and Sam Altman, the CEO of OpenAI. This is more than a symbolic gesture—it’s a clear sign that AI governance has become a matter of international security and diplomacy. As AI capabilities continue to advance and geopolitical competition intensifies, global leaders are recognizing the need for coordinated frameworks to address AI misuse, safety, and the cross-border impacts of these technologies.

This growing focus at the UN level is likely to drive new regulatory expectations for organizations deploying advanced AI. Security leaders should anticipate that internal AI governance will need to align with emerging international standards—not just national or industry-specific requirements. This is about more than compliance; it’s about demonstrating responsible stewardship of AI, ensuring transparency, and preparing for a world where AI-related incidents can have global consequences.

At the same time, research is exposing a significant gap between the rapid adoption of AI in the enterprise and the maturity of governance practices. A new EMA Research webinar is set to examine this issue in depth, highlighting that while AI is being integrated into business processes at breakneck speed, controls around risk, compliance, and security are struggling to keep up. The implications are serious: operational, reputational, and regulatory risks are mounting for organizations that lack dedicated AI governance frameworks and cross-functional oversight.

This governance gap isn’t just theoretical. According to recent ISACA research, only 8% of organizations conduct regular AI-specific incident response exercises. That means more than nine out of ten enterprises are not actively preparing for AI-driven attacks or failures. As AI systems increasingly power critical decision-making and automation, this lack of preparedness is a glaring vulnerability. Security and risk leaders need to prioritize scenario planning and tabletop exercises that address the unique risks posed by generative and agentic AI systems.

Let’s talk about what those risks look like in practice. One area of concern is the potential for unbounded resource consumption in large language models—a risk highlighted in the OWASP LLM Top 10. A recent simulation demonstrated how attackers can exploit these models to trigger excessive compute or data usage. The result? Denial-of-service attacks or runaway costs that can disrupt operations and hit the bottom line. Security teams must implement usage controls and monitoring for AI workloads, ensuring that resource consumption is predictable and contained.

The evolution of AI is also driving a shift in how organizations need to approach governance. Akamai’s latest report underscores that agentic AI—systems capable of autonomous action—require a move away from purely technical controls toward behavioral governance. This means organizations must monitor AI decision-making, enforce guardrails, and ensure accountability at every stage of the AI lifecycle. Traditional security controls aren’t enough; it’s about understanding and shaping the behavior of AI agents in real-world environments.

Compounding this, agentic AI systems are not exempt from existing compliance requirements. Cybersecurity Insiders points out that frameworks like the Cybersecurity Maturity Model Certification (CMMC) and state privacy laws still apply. Organizations can’t afford to treat AI as a special case outside the scope of established controls. Instead, they need to integrate AI-specific measures into their broader compliance and privacy programs, especially as regulatory scrutiny intensifies.

While AI risk and governance are quickly rising to the top of the agenda, the cyber threat landscape remains as active as ever. Several critical vulnerabilities and breaches have emerged that demand immediate attention.

First, a coordinated attack has compromised 65 GitHub repositories and introduced a hidden backdoor into an npm package. This is a textbook supply chain attack, demonstrating the ongoing risk of dependency poisoning. For organizations that rely on open-source components—and that’s virtually everyone—rigorous code provenance checks and supply chain security practices are essential. It’s not just about vetting your own code, but also understanding and managing the risks introduced by third-party dependencies.

Meanwhile, Chinese advanced persistent threat groups are leveraging cloned legitimate websites to deliver Chrome and Windows zero-day exploits. This tactic raises the risk of drive-by compromise, where unsuspecting users are infected simply by visiting a trusted-looking site. The practical takeaway here is the importance of user awareness, robust patch management, and integrating threat intelligence into security operations. Organizations need to ensure that their endpoints are patched quickly and that users are trained to recognize suspicious activity—even when it appears to come from familiar sources.

On the vulnerability management front, the Cybersecurity and Infrastructure Security Agency—CISA—has added six new exploited flaws to its Known Exploited Vulnerabilities catalog. Federal agencies have been given just three days to patch, reflecting the accelerating pace at which vulnerabilities are being weaponized in the wild. This is not just a federal issue; the expectation for rapid vulnerability management is becoming the norm across all sectors. Organizations need to maintain up-to-date asset inventories, automate patch deployment where possible, and ensure that both IT and operational technology environments are covered.

The risks associated with identity and authentication providers have also been underscored by a massive breach at Nexus, which exposed 153 million identities. The sheer scale of this incident raises significant counterintelligence and fraud risks—not just for Nexus, but for every organization that relies on third-party authentication. This highlights the need for robust third-party risk management, layered authentication controls, and continuous monitoring for signs of credential abuse or identity compromise.

Another area of immediate concern is the exploitation of zero-day vulnerabilities in network infrastructure. A zero-day exploit chain targeting SonicWall SMA1000 appliances has been rated with a maximum CVSS score of 10.0—indicating the highest level of severity. Organizations using these devices should move quickly to patch, but also consider additional measures like network segmentation and enhanced monitoring to detect and contain any potential compromise.

Similarly, CISA has issued an alert for an actively exploited vulnerability in Zyxel GS1900 switches. Network infrastructure devices remain high-value targets for attackers seeking persistent access or lateral movement within organizations. Timely patching and ongoing monitoring are critical to defend against these threats.

Stepping back, what are the strategic implications of these developments? First, international AI governance is accelerating. Organizations deploying advanced AI should expect regulatory expectations to increase, and should begin aligning their internal policies with emerging global standards. This isn’t just about checking boxes; it’s about building trust with stakeholders, customers, and regulators in an environment where AI risks are under the microscope.

Second, the gap between AI adoption and governance is a critical risk. Most organizations are not adequately prepared to respond to AI-specific incidents or to govern the behavior of autonomous systems. This is now a board-level issue, requiring investment in dedicated governance frameworks, cross-functional oversight, and ongoing training and exercises.

Third, supply chain and identity breaches are escalating. Organizations must double down on third-party risk management, robust authentication controls, and continuous monitoring for compromise. The risks introduced by partners and providers are no longer peripheral—they are central to organizational security.

Finally, the pace of vulnerability exploitation is only increasing. Rapid patch cycles, improved asset visibility, and automation are essential to keep up with the threat landscape. This applies not just to traditional IT assets, but to operational technology and network infrastructure as well.

So, what matters most today for security and risk leaders?

First, prepare for new AI governance requirements by proactively aligning your internal policies and controls with international standards. Don’t wait for regulations to be finalized—start building the foundations now.

Second, accelerate your AI-specific incident response planning. This means developing and running tabletop exercises that address the unique risks posed by generative and agentic AI. Make sure your teams know how to respond to AI-driven incidents, from data leakage to autonomous system failures.

Third, prioritize patching of newly disclosed vulnerabilities. The window between disclosure and exploitation is shrinking, and attac

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is in a state of rapid evolution, with several significant developments shaping the way organizations need to think about security, governance, and resilience. Over the next several minutes, I’ll walk through the most pressing issues facing CISOs, risk executives, and security teams today, drawing on recent high-profile incidents, emerging best practices, and the shifting dynamics of both cybercrime and global AI regulation.

Let’s start with one of the more unusual stories in recent memory—an open feud between two of the world’s most notorious ransomware gangs. The group known as ShinyHunters has publicly claimed responsibility for hacking the dark web leak site operated by their rivals, the Clop ransomware gang. Multiple sources have confirmed the attack, which disrupted Clop’s operations and exposed the inner workings of their infrastructure.

Why does this matter to security leaders? For one, it’s a stark reminder that even the most sophisticated criminal organizations are vulnerable to the same types of attacks they inflict on others. But beyond that, this kind of infighting introduces a new layer of volatility into the ransomware ecosystem. When criminal groups turn on each other, we often see unpredictable shifts in tactics, sudden data dumps, and spillover effects that can impact legitimate organizations. For example, data exfiltrated in these feuds may end up being released publicly, increasing the risk of exposure for companies that have previously paid ransoms or been targeted by either group.

The lesson here is that the threat landscape isn’t just shaped by external actors targeting businesses—it’s also influenced by the dynamics within the cybercriminal community itself. For defenders, this means staying alert to changes in ransomware group behavior, monitoring for unexpected data leaks, and preparing for the possibility that your organization could be caught in the crossfire of these criminal disputes.

Shifting gears, we’re seeing continued evidence that supply chain attacks remain one of the most persistent and challenging risks in cybersecurity. CrowdSec, a well-known open-source security vendor, recently confirmed that its source code was stolen in a supply chain breach. This incident underscores the ongoing vulnerability of third-party software dependencies—especially in open-source ecosystems, where code is often reused and integrated across countless organizations.

For CISOs, the implications are clear: it’s no longer enough to trust that a reputable vendor or open-source project is inherently secure. Rigorous vetting of software components, continuous monitoring for unauthorized changes, and robust incident response plans are now essential elements of any effective security program. The CrowdSec breach is a reminder that even security vendors themselves are not immune to these risks, and that the downstream impacts of a single compromise can ripple across entire industries.

In a related vein, attackers are getting more creative in their attempts to infiltrate open-source communities. Members of the Rust programming language team, along with maintainers of several popular Rust crates, have been targeted in a sophisticated social engineering campaign involving video calls. The attackers used direct communication to try and compromise identities, with the apparent goal of injecting malicious code into widely used packages.

This is a clear example of how the human element remains a critical vulnerability, even in technically robust environments. Social engineering isn’t just about phishing emails anymore—it’s evolving to include more personalized, high-touch tactics that can be difficult to detect. For developer communities, this highlights the importance of strong identity verification, secure communication practices, and a culture of vigilance against manipulation. It also points to the need for layered defenses that combine technical controls with ongoing security awareness training.

While these technical and human risks continue to evolve, we’re also witnessing a surge in global activity around AI governance. Just recently, President Trump and President Xi Jinping met to discuss the future of global AI regulation. This high-profile meeting signals that AI risk management has become a top-tier geopolitical issue, with significant implications for international regulatory approaches, data sovereignty, and cross-border collaboration.

For security executives, this development is more than just a headline. It foreshadows a period of increased scrutiny on AI-enabled systems, especially for multinational organizations operating across multiple jurisdictions. We can expect to see new compliance requirements, tighter controls on data flows, and a growing emphasis on transparency and accountability in AI development and deployment.

Adding to this, a fellow from Chatham House provided expert testimony to the UK Parliament on the global risks and governance challenges posed by AI. The session emphasized the need for coordinated international frameworks and highlighted the complexity of managing AI risks across different legal and regulatory environments. This is a space that’s moving quickly, and organizations will need to stay agile to keep up with new standards and expectations as they emerge.

One practical response to these challenges is the development and adoption of specialized platforms designed to address data sovereignty and AI security. Seclore, for example, has launched its ARMOR platform, which aims to help organizations enforce data residency, control access, and secure sensitive information within AI workflows. As regulatory and customer demands for data localization and AI transparency continue to grow, solutions like this are becoming increasingly relevant. For CISOs, the message is clear: data governance and AI security need to be integrated into every stage of the technology lifecycle, from initial design through to deployment and ongoing management.

Industry guidance is also evolving to reflect these new realities. Bulwark, a security solutions provider, has recently outlined key cybersecurity priorities for organizations integrating AI into their operations. Their focus areas include securing AI models against tampering, managing data privacy risks, and ensuring compliance with a rapidly changing regulatory landscape. This reflects a broader industry shift toward embedding security and governance directly into the AI development process, rather than treating them as afterthoughts.

One area where this is especially relevant is marketing. As AI becomes more deeply integrated into customer engagement strategies, there’s a growing need for frameworks that ensure transparency, accountability, and risk assessment in AI-driven campaigns. A new governance framework for AI in marketing has been proposed, emphasizing the importance of collaboration between marketing, security, and compliance teams. The goal is to mitigate reputational and regulatory risks before they materialize, rather than reacting after the fact.

Turning our attention to cloud security, Unit 42 has detailed how AWS uses managed policies to detect and neutralize compromised IAM credentials. By automating controls and continuously monitoring for suspicious activity, AWS is able to reduce the window of exposure when credentials are compromised. This is a powerful example of how cloud providers and customers can work together to enhance security, but it also highlights the need for organizations to understand and implement shared responsibility models. Automated controls, rapid response capabilities, and continuous monitoring are now table stakes for any effective cloud security strategy.

To build on that, CloudSEK has provided a comprehensive overview of cloud security fundamentals, including the components, risks, and responsibilities involved. As cloud adoption accelerates across industries, it’s essential for organizations to understand where their responsibilities begin and end, and to implement best practices for securing cloud environments. This includes everything from identity and access management, to encryption, to monitoring for misconfigurations and unauthorized activity.

Financial services are another sector where AI governance and compliance are taking center stage. Persistent Systems has achieved a specialization with Databricks to support governed AI initiatives in banking, financial services, and insurance. This move reflects the sector’s focus on embedding governance and compliance into AI projects from the outset, particularly when dealing with sensitive data and stringent regulatory requirements. For organizations in highly regulated industries, this is a model worth emulating—prioritizing governance as a foundational element of any AI initiative.

Threat intelligence remains a cornerstone of effective cybersecurity. Analytics Insight has highlighted the value of integrating threat intelligence into security operations, emphasizing proactive monitoring, information sharing, and actionable insights. By leveraging threat intelligence, organizations can enhance their ability to detect and respond to emerging threats, often before they escalate into full-blown incidents. This proactive approach is especially important in today’s environment, where threat actors are constantly evolving their tactics and looking for new ways to exploit vulnerabilities.

Stepping back to look at the bigger picture, several strategic implications emerge from these developments. First, supply chain and open-source software risks remain a critical vulnerability for organizations of all sizes. Proactive monitoring, rigorou

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is marked by a surge in critical vulnerabilities, active exploitation, and a rapidly evolving regulatory environment. Security leaders are being tested on multiple fronts: from urgent patch management to the governance of shadow AI, and from defending against sophisticated supply chain attacks to anticipating the next wave of AI-driven threats. Let’s break down the key developments shaping today’s risk environment, explore their practical implications, and consider what security leaders need to prioritize right now.

Let’s start with the wave of critical vulnerabilities impacting some of the most widely deployed enterprise security products. Over the past 24 hours, vendors including Cisco, Check Point, Kaspersky, and Tanium have all issued urgent patches for flaws that, in many cases, are already being exploited in the wild. Cisco’s Identity Services Engine, or ISE, is a particular concern, with active attacks targeting environments that haven’t yet applied the latest fix. Check Point, Kaspersky, and Tanium have addressed vulnerabilities that open the door to remote code execution or privilege escalation—attackers’ favorite footholds for lateral movement or data theft.

For organizations running these products, the message is clear: immediate patch deployment is non-negotiable. But it doesn’t stop there. Environments with complex or distributed infrastructure—think hybrid cloud, multiple branch offices, or remote workforces—face additional challenges. Patching at scale requires coordination, testing, and sometimes downtime, but the risk of delay is now demonstrably higher. Attackers are moving quickly to reverse-engineer patches and weaponize exploits, often within hours of disclosure. That means continuous monitoring for exploitation attempts is just as critical as the patching itself. Watch for unusual authentication attempts, privilege escalations, or unexpected outbound traffic—these are often the first signs that a vulnerability is being targeted.

Shifting focus to network infrastructure, MikroTik routers are under active attack, with hackers exploiting vulnerabilities that allow unauthenticated takeover of devices. This is particularly worrisome because MikroTik hardware is popular in both enterprise and service provider environments. Once compromised, these routers can be conscripted into botnets, used as launchpads for lateral movement, or serve as persistent footholds for further compromise. The fact that attackers don’t even need credentials to take control amplifies the urgency. Organizations using MikroTik should prioritize patching, review their network segmentation to limit the blast radius of a potential breach, and monitor for unusual outbound connections that might indicate a device has been hijacked.

Fortinet’s FortiGate appliances are also in the spotlight, with news that a so-called “1-day” vulnerability—meaning a flaw that’s just been patched but is not yet widely remediated—is being sold on underground forums. FortiGate devices are a backbone of security infrastructure for many enterprises, providing firewall and VPN services. The sale of this exploit on criminal marketplaces suggests that widespread attacks could be imminent. Security teams should be monitoring vendor advisories closely, applying patches as soon as they become available, and reviewing firewall and VPN logs for any signs of suspicious activity. This is a classic example of the shrinking window between vulnerability disclosure and exploitation, and it reinforces the need for rapid, automated patch management wherever possible.

Now, let’s talk about the human element—specifically, the rise of shadow AI in the enterprise. A new report finds that 67% of employees are using unapproved AI tools at work. That’s two out of every three workers bypassing official channels to leverage generative AI, coding assistants, or other productivity tools. While the intent may be to boost efficiency, the risks are significant: data leakage, compliance violations, and the introduction of unmonitored, potentially insecure applications into the environment. For CISOs, this is a wake-up call. AI governance policies can’t be theoretical—they need to be rolled out, communicated, and enforced. This means increasing user awareness about the risks of unauthorized AI use, deploying monitoring tools to detect shadow AI activity, and working with business units to provide secure, approved alternatives that meet employees’ needs without compromising the organization’s risk posture.

The supply chain threat landscape is also evolving, with attackers targeting code repositories and exploiting SaaS integrations in new ways. One novel attack, dubbed the “Shai-Hulud Worm,” is hijacking AI coding assistant sessions to compromise SaaS code repositories. This is a significant supply chain risk because compromised code can propagate downstream to customers and partners, multiplying the impact. Security leaders should review their SaaS access controls, enforce multi-factor authentication for critical development tools, and monitor for anomalous activity within code repositories. The lesson here is that the supply chain is only as strong as its weakest link, and attackers are increasingly targeting the tools and integrations that developers rely on every day.

The risks of third-party integrations are further highlighted by a large-scale supply chain attack involving Brevo widgets. Attackers have turned these widgets into a malware delivery channel, impacting over 100,000 websites. This demonstrates the inherent risk of embedding third-party scripts and components into web applications. Organizations should maintain an up-to-date inventory of all third-party scripts, implement content security policies to limit the execution of untrusted code, and be prepared to respond quickly to widespread web-based compromises. The scale of this attack serves as a reminder that even trusted vendors can become vectors for malware delivery if their supply chain is compromised.

Turning to the consumer and enterprise malware front, the MovieReaper malware campaign is spreading through pirated movie torrents and using the Solana blockchain for command-and-control. This is an example of attackers leveraging decentralized technologies to evade takedown efforts. By using the blockchain, they make it much harder for defenders to disrupt their infrastructure. MovieReaper targets both individuals and organizations, potentially leading to ransomware infections or data theft. Security teams should block access to known malicious torrent sources and monitor for unusual network activity related to blockchain transactions. The use of popular blockchains for command-and-control is likely to become more common, so defenders need to adapt their detection strategies accordingly.

As AI adoption accelerates, organizations are scrambling to secure and manage their AI fleets. A growing ecosystem of governance tools is emerging to help with this challenge, but the regulatory environment remains fragmented. Some governments are shelving AI legislation, while others—China, for example—are framing AI as a security threat rather than an existential risk. This divergence creates uncertainty for security executives, who must ensure their governance frameworks are both robust and adaptable. Staying abreast of evolving best practices and regulatory expectations is essential. This means regularly reviewing and updating AI governance policies, engaging with industry groups and regulators, and ensuring that governance tools are flexible enough to accommodate new requirements as they emerge.

On the policy front, the US Cybersecurity and Infrastructure Security Agency, or CISA, has released new guidance on the use of decoys—sometimes called deception technologies—in cyber defense. At the same time, policymakers are debating whether “nuclear-style” safeguards should be applied to AI, reflecting growing concern over the potential for catastrophic misuse. For CISOs, this is a signal to evaluate the applicability of deception technologies within their own environments and to prepare for potential regulatory shifts in AI oversight. Deception can be a valuable tool for detecting and slowing attackers, but it requires careful planning and integration with existing detection and response processes.

A recent analysis from Unit 42 highlights the complex relationship between identity management, cloud harnesses, and supply chain security. The report emphasizes the “uncomfortable space” where vulnerabilities can be exploited—often at the intersection of identity and cloud infrastructure. Security leaders should prioritize identity governance, review cloud access policies, and assess supply chain dependencies for potential weak points. The takeaway is that identity is increasingly the new perimeter, and attackers are adept at finding and exploiting gaps in identity and access management.

Zooming out, the convergence of AI and cyber operations is accelerating. Both attackers and defenders are leveraging AI for automation, reconnaissance, and exploitation. For defenders, this means investing in AI-enabled security tools that can keep pace with adversarial capabilities. It also requires ongoing staff training to ensure that teams can effectively use these tools and adapt to new tactics. The bar for defensive innovation is rising, and organizations that fail to keep up risk being outmaneuvered by more agile, AI-powered adversaries.

Let’s take a step back and consider the strategic implications of these developments. First, patch management and vulnerability response must be accelerated, especially for widely deployed security infrastructure. The window

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

The cyber and AI risk landscape is evolving at a pace that’s catching many organizations off guard. As AI adoption accelerates, we’re seeing a sharp increase in both the volume and complexity of vulnerabilities. Companies are integrating AI into critical workflows, but the controls and governance frameworks in place are often relics of a pre-AI era. This creates a mismatch between the risks organizations face and the protections they’re relying on.

Let’s start by looking at the scale of AI adoption and the compounding risk that comes with it. Snyk, a leading security vendor, reports that their Evo platform—focused on AI security—now accounts for 60% of new deal volume. That’s a clear signal: organizations recognize the need for dedicated AI security solutions. But this surge in demand is also a response to the reality that as AI becomes more embedded in business processes, the attack surface expands. Vulnerabilities unique to AI systems—things like data poisoning, model inversion, and prompt injection—are multiplying. These aren’t just theoretical risks. Attackers are actively probing for weaknesses in AI models and the infrastructure supporting them.

What’s concerning is that most organizations are still trying to manage these risks with legacy cybersecurity controls. According to a recent MarketScale survey, 75% of CISOs are using controls that were never designed with AI in mind. These might be effective against traditional threats, but they’re not equipped to handle the nuances of AI-specific attacks. For example, a firewall or endpoint protection tool isn’t going to stop an adversary from manipulating a machine learning model’s training data. The implication is clear: security leaders need to assess whether their current controls are fit for purpose and, where they’re not, invest in AI-native security solutions.

We’re also seeing attackers get more creative in how they exploit AI. A recent incident involving OpenAI highlighted the risk of so-called “cheating” AI agents. In this case, adversaries manipulated AI agents to bypass intended safety mechanisms. This isn’t just a technical curiosity—it’s a real-world risk for organizations that rely on AI for sensitive or mission-critical tasks. If an AI agent can be tricked into ignoring its own guardrails, it could be used to carry out malicious actions, leak sensitive information, or make unauthorized decisions. The takeaway here is the need for robust oversight of AI agents, including adversarial testing and transparent incident response protocols. Organizations need to know not just how their AI systems are supposed to behave, but also how they might behave under attack or manipulation.

Another emerging tactic involves attackers actively removing safety refusal mechanisms from AI agents. Researchers have documented cases where bad actors strip out the very features designed to prevent abuse, effectively weaponizing these agents. Once those safety checks are gone, AI can be used to automate phishing campaigns, generate polymorphic malware, or even conduct reconnaissance on target networks. This raises the bar for defense. It’s not enough to implement safety features—you need to make sure they can’t be easily disabled or bypassed. That means strong guardrails, continuous monitoring of AI agent behavior, and a layered approach to security that assumes some controls will eventually be tested or circumvented.

This theme of attackers leveraging legitimate tools for malicious purposes extends beyond AI. The NightEagle hacking group, for example, has been abusing Microsoft Dev Tunnels and GhostContainer to breach organizations—specifically targeting Russian companies in recent campaigns. These are tools intended to help developers work more efficiently, but in the wrong hands, they can provide a pathway for lateral movement and persistence within a compromised environment. For security teams, this underscores the need for vigilant monitoring of developer environments and strict access controls. It’s also a reminder to regularly review the configuration of development tools and environments—what’s convenient for developers can sometimes be a gift to attackers.

Vulnerability exploitation remains a persistent challenge. DesignRush reports that 31% of breaches now originate from exploiting known vulnerabilities. That’s nearly a third of all breaches starting with weaknesses that, in many cases, could have been patched or mitigated. The lesson here is as old as cybersecurity itself: timely patching and vulnerability management are foundational. But as environments become more complex—especially with the addition of AI systems and cloud-native infrastructure—the process of discovering assets, prioritizing vulnerabilities, and deploying patches needs to be continuous and, where possible, automated. Manual processes simply can’t keep up with the speed at which new vulnerabilities are discovered and exploited.

Data leakage via AI platforms is another area getting increased attention. A major investment bank recently blocked hundreds of attempts to transfer confidential data to public AI platforms. This is a textbook example of “shadow AI”—employees using generative AI tools in ways that put sensitive data at risk, often without the knowledge or approval of IT or security teams. The bank’s response highlights the need for strict data loss prevention controls and ongoing user education. Employees need to understand not just the benefits of AI, but also the risks associated with uploading corporate data to public platforms that may not have adequate security or privacy protections.

On the regulatory front, complexity is only increasing. Enterprises are facing a patchwork of requirements around AI governance, data protection, and ethical use. In response, we’re seeing new collaborations aimed at simplifying compliance. CUBE and IBM, for example, have announced a partnership to provide integrated solutions for regulatory mapping, risk assessment, and automated reporting. For risk and compliance leaders, these kinds of tools can reduce the overhead associated with compliance and improve audit readiness. But they also reflect a broader trend: managing AI risk is no longer just a technical issue—it’s a cross-functional challenge that requires coordination between IT, legal, and compliance teams.

AI is also transforming the defensive side of cybersecurity. At the GISEC conference, Microsoft showcased new AI-powered cyber defense tools designed to enhance threat detection and automate incident response. These tools use machine learning to identify anomalous behavior—potentially catching threats that would slip past traditional rule-based systems. For security operations centers, the promise is greater efficiency and effectiveness, but it also means adapting workflows to leverage these new capabilities. As with any technology, the effectiveness of AI-driven defense tools depends on proper configuration, ongoing tuning, and a clear understanding of their limitations.

Mobile threats are evolving alongside traditional enterprise risks. The RatHat malware, for example, is exploiting Android’s wireless debugging feature to gain shell access to devices and steal banking PINs. This attack vector highlights the importance of mobile device management and the need to enforce strict controls on debugging features. Organizations should ensure that wireless debugging is disabled on production devices and monitor for unauthorized access attempts. As mobile devices become more integral to business operations, the risks associated with lax controls in this area will only grow.

Data sovereignty is another issue gaining traction, especially in the Asia-Pacific region. Organizations are demanding robust controls to ensure that sensitive information stays within local jurisdictions and complies with regional regulations. This is driving changes in cloud architecture, vendor selection, and contractual risk management. For multinational organizations, it means navigating a complex web of requirements that can impact everything from where data is stored to how it’s processed and shared across borders.

Globally, there’s a growing focus on AI governance and the prevention of AI weaponization. International forums like the Xiangshan conference are calling for improved oversight and new standards to ensure that AI technologies aren’t misused. While the specifics of future regulations are still taking shape, the direction is clear: organizations will be expected to demonstrate not just technical security, but also ethical stewardship of AI. For CISOs, that means staying engaged with regulatory developments and proactively building governance frameworks that address both compliance and ethical considerations.

So, what does all this mean for organizations today? First, most are underprepared for AI-specific threats because they’re relying on outdated controls. The threat landscape is shifting rapidly—attackers are exploiting both AI systems and traditional vulnerabilities, raising the stakes for proactive defense. Regulatory and compliance demands are also intensifying, requiring new investments in governance tools and closer collaboration across IT, legal, and compliance functions.

Let’s break down the strategic implications a bit further. AI-specific risks require dedicated governance, controls, and monitoring. Legacy cybersecurity frameworks may provide a baseline, but they’re not enough to address the unique challenges posed by AI. Attackers are adapting quickly, weaponizing both AI agents and legitimate development tools. This necessitates continuous threat intelligence and adaptive defenses that can respond to new tactics as they emerge.

Regulatory

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk environment is evolving at a pace few could have predicted just a few years ago. We’re seeing a surge in actively exploited vulnerabilities, a rapid expansion of AI into every corner of the enterprise, and a growing focus on governance and liability—especially for CISOs, who are increasingly being held accountable for risks that extend well beyond their direct control.

Let’s start with the threat landscape. Right now, multiple zero-day exploits are being actively leveraged by attackers, targeting both remote access tools and mobile devices. This isn’t just a theoretical risk—these are real-world attacks, already causing disruption and data loss for organizations that haven’t responded quickly enough.

One of the most pressing issues today is a critical vulnerability in ScreenConnect, a remote access tool that’s widely used in IT support and managed services. Attackers are actively exploiting this flaw to gain unauthorized access to systems. Once inside, they can move laterally, deploy ransomware, or steal sensitive data. For organizations relying on ScreenConnect, the action items are clear: prioritize patching, review your remote access policies, and monitor for any signs of compromise. The risk here isn’t just technical—it’s operational. A successful attack can halt business operations, damage your reputation, and lead to significant data loss. This is a textbook example of why patch management and remote access governance remain foundational pillars of cyber defense.

Mobile devices are also in the crosshairs. Google recently patched a zero-day vulnerability affecting Pixel devices. This flaw was already being exploited in targeted attacks, allowing privilege escalation and the potential to bypass security controls. In organizations with bring-your-own-device policies or corporate-managed Android fleets, this raises the stakes. Prompt updates are essential, but so is reinforcing mobile device management policies. It’s not enough to rely on users to update their devices—there needs to be clear governance, monitoring, and enforcement to ensure that vulnerabilities don’t become open doors for attackers.

Beyond technical vulnerabilities, the role and responsibilities of the CISO are expanding—and not always in ways that are comfortable or clear-cut. Increasingly, CISOs are being held personally and organizationally liable for risks tied to assets and technologies outside their direct control. Think about third-party SaaS platforms, shadow IT, and AI systems that may be embedded in business processes without centralized oversight. This trend is being driven by new regulatory expectations and the evolving threat landscape. For risk leaders, it means doubling down on governance, documentation, and third-party oversight. It’s about demonstrating that you’re not just aware of these risks, but that you’re actively managing and mitigating them—even when they fall outside traditional IT boundaries.

AI, meanwhile, is quietly but rapidly penetrating enterprise operations. We’re seeing AI embedded across at least eight key business domains, from security operations and HR to finance and customer service. The benefits are real—operational efficiency, faster decision-making, and new capabilities. But every new AI system introduces a new attack surface and a new set of compliance challenges. For CISOs, mapping where and how AI is being used is no longer optional. It’s essential to assess the risks associated with each use case and to work closely with business units to ensure that AI adoption is both secure and compliant. This isn’t just about technical controls; it’s about policy, training, and ongoing risk assessment.

One area that deserves special attention is agentic AI—autonomous systems capable of making decisions without human intervention. These systems can drive significant value, but they also introduce unique security risks. Manipulation, data leakage, and unintended actions are all real concerns. Best practices are emerging, focused on robust monitoring, tight access controls, and scenario-based testing. Security leaders should be evaluating their current controls for agentic AI and updating incident response plans to account for the unpredictable nature of these systems. As agentic AI becomes more prevalent, the need for proactive governance and continuous monitoring will only increase.

AI isn’t just a tool for defenders—it’s also being weaponized by attackers. In the UAE, for example, businesses are reporting a rise in AI-driven cybercrime. These attacks are sophisticated, leveraging deepfake-enabled fraud, automated phishing, and adaptive malware that can change tactics on the fly. The implications are clear: traditional detection and response methods are no longer sufficient. Organizations need advanced detection capabilities that can keep pace with AI-enabled threats, as well as comprehensive user awareness training to help employees recognize and respond to new forms of social engineering and deception.

Industry events and new partnerships are reflecting this urgency. Sola Security’s recent participation in an AI governance and GRC-focused event signals a broader industry movement toward formalizing AI risk management frameworks. Topics like regulatory compliance, ethical AI, and integrating AI risk into broader governance, risk, and compliance programs are now front and center. For CISOs, this is a cue to benchmark your own AI governance maturity against emerging standards and to stay engaged with industry developments. The regulatory environment is only going to become more complex, and proactive engagement is key to staying ahead.

On the technology partnership front, HCLTech and CrowdStrike have expanded their collaboration to deliver advanced, AI-driven security and resilience solutions. The goal is to enhance threat detection and response capabilities, leveraging AI for faster and more accurate incident handling. For security leaders, this is an opportunity to evaluate the potential of such partnerships to augment in-house capabilities. As the threat landscape becomes more complex, no organization can afford to go it alone. Strategic partnerships and industry collaboration are critical to keeping pace with both adversaries and regulatory expectations.

Threat actors are also evolving their tactics. China-aligned hackers, for example, are deploying the PeckBirdy malware, hiding their command-and-control infrastructure within casino and adult websites. This approach complicates detection and attribution, and may be used for both espionage and financial crime. The lesson here is that threat intelligence needs to be continuously updated, and organizations should be proactive in blocking known malicious domains. Relying on static defenses is no longer sufficient; adaptive, intelligence-driven security is now the standard.

Cloud and multi-cloud security platforms are also maturing rapidly. Recent reviews highlight tools that offer improved visibility, runtime protection for AI agents, and integrated compliance features. As cloud adoption accelerates, CISOs should reassess their security platforms to ensure they’re covering emerging risks, including those tied to AI workloads and supply chain dependencies. The cloud isn’t just an infrastructure choice—it’s a risk management challenge that requires continuous attention and investment.

MacOS environments are not immune, either. New activity from the Atomic macOS Stealer, or AMOS, has been detected, targeting macOS users to exfiltrate credentials and sensitive data. With macOS adoption rising in enterprise settings, it’s important to update endpoint protection and educate users about phishing and malware risks. The perception that macOS is inherently secure is outdated; attackers are increasingly targeting these platforms as their enterprise footprint grows.

Zooming out to the geopolitical level, experts are warning that the US lead over China in AI is “narrow and fragile.” This has far-reaching implications for national security, technology supply chains, and regulatory policy. For CISOs in global organizations, it’s essential to monitor these developments and assess how shifts in AI leadership might impact technology sourcing, compliance requirements, and the capabilities of threat actors. Geopolitical risk is now a core component of cyber risk management.

So, what does all this mean strategically? First, the attack surface is expanding rapidly, driven by AI integration and cloud adoption. This requires a continuous reassessment of controls and risk posture. It’s not enough to set policies and forget them; ongoing vigilance and adaptation are required to keep pace with the evolving threat landscape.

Second, CISOs must proactively address liability and governance gaps, especially for assets that fall outside direct control. This means strengthening documentation, oversight, and incident response plans—not just for traditional IT assets, but for third-party platforms, shadow IT, and AI-driven systems. The regulatory environment is shifting, and the expectation is that organizations will demonstrate active and effective governance across the entire technology stack.

Third, partnerships and industry collaboration are more important than ever. No single organization has all the answers or all the resources needed to address today’s risks. Engaging with industry events, formalizing partnerships, and benchmarking against peers are all critical steps to staying ahead.

And finally, geopolitical shifts in AI leadership are likely to have a direct impact on technology supply chains, regulatory requirements, and the capabilities of both defenders and adversaries. Staying infor

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is defined by a convergence of rapidly evolving threats and a persistent gap between technology adoption and effective governance. Over the past 24 hours, we’ve seen a surge in exploitation of critical vulnerabilities across major enterprise platforms, a marked increase in the sophistication of AI-driven attacks, and a global shift toward tighter data control as organizations respond to digital sovereignty concerns. Let’s break down what’s happening, what it means, and the practical steps risk leaders should be considering today.

We’ll begin with the most urgent developments on the technical front: the active exploitation of zero-day vulnerabilities in some of the world’s most widely used enterprise platforms. These aren’t hypothetical risks—they’re being used right now by ransomware groups and other threat actors to compromise business-critical infrastructure.

First, the U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has confirmed that ransomware gangs are actively exploiting a critical remote code execution vulnerability in VMware products. This isn’t just a proof-of-concept; attackers are using this flaw in real-world ransomware campaigns to gain full control of affected systems. The bottom line is that if you’re running VMware in your environment, immediate patching is not optional. Delayed remediation leaves the door wide open for attackers, especially given how widely VMware is deployed in enterprise and cloud environments. Security leaders need to prioritize vulnerability management, ensure all VMware systems are updated, and ramp up monitoring for any signs of compromise. The lesson here is clear: when a critical infrastructure platform is under active attack, speed and thoroughness in patching make the difference between business as usual and a major incident.

The story is similar with Cisco’s email gateway products. Cisco has just released patches for a zero-day vulnerability, tracked as CVE-2026-76461, that was being actively exploited in the wild. This flaw allowed attackers to bypass security controls and gain persistent access to sensitive communications. If your organization relies on Cisco’s email gateways, patching is urgent—but that’s only the first step. You also need to review logs for any evidence of exploitation, since attackers often move quickly to establish persistence or exfiltrate data before defenders can react. This incident is another reminder that edge devices—those systems sitting at the boundary between your organization and the internet—are high-value targets and require continuous monitoring and rapid response capabilities.

Online retailers are facing their own critical threat. A zero-day vulnerability known as “StyleSmuggler” is being actively exploited to compromise Adobe Commerce and Magento e-commerce platforms. Attackers are using this flaw to inject malicious code and steal payment data, putting both businesses and their customers at risk. For organizations running these platforms, immediate patching is critical, but so is enhanced monitoring for suspicious activity. This is a wake-up call for the e-commerce sector: robust web application security and vigilance across the software supply chain are now table stakes, not optional extras.

The risks don’t stop there. In the software development space, JetBrains Cadence recently experienced a breach due to a critical vulnerability with a CVSS score of 9.8 that remained unpatched for over two weeks. That delay gave attackers a significant window of opportunity. This incident highlights a recurring problem in the software supply chain—delays in patching high-severity bugs can have cascading consequences. For CISOs, it’s a call to action: review your exposure to JetBrains and similar tools, and take a hard look at your patch management processes, especially for high-impact vulnerabilities. The goal is to shrink the window of exposure as much as possible.

Now, let’s talk about the evolving tactics of threat actors, particularly their use of AI. Attackers are increasingly leveraging agentic AI systems to automate the exploitation of vulnerabilities and mass credential harvesting. What does this mean in practice? It means attackers can now scan for and exploit vulnerabilities, harvest credentials, and adapt to defenses at machine speed. The scale and adaptability of these AI-driven attacks are raising the bar for defenders. Traditional manual detection and response simply can’t keep up. Security teams should be considering AI-driven detection and response tools to match the speed and sophistication of these threats. If you’re not already evaluating or deploying AI-enabled security solutions, it’s time to start.

But it’s not just the attackers who are moving quickly with AI. Organizations themselves are rapidly integrating AI into business processes, often outpacing the development of robust governance and risk management frameworks. New research shows that the adoption of AI technologies is accelerating much faster than the implementation of policies to manage the associated risks. This gap exposes organizations to a host of new threats, including data leakage, model manipulation, and regulatory non-compliance. The takeaway for CISOs is that AI governance can’t be an afterthought. Work with business units to develop clear policies for responsible AI deployment, and ensure that risk management keeps pace with innovation.

This brings us to a broader trend: the global push for digital sovereignty. More than half of global and Asia-Pacific businesses are seeking greater control over their data, driven in large part by concerns about AI risks and the need to comply with evolving regulatory requirements. Organizations are rethinking their cloud strategies, demanding more transparency and control from service providers, and preparing for stricter rules around cross-border data flows. For risk leaders, this means reassessing your data governance frameworks, updating policies, and working closely with legal and compliance teams to stay ahead of regulatory changes. Digital sovereignty isn’t just a compliance issue—it’s becoming central to how organizations manage risk in a world where data is both an asset and a liability.

On the technology side, we’re also seeing security vendors respond to these new challenges. Proofpoint, for example, has expanded its AI-powered investigation tools for Microsoft 365, giving organizations deeper visibility into insider risk and AI-related activity. As AI becomes more integrated into daily business workflows, having the ability to detect anomalous behavior and potential data leakage tied to AI usage is going to be essential. These kinds of monitoring tools will play a key role in managing new classes of risk and ensuring ongoing compliance.

Of course, not all threats are purely technical. Social engineering remains a persistent and evolving risk. A new attack method called ClickFix is making the rounds, using fake CAPTCHA challenges to trick users into installing malware themselves. In one recent incident, a compromised HBO Max Reddit account was used to distribute malware via this technique. What makes ClickFix particularly dangerous is that it bypasses traditional technical controls by exploiting user trust and behavior. The practical implication is that ongoing security awareness training is more important than ever, and organizations should also invest in advanced email and web filtering to catch these kinds of attacks before they reach end users.

Returning to the challenge of protecting internet-edge devices, the Hong Kong Computer Emergency Response Team has warned that patching alone is no longer sufficient. Attackers are using advanced techniques to maintain persistent access and steal credentials, even after vulnerabilities have been patched. This means organizations need to move beyond a patch-and-forget mentality. Layered defenses—including network segmentation, strong authentication, and continuous monitoring—are now required to protect these high-risk assets. If your edge devices aren’t being monitored for unusual behavior, you’re leaving a critical gap in your defenses.

Attackers are also getting more creative in abusing native operating system tools. There’s been a notable uptick in the abuse of the Windows VSSAdmin tool, which is being used to extract the NTDS.dit Active Directory database and delete recovery copies. This makes it much harder for organizations to recover from attacks, as both credentials and backup data are being targeted. Security teams should be monitoring for suspicious use of VSSAdmin and ensuring that backup and recovery strategies are resilient to these kinds of tactics. If you’re relying on standard backup procedures without additional controls, it’s time to reassess.

Another emerging risk area is AI knowledge distillation—the process of compressing large AI models into smaller, more efficient ones. While this can improve performance and reduce costs, it also introduces security risks. Poorly managed distillation can lead to model inversion, data leakage, and reduced robustness. Organizations deploying distilled AI models need to assess the security implications and put proper controls in place to prevent unintended information disclosure. This is a nuanced area, but as AI models become more central to business operations, understanding and mitigating these risks will be increasingly important.

Let’s take a step back and look at the strategic implications of these trends. First, the increasing exploitation of zero-day vulnerabilities in core enterprise platforms means that accelerated patch management and improved supply chain security are now essential. The o

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is marked by a convergence of geopolitical tension, rapid technological adoption, and persistent operational threats. As organizations accelerate their use of artificial intelligence, the challenges of governance, national security, and risk transfer are intensifying. Let’s break down the most critical developments shaping today’s environment, and what they mean for security leaders and risk professionals.

We begin with a significant shift in the global conversation on artificial intelligence. China’s top intelligence official has issued a public warning about the national security risks posed by AI, specifically highlighting threats like deepfakes, cyberattacks, and what’s being called “cognitive warfare.” This is notable for a couple of reasons. First, it’s rare for China’s leadership to echo concerns that have been voiced by Western technology leaders and policymakers. Second, it signals China’s intent to actively shape the global narrative around AI risk, rather than simply reacting to it.

The implications here are substantial. When a major state actor like China publicly acknowledges the potential for AI to be weaponized—not just for technical attacks but also for influence operations and psychological manipulation—it raises the stakes for organizations worldwide. The risk of AI-driven misinformation campaigns, automated spear phishing, and even large-scale social engineering is no longer theoretical. For CISOs, this means that monitoring for AI-enabled threats and misinformation must become a core part of the security function. It’s not just about defending infrastructure, but also about protecting the organization’s reputation and the integrity of its information environment.

At the same time, China is pushing back against Western calls for AI restrictions. Chinese officials and state media have criticized recent statements from U.S. CEOs and AI firms—most notably Anthropic—that advocate for curbing China’s AI development. Beijing has labeled these warnings as “fearmongering” and “vicious competition,” arguing that AI governance should not be politicized or used as a tool for technological containment.

This rhetoric is more than just diplomatic posturing. It signals a deepening divide over how AI should be regulated and who gets to set the rules. For multinational organizations, this could complicate efforts to comply with emerging standards and regulations, especially as supply chain and data sovereignty issues become more prominent. Regulatory risk is no longer confined to a single jurisdiction; it’s now a moving target shaped by global power dynamics. Security and compliance teams need to stay agile, tracking not only technical developments but also the shifting landscape of international policy and rhetoric.

Shifting focus to operational realities, a new report from OneTrust highlights the rapid adoption of AI agents in Australian enterprises. The pace of deployment is outstripping the development of governance and oversight mechanisms. This is a microcosm of a broader trend: organizations are eager to leverage the efficiency and innovation that AI agents can bring, but the controls to manage their risks are lagging behind.

The risks here are multifaceted. Without mature governance, there’s a heightened chance of data leakage, compliance failures, and unintentional exposure to AI-driven attacks. Regulatory scrutiny is increasing, and organizations that can’t demonstrate effective oversight of their AI deployments may find themselves at risk of sanctions or reputational damage. For CISOs, the message is clear: don’t let the excitement over AI’s potential blind you to its risks. Establishing clear policies, ongoing monitoring, and regular risk assessments for AI use cases should be a top priority.

Let’s turn to the cyber insurance sector, which is facing its own set of challenges. The industry is grappling with solvency pressures driven by the rise of war exclusion clauses, systemic catastrophe models, and mounting liabilities from ransomware attacks. Insurers are increasingly reluctant to cover large-scale or state-linked incidents, and the introduction of broad exclusions for acts of war or systemic events is leaving many organizations exposed.

This has direct implications for risk transfer strategies. If insurance is no longer a reliable backstop for catastrophic cyber events, organizations must rethink how they manage residual risk. Risk leaders should conduct a thorough review of their policies, clarify exactly what is and isn’t covered, and ensure that internal controls are robust enough to handle scenarios that may fall outside the scope of insurance. The days of relying on insurance to fill every gap are over; proactive controls, incident response readiness, and business continuity planning are more important than ever.

On the threat landscape front, Security Boulevard’s latest report offers a sobering view. Active attack campaigns are targeting organizations across sectors, with ransomware, supply chain breaches, and identity-based exploits all on the rise. Attackers are increasingly focusing on cloud environments, using behavioral analytics to bypass traditional defenses. This highlights the need for continuous threat intelligence and adaptive security controls. Static, signature-based defenses are no longer sufficient. Organizations need to invest in tools and processes that can detect and respond to threats in real time, adapting as attackers change their tactics.

Critical infrastructure is also under sustained attack. New malware strains are targeting SCADA systems and electrical substations through weaponized firmware. These attacks go beyond data theft or financial loss—they can disrupt essential services and pose real safety risks. For organizations operating industrial control systems, it’s crucial to prioritize firmware integrity checks, implement network segmentation, and conduct regular incident response drills tailored to operational technology environments. The convergence of IT and OT has expanded the attack surface, and defenders must be prepared for threats that can move laterally between these domains.

Patching and vulnerability management remain foundational, but the stakes are higher than ever. ConnectWise recently released patches for a critical vulnerability in its ScreenConnect remote access tool. This flaw has already been exploited in worm-based attacks, enabling lateral movement and ransomware deployment. Organizations using ScreenConnect should prioritize applying these updates immediately and review their remote access policies to minimize unnecessary exposure.

Similarly, GitLab has disclosed a maximum-severity vulnerability that is being actively exploited in the wild. This zero-day allows for remote code execution, making it a prime target for attackers seeking to compromise software supply chains. All GitLab users should patch without delay and review the security of their CI/CD pipelines. The supply chain remains a high-value target, and a single compromised component can have cascading effects across multiple organizations.

Cloud identity attacks are becoming more sophisticated. Unit 42’s latest research highlights advances in detecting compromised cloud identities through behavioral clustering and automation. Attackers are targeting cloud accounts to escalate privileges and exfiltrate sensitive data, often moving laterally within cloud environments before being detected. To counter this, security teams should invest in identity analytics and automated detection mechanisms. Reducing dwell time and limiting the blast radius of compromised accounts can make the difference between a contained incident and a major breach.

One emerging development worth watching is the rise of AI agents designed to autonomously defend against cyber threats. Vendors like Edvance International and CWG Innovations are rolling out solutions where AI agents can detect and respond to attacks on their own, without human intervention. While this promises a new level of speed and scalability in defense, it also introduces new governance and reliability questions. How do you ensure that autonomous agents make the right decisions? What happens if they are themselves targeted or manipulated? CISOs should closely monitor these developments, weighing the benefits of autonomous controls against the risks of reduced transparency and potential unintended consequences.

Zero-day and CVE exploitation remains a constant concern. Check Point Research’s latest threat intelligence report underscores how quickly attackers are moving to weaponize new vulnerabilities. The window between disclosure and exploitation is shrinking, making rapid patch management and continuous vulnerability scanning essential. Organizations that can’t keep up with this pace risk being caught flat-footed by threats that are already in the wild.

Stepping back, several strategic implications emerge from today’s risk environment. First, AI governance is no longer just a technical or compliance issue—it’s a geopolitical flashpoint. The way nations and organizations approach AI will shape regulatory risk, international collaboration, and even market access. Security leaders need to engage at the executive level, ensuring that governance frameworks are robust, adaptable, and aligned with both local and global expectations.

Second, the instability of the cyber insurance market means that internal controls are becoming the primary line of defense for many organizations. This places a premium on proactive risk management, from technical controls to incident response planning and business continuity.

Third, the rise of cloud an

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is evolving at a pace that’s challenging even the most prepared organizations. The surge in attacks leveraging autonomous AI agents, the mounting urgency for robust AI governance, and a series of high-impact vulnerabilities and breaches across both enterprise and critical infrastructure are all converging to redefine what it means to manage cyber risk in 2026.

Security leaders are now facing pressure from every direction: attackers are automating and scaling their operations, regulators are tightening expectations, and boards are demanding clear strategies for AI oversight. In response, the FBI has just rolled out its first-ever cyber strategy, signaling a more aggressive law enforcement posture. Meanwhile, the private sector is racing to adapt, with new AI security platforms and partnerships emerging to help organizations keep pace.

Let’s break down the most important developments shaping the risk environment today, and what they mean for your organization.

First, the operational reality of AI-augmented cybercrime is no longer theoretical. Attackers have used autonomous AI agents to compromise at least 440 PaperCut servers. This isn’t just a matter of speed—it’s about scale and efficiency. These AI-driven attackers exploited known vulnerabilities to gain unauthorized access, demonstrating how quickly threat actors can pivot and automate exploitation across hundreds of targets. For CISOs and security teams, this is a wake-up call. Monitoring for AI-driven threats has to become a core capability. Timely patching of known vulnerabilities is more important than ever, and organizations need to reassess the resilience of any legacy systems that may not be equipped to withstand automated exploitation.

This brings us to the FBI’s new cyber strategy. For the first time, the Bureau is taking an explicitly offensive approach to cybercrime. The strategy emphasizes proactive disruption of threat actors and much closer collaboration with the private sector. What does this mean for organizations? Security leaders should expect more engagement from law enforcement, the potential for joint operations, and a higher bar for incident reporting and cooperation. The days of quietly handling incidents in isolation are fading. Enterprises will need to be ready for more frequent and detailed interactions with regulators and investigators, and that means having clear processes for evidence preservation, incident communication, and legal review.

Another critical shift is the growing consensus that AI governance can no longer be siloed from core risk and compliance activities. Multiple sources are stressing that CISOs must embed AI oversight directly into their governance, risk, and compliance—GRC—frameworks. This isn’t just about checking a box for regulatory alignment. It’s about addressing model risk, data privacy, and the unique challenges of AI systems that can learn, adapt, and even act autonomously. As AI adoption accelerates and regulatory scrutiny intensifies, organizations that fail to integrate AI governance into their GRC programs are exposing themselves to both operational and reputational risk.

We’re also seeing confirmation that cybercriminals are actively using autonomous AI agents to automate reconnaissance, exploitation, and lateral movement. The result? Attacks are not only faster, but they’re also more widespread. This raises the stakes for detection and response. Traditional monitoring tools may not be sufficient to spot the subtle, high-velocity tactics of AI-driven attackers. Organizations need to enhance their monitoring for anomalous activity that could indicate AI involvement, and invest in security tooling that’s aware of—and can counter—AI-based threats.

Let’s talk about vulnerabilities. A critical NetScaler vulnerability is being actively exploited, with AdaptHealth among the latest victims. At the same time, new Android malware strains are surfacing, capable of recording screens, stealing one-time passwords, and covertly taking photos. These incidents reinforce the importance of patch management, mobile device security, and rapid incident response. The lesson here is clear: attackers are targeting both infrastructure and endpoints, and the window between vulnerability disclosure and exploitation is shrinking. Organizations need to be able to identify, prioritize, and remediate high-severity vulnerabilities quickly, especially in systems that support remote access or handle sensitive data.

CISA has also updated its security alerts to include actively exploited vulnerabilities in MikroTik RouterOS. These flaws are being targeted in the wild, posing significant risks to organizations that rely on this networking equipment. The recommendation from CISA is straightforward: patch immediately, and consider network segmentation to limit exposure if patching isn’t feasible in the short term. This is especially important for organizations with distributed or remote operations, where network devices may not always be centrally managed.

On the VPN front, Check Point has released patches for critical vulnerabilities that could allow remote code execution. VPN infrastructure remains a prime target for attackers, given its role as a gateway to internal networks. If you’re using Check Point VPN solutions, prioritize these updates. Delaying patching here could open the door to attackers who are increasingly adept at automating exploits and moving laterally once inside.

The IoT threat landscape continues to evolve as well. A new malware variant, KATARU, is exploiting Linux privilege escalation vulnerabilities and deploying Mirai-style distributed denial-of-service attacks. This highlights the persistent risk posed by insecure IoT devices. The practical takeaway: organizations need robust network segmentation, a comprehensive inventory of connected devices, and a disciplined approach to firmware management. If you don’t know what’s on your network, you can’t defend it.

We’re also seeing a surge in social engineering and malware delivery campaigns. Researchers have uncovered more than 10,000 malware loaders distributed via YouTube and SEO poisoning. This enables widespread malware delivery, often bypassing traditional perimeter defenses. User awareness, web filtering, and endpoint protection are all critical to countering these evolving tactics. Employees remain a key line of defense, but they need the right tools and training to recognize and avoid these threats.

On the solution side, vendors like Kovrr and Nudge Security are launching platforms focused on proportional AI governance and enterprise-wide visibility. Strategic collaborations, such as the partnership between Odyssey Cybersecurity and Airia, are aiming to support secure AI adoption at scale. For CISOs, the message is clear: evaluate these solutions for alignment with your organization’s risk appetite and regulatory requirements. Not every platform will be a fit, but the market is moving quickly to address the unique challenges of AI in the enterprise.

A particularly important point raised by security experts is that the next major AI-related security incident may well begin with permissions. In agentic—or autonomous—systems, mismanaged permissions can have cascading effects. Rigorous identity and access management, least privilege enforcement, and continuous review of AI agent permissions are not optional. They’re essential. As organizations deploy more autonomous agents, the risk of over-permissioned or misconfigured access grows. This is an area where proactive governance can prevent significant downstream incidents.

There’s also a positive case study worth highlighting. An investment bank recently detailed how it successfully adopted AI without compromising confidential financial data. The key measures included strict data segregation, robust access controls, and continuous monitoring. This serves as a blueprint for secure AI enablement in regulated industries. It’s proof that innovation and security don’t have to be mutually exclusive, as long as organizations are deliberate about risk management and compliance.

So, what are the strategic implications of all these developments?

First, AI-driven attacks are now an operational reality. Security programs must adapt to threats that are automated, scalable, and increasingly difficult to detect using traditional methods. This means investing in AI-aware detection and response capabilities, and ensuring that security teams are equipped to recognize and respond to AI-driven tactics.

Second, AI governance is no longer just a technical issue—it’s a board-level concern. Integrating AI oversight into GRC and risk management frameworks is now a baseline expectation, not a nice-to-have. Boards and executives will be asking tough questions about how AI is being used, what risks it introduces, and how those risks are being managed.

Third, critical infrastructure and legacy systems remain prime targets. Patching and segmentation are essential, particularly for systems that can’t be easily replaced or upgraded. Organizations need to be realistic about the risks posed by older technologies, and have clear plans for mitigating those risks.

Fourth, law enforcement’s more offensive cyber posture may increase regulatory and reporting expectations for enterprises. Organizations should be prepared for more frequent requests for information, greater scrutiny of incident response processes, and potentially, participation in joint disruption operations.

So what matters most today?

Autonomous AI agents are amplifying the speed and scale of cyberattacks. This isn’t just a future risk—it’s happening now, and

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk environment is defined by a wave of critical vulnerabilities, escalating supply chain threats, and mounting governance challenges. The headlines are dominated by a series of high-impact software flaws—affecting everything from web browsers to enterprise appliances and cloud platforms. At the same time, organizations are facing renewed pressure to secure their supply chains, especially as attacks increasingly target the open-source and AI development ecosystems. Let’s break down the most pressing issues shaping the risk landscape today, and consider what practical steps organizations should be taking to stay ahead.

Let’s start with vulnerabilities that demand immediate attention. Google has just released an urgent update for Chrome, patching 12 security flaws, several of which are rated high severity. These vulnerabilities, if left unpatched, could allow attackers to execute arbitrary code, steal sensitive data, or even take control of user systems. Given Chrome’s near-universal presence in enterprise environments, this is not a patch to delay. Organizations should ensure automated patching is enabled and verify that every endpoint is up to date. This isn’t just about ticking a compliance box—attackers move quickly to exploit these kinds of flaws, and even a small window of exposure can be enough for compromise.

Moving from browsers to network infrastructure, SonicWall has issued an alert for actively exploited vulnerabilities in its SMA1000 series appliances. These devices are widely used for secure remote access, making them a high-value target. Attackers are leveraging the flaws to gain unauthorized access—potentially putting sensitive networks at risk. If your organization uses SonicWall SMA1000 appliances, immediate patching is essential. It’s also wise to review access logs for signs of suspicious activity, and consider network segmentation to contain any potential lateral movement. The lesson here: vulnerabilities in edge devices can quickly become a gateway for attackers, so proactive monitoring and swift remediation are non-negotiable.

Microsoft 365 users are facing their own set of challenges. A newly disclosed vulnerability in the Direct Send feature allows attackers to bypass authentication and spoof internal users—without needing valid credentials. This opens the door to phishing, business email compromise, and internal fraud, all with messages that appear to come from trusted sources inside your organization. The practical response should be twofold: review and tighten mail flow rules, and disable unnecessary Direct Send configurations. Just as importantly, invest in user education—make sure staff are aware that not every internal-looking email can be trusted. Social engineering remains one of the most effective tools for attackers, and technical controls need to be backed by vigilance at the human level.

Now, let’s shift to supply chain security—a topic that’s only growing in urgency. A new campaign, dubbed “Operation RepoGhost,” has been uncovered, involving Russian-linked malware hidden within GitHub repositories. This is a classic supply chain attack, targeting developers and organizations that rely on open-source code. By compromising popular repositories, attackers can potentially reach thousands of downstream targets in one move. For organizations building or integrating AI solutions, the risk is especially acute. Rigorous code provenance checks and enhanced monitoring of third-party dependencies are now table stakes. It’s not enough to trust that code from a reputable platform is safe—continuous validation and the use of tools like software bill of materials (SBOM) are becoming essential parts of the development process.

The supply chain threat doesn’t stop there. A separate compromise affecting Microsoft and GitHub platforms has specifically targeted AI developers. This should be a wake-up call for anyone in the AI space: the tools and libraries you depend on can themselves be a vector for attack. Dependency management, continuous monitoring, and SBOM adoption aren’t just best practices—they’re critical defenses against tampering in the development pipeline. The integrity of your software supply chain is only as strong as its weakest link, and attackers are actively looking for those weak points.

Physical security devices are also in the crosshairs. A persistent backdoor has been discovered in Dahua security cameras—a vulnerability that survives even after password changes and factory resets. This means that once a device is compromised, attackers can maintain long-term access, posing ongoing risks to both physical security and the broader network. For organizations using Dahua cameras, the options are clear: assess your exposure, apply any available firmware updates, and if remediation isn’t possible, consider device replacement. The broader takeaway is that IoT and physical security devices need the same level of scrutiny and lifecycle management as any other endpoint.

Turning to the human side of risk, a recent survey found that half of UK firms are concerned employees may be inputting sensitive company data into AI systems—sometimes intentionally, sometimes by accident. This insider risk is a growing concern as generative AI platforms become more integrated into daily workflows. The solution isn’t just technical—it’s about policy, training, and culture. Organizations need clear AI usage policies, regular staff training, and technical controls to prevent data leakage. Whether it’s restricting access to certain AI tools or deploying data loss prevention solutions, the goal is to make sure that sensitive information doesn’t inadvertently end up in places it shouldn’t.

As enterprises accelerate their adoption of AI, the intersection of financial operations—FinOps—and security is coming into sharper focus. Managing the costs of AI, ensuring data privacy, and staying compliant with evolving regulations all require tight coordination between security, finance, and business units. CISOs should be championing integrated frameworks that balance innovation with risk mitigation. It’s not just about what AI can do for the business, but how to do it responsibly—without exposing the organization to unnecessary financial or reputational risk.

Strategic decisions about cyber resilience and AI risk are increasingly being made at the board level. Board engagement is now essential for aligning security investments with organizational priorities, especially as threats to identity, cloud, and supply chains become more complex. CISOs need to ensure that risk reporting and scenario planning are tailored for executive audiences. That means translating technical risk into business impact, and making sure the board understands not just the threats, but the options and trade-offs involved in managing them.

On the topic of AI governance, the recent adoption of ISO 42001 certification by organizations like KuCoin has sparked discussion about what these certifications actually cover—and what they don’t. While ISO 42001 provides a framework for AI management, it has notable gaps, particularly around operational security and real-world risk scenarios. Organizations shouldn’t rely solely on certification as proof of security or compliance. Independent risk assessments and continuous oversight of AI deployments remain critical. Certifications are a starting point, not a finish line.

Identity and access management continues to be a foundational element of cyber defense. Okta has been recognized as a top privileged access management (PAM) solution, reflecting the growing importance of robust identity and access controls in both cloud and hybrid environments. Effective PAM is key for mitigating insider threats and limiting the blast radius of potential breaches. As organizations move more workloads to the cloud, ensuring that privileged accounts are tightly managed and monitored is more important than ever.

Data governance is also evolving, with leading organizations adopting a “shift-left” approach—integrating data security and compliance controls early in the development lifecycle. A PayPal executive recently outlined a strategy for embedding data governance from the very start of software and AI projects. This approach can dramatically reduce downstream risk and support secure innovation. For organizations looking to scale AI responsibly, early integration of data controls is a best practice that pays dividends over time.

Let’s take a step back and look at the bigger picture. The strategic implications of today’s threat landscape are clear. Rapid patching and vulnerability management remain essential, as attackers increasingly exploit zero-day and supply chain vulnerabilities. AI adoption amplifies insider risk and data governance challenges, requiring updated policies, staff awareness, and technical safeguards. Board-level engagement is critical for aligning cyber and AI risk management with business strategy and regulatory expectations. And supply chain security—including third-party code and device integrity—must be prioritized to prevent cascading compromise across ecosystems.

So, what matters most today? First, immediate action is needed to patch critical vulnerabilities in Chrome, SonicWall, and Microsoft 365 environments. Delaying these updates leaves organizations exposed to attacks that are already underway. Second, supply chain and open-source risks are escalating, particularly for organizations developing or deploying AI solutions. Continuous monitoring, dependency management, and SBOM adoption are no longer optional—they’re essential. Third, AI governance frameworks must evolve to address both technical and human factors, incl

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber risk landscape is marked by a convergence of urgent threats targeting the very core of enterprise infrastructure. Over the past 24 hours, we’ve seen a surge in critical vulnerabilities and active exploitation affecting virtualization platforms, email servers, and network security appliances. The scope and velocity of these developments underscore the need for organizations to move quickly—to patch, to monitor, and to communicate risk at the executive level.

Let’s break down the most significant risks and their practical implications, starting with the vulnerabilities that are shaping today’s threat environment.

First, VMware has disclosed a set of critical vulnerabilities in its Workstation and Fusion products. These are widely used virtualization platforms in both production and developer environments. The vulnerabilities allow attackers to execute code on the host machine from within a guest virtual machine. In other words, if an attacker compromises a VM, they can potentially break out of that sandbox and gain access to the underlying host system. This is a classic example of a “VM escape,” and it’s especially concerning because it can open the door to lateral movement across the network and compromise of sensitive data.

The practical implication here is clear: organizations relying on VMware for isolation or segmentation need to treat this as a high-priority patch. It’s not just about protecting the VMs themselves, but about safeguarding the entire host environment and, by extension, the broader network. Security leaders should not only apply the available patches but also review their segmentation controls around virtualization infrastructure. Are your VMs truly isolated? Is your management network segregated from production? These are questions worth revisiting in light of this disclosure.

Next, let’s talk about endpoint security—specifically, CrowdStrike Falcon. A security researcher has released a proof-of-concept exploit, dubbed FalconFlank, which demonstrates privilege escalation in the CrowdStrike Falcon platform. For context, CrowdStrike Falcon is a leading endpoint detection and response solution, deployed across thousands of organizations globally. The FalconFlank exploit allows a local attacker to gain elevated privileges, effectively undermining the integrity of the EDR platform itself.

Why does this matter? Security tools are often trusted implicitly. If an attacker can exploit the very tools designed to protect your endpoints, they can potentially disable security controls, evade detection, and facilitate further attacks. This is a wake-up call: even best-in-class security products are not immune to vulnerabilities. Organizations should monitor CrowdStrike advisories closely, apply updates as soon as they’re available, and consider compensating controls—such as restricting local admin rights or monitoring for suspicious privilege escalation—if immediate patching isn’t feasible.

Moving to email infrastructure, we’re seeing a critical vulnerability—CVE-2026-62911—in Microsoft Exchange. This flaw has left approximately 22,000 Exchange servers exposed to remote exploitation, and exploit code is now publicly available. The vulnerability allows attackers to compromise email servers without needing authentication. That means no password is required—an attacker can simply target the server directly.

The risks here are significant. Email servers are a prime target for attackers, and this vulnerability raises the specter of data breaches, business email compromise, and lateral movement within the network. Compounding the issue, Extended Security Updates for some Exchange versions are set to expire in October. That means organizations running legacy Exchange servers will soon lose access to vendor patches, further increasing their exposure.

The immediate action item is clear: patch now. Review your external exposure—are your Exchange servers accessible from the internet? If so, they are at heightened risk. Accelerate migration plans if you’re running end-of-life versions, and ensure that all critical patches are applied. This is not a risk that can be deferred.

Let’s turn to network security appliances—specifically, SonicWall’s SMA 1000 series. Multiple zero-day vulnerabilities have been disclosed, enabling unauthenticated remote code execution. These devices are widely deployed as secure remote access gateways, making them high-value targets for attackers. The vulnerabilities are being actively exploited in the wild, and several advisories have urged immediate patching or mitigation.

The operational impact here is substantial. If an attacker can gain unauthenticated remote access to your secure gateway, they have a foothold into your internal network. This can be used to pivot further, escalate privileges, and ultimately compromise sensitive systems and data. Organizations should assess their exposure—how many SMA 1000 appliances are internet-facing? Are they running vulnerable firmware versions? Apply vendor patches without delay, and monitor for signs of compromise. Enhanced logging and review of access logs are recommended, as is enforcing multi-factor authentication where possible.

Building on this, we now have further details on two specific SonicWall SMA1000 vulnerabilities—CVE-2026-83548 and CVE-2026-83549. These have been confirmed to be under active exploitation. Attackers can gain full control of affected devices, which means they can potentially pivot into internal networks, bypassing perimeter defenses. Security firms like Rapid7 are recommending urgent action: patch immediately, enhance monitoring of remote access infrastructure, and consider additional segmentation to limit the blast radius if a device is compromised.

What’s notable here is the recurring targeting of remote access infrastructure. Reports confirm that SonicWall SMA1000 appliances are once again under active attack, with threat actors leveraging newly disclosed vulnerabilities. This pattern highlights a persistent threat to VPN and secure gateway devices. Security teams should not only patch but also review access logs for anomalous activity, enforce strong authentication mechanisms, and consider network segmentation to minimize the impact of a potential breach.

Returning to Microsoft Exchange, new research has confirmed that the latest exploit requires no password, exposing roughly 22,000 servers globally. With Extended Security Updates ending soon, organizations running legacy Exchange versions face imminent risk of compromise. Security leaders should accelerate migration plans, ensure all critical patches are applied, and consider additional controls—such as restricting external access or implementing email filtering—to reduce exposure.

Let’s shift focus to operational technology, or OT. The latest OT security roundup highlights continued threats to industrial and operational technology environments. Vulnerabilities in remote access and control systems remain a concern, especially as IT and OT environments become more interconnected. The risk of cross-domain attacks—where a compromise in the IT network leads to an attack on OT systems—is growing.

For CISOs overseeing OT environments, the message is clear: patching, segmentation, and incident response plans must extend to these critical assets. It’s not enough to secure IT; the boundaries between IT and OT are increasingly blurred, and attackers are exploiting these gaps. Regularly review your asset inventory, ensure that remote access to OT systems is tightly controlled, and test your incident response plans with OT scenarios in mind.

Stepping back, what do these developments mean strategically?

First, the sheer volume and severity of zero-day vulnerabilities reinforce the need for continuous vulnerability management and rapid patch cycles. This isn’t a once-a-quarter exercise. The window between disclosure and active exploitation is shrinking, and organizations must be able to identify, prioritize, and remediate vulnerabilities quickly.

Second, we’re seeing that security tools and infrastructure components themselves are increasingly targeted. This requires a true defense-in-depth approach. Don’t assume that your security products are invulnerable—validate your controls regularly, monitor for anomalies, and be prepared to respond if a trusted tool is compromised.

Third, legacy systems and end-of-life software represent escalating risk. As vendor support ends and exploit code becomes public, these systems become low-hanging fruit for attackers. Executive engagement is critical here. Remediation often requires budget, resources, and sometimes tough decisions about business continuity and risk tolerance. Make sure these conversations are happening at the right level.

So, what matters most today?

Immediate patching of VMware, SonicWall, and Microsoft Exchange vulnerabilities is essential. Delaying even a few days can be the difference between staying secure and suffering a breach. Security teams should review the exposure of remote access and email infrastructure, focusing on segmentation and monitoring. The release of proof-of-concept exploits for security products like CrowdStrike Falcon highlights the need for layered defenses and rapid response capabilities.

Let’s get practical for a moment. If you’re a security leader, here’s what you should be doing right now:

- Inventory your assets. Know which systems are running VMware Workstation or Fusion, which devices are SonicWall SMA1000 appliances, and which servers are running Microsoft Exchange. Asset visibility is foundational to any response.

- Prioritize patching. Start with internet-facing s

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

The cyber and AI risk landscape is evolving at a relentless pace, and today’s developments highlight just how quickly offensive capabilities are outstripping traditional defenses. The surge in AI-driven threats is not just a matter of frequency—it’s also about sophistication. We’re seeing a fundamental shift, where attackers are leveraging automation and artificial intelligence to discover vulnerabilities, execute attacks, and evade detection at a scale and speed that was previously unthinkable.

Let’s start with one of the most significant breakthroughs in recent months: AI agents are now autonomously discovering zero-day vulnerabilities, including those that allow them to escape virtual machines. Trail of Bits, a leading security research firm, has demonstrated that AI can now identify and exploit critical flaws without human intervention. This is a game-changer for offensive security. Traditionally, the process of finding zero-days—those previously unknown and unpatched vulnerabilities—has required a high level of expertise, patience, and manual effort. Now, AI agents can automate much of this work, scanning vast codebases, learning from past exploits, and even generating new attack techniques on their own.

The implications for defenders are profound. Virtual machine isolation, once considered a robust security measure, is now at risk. If AI can autonomously break out of VMs, then isolation strategies that rely on virtual boundaries are no longer sufficient on their own. Organizations need to rethink how they segment and monitor their environments. Continuous monitoring, behavioral analytics, and layered defense are becoming non-negotiable. It’s no longer enough to trust that a virtual machine boundary will contain an attacker.

This escalation isn’t confined to research labs or proof-of-concept attacks. In Australia, organizations are facing a real-world onslaught from AI-powered cyberattacks. Reports indicate that attackers are using AI to automate reconnaissance, exploit vulnerabilities, and evade detection, overwhelming many firms’ existing security measures. The pace of these attacks is outstripping defenders’ ability to respond, and this isn’t just an Australian problem—it’s a global one. The lesson here is clear: defenders must adapt just as quickly as attackers. That means investing in AI-driven defense tools, upskilling security teams, and adopting a mindset of continuous improvement.

Let’s talk about some of the specific vulnerabilities that are being actively exploited right now. PaperCut NG/MF, a widely used print management solution, has critical flaws that are under active attack. The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has added these vulnerabilities to its Known Exploited Vulnerabilities catalog and is urging organizations to patch immediately. Attackers are using these flaws to gain initial access, move laterally within networks, and deploy ransomware. If your organization uses PaperCut, this is not a drill—patch now, and review your logs for any signs of compromise. The exploitation is widespread and ongoing, and the window for remediation is closing fast.

Another urgent issue is a critical vulnerability in JFrog Artifactory, a core component in many organizations’ software supply chains. Attackers are actively exploiting this flaw to target artifact management systems. The risk here is twofold: not only could attackers tamper with software artifacts, potentially introducing malicious code downstream, but they could also exfiltrate sensitive data. This kind of supply chain attack can have cascading effects, impacting not just your organization but also your customers and partners. Immediate patching is essential, and organizations should also conduct integrity checks across their software supply chains to ensure nothing has been compromised.

The underground cybercrime economy is also evolving. The BraZetsu malware, now enhanced with AI capabilities, is enabling the sale of corporate network access on underground markets. This malware leverages AI to evade detection and automate lateral movement inside compromised networks, making it harder for defenders to root out intruders. The commoditization of network access—where attackers can simply buy their way into a target environment—raises the stakes for organizations of all sizes. Advanced behavioral analytics and proactive threat hunting are becoming critical tools in the fight against these AI-driven threats. It’s not enough to rely on signature-based detection; defenders need to look for subtle anomalies and patterns that indicate something isn’t right.

Ransomware remains a persistent and evolving threat, with healthcare organizations continuing to be prime targets. A ransomware gang recently claimed responsibility for a data breach at Nutex Health, underscoring the sector’s vulnerability to both data extortion and operational disruption. Healthcare organizations face unique challenges: they hold sensitive personal data, operate complex networks, and often have limited resources for cybersecurity. The Nutex Health incident is a reminder that robust backup strategies, incident response planning, and third-party risk management are essential. It’s not just about preventing attacks, but also about ensuring rapid recovery when—not if—a breach occurs.

Shifting gears to the governance side, we’re seeing organizations respond to these threats by accelerating the adoption of AI security certifications and governance frameworks. In the Asia-Pacific region, and particularly in India, regulatory and compliance pressures are mounting. Data sovereignty—who controls data and where it resides—is becoming a central issue, especially as cross-border data flows increase. Proofpoint, for example, is expanding its data security capabilities across Asia Pacific and Japan in direct response to these rising demands. For organizations operating in these regions, compliance-driven security controls and localization strategies are no longer optional—they’re essential for doing business.

Certifications are also emerging as key differentiators in the AI platform space. HiLabs recently achieved both HITRUST e1 and AI Security Certification for its MCheck platform. These certifications provide assurance to customers and regulators that the platform meets rigorous standards for data protection and AI governance. As AI becomes more deeply embedded in enterprise systems, formalized risk management and certification will become table stakes for vendors.

India is taking a significant step forward with the launch of its first sovereign AI governance platform by TRUSTNOW. This platform is designed to manage and control autonomous enterprise agents, addressing both regulatory and operational concerns around AI autonomy. The move signals a shift toward national-level oversight of enterprise AI systems. As AI agents become more capable and independent, questions about accountability, transparency, and control are coming to the forefront. Sovereign governance platforms like this one are likely to become more common as governments seek to balance innovation with risk management.

One of the more subtle but equally important risks in enterprise AI is the phenomenon of AI hallucination—when AI systems generate erroneous or fabricated outputs. A new in-depth analysis recommends that organizations implement robust governance frameworks, including red teaming and adversarial testing, to mitigate these risks. Hallucinations can have real-world consequences, especially in sectors like finance, healthcare, and legal services, where accuracy is paramount. Governance isn’t just about compliance—it’s about ensuring that AI systems are reliable, trustworthy, and aligned with business objectives.

On the defensive technology front, we’re seeing a shift toward AI-augmented vulnerability management. WordPress, for example, is now using advanced AI tools to proactively identify and remediate vulnerabilities before they can be exploited. This approach reduces the window of exposure and exemplifies the move toward continuous, automated defense. Rather than waiting for attackers to find and exploit flaws, organizations are increasingly using AI to get ahead of the threat curve.

The threat landscape is also being shaped by novel malware techniques. The SLEEPWALKER malware, for instance, employs raw packet transmission, DNS tunneling, and VMware VMCI channels for covert command-and-control communications. These methods are designed to bypass traditional detection tools, making it harder for defenders to spot and contain intrusions. Deep network visibility and anomaly detection are becoming must-haves. Traditional perimeter defenses are no longer sufficient; organizations need to be able to detect and respond to threats that operate below the radar.

Stepping back to look at the bigger picture, several strategic implications emerge from these developments. First, AI-driven offensive tools are lowering the barrier for zero-day discovery and exploitation. This challenges traditional isolation and detection strategies, and it means that organizations can’t rely solely on perimeter defenses or static controls. Second, regulatory and compliance pressures—especially around data sovereignty and AI governance—are intensifying, particularly in Asia-Pacific and India. Organizations need to stay ahead of evolving regulations and be proactive in their compliance efforts.

Third, the proliferation of AI-enhanced malware and ransomware is accelerating the commoditization of network access and data extortion. Attackers are no longer limited by manual processes; they can automate much of their activity, scale their operations, and targ

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber risk landscape is in a state of rapid evolution, shaped by the relentless integration of artificial intelligence into both defense and attack strategies. We’re seeing AI not just as a tool for defenders, but also as a new surface for attackers. Identity security and operational readiness are now front and center, with organizations under pressure to demonstrate that their policies aren’t just words on paper, but are actually being put into practice and can be proven when regulators or customers demand it.

Let’s start by looking at the dual-edged nature of AI in cybersecurity. On one hand, AI is enabling organizations to automate risk management, monitor controls in real time, and respond to threats faster than ever before. On the other, attackers are increasingly targeting AI platforms themselves, exploiting their integration into business operations and the sensitive data they process.

A clear example of this comes from Anthropic’s recent warning to users of its Claude AI platform. They’ve identified active infostealer malware campaigns targeting Claude users, aiming to steal credentials and sensitive data. As businesses rely more on AI tools like Claude for core operations, these platforms become high-value targets. The practical implication is that organizations need to treat their AI platforms with the same—if not greater—scrutiny as their traditional IT assets. That means robust endpoint security, ongoing user education, and continuous monitoring of AI-integrated environments.

This isn’t just a theoretical risk. Infostealer malware is designed to quietly siphon off credentials, session tokens, and other sensitive information, often before anyone notices. If those credentials unlock access to AI tools that are deeply embedded in business processes, the impact can be significant—ranging from data theft to manipulation of AI outputs. For CISOs, this is a call to action: review your endpoint security controls, ensure your detection and response capabilities are up to date, and make sure users understand the risks of phishing and malware in the context of AI.

Shifting gears, let’s talk about the persistent threat to critical infrastructure. Just recently, a cyber extortion group claimed responsibility for a breach at Manchester Airports Group, reportedly exfiltrating sensitive data. While details are still emerging, this incident highlights the ongoing risks facing critical infrastructure operators—not just from ransomware, but from extortion groups that are willing to disrupt operations or leak sensitive data to achieve their goals.

What does this mean for risk leaders? First, it’s a reminder that supply chain security is only as strong as your weakest link. Airports, utilities, and other critical sectors are attractive targets because of their operational importance and the sensitive data they hold. Second, incident response readiness is essential. Organizations need to have layered defenses, clear playbooks, and the ability to quickly contain and investigate breaches. And third, the risk isn’t just about data loss—it’s about operational disruption, reputational damage, and regulatory consequences.

Now, let’s look at how AI is being used to automate cybersecurity risk management in highly sensitive environments. Telos Corporation has secured a $34.3 million contract to deploy AI-driven automation for cybersecurity risk management within the Air Force intelligence community. The goal is to streamline compliance, threat detection, and risk assessment processes—essentially automating the tedious, error-prone parts of risk management so that human analysts can focus on higher-value tasks.

This is part of a broader trend: AI isn’t just about detecting threats, it’s about automating the entire risk management lifecycle. For CISOs, the takeaway is clear. If you’re still relying on manual processes for risk assessments, compliance monitoring, or controls testing, you’re falling behind. Automation can reduce human error, increase efficiency, and provide continuous assurance that controls are working as intended. It’s time to evaluate where AI and automation can add value in your own risk management workflows.

Identity security is also evolving rapidly in the age of AI. LastPass, for example, has rolled out new secure access capabilities designed to strengthen identity security against AI-driven threats. These enhancements focus on adaptive authentication, improved user experience, and integration with AI-powered risk analytics. The idea is to make it harder for attackers to exploit stolen credentials, while making it easier for legitimate users to access what they need.

Credential-based attacks remain one of the most common and damaging threats. As AI platforms become more deeply integrated into business processes, the value of a compromised credential goes up. Adaptive authentication—using context and behavioral analytics to assess risk in real time—can help mitigate these risks. For organizations, this is a proactive step toward aligning identity governance with the evolving threat landscape.

On the compliance front, Anthropic is rolling out a compliance API and enhanced local visibility features for its Claude platform. This is a response to growing regulatory and governance requirements. The new tools provide granular access controls, audit trails, and improved identity governance, supporting both compliance and operational transparency.

For CISOs, this is a development worth watching. Compliance APIs can be leveraged to provide real-time evidence of compliance, integrate with broader governance, risk, and compliance (GRC) frameworks, and automate the production of audit trails. This is especially important as regulators and customers increasingly expect organizations to demonstrate—not just declare—their adherence to security and privacy controls.

But there’s a bigger issue at play here: the accountability gap for CIOs and CISOs. As organizations adopt distributed and AI-enabled technologies, the complexity of managing risk, compliance, and security across hybrid environments is outpacing traditional governance models. A new analysis highlights the need for updated accountability frameworks, clearer lines of responsibility, and increased board-level engagement on technology risk.

What does this look like in practice? It means that leadership can no longer delegate cyber and AI risk to a single function or team. Instead, there needs to be cross-functional coordination, with clear ownership of risks, controls, and reporting. Boards are increasingly asking tough questions about operational readiness, resilience, and the ability to produce evidence of compliance on demand.

This brings us to the evolving security concerns around agentic, or autonomous, AI. In 2026, AI systems aren’t just assisting—they’re making decisions, accessing sensitive data, and interacting with critical business processes. This increased autonomy brings new risks. Without robust guardrails, continuous monitoring, and transparent governance, agentic AI can introduce vulnerabilities that are hard to detect and even harder to remediate.

For CISOs, this means re-evaluating risk assessments and controls for AI systems that act independently. It’s not enough to secure the data going in and out; you need to understand how AI systems are making decisions, what data they’re accessing, and how they’re interacting with other systems. Continuous monitoring and transparent governance are key to ensuring trustworthy AI operations.

A related challenge is the gap between policy and practice in AI governance. Having a policy on the books isn’t enough—regulators and stakeholders now expect organizations to produce evidence of compliance on demand. This means investing in tooling, documentation, and process automation to ensure auditability and defensibility.

This shift is being driven by increasing regulatory scrutiny, especially in sectors like finance, healthcare, and critical infrastructure. Demonstrable, auditable evidence of AI and cybersecurity governance is becoming a baseline expectation—not just for regulators, but for boards and customers as well.

Let’s talk about data sovereignty and localized security solutions. Horizon3 has launched a sovereign, Sydney-hosted instance of its NodeZero penetration testing platform. This move addresses data residency and sovereignty requirements for organizations operating in regulated jurisdictions. For CISOs, sovereign cloud and testing solutions are becoming essential for meeting local regulatory mandates and reducing cross-border data risk.

Data sovereignty isn’t just a compliance checkbox—it’s a strategic consideration. Organizations need to know where their data is stored, who has access to it, and how it’s being protected. Sovereign cloud solutions can help address these concerns, but they also require careful integration with existing security and compliance frameworks.

Finally, a recent report has emphasized that AI-native success depends on operational readiness—not just adoption. It’s not enough to implement AI tools; organizations need the processes, controls, and cultural alignment to ensure secure, resilient deployments. This includes security, compliance, and risk management capabilities tailored to the unique challenges of AI.

For CISOs, this means prioritizing readiness assessments and cross-functional collaboration. Security teams need to work closely with IT, legal, compliance, and business units to ensure that AI deployments are not only effective, but also secure and compliant.

Let’s pull these threads together and look at the strategic implications for organizations today.

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is defined by a convergence of escalating threats and rapid technological change. We’re seeing a surge in zero-day exploits, a fast pace of AI agent adoption, and mounting regulatory and governance demands. For security and risk leaders, the message is clear: the threat environment is not just evolving—it’s accelerating, and the operational, strategic, and regulatory challenges are deeply intertwined.

Let’s start with the most urgent operational threat: a critical zero-day vulnerability in PaperCut NG and MF. This is a print management solution used widely across enterprise environments. Multiple sources confirm that this zero-day is under active attack, and while emergency patches have been released, exploitation is ongoing. What makes this vulnerability particularly concerning is PaperCut’s deep integration into enterprise networks. Attackers who gain a foothold here can potentially move laterally, accessing sensitive data or systems far beyond the initial compromise.

For organizations running PaperCut NG or MF, the immediate priority must be patch management. Deploy the emergency patches without delay, and don’t stop there—monitor for any signs of exploitation. Delayed response can give attackers the window they need to establish persistence or exfiltrate data. This is a textbook scenario where time is of the essence, and it’s a reminder that even routine infrastructure like print management can become a high-impact attack vector.

While the PaperCut zero-day is the most pressing, it’s far from the only critical vulnerability demanding attention. The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, has just updated its Known Exploited Vulnerabilities catalog. The new entries include high-impact vulnerabilities in Red Hat, the Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler. These are foundational technologies in many enterprise stacks, and active exploitation is already underway.

Security teams should immediately assess their exposure to these vulnerabilities. Prioritize patching, but also review compensating controls—especially in environments where legacy systems can’t be updated as quickly. This is a moment to reinforce the importance of asset inventories, vulnerability management, and layered defenses. The reality is that attackers are scanning for these weaknesses, and any delay in remediation increases the risk of compromise.

Shifting from traditional IT to the AI domain, we’re seeing a new class of risks emerge as organizations accelerate AI adoption. A major breach at Hugging Face, a leading AI platform, has been traced to over 700 AI agents. This incident is a wake-up call about the risks inherent in large-scale, interconnected AI ecosystems. As AI agents become more autonomous and are integrated into more business processes, managing their identity, access, and behavior becomes a complex challenge.

The Hugging Face breach highlights the need for robust AI agent governance. Security leaders must implement continuous monitoring and real-time enforcement mechanisms. Without these controls, a single compromised agent can trigger cascading failures or be leveraged for malicious activity at scale. This is not just a technical challenge—it’s a governance issue that demands new policies, playbooks, and oversight structures.

In response to these challenges, we’re seeing innovation in AI security controls. Operant AI, for example, has launched a Semantic Firewall designed to enforce AI agent behavior in real time. This technology allows organizations to set and enforce policies for AI agents, reducing the risk of unintended or malicious actions as automation scales. For CISOs, solutions like this represent a path to operationalizing AI governance and maintaining compliance as agent-based automation becomes more widespread.

But technology alone isn’t enough. A recent report from Rubrik underscores the demand for integrated solutions that provide agent identity, visibility, and recovery. As the number of AI agents grows, fragmented identity management and limited visibility create exploitable gaps. Security leaders should prioritize unified identity and access management frameworks—ones that cover both human and machine identities. This unified approach reduces risk and streamlines incident response, making it easier to detect and contain threats that cross the boundaries between traditional IT and AI-driven environments.

The first 24 hours of an AI agent security incident are critical. A detailed analysis of a recent incident reveals several key lessons. Rapid detection, immediate containment, and clear communication are essential to minimizing impact. Pre-established playbooks, cross-functional coordination, and continuous monitoring can make the difference between a contained incident and a major breach. Security leaders should ensure that their incident response plans explicitly address AI agent scenarios and that these plans are regularly tested through tabletop exercises and simulations.

As organizations race to deploy AI solutions, there’s a growing risk of introducing vulnerabilities through inadequate security controls or oversight. Best practices here include embedding security into the AI development lifecycle, conducting regular risk assessments, and fostering a culture of responsible AI use. CISOs must balance the drive for innovation with the need for robust risk management. Security should never be an afterthought in AI projects—otherwise, the speed of adoption can outpace the organization’s ability to manage new risks.

The intersection of AI and quantum computing is also redefining the boundaries of data security. Traditional encryption methods are becoming increasingly vulnerable as AI-driven attacks grow more sophisticated and quantum capabilities mature. Organizations need to start evaluating post-quantum cryptography options and reassess their encryption strategies. This is about future-proofing sensitive data, ensuring that confidentiality and integrity are maintained even as the threat landscape evolves.

Meanwhile, the proliferation of Internet of Things devices is expanding the attack surface in enterprise environments. The IoT identity and access management market is projected to grow significantly over the next decade, reflecting the sheer number of connected devices being deployed. While this growth enables new business models and operational efficiencies, it also complicates identity management and increases supply chain and device-level risks.

Security leaders should assess their IoT IAM capabilities and integrate them with broader identity governance programs. This means ensuring visibility and control over every device that connects to the network, from traditional endpoints to sensors, cameras, and even wearables. The goal is to mitigate risks not just at the device level, but across the entire digital ecosystem.

Speaking of wearables, there’s a growing recognition that devices like smartwatches can be vectors for corporate compromise. As these devices integrate more deeply with enterprise systems and store sensitive data, organizations must update their BYOD and endpoint security policies. Device management and monitoring need to extend to wearables and other non-traditional endpoints. The lesson here is that the definition of an endpoint is expanding, and security controls must keep pace.

Recent high-profile breaches reinforce the persistence and diversity of cyber threats. Manchester Airports, the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives, and apparel company Carhartt have all suffered breaches in recent weeks. These incidents span sectors, but they share common themes: targeted attacks, the need for layered defenses, and the importance of rapid detection and response. For CISOs, this is a reminder to review incident response playbooks, ensure breach notification and containment procedures are up to date, and participate in cross-sector intelligence sharing.

The regulatory environment is also shifting rapidly. Washington is increasing its scrutiny of AI, cybersecurity, and privacy practices. Law firms, for example, are adopting AI at a growing pace, but this comes with unique challenges around data privacy, client confidentiality, and regulatory compliance. Responsible AI in this context means building tailored governance frameworks and sector-specific controls. CISOs in regulated industries should benchmark their AI governance practices against emerging standards and legal requirements, ensuring that compliance is built in from the outset.

Stepping back, what does all this mean for security and risk leaders? The strategic implications are clear. Immediate patching and monitoring for actively exploited zero-days is critical to prevent compromise and lateral movement. AI agent governance and real-time enforcement are no longer optional—they’re essential as agent-based automation scales across industries. The convergence of AI and quantum computing means organizations must proactively shift toward post-quantum cryptography and advanced data protection strategies. And unified identity and access management, covering both human and machine identities, is increasingly vital for operational resilience.

Let’s distill what matters most today. First, the PaperCut zero-day is an active threat—patching and monitoring should be at the top of every IT and security team’s list. Second, AI agent ecosystems are now proven attack surfaces. Governance and real-time controls must be strengthened to prevent incidents like the Hugging Face breach from becoming commonplace. And third, regulatory and technological shifts—acr

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is defined by a convergence of accelerating technical threats and mounting governance demands. As we look at the current environment, it’s clear that attackers are not only becoming more sophisticated, but they’re also leveraging artificial intelligence to orchestrate highly targeted campaigns. Defenders, meanwhile, are under increasing pressure to secure complex AI infrastructure and manage identity risks across sprawling digital environments. At the same time, regulatory scrutiny around AI governance is intensifying, with new frameworks and board-level expectations emerging across the globe.

Let’s break down the most significant developments shaping today’s risk environment and discuss what they mean for organizations navigating this evolving landscape.

First, we have a major incident that underscores the persistent threat to critical infrastructure: Boston Scientific, a leading medical device manufacturer, recently suffered a cyberattack that caused global operational disruption. This event is a stark reminder that ransomware and supply chain attacks remain a top concern, particularly for organizations in regulated sectors like healthcare. The implications here are broad. For risk leaders, it’s a wakeup call to ensure robust incident response plans are in place, business continuity strategies are tested, and third-party risk management is prioritized. The interconnectedness of supply chains in healthcare means that a single breach can ripple across the sector, impacting not just the targeted company, but also hospitals, clinics, and ultimately, patient care.

This incident also highlights the need for organizations to regularly assess their exposure to ransomware tactics and supply chain vulnerabilities. It’s not enough to focus on internal defenses; organizations must also scrutinize the security posture of their vendors and partners. In regulated industries, this is doubly important, as compliance requirements add another layer of complexity to incident response and recovery efforts.

Moving to the technical side, the Cybersecurity and Infrastructure Security Agency, or CISA, has issued alerts on six actively exploited vulnerabilities across some of the most widely used enterprise platforms: Microsoft, Linux, Red Hat, and Citrix. These vulnerabilities are being weaponized in the wild, which means organizations that haven’t patched are at heightened risk of compromise. The practical takeaway is clear: patch management and vulnerability remediation must be treated as urgent priorities. Security teams should not only apply patches, but also monitor for signs of exploitation, as these flaws could enable attackers to move laterally across networks or exfiltrate sensitive data.

This is a classic example of how foundational security hygiene—things like timely patching and configuration management—remains critical, even as the threat landscape evolves. Attackers continue to look for the path of least resistance, and unpatched systems are often the lowest-hanging fruit. For organizations with large, distributed environments, automating patch deployment and maintaining real-time visibility into asset inventories can make a significant difference in reducing exposure.

Shifting focus to AI-specific risks, there’s a growing trend of attackers targeting AI servers to steal API keys and hijack computational resources. These attacks are not just about data theft; they’re also about commandeering compute power for malicious purposes, such as running unauthorized workloads or launching further attacks. The unique risks associated with AI infrastructure—like potential data leakage and service disruption—require dedicated security controls.

For CISOs, this means ensuring strong authentication and key management for AI workloads. It’s important to review access controls for sensitive AI assets and implement monitoring that can detect anomalous behavior in AI environments. Given the increasing reliance on AI for core business functions, the impact of a compromised AI server can be significant, affecting everything from data privacy to operational continuity.

What’s particularly notable is the sophistication with which adversaries are now using AI themselves. In a recent case, a ransomware operator reportedly used AI to plan and execute attacks, successfully compromising more than 20 organizations. This marks a significant escalation in adversary capabilities. AI is enabling attackers to automate reconnaissance, identify high-value targets, and optimize their attack paths, making campaigns more targeted and efficient.

For defenders, this raises the stakes. Risk leaders must anticipate more AI-driven threats and invest in AI-enabled defense and detection capabilities. This includes leveraging machine learning for anomaly detection, automating threat hunting, and integrating AI into security operations centers. The goal is to keep pace with adversaries who are rapidly adopting these technologies to increase the scale and precision of their attacks.

Let’s turn to a pair of critical vulnerabilities in Veeam products, which are widely used for backup and replication in enterprise environments. The first is a flaw in Veeam Backup & Replication that exposes guest operating system credentials in cleartext within logs. This creates a significant risk of credential theft and lateral movement, as attackers who gain access to these logs can harvest credentials and pivot across the network.

Organizations using Veeam should urgently review their configurations, apply available patches, and audit logs for any evidence of sensitive data exposure. This incident reinforces the importance of secure logging practices and privileged access management. It’s a reminder that even trusted infrastructure tools can become a liability if not properly secured and monitored.

The second Veeam-related issue is a critical vulnerability in Veeam ONE, which allows unauthenticated attackers to coerce SMB authentication from service accounts. This could lead to credential compromise and expand the attack surface for lateral movement and privilege escalation. The recommended response is immediate patching and network segmentation to limit exposure. These types of vulnerabilities highlight the need for continuous assessment of both new and legacy systems, as attackers often exploit overlooked or under-maintained components.

On the identity protection front, we’re seeing notable vendor activity. Integrity60 has expanded its identity protection capabilities through a partnership with CyberIAM. This move reflects the growing importance of identity security in modern risk management. Enhanced identity controls are essential for mitigating risks from credential theft, insider threats, and supply chain attacks. For CISOs, it’s a good moment to evaluate your organization’s identity and access management posture, ensuring that controls are keeping pace with evolving threats and business requirements.

Identity and access management is increasingly recognized as a foundational control—one that underpins everything from endpoint security to cloud governance. The proliferation of SaaS applications, remote work, and third-party integrations has dramatically expanded the attack surface. Effective IAM solutions need to be adaptive, context-aware, and integrated with broader security operations.

In the managed security space, Globalgig has announced enhancements to its portfolio, focusing on edge, endpoint, identity, and AI security. This signals a growing market demand for integrated, AI-aware security solutions. For organizations struggling to scale security operations or address skills gaps—particularly in AI and identity domains—managed services can offer a pragmatic path forward. Outsourcing certain functions to specialized providers can help organizations stay ahead of emerging threats while freeing up internal resources for strategic initiatives.

This trend also speaks to the broader challenge of talent shortages in cybersecurity. As threats become more complex and the technology stack grows, it’s increasingly difficult for organizations to maintain the necessary expertise in-house. Managed security service providers can bridge this gap, offering access to advanced capabilities and around-the-clock monitoring.

Let’s talk about AI governance. A recent report finds that executives are more concerned about AI governance than their security teams. This highlights a potential disconnect in organizational priorities. As regulatory and reputational risks associated with AI continue to grow, it’s essential for CISOs to bridge this gap by aligning security and governance strategies. Ensuring both compliance and operational security is key to holistic risk management.

The rise of AI governance frameworks is being driven by several factors. Regulators are increasingly focused on issues like algorithmic transparency, bias mitigation, and data privacy. Boards are demanding greater visibility into how AI is being used and what risks it introduces. For security leaders, this means working closely with legal, compliance, and business stakeholders to develop policies and controls that address the full spectrum of AI-related risks.

In Australia, regulators ASIC and APRA have outlined four key crisis decisions for boards regarding AI, emphasizing the need for governance, risk assessment, and crisis preparedness. This guidance reflects a broader trend of regulatory focus on AI risk at the board level. Security leaders should ensure their organizations are prepared to address AI-related incidents and meet evolving governance expectations. This includes scenario planning, ta

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber risk landscape is evolving at a pace that challenges even the most mature organizations. The convergence of advanced cyber threats with the rapid adoption of enterprise AI is fundamentally reshaping how we think about risk, governance, and operational resilience. Security leaders are now tasked with managing not just the technical exploits we’ve grown familiar with, but also a new class of risks introduced by invisible, autonomous AI processes and a vastly expanded attack surface.

Let’s start with the most pressing developments shaping today’s risk environment.

First, we’re seeing a significant escalation in state-linked cyber activity, particularly from China and Iran. A critical vulnerability in Oracle’s proxy software—tracked as CVE-2026-21962—has been actively exploited by China-linked threat actors. Over a hundred government entities worldwide have been targeted, with attackers leveraging this flaw to gain unauthorized access and maintain persistent footholds in sensitive networks. This isn’t just another zero-day; it’s a stark reminder of how quickly these vulnerabilities can be weaponized at scale, especially when they exist in widely deployed enterprise platforms.

The practical takeaway here is the urgency of timely patch management. Organizations can’t afford to treat patching as a routine, low-priority task. It’s about more than compliance; it’s about protecting the core of your operations from sophisticated, well-resourced adversaries. Beyond patching, robust monitoring for lateral movement is critical. Attackers are no longer content with a single point of entry—they’re using that foothold to move deeper, often undetected, leveraging legitimate credentials and tools. Threat intelligence focused on state-sponsored campaigns is now table stakes for any organization with a significant digital footprint.

Shifting to Iran-linked activity, we’re seeing the use of reverse SSH tunnels as a favored technique for bypassing perimeter defenses. With reverse SSH tunneling, attackers can establish a persistent, stealthy connection back into compromised networks, often evading traditional detection methods. This method allows them to access internal systems as if they were an insider, making it much harder for security teams to spot the intrusion.

The implication for defenders is clear: review your organization’s SSH usage. Monitor for anomalous tunneling activity, and don’t assume that just because traffic is encrypted, it’s benign. Implementing network segmentation and enforcing least-privilege access can help limit the damage if attackers do get inside. It’s about making lateral movement as difficult as possible.

Now, let’s talk about the accelerating pace of zero-day exploitation, driven in large part by AI. AI-powered tools are now being used not just for defense, but by attackers to discover and exploit vulnerabilities faster than ever before. The window between a vulnerability’s disclosure and its exploitation is shrinking—sometimes to zero. This trend fundamentally changes the calculus for vulnerability management.

Organizations need to automate their patching processes wherever possible. Manual, ad hoc approaches simply can’t keep up with the speed of modern attacks. Investing in AI-powered defense mechanisms isn’t optional anymore—it’s a necessity if you want to keep pace with adversaries who are already leveraging these tools. At the same time, enhancing your vulnerability management processes to prioritize the most critical exposures is essential. Not every vulnerability is equally urgent, but the ones that are can have catastrophic consequences if left unaddressed.

Supply chain attacks continue to be a major concern, especially in the software development ecosystem. Recently, attackers have compromised trusted npm mirrors—repositories that developers rely on for open-source packages—and used them to distribute malicious pages disguised as legitimate Cloudflare ClickFix resources. This isn’t just a technical issue; it’s a governance problem. When attackers can infiltrate the very tools and dependencies your developers use, the risk extends far beyond your own perimeter.

To mitigate this, organizations need to validate third-party dependencies rigorously. Monitoring for tampered packages and implementing software bill of materials (SBOM) practices are becoming best practices. SBOMs provide transparency into the components that make up your software, making it easier to identify and respond to supply chain risks. It’s about knowing not just what you build, but what you build with.

Iranian threat actors are also abusing legitimate runtimes—like the Deno JavaScript runtime—to hide malware on Windows systems. Specifically, they’re concealing the Dindoor backdoor by blending it with legitimate Deno processes. This technique complicates detection, because traditional security tools often whitelist trusted runtimes, assuming they’re safe.

The lesson here is the importance of behavioral analytics and endpoint monitoring. Rather than relying solely on static allowlists, organizations need to look for anomalous runtime usage—processes behaving in ways that don’t match their expected patterns. It’s a more nuanced approach, but it’s increasingly necessary as attackers get better at hiding in plain sight.

Let’s turn to identity security, specifically the challenges around multi-factor authentication, or MFA. While MFA remains a cornerstone of modern security, recent analysis warns that it can create a false sense of security if not implemented and monitored correctly. Attackers are getting better at bypassing MFA, often by exploiting weaknesses in enrollment or recovery processes.

For security leaders, this means auditing your MFA implementations regularly. Don’t just set it and forget it. Educate users about potential bypass techniques, and layer additional controls such as device trust and behavioral analytics. MFA is necessary, but it’s not sufficient on its own. The goal is to create a layered defense that doesn’t rely on any single control.

The financial sector is experiencing its own set of challenges as open finance initiatives expand. Open finance is all about enabling broader access to financial data and services through APIs and integrations. While this drives innovation, it also broadens the attack surface, exposing new integration points to potential exploitation.

Financial institutions need to double down on third-party risk management. Continuous API security assessments are essential, as is enhanced monitoring for anomalous activity across interconnected platforms. The complexity of these environments means that traditional perimeter defenses are no longer enough. It’s about understanding and managing risk across the entire ecosystem.

Supply chain risk isn’t limited to software. A recent data breach at Paylogix, a third-party administrator, has exposed sensitive information belonging to benefits brokers and their clients. This incident is a reminder that your organization’s security is only as strong as the weakest link in your supply chain.

Due diligence with vendors is critical. That means not just assessing their technical controls, but also ensuring contractual security requirements and incident response coordination are in place. When a breach occurs, you need to be able to respond quickly and effectively, even if the incident originates outside your own organization.

As AI becomes more deeply embedded in enterprise operations, we’re seeing the rise of “invisible” AI agents—autonomous processes that operate without direct human oversight. These agents can introduce new risks around data exposure, compliance, and operational integrity. The challenge is that these processes are often invisible to traditional monitoring tools.

Security teams need to map out where AI agents are operating, enforce governance policies, and monitor for unauthorized or unintended actions. This isn’t just about technical controls; it’s about establishing clear accountability and oversight for AI-driven systems. As these agents become more capable, the risks associated with their autonomy will only grow.

AI-powered coding tools are another double-edged sword. On the one hand, they accelerate software development, enabling teams to move faster and innovate more quickly. On the other hand, they can amplify the risk of introducing vulnerabilities at scale, especially if AI-generated code isn’t subject to the same scrutiny as human-written code.

Organizations should implement secure coding practices across the board, including regular code reviews that specifically include AI-generated code. Developer education is key—teams need to understand not just how to use these tools, but also how to spot and mitigate the risks they introduce. The goal is to harness the benefits of AI without compromising security.

A new report from IANS and Artico Search underscores a critical point: organizational readiness is more important than simply adding more technical controls when it comes to building confidence in AI adoption. Readiness encompasses governance, training, and process maturity. It’s about building a culture and a set of practices that can adapt to new risks as they emerge.

Security leaders should prioritize readiness assessments and invest in cross-functional AI risk management capabilities. This means bringing together stakeholders from security, compliance, legal, and business units to ensure that AI adoption is both innovative and secure. It’s not enough to bolt on controls after the fact—risk management needs to be integrated from the outset.

We’re also seeing a shift toward formal AI governance

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is defined by a convergence of escalating software vulnerabilities, rapid AI adoption, and evolving governance challenges. We’re seeing a perfect storm: critical vulnerabilities are surfacing at a record pace, AI systems are being integrated into every layer of business, and both regulators and attackers are moving faster than ever. For security leaders, the practical implications are clear—accelerated patch management, proactive AI governance, and enhanced supply chain vigilance are no longer optional. Let’s break down the top developments shaping the risk environment right now, and what they mean for organizations navigating this complex terrain.

Let’s start with software vulnerabilities, where urgency is the name of the game. The US Cybersecurity and Infrastructure Security Agency, or CISA, has just imposed its shortest-ever patching deadline: three days. This unprecedented mandate comes in response to a newly disclosed Oracle vulnerability, rated a “perfect-10” on the CVSS scale. For context, a CVSS score of 10 means the flaw is as severe as it gets—an open door for remote code execution, potentially allowing attackers to take full control of affected systems from anywhere in the world.

What’s significant here isn’t just the technical risk, but the regulatory shift. CISA’s three-day deadline signals a new era of accelerated vulnerability management, where organizations can expect tighter timelines and closer scrutiny from regulators. For CISOs and IT teams, this means immediate triage: identify affected Oracle systems, deploy patches without delay, and verify remediation. Delayed action isn’t just a technical risk—it’s a compliance risk, with potential for regulatory penalties and reputational damage. This sets a precedent, and we can expect similar expectations for future critical flaws. The message is clear: patch management needs to be both proactive and agile.

Moving from traditional software to the evolving world of AI, the UK’s National Cyber Security Centre has released new guidance focused on what’s known as “agentic AI.” These are AI systems capable of autonomous action—think of AI agents that can make decisions, execute tasks, and interact with other systems without direct human oversight. The NCSC’s guidance addresses several key areas: threat modeling for AI-specific risks, managing supply chain dependencies, and the need for continuous monitoring of AI behaviors.

Why does this matter? As organizations accelerate AI adoption, these agentic systems introduce new risk dimensions. They can act in unpredictable ways, interact with sensitive data, and even make decisions that impact business operations or customer trust. Integrating AI-specific controls into existing risk management frameworks is now essential. That means not just securing the AI models themselves, but also the data pipelines, APIs, and third-party dependencies that support them. For security leaders, this is a call to action: AI governance needs to be built into your cyber risk strategy from the ground up.

Supply chain risk is another area where the stakes are rising. A new report highlights that 91 recently disclosed Spring Framework vulnerabilities—CVEs—impact more than 209,000 software components across the supply chain. The Spring Framework is widely used in enterprise applications, and attackers are increasingly targeting these open-source dependencies as a way to compromise organizations at scale.

This amplifies the importance of comprehensive Software Bill of Materials, or SBOM, management. Knowing exactly which components you’re running, where they come from, and how they’re maintained is critical. Rapid patching is essential, but so is coordination with vendors and third-party partners to mitigate cascading vulnerabilities. The supply chain is only as strong as its weakest link, and attackers know it. For organizations, this means investing in tools and processes to track, assess, and remediate vulnerabilities across the entire software ecosystem.

Identity and access management is also under the microscope, following the disclosure of a critical vulnerability in Keycloak. This flaw allows attackers to hijack any account by bypassing the password reset process—a direct route to unauthorized access and potential data breaches. Keycloak is a popular open-source identity solution, relied on by organizations worldwide to manage authentication and authorization.

The practical takeaway here is straightforward: patch Keycloak immediately, and review your authentication workflows for any signs of compromise. But the broader implication is that identity platforms are high-value targets, and attackers are constantly probing for weaknesses. Regular audits, strong monitoring, and layered defenses around identity infrastructure are now table stakes.

Email infrastructure is facing its own set of threats. Unpatched Zimbra servers are currently being targeted by attackers exploiting CVE-2026-73570. Zimbra is a widely used email and collaboration platform, and the vulnerability allows unauthorized access with potential for lateral movement inside affected environments. The lesson here is familiar: patch quickly, monitor for indicators of compromise, and review your email infrastructure for any lingering vulnerabilities. Email remains a critical attack vector, and unpatched systems are low-hanging fruit for threat actors.

Let’s turn to the evolving tactics of cybercriminals. The WeedHack malware campaign is a case in point. Despite disruptions to its command-and-control infrastructure, WeedHack continues to spread through SEO-poisoned Minecraft-related websites. This campaign targets gaming and youth-oriented platforms, using malicious downloads to compromise unsuspecting users.

What stands out is the resilience and adaptability of threat actors. Even when infrastructure is disrupted, they find new ways to reach victims—often by exploiting popular search terms and trusted community sites. For organizations, this underscores the importance of user awareness training, especially for younger or less security-savvy audiences. Web filtering controls and proactive monitoring of web traffic can help reduce exposure to these types of campaigns.

Third-party risk is also in the spotlight, following reports that the threat group ShinyHunters has allegedly breached ReliaQuest and leaked screenshots of an Okta dashboard as proof. While details are still emerging, this incident highlights the risks associated with identity providers and the potential for downstream compromise. Okta is a widely used identity platform, and a breach can have ripple effects across multiple organizations.

For CISOs, this is a reminder to review third-party access controls, monitor for suspicious activity in identity platforms, and maintain strong incident response plans. The interconnected nature of modern IT environments means that a compromise in one provider can quickly escalate into a broader security incident. Vigilance and proactive management of third-party relationships are essential.

Critical infrastructure is facing heightened threats as well. A recent wave of cyberattacks has impacted major organizations including Shell, GE, and Philips, prompting federal agencies to issue warnings about vulnerabilities in Siemens programmable logic controllers, or PLCs. These devices are foundational to operational technology environments—think manufacturing plants, energy grids, and transportation systems.

The attacks underscore the persistent threat to critical infrastructure and the need for robust OT security controls. Unlike traditional IT systems, OT environments often have unique constraints—legacy devices, limited patch windows, and a high tolerance for uptime. Security teams need to balance operational requirements with the imperative to patch and secure vulnerable systems. Network segmentation, continuous monitoring, and specialized OT security solutions are key components of a resilient defense.

On the industry front, we’re seeing major players join forces to tackle the scale and complexity of AI and cyber threats. NTT DATA and Palo Alto Networks have announced a global alliance targeting $1 billion in AI security solutions. The partnership aims to deliver integrated, AI-driven security platforms that can scale with enterprise needs.

This reflects a broader trend: as threats become more sophisticated and AI adoption accelerates, no single organization can go it alone. Strategic alliances and advanced security tooling are becoming essential. For security leaders, it’s worth evaluating the potential benefits of these partnerships—whether that means access to cutting-edge technology, shared threat intelligence, or streamlined integration across security domains.

As organizations scale their AI initiatives, the limitations of traditional security tools are coming into focus. Experts are warning that conventional SBOMs—Software Bills of Materials—are no longer sufficient for managing risks in AI-driven environments. AI models introduce new dependencies, often with opaque or dynamic supply chains that are hard to track using legacy methods.

Enhanced transparency and dynamic SBOMs are recommended to address the complexity of AI software stacks. This means not just listing static components, but also tracking model versions, training data sources, and third-party services that feed into AI workflows. For organizations, this is a call to invest in tools and processes that can keep pace with the evolving nature of AI software.

On the tooling front, a review of leading AI safety solutions highlights a range of options for model monitoring, bias detection,

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is evolving at a pace that demands more than just vigilance—it requires a fundamental shift in how organizations approach governance, identity, and third-party oversight. As AI adoption accelerates across industries, security blind spots are widening, especially around user behavior, vendor relationships, and automated contract workflows. At the same time, we’re seeing a steady drumbeat of active exploits, sophisticated malware campaigns, and persistent threats targeting both legacy and emerging technologies.

Let’s break down the most critical developments shaping today’s risk environment and what they mean for CISOs, risk executives, and security teams on the front lines.

First, let’s talk about the convergence of AI and cyber risk. Organizations are integrating AI into more business processes than ever before, but this rapid adoption is introducing new governance challenges. The need for robust frameworks that can keep pace with both regulatory expectations and the evolving threat landscape is urgent. Without clear policies and adaptive controls, organizations risk falling behind—not just in compliance, but in their ability to respond to incidents and protect sensitive data.

One of the most striking findings from recent research is that just 5% of AI users within organizations are responsible for the majority of security risk. These high-risk users are often the ones who bypass established controls, misuse sensitive data, or inadvertently expose information through careless or uninformed actions. For security leaders, this means that blanket policies may not be enough. Instead, targeted monitoring, user segmentation, and adaptive access controls are needed to focus resources where they’ll have the greatest impact. By identifying and addressing the behaviors of this small but risky cohort, organizations can achieve significant risk reduction without stifling innovation for the broader user base.

Now, let’s turn to some of the active threats making headlines. The Zimbra Collaboration Suite, a widely used email and collaboration platform, is currently under attack due to a critical vulnerability that allows attackers to execute arbitrary commands on affected systems. This isn’t just a theoretical risk—exploitation is ongoing and public. For organizations relying on Zimbra, the implications are serious: attackers can gain unauthorized access, move laterally within networks, and potentially deploy ransomware. The lesson here is clear: rapid vulnerability management is not optional. Security teams must prioritize patching, actively monitor for indicators of compromise, and ensure that their detection capabilities are up to date. This incident is yet another reminder of the persistent threat posed by unpatched software and the importance of maintaining a disciplined approach to vulnerability management.

Supply chain risk is also front and center, as demonstrated by the recent data theft claims involving Shell and the Cl0p ransomware group. This incident is tied to a zero-day vulnerability in PTC Windchill, a platform used for product lifecycle management. The attack highlights the growing sophistication of ransomware operations and the risks associated with third-party software dependencies. For CISOs, this means that assessing exposure to platforms like PTC Windchill, reviewing incident response plans, and maintaining open lines of communication with vendors are now critical components of a resilient security posture. The Shell case underscores that supply chain and zero-day exploits are not just theoretical—they are being actively leveraged by organized threat actors to target enterprise environments.

The healthcare sector, in particular, is under increasing scrutiny for its management of AI vendor risk. The complexity of healthcare data, combined with stringent regulatory requirements, makes the stakes especially high. Third-party failures or breaches can have outsized impacts, both in terms of patient safety and regulatory compliance. As AI becomes more embedded in healthcare operations, CISOs must enhance their vendor risk management programs. This includes rigorous due diligence, contractual safeguards, ongoing monitoring, and coordinated incident response. What’s happening in healthcare today is likely a preview of what other regulated sectors will face as AI adoption continues to grow.

On the malware front, a new strain known as SynkLoader is making waves. This malware uses a fake Windows lock screen as a social engineering tactic to harvest user credentials and facilitate lateral movement within enterprise networks. What’s notable about SynkLoader is its ability to bypass traditional endpoint defenses, relying on deception rather than technical exploits. For security teams, the response should be multi-faceted: update detection signatures, educate users about the risks of social engineering, and reinforce multi-factor authentication to mitigate the risk of credential theft and internal compromise. The rise of malware like SynkLoader highlights the need for layered defenses that address both technical and human factors.

As the threat landscape becomes more dynamic, organizations are increasingly adopting continuous evidence programs to maintain real-time assurance of their security controls and compliance posture. Unlike traditional point-in-time audits, continuous evidence allows for proactive identification of control failures and rapid remediation. For CISOs, investing in automation and evidence collection infrastructure is becoming essential—not just to satisfy regulatory requirements, but to provide the board and other stakeholders with the assurance they expect in a rapidly changing environment.

Building a robust AI security and governance program is no longer a nice-to-have—it’s a necessity. This involves more than just drafting policies; it requires ongoing risk assessments, cross-functional collaboration, and alignment with both organizational risk appetite and regulatory obligations. Governance frameworks must be adaptable, with mechanisms for continuous improvement as AI capabilities and use cases evolve. Security leaders should ensure that their programs are not static, but responsive to new developments in both technology and the threat landscape.

Identity management and contract workflows are emerging as significant blind spots for many organizations, particularly as AI automates more business processes. Gaps in visibility and control over these workflows can lead to unauthorized access, data leakage, and compliance failures. To address these risks, investments in identity governance and contract lifecycle management tools are becoming increasingly important. These tools can help close the gaps, providing the oversight needed to prevent unauthorized actions and protect sensitive data as automation expands.

Decentralized finance, or DeFi, is another area where governance risks are coming to the fore. A recent exploit in the Term Finance platform has drawn attention to the vulnerabilities inherent in smart contract design and the need for robust oversight. In the financial sector, the integration of AI with DeFi products introduces new layers of complexity and risk. CISOs should work closely with product teams to ensure that governance and security reviews are built into the development lifecycle of AI-enabled financial services. The consequences of insufficient oversight can be severe, leading to financial losses and reputational damage.

Looking at the broader market, the demand for advanced threat detection and response capabilities continues to grow. The global endpoint detection and response, or EDR, market is forecast to reach over $33 billion by 2033. This growth is being driven by the proliferation of sophisticated cyber threats and the need for real-time visibility across enterprise endpoints. For security leaders, this means evaluating EDR strategies to ensure they are scalable and can be integrated with broader security operations. The investment in EDR is not just about technology—it’s about building the operational resilience needed to detect and respond to threats quickly and effectively.

Governance is increasingly being recognized as the next major battleground for enterprise security, especially around AI and software development. Organizations that invest in secure coding practices, governance automation, and developer enablement are better positioned to manage emerging risks. For CISOs, championing governance initiatives that bridge the gap between security and development teams is key to building a culture of security that can keep pace with innovation.

On the technology front, we’re seeing new solutions emerge to address the challenges of AI governance. One example is the launch of the TRUSTNOW platform in India, which provides sovereign AI governance for autonomous enterprise agents. Tools like TRUSTNOW are designed to enforce policy, monitor AI behavior, and ensure compliance in complex environments. While these platforms are still evolving, security leaders should keep a close eye on their development as part of a comprehensive AI risk management strategy.

So, what are the strategic implications of these trends for organizations today? First, as AI adoption accelerates, risk is becoming more concentrated among a small subset of users. This requires a shift toward targeted controls and monitoring, rather than one-size-fits-all approaches. Second, third-party and supply chain vulnerabilities—especially in critical sectors like healthcare and financial services—demand enhanced vendor oversight and incident response readiness. Third, continuous evidence and adaptive governance fram

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is evolving rapidly, shaped by a convergence of critical vulnerabilities, emerging AI governance standards, and the relentless operationalization of AI across every sector. Security leaders are facing an expanding attack surface—not just from traditional vectors like web server exploits and password vault flaws, but increasingly from the adoption of AI technologies that are challenging established security models, especially around identity and data governance. Regulatory bodies are responding with new standards and guidance, but the pace of change is relentless. Proactive adaptation and cross-functional engagement are now essential, particularly as AI risk becomes a board-level concern.

Let’s break down the top developments shaping today’s risk environment, and what they mean for organizations, security teams, and leadership.

Starting with the most urgent: CISA has issued an emergency directive requiring federal agencies to immediately patch critical vulnerabilities in TrueConf Server. These flaws are being actively exploited in the wild, with attackers leveraging them to deliver malware—most notably PhantomCore—to meeting participants. Reports indicate both advanced persistent threat actors and criminal groups are involved. The urgency here isn’t limited to federal agencies. Any organization using TrueConf for communications is at risk. Attackers are increasingly targeting collaboration platforms, recognizing that these systems are now critical to business operations and often have direct access to sensitive data.

The practical implication is clear: patching can’t wait. Security leaders should prioritize updating TrueConf Server instances, review meeting platform configurations for unnecessary exposure, and closely monitor for signs of compromise. This includes looking for unexpected processes, unusual network connections, or indicators tied to PhantomCore and related malware. It’s also a reminder to audit the broader collaboration stack—attackers are showing a pattern of targeting the tools that connect people internally and externally.

Moving to another critical vulnerability: the N-Able PassPortal browser extension has been found to contain a flaw that allows attackers to gain full access to password vaults. If exploited, this could result in widespread credential theft and enable lateral movement within affected organizations. Password vaults are central to privileged access management, so a compromise here can have cascading effects across the entire enterprise.

Immediate patching is essential. But beyond that, organizations should review access logs for signs of unauthorized access, reassess password management policies, and evaluate vendor risk. This is also an opportunity to reinforce the basics—ensure multi-factor authentication is enforced, privilege is minimized, and vault access is tightly controlled. The incident underscores the importance of continuous third-party risk oversight. Even trusted security tools can become attack vectors if not properly maintained.

Web servers remain a persistent target as well. The UAT-10147 threat group has been exploiting vulnerabilities to deploy the BadIIS backdoor. This campaign is notable for facilitating both SEO fraud and data exfiltration. In other words, attackers are using compromised web servers to manipulate search engine rankings for financial gain, while also siphoning off sensitive data for espionage or further criminal activity.

Security teams should audit web server configurations, apply all relevant patches, and monitor for indicators of BadIIS activity. This includes scanning for unusual server processes, unexpected outbound connections, and changes to web content. The campaign is a reminder that public-facing infrastructure is both a financial and espionage target, and that attackers are blending motives and techniques.

Shifting to AI security, the ecosystem is maturing quickly. CREST has launched a new standard for testing AI security, providing a structured approach to evaluating AI systems for vulnerabilities and resilience. As organizations increasingly deploy AI in production environments, often without established security benchmarks, this standard is a significant step forward. Security leaders should review the CREST standard and consider integrating it into their AI risk assessments and procurement processes. It’s not just about technical vulnerabilities—testing should include data governance, model robustness, and the potential for adversarial manipulation.

NIST has also released Special Publication 1353, which details AI prompts and use cases designed to support analysis, planning, and reporting under the Cybersecurity Framework 2.0. This guidance is meant to help organizations align their AI deployments with established cybersecurity best practices. For security leaders, this is an opportunity to evaluate how these prompts can inform AI governance and risk management strategies. It’s about ensuring that AI isn’t just deployed for efficiency or innovation, but is also managed in a way that’s consistent with broader risk frameworks.

A recurring theme in recent research is that AI security risk is fundamentally a data governance issue, with employees at the center. As AI systems increasingly interact with sensitive data, the risk of insider threats and inadvertent data leakage rises. Employees can unintentionally expose sensitive information through AI-powered tools, or become targets for adversaries seeking access to training data or model outputs.

CISOs should prioritize employee training, clear data classification schemes, and robust access controls as part of their AI risk management strategies. This means not only technical controls, but also fostering a culture of security awareness—ensuring employees understand the risks associated with AI and the importance of responsible data handling.

Identity is emerging as the new perimeter, but AI is complicating the picture. Attackers are exploiting weaknesses in identity systems, and AI-driven automation can amplify the impact of credential compromise. For example, if an attacker gains access to an AI system with broad data access, the potential for damage is much greater than with a traditional application. Security leaders must strengthen identity governance, implement adaptive authentication, and monitor for anomalous access patterns. This includes leveraging behavioral analytics to detect when access patterns deviate from the norm, and ensuring that identity systems are resilient to both traditional and AI-driven attacks.

AI risk is also becoming a board-level liability. Directors are now expected to exercise oversight of AI governance and risk mitigation, and this trend is driving demand for clear reporting, risk quantification, and alignment with regulatory expectations. CISOs should engage with boards to ensure that AI risks are understood, documented, and addressed within enterprise risk frameworks. This means translating technical risks into business terms, quantifying potential impacts, and outlining clear mitigation strategies.

The latest Unified Data Security Report for 2026 highlights persistent gaps in data protection as organizations adopt AI at scale. Key findings include insufficient data inventory, a lack of unified controls, and challenges in monitoring data flows across hybrid environments. Security leaders should accelerate efforts to map data assets, unify controls across environments, and leverage AI observability tools to gain visibility into how data is being used and where it’s flowing.

Observability is becoming a core component of AI risk management, especially in regulated sectors. Indian banks, for example, are investing in observability solutions to manage the risks associated with AI in production environments. This reflects a broader trend toward operationalizing AI while maintaining visibility into model behavior, data usage, and compliance. Security teams should consider observability not as an afterthought, but as a foundational capability—one that enables rapid detection of anomalies, supports compliance efforts, and provides assurance to stakeholders.

On the software protection front, researchers at Quarkslab are advocating for anti-reversing software that returns plausible but incorrect answers to attackers, rather than simply crashing. The idea is to deceive attackers and slow down reverse engineering efforts. While this approach could enhance software protection, it may also introduce operational complexity. Security teams should weigh the benefits and risks of such techniques, especially in high-value applications where intellectual property or sensitive algorithms are at stake.

Vendor collaboration is also on the rise. NTT DATA and Palo Alto Networks have expanded their partnership to address AI security risks, focusing on joint solutions for AI governance, threat detection, and compliance. This alliance signals increasing vendor collaboration in response to enterprise demand for integrated AI security offerings. CISOs should monitor the evolving vendor landscape and assess opportunities for enhanced AI security integration. It’s important to evaluate not just the technical capabilities of vendors, but also their alignment with emerging standards and their ability to support enterprise governance requirements.

Let’s step back and look at the strategic implications of these developments.

First, the rapid exploitation of collaboration and password management platforms highlights the need for continuous patch management and vigilant third-party risk oversight. Attackers are targeting the connective tissue of organizations—tools t

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is evolving at a pace that challenges even the most prepared organizations. We’re seeing a convergence of technical threats with complex governance dilemmas, and the stakes are rising for enterprises of every size and sector. Today, I’ll break down the most urgent developments, highlight where attackers are focusing their efforts, and discuss what these shifts mean for security leaders, risk managers, and business decision-makers.

Let’s start with the technical threat environment, which is marked by a wave of sophisticated attacks targeting both traditional IT assets and the rapidly expanding world of AI-driven business processes. One of the most critical issues right now is the emergence of a new zero-day vulnerability in cursor handling—a technical flaw that’s already being weaponized in the wild. This vulnerability allows attackers to execute arbitrary code on affected systems, which means a successful exploit could lead to full system compromise, lateral movement across networks, and widespread data exfiltration.

For organizations, the implications are immediate and serious. If you’re running endpoints that haven’t been patched, you’re at risk. Attackers can leverage this flaw to bypass existing security controls and gain persistent access. This isn’t a theoretical risk—it’s happening now, and the window for defenders to respond is measured in hours, not days. The lesson here is clear: robust vulnerability management is not optional. Rapid assessment, patch prioritization, and endpoint detection capabilities must be in place and regularly tested. If you’re a CISO or IT leader, this is the kind of incident that should trigger an immediate review of your patch status and detection coverage.

But technical exploits aren’t the only avenue attackers are pursuing. Social engineering campaigns are growing more sophisticated, and the latest tactics are designed to bypass even well-trained users and layered defenses. One campaign making the rounds uses fake CAPTCHA pages to trick users into downloading malware. Once executed, this malware disables endpoint security solutions, effectively blinding your defenses and opening the door to ransomware or data theft.

This approach is particularly dangerous because it leverages the trust users place in familiar web interactions. Most people are accustomed to solving CAPTCHAs as part of everyday online activity, so they’re less likely to question the legitimacy of these prompts. For organizations, this means that technical controls alone aren’t enough. User awareness training, behavioral monitoring, and layered security—such as web filtering and application whitelisting—are essential to detect and disrupt these attacks before they escalate. Security teams should be looking for anomalous activity, such as the sudden disabling of endpoint protection, and have automated responses ready to contain threats quickly.

Now, let’s talk about a trend that’s gaining momentum: attackers targeting Product Lifecycle Management, or PLM, systems. Recent breaches at major firms like Shell, GE, and Philips have shown that PLM platforms—once considered niche or specialized—are now high-value targets. Attackers are exploiting vulnerabilities in these systems to access sensitive intellectual property and operational data. This is a significant shift, signaling that supply chain and engineering platforms are firmly in the crosshairs.

The practical implication is that third-party risk management and the security of legacy industrial platforms need renewed attention. Many organizations rely on PLM systems that weren’t designed with today’s threat landscape in mind, and attackers know it. If your business is part of a complex supply chain, or if you manage critical engineering data, it’s time to reassess your exposure. This means not just reviewing your own controls, but also those of your partners and vendors. Continuous monitoring, segmentation, and regular security assessments of these platforms are now essential.

Another area where attackers are innovating is in the manipulation of business process platforms, particularly email systems. There’s a growing trend of hackers creating hidden inbox rules in Microsoft 365 to conceal fraudulent vendor payment activity. By manipulating mailbox rules, attackers can hide their tracks, allowing payment fraud to go undetected for extended periods. This increases the risk of significant financial loss and complicates incident response.

For security and finance teams, the key takeaway is that monitoring mailbox rule changes is no longer a nice-to-have—it’s a necessity. Advanced anomaly detection, regular audits of mailbox configurations, and cross-functional collaboration between IT and finance are all critical. Business email compromise isn’t going away, and attackers are getting better at blending in with legitimate activity. Organizations need to be proactive in identifying unusual mailbox behavior and ensuring that controls are in place to flag and investigate suspicious changes.

Shifting gears to the intersection of AI and cyber risk, we’re seeing attackers weaponize the trust that users place in popular AI tools. Cybercriminals are distributing fake versions of well-known AI assistants like Claude, ChatGPT, and Copilot as lures to deliver malware. These campaigns are effective because users often assume that anything branded with a familiar AI name is safe. In reality, downloading unauthorized or unofficial versions of these tools can lead to credential theft, system compromise, or worse.

This trend highlights the importance of user education and domain monitoring. Organizations need to make it clear which AI tools are approved for use, and have controls in place to prevent the installation of unauthorized software. Monitoring for lookalike domains and educating users about the risks of downloading software from untrusted sources are practical steps that can reduce exposure. As AI becomes more deeply integrated into business operations, the attack surface will only grow, making vigilance and clear communication even more important.

On the defensive side, there’s some positive news. CrowdStrike has once again been named a leader in cloud workload protection, marking its fourth consecutive recognition in this space. This reflects the growing maturity of cloud security solutions and the increasing focus on protecting cloud-native environments. For CISOs, the message is twofold: first, that robust solutions are available, and second, that continuous evaluation of vendor capabilities is essential. Attackers are targeting cloud workloads with increasing frequency and sophistication, so security teams need to ensure their controls keep pace with evolving threats.

Turning to governance, we’re witnessing a global shift in how AI systems are regulated and managed. Chinese regulators, for example, are signaling a move toward a tiered governance model for open-weight AI systems. This approach would differentiate oversight based on the risk and capability of each system, rather than applying a one-size-fits-all framework. For multinational organizations, this means compliance obligations are becoming more complex and dynamic. Tracking regulatory developments and aligning internal policies with emerging standards is now a strategic imperative.

The rise of what’s being called “shady AI” is also a growing governance challenge. These are AI systems that operate with opaque, unregulated, or unethical behaviors—either by design or through neglect. Security leaders need to anticipate risks not just from their own AI deployments, but also from third-party systems that may not meet the same standards for transparency and auditability. Ensuring that AI aligns with organizational values and regulatory expectations is becoming as important as technical security controls. This requires collaboration between security, compliance, and data science teams to establish clear guidelines and oversight mechanisms.

Industry responses are evolving as well. Fortinet’s recent acquisition of Virtue AI, a startup specializing in agentic AI security, marks a strategic move into a new frontier: managing the risks posed by autonomous AI agents. These are systems capable of making decisions and taking actions independently, which introduces unique challenges for security architecture. The industry is recognizing that traditional controls may not be sufficient for these new forms of AI, and specialized solutions will be required.

This brings us to a broader trend: the call for unified security architectures that can address the complexity of agentic AI systems. As organizations deploy more autonomous agents, integrating AI governance, monitoring, and incident response into the broader security framework becomes critical. Siloed approaches are no longer viable. The ability to manage emergent risks from AI—whether it’s data poisoning, model theft, or adversarial attacks—depends on having a cohesive, organization-wide strategy.

Insights from security leaders reinforce this point. The CISO of Guild Group recently emphasized the evolving nature of AI security risks, highlighting the need for continuous risk assessment, robust controls across the AI lifecycle, and cross-functional collaboration. These aren’t just technical issues—they’re organizational challenges that require buy-in from stakeholders across security, data science, and compliance.

The practical reality is that AI is now embedded in critical business processes across sectors. Take the food industry, for example, where AI is being used for quality control and supply chain management. While the benefits are clear—improved efficiency, b

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is moving at a pace—and a scale—that’s challenging even the most mature organizations. We’re seeing a convergence of technical vulnerabilities, aggressive threat activity, and governance gaps, all while AI adoption accelerates across the enterprise. Let’s break down what matters most today, the practical implications for risk leaders, and the strategic shifts underway.

Let’s start with the technical front. Major software vendors are issuing record numbers of patches, and attackers are moving faster than ever to exploit the gaps. Oracle, for example, has just released a massive security update—943 patches in total. Among them is a critical fix for a WebLogic vulnerability that could allow a full system takeover. That’s not an edge case; WebLogic is widely used to run enterprise applications, manage sensitive data, and support core business processes. If you’re running Oracle environments, this patch isn’t optional. Exploitation could mean data theft, service disruption, or attackers gaining a foothold for lateral movement across your network. The urgency here is real: patching quickly is the only way to stay ahead of active exploitation, especially given Oracle’s prominence in large organizations.

But Oracle isn’t alone. Google has also pushed out critical updates, this time for Chrome’s WebGL and Dawn components. These vulnerabilities could allow remote code execution—essentially, attackers could run their own code on user machines just by getting them to visit a malicious website. Considering Chrome’s dominance as an enterprise browser, this is a high-risk scenario. Delayed patching opens the door to drive-by attacks and potential credential theft. The takeaway: browser updates are now as critical as operating system patches, and should be prioritized across the enterprise.

VMware is another key area of focus. CISA has issued an alert about an actively exploited path traversal vulnerability in VMware vCenter. Attackers are using this flaw to gain unauthorized access and potentially escalate privileges within virtualized environments. For organizations relying on VMware for their infrastructure, this is a wake-up call. Beyond patching, it’s time to review your segmentation and monitoring controls. If an attacker does get in, you want to limit their ability to move laterally or escalate privileges. Virtualization is foundational to many organizations’ operations, so a compromise here can have wide-reaching impacts.

BeyondTrust’s Windows Endpoint Privilege Management solution has also been found to contain critical vulnerabilities that allow privilege escalation. These tools are supposed to enforce least privilege—one of the core tenets of modern security. If attackers can subvert them, they can undermine your entire privilege model and facilitate lateral movement. Organizations using BeyondTrust should patch immediately and review their monitoring for privilege escalation attempts.

Now, let’s pivot to the threat landscape. Ransomware groups are not letting up—in fact, they’re accelerating. The Cl0p ransomware group has named over 40 organizations as victims of its campaign targeting PTC Windchill, a widely used product lifecycle management platform. This is a classic example of supply chain risk: attackers are exploiting third-party software to reach a broad set of victims. For CISOs, this underscores the need for robust third-party risk management and rapid detection and response capabilities. It’s not just about your own environment anymore; it’s about every vendor and platform you rely on.

The Medusa ransomware group is another example. They’ve now surpassed 500 known victims, with threat actors like STORM-1175 rapidly exploiting newly disclosed vulnerabilities—sometimes within hours of public disclosure. This trend highlights the shrinking window organizations have to patch and remediate. Ransomware operators are weaponizing zero-days and recently patched flaws at unprecedented speed. The practical implication? Vulnerability management can’t be a quarterly or even monthly exercise anymore. It needs to be continuous, with rapid prioritization and deployment of critical fixes.

Data breaches remain a persistent risk as well. A recent incident at ClarityCheck exposed 9 million private image files—a stark reminder of the risks associated with third-party cloud providers. The breach raises questions about access controls, encryption, and incident response planning for sensitive data stored in the cloud. As organizations increasingly rely on cloud services, the attack surface grows, and so does the potential impact of a breach. This is a call to action: review your cloud security posture, ensure robust access controls, and have a tested incident response plan in place.

Now, let’s talk about AI—because it’s not just a technical challenge; it’s a governance challenge. Across the globe, we’re seeing rapid adoption of AI tools in the workplace. A recent report highlights that Indian workers, for example, are embracing AI at scale. But with that comes the rise of “shadow AI”—unsanctioned, unmonitored use of AI tools that can put corporate intellectual property at risk. This isn’t a localized issue; it’s a global trend. Employees are turning to AI to boost productivity, but without proper oversight, organizations face risks of data leakage, regulatory non-compliance, and loss of competitive advantage.

The governance gap is widening. Traditional policies and manual oversight can’t keep pace with the speed and scale of AI adoption. Organizations are recognizing that policy alone isn’t enough. There’s a growing demand for automated, continuous controls that can monitor AI usage, enforce compliance, and detect risky behaviors in real time.

The market is responding. Vendors are rolling out new platforms and tools designed to address these challenges. Tenable, for example, has expanded its exposure management capabilities to provide coverage across every major AI platform and developer tool. This is about visibility—knowing where AI is being used, how it’s being used, and what risks are emerging as a result. It’s a shift from reactive to proactive risk management.

Strike Graph has launched Atlas, an AI-powered advisor for compliance posture intelligence. The idea here is to automate compliance monitoring, provide actionable insights, and help organizations keep pace with evolving regulatory and security requirements. As regulations around AI tighten—and they will—tools like this will become essential for maintaining compliance and demonstrating due diligence.

Hexaware is taking a different approach with its “Zero Vulnerability” initiative. The goal is ambitious: eliminate exploitable weaknesses in enterprise environments. This involves proactive vulnerability management, continuous monitoring, and rapid remediation. It’s a recognition that the old model of periodic scanning and patching isn’t enough in the face of escalating threat activity. Organizations need to be more aggressive and more agile in their risk reduction strategies.

All of this points to a broader shift in the market. The convergence of AI and cybersecurity is driving demand for advanced governance tools and exposure management solutions. Organizations are moving toward continuous, automated compliance—not just for cyber risk, but for AI risk as well. CISOs are being challenged to rethink their strategies, integrating AI-specific controls and monitoring into existing security architectures.

So, what does this mean for risk leaders today? There are a few clear imperatives.

First, prioritize timely patching. The window between vulnerability disclosure and active exploitation is shrinking. Critical vulnerabilities in Oracle, VMware, Chrome, and BeyondTrust products need to be patched immediately to reduce exposure. This isn’t just about avoiding a headline-grabbing breach; it’s about maintaining operational continuity and protecting sensitive data.

Second, enhance visibility into AI usage across the enterprise. That means not just tracking sanctioned tools, but also identifying and managing “shadow AI.” Unsanctioned AI use can lead to IP leakage, data privacy violations, and regulatory non-compliance. Organizations need tools and processes to discover, monitor, and govern all AI activity—whether it’s happening in the open or under the radar.

Third, accelerate the adoption of governance and exposure management solutions that can keep pace with evolving threats. Manual processes and policy-only approaches are no longer sufficient. Automated, continuous controls are becoming the standard for managing both cyber and AI risk. Evaluate platforms that provide real-time compliance intelligence, risk assessment, and actionable insights.

Let’s recap some of the key items driving these imperatives.

Oracle’s 943 security patches—and especially the WebLogic full takeover vulnerability—are a stark reminder of the scale and complexity of modern enterprise environments. Patching at this scale requires coordination, prioritization, and testing, but the risk of delay is too high to ignore.

Ransomware groups like Cl0p and Medusa are exploiting both supply chain and newly disclosed vulnerabilities at speed. The Cl0p campaign against PTC Windchill shows how attackers are targeting widely used third-party platforms to reach multiple victims. Medusa’s rapid exploitation of zero-days highlights the need for continuous vulnerability management.

CISA’s warning about the VMware vCenter path traversal vulnerability is another example of attackers targeting core infrastructure. Virtualization is the backbone of many enterprise environments, and a compromise he

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is defined by a series of high-impact incidents and persistent governance gaps. As organizations accelerate their adoption of AI and cloud technologies, the challenges of securing data, managing third parties, and maintaining trust are becoming more complex—and more urgent. Let’s break down the key developments shaping risk management today, and explore what they mean for security leaders and organizations navigating this evolving threat environment.

To start, we’re seeing a continued surge in high-profile data exposures, with ransomware groups and threat actors targeting critical infrastructure and high-value sectors. Philips and GE, two giants in the healthcare technology space, are currently investigating claims by the Clop ransomware group that sensitive data has been stolen. While the full extent of the breach is still being determined, the incident underscores how ransomware actors are shifting their focus to supply chain partners and critical infrastructure providers. For organizations in healthcare and other regulated sectors, this is a stark reminder: third-party risk management and incident response planning can’t be afterthoughts. These must be core components of your security strategy, especially when you’re handling regulated or life-critical data.

Ransomware isn’t the only threat vector making headlines. Misconfigurations in cloud and SaaS environments continue to be a leading cause of large-scale data exposures. A recent incident involving Microsoft Power Pages is a case in point. Due to a misconfiguration, an estimated 27 million records were exposed, potentially to the ExfilSquad threat group. This isn’t an isolated event—it’s part of a broader pattern where simple mistakes in cloud configuration open the door to massive breaches. Security leaders need to prioritize configuration management, conduct regular audits, and implement automated detection for misconfigurations. In the cloud, the speed and scale of deployments mean that small errors can have outsized consequences.

Third-party plugins are another area of growing concern. The SafePal order-tracking plugin breach exposed nearly 40,000 customers’ data, putting them at heightened risk for targeted phishing attacks. This incident highlights the downstream impacts that can arise from third-party components. It’s not enough to vet plugins at the point of adoption; organizations need ongoing monitoring and robust governance around all third-party integrations. Customer notification protocols and fraud risk monitoring should be in place, ready to activate the moment a potential breach is detected.

We’re also seeing adversaries adapt quickly to new defenses. The ShieldBreak exploit, for example, has been identified as a way to bypass the RoguePlanet patch in Microsoft Defender. This is a classic zero-day scenario: attackers are finding ways around vendor fixes almost as soon as they’re released. The implication for defenders is clear—layered defenses and rapid patch validation are essential. Relying on a single patch or control is no longer sufficient. Security teams need to assume that some controls will fail and have compensating measures in place.

One of the most important shifts in thinking comes from the recent analysis of the Microsoft compromise. Rather than framing it as a technical vulnerability, experts are now calling it a breakdown of trust. This reframing is significant. It suggests that effective risk management isn’t just about patching software or fixing bugs—it’s about establishing and maintaining trust across the entire supply chain and identity ecosystem. Continuous trust validation, ongoing monitoring, and secure-by-design principles must be embedded throughout the software lifecycle. The lesson here is that trust is both a technical and organizational challenge, and it requires holistic approaches that go beyond traditional security controls.

APIs are another area where risk is escalating rapidly. As organizations pursue digital transformation and integrate AI into their operations, the number of APIs in use is exploding. Softrick has warned that inadequate API security can result in simultaneous, large-scale leaks of sensitive data. The implications are serious: a single weak API can become a conduit for massive data loss, especially when connected to critical systems. To mitigate this risk, organizations need to enforce strong authentication, implement continuous monitoring, and apply data minimization controls. API inventories should be kept up to date, and security teams should be proactive in identifying and addressing potential weaknesses before they can be exploited.

Turning to AI, the latest SANS survey reveals a growing gap between the rate of AI adoption and the maturity of governance, validation, and operational controls. Organizations are racing to deploy AI-driven solutions, but the frameworks and oversight needed to manage these technologies safely are lagging behind. This governance gap increases the risk of unintended consequences, model drift, and regulatory non-compliance. For CISOs and risk executives, the message is clear: advocate for AI-specific governance frameworks and cross-disciplinary oversight. AI isn’t just another IT system—it brings unique risks that require tailored approaches to validation, monitoring, and accountability.

A cross-industry survey reinforces this point, finding that the gap between AI deployment and effective governance remains wide, with security incidents on the rise as a direct result. Organizations need to formalize AI risk management, establish clear lines of accountability, and develop incident response protocols specifically designed for AI systems. This isn’t just about compliance—it’s about protecting the organization from operational and reputational harm as AI becomes more deeply embedded in business processes.

Cloud management is also undergoing significant changes. Cloudflare has introduced new detection capabilities for Managed Control Plane, or MCP, traffic. This advancement makes previously invisible “shadow MCP” activity detectable and blockable. For organizations, this means improved visibility into cloud management activity, and the ability to identify and block unauthorized or risky actions. As cloud environments become more complex, exposure visibility is foundational to effective risk management. Security teams should take advantage of these new capabilities to strengthen their monitoring and response strategies.

Research into MCP servers has also highlighted how misconfigured or poorly secured endpoints can leak enterprise secrets. These exposures can compound the risk of supply chain and cloud breaches, especially when attackers are able to pivot from one compromised system to another. Security teams need to inventory all MCP endpoints, harden their configurations, and monitor for anomalous access patterns. The goal is to reduce the attack surface and prevent attackers from exploiting weak points in cloud management infrastructure.

Exposure visibility isn’t just a technical issue—it’s an organizational one. A regional analysis of South African organizations found that the core problem isn’t a lack of cybersecurity controls, but insufficient visibility into the exposure and attack surface. This insight is broadly applicable. Asset discovery, continuous monitoring, and risk-based prioritization are critical for organizations everywhere. Without a clear understanding of what’s exposed and where, even the best security controls can fall short.

As AI becomes more deeply integrated into enterprise operations, the need for industry context is becoming apparent. Security experts argue that forward deployed engineers—those working on enterprise AI projects—require deep industry knowledge to effectively identify and mitigate risks. This points to the importance of cross-functional collaboration and ongoing education. AI risks aren’t just technical; they’re also operational and contextual. Security teams need to work closely with business units and domain experts to ensure that AI deployments are both effective and secure.

Let’s step back and look at the strategic implications of these trends. Ransomware and supply chain attacks are continuing to target high-value sectors, which means enhanced third-party and incident response strategies are more important than ever. Misconfigurations in SaaS and cloud environments remain a leading cause of data exposures, so automated detection and configuration management must be prioritized. The rapid adoption of AI is outpacing governance and validation, increasing the risk of operational, regulatory, and reputational harm. And at the foundation of all of this are trust and visibility—across identity, supply chain, and cloud.

So, what should organizations be focusing on today? First, prioritize exposure visibility and asset inventory. This means going beyond traditional vulnerability management and ensuring you have a clear, real-time picture of your attack surface—including shadow IT, third-party integrations, and cloud assets. Second, accelerate the development and implementation of AI governance frameworks. Don’t wait for regulators to set the rules; take a proactive approach to managing AI risk, with clear policies, validation processes, and incident response protocols. Third, strengthen supply chain and third-party risk management, especially if you’re operating in critical infrastructure or healthcare. This includes continuous monitoring, robust due diligence, and clear escalation paths when issues are detected.

Let’s take a closer look at some of these points, starting with exposure visibility. In today’s environment, the at

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is evolving at a pace that challenges even the most prepared organizations. As we look at the major developments shaping risk management today, several themes emerge: the relentless advance of supply chain threats, the growing complexity of AI governance, and the urgent need for organizations to adapt their security posture to a new era of accelerated digital transformation.

Let’s begin with one of the most significant incidents in recent weeks: the LiteLLM supply chain attack. Over 2,500 organizations have been impacted by this event, which traces back to malicious releases linked to a previous compromise involving Trivy, a popular open-source security tool. This incident is a stark reminder of how deeply interwoven third-party software has become in our operational environments—and how a single breach can cascade through the ecosystem, affecting thousands downstream.

The LiteLLM breach serves as a case study in the persistent risks associated with open-source dependencies. Organizations often rely on a web of third-party components, many of which are updated frequently and maintained by distributed teams. When one of those links is compromised, the effects can be widespread and difficult to contain. For security leaders, this underscores the need for rigorous third-party risk management practices. It’s not enough to vet a vendor or open-source project once. Continuous monitoring is essential—tracking for new vulnerabilities, monitoring for suspicious activity, and being ready to respond rapidly if an incident is detected.

Incident response capabilities are also being tested. With thousands of organizations potentially exposed, the speed at which a security team can identify, contain, and remediate the threat becomes a critical factor in limiting damage. Many organizations are now re-evaluating their dependency management processes, implementing stricter controls on software updates, and investing in tools that provide greater visibility into their software supply chain.

But supply chain attacks aren’t the only threat making headlines. A critical vulnerability has been identified in Microsoft SharePoint—a platform relied upon by enterprises worldwide for collaboration and document management. This remote code execution, or RCE, vulnerability allows attackers to execute arbitrary code on unpatched systems, potentially gaining access to sensitive data or disrupting business operations.

The implications here are significant. SharePoint is often deeply integrated into business processes, and a successful exploit could provide attackers with a foothold inside the organization’s network. The urgency of patch management cannot be overstated. Security teams should prioritize reviewing their SharePoint deployments, applying patches as soon as they become available, and conducting proactive vulnerability scans to identify any lingering exposures. Attackers are known to target unpatched systems quickly, so delays in remediation can have costly consequences.

As organizations work to secure their technology stack, the rapid adoption of AI introduces a new set of challenges—particularly in the realm of identity governance. Traditional frameworks for managing user access and monitoring activity are struggling to keep pace with AI-driven threats. Attackers are leveraging AI to automate reconnaissance, bypass controls, and scale their operations in ways that were previously impossible.

This reality is forcing security leaders to rethink their approach to identity governance. Static access controls and manual monitoring are no longer sufficient. Instead, organizations should look to adaptive identity governance solutions—platforms that can dynamically adjust permissions, detect anomalous behavior in real time, and respond to threats as they emerge. The goal is to create a security posture that is as agile as the threats it faces.

Building this kind of adaptive capability requires more than just technology. It demands a workforce that is upskilled and ready to operate in an AI-accelerated environment. That’s why events like the Infosec Institute’s AI Cyber Readiness Summit are so important. Security leaders from across the industry recently gathered to discuss strategies for building AI-ready teams and developing governance frameworks that can keep pace with innovation.

Key themes from the summit included workforce upskilling, policy development, and the integration of AI into existing security operations. As organizations race to deploy AI solutions, they must ensure that their teams have the skills necessary to manage new risks, and that their policies reflect the realities of AI-driven business processes. Participation in industry forums and summits can provide valuable opportunities for benchmarking readiness and identifying best practices.

On the technology front, we’re seeing the emergence of AI-native platforms designed specifically for assurance and compliance. One example is HavenASSURE, recently launched by Haven Safety AI. This platform focuses on investigation quality assurance and has achieved SOC 2 Type II attestation—a significant milestone in demonstrating its commitment to security and compliance. For organizations looking to validate the integrity and security of their AI-driven processes, solutions like HavenASSURE are worth evaluating for potential integration into assurance programs.

As we circle back to the LiteLLM incident, further details have emerged indicating that over 2,100 organizations may have been exposed due to malicious releases tied to the Trivy hack. This highlights the cascading risks inherent in supply chain attacks. It’s not just the initial compromise that matters, but the downstream effects as malicious code propagates through interconnected systems. Monitoring for indicators of compromise across all software dependencies is now a critical task for security teams.

The pace of AI deployment is another area where risk and opportunity intersect. Industry analysis consistently emphasizes that speed must be matched with governance. Rapid adoption of AI can create competitive advantages, but without robust governance frameworks, organizations risk security lapses and compliance failures. Governance, in this context, means having clear policies, transparent processes, and mechanisms for enforcing accountability.

Microsoft has recently published practical guidance on developing AI policies for employees. The focus is on clarity, enforceability, and alignment with organizational values. Effective AI policies are not just about compliance—they’re about fostering a culture of responsible AI use. CISOs should take this opportunity to review and update their AI policies, ensuring they reflect current best practices and are communicated clearly to all employees.

Technology resilience is another theme gaining traction as organizations confront increasing cyber instability. KPMG’s latest analysis underscores the need for a holistic approach to resilience—one that integrates technical, organizational, and governance measures. This includes strengthening cloud security, improving identity management, and addressing supply chain risks. The goal is not just to prevent incidents, but to ensure the organization can withstand and recover from disruptions when they occur.

When it comes to selecting third-party providers, peer recognition can be a valuable data point. Eventus Security has been voted the top cybersecurity service provider by the community, reflecting a high level of trust in their managed security services. For CISOs evaluating vendors, such recognition can help inform due diligence and selection processes.

On the research front, a new AI Governance Taskforce Research Programme has been launched. This initiative aims to advance policy development, risk assessment, and best practices in AI governance. Participation in such programs can help organizations stay ahead of regulatory trends and emerging standards, ensuring they are prepared for the evolving landscape of AI risk.

One area where AI risk is drawing particular concern is in the context of elections. The use of AI in elections introduces risks of misinformation, manipulation, and the potential undermining of democratic processes. While this is primarily a societal issue, organizations should be aware of the reputational and operational risks posed by AI-driven disinformation campaigns—especially during sensitive periods. Monitoring for signs of coordinated disinformation and having response plans in place can help mitigate these risks.

Stepping back, several strategic implications emerge from today’s risk landscape. First, supply chain attacks remain one of the top threat vectors. Organizations must enhance their third-party risk management programs, monitor software dependencies continuously, and be prepared to respond quickly to incidents. Second, the rapid adoption of AI must be balanced with the development of governance frameworks, clear policies, and ongoing workforce upskilling. Without these elements, organizations risk falling behind in both compliance and operational resilience.

Third, critical vulnerabilities in widely used platforms—like the SharePoint RCE—demand prompt patch management and proactive vulnerability scanning. The window between vulnerability disclosure and active exploitation is shrinking, making speed and discipline in patching more important than ever.

Finally, identity governance frameworks must evolve to address the unique challenges posed by AI-accelerated threats. This means moving beyond static controls and embracing adaptive, intelligence-driven solutions that can keep pace with e

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is moving faster than ever, with threats evolving at the intersection of artificial intelligence, software vulnerabilities, and governance gaps. The headlines aren’t just about new exploits; they’re about how organizations are struggling to keep up as AI adoption accelerates, supply chains grow more complex, and the lines between IT, OT, and business operations blur. Let’s break down the most critical developments shaping enterprise risk today, and what they mean for security leaders tasked with defending their organizations.

We’re seeing a wave of high-impact vulnerabilities being actively exploited, many of them in the tools and platforms that organizations rely on every day. Microsoft SharePoint, SonicWall SMA1000, and Google Chrome have all been hit with zero-day vulnerabilities—flaws that attackers are using before patches are widely available. Ransomware actors are moving quickly to leverage these weaknesses, gaining initial access to enterprise networks and then deploying their payloads.

Let’s start with Microsoft SharePoint. The Cybersecurity and Infrastructure Security Agency, or CISA, has confirmed that a critical SharePoint vulnerability is now being actively exploited by ransomware groups. Attackers are using this flaw to get inside enterprise environments, where they can move laterally and deploy ransomware. This isn’t just about patching a single system; it’s a wake-up call that even mature, widely adopted collaboration platforms can become high-risk assets if they’re not rigorously maintained. For CISOs and IT leaders, the message is clear: patching is urgent, but so is continuous monitoring. Collaboration tools are often deeply integrated into business processes, so a compromise here can have outsized impacts.

The situation is similar with SonicWall’s SMA1000 appliances. These are widely used for secure remote access, and multiple zero-day vulnerabilities have been reported as being exploited in the wild. Ransomware actors are using these flaws for initial access and then moving laterally across networks. CISA and other agencies have issued warnings, and for good reason: remote access infrastructure is a prime target. Organizations relying on SonicWall should prioritize patching and, just as importantly, consider additional network segmentation. The goal is to limit the blast radius if an attacker does get in. It’s a reminder that remote access solutions, which became even more critical during the shift to hybrid work, require ongoing scrutiny and layered defenses.

Google Chrome is also in the spotlight, but for a different reason. A new report highlights that the latest GPT-5.6-Cyber AI model has uncovered Chrome zero-days that standard AI-based detection tools failed to identify. This points to what researchers are calling an “alignment gap” in current AI security solutions. In other words, mainstream AI-driven defenses aren’t catching everything, and adversaries are quick to exploit these blind spots. For organizations, this means that relying solely on AI-based detection is risky. A layered approach to vulnerability management and threat detection is essential—one that combines AI, traditional security controls, and human expertise.

But it’s not just about individual vulnerabilities. The supply chain is emerging as a major source of risk, especially as organizations accelerate their adoption of AI. In a recent incident, an AI supply chain breach compromised over 2,500 organizations. The root of the problem was third-party AI tools and libraries that were integrated into enterprise environments without comprehensive vetting. This event underscores the importance of rigorous supply chain risk assessments and continuous monitoring of AI-related components. As organizations rush to integrate AI, they can inadvertently introduce new dependencies—and new vulnerabilities—into their environments.

Ransomware groups are also targeting critical infrastructure and operational technology. The Gunra ransomware group, for example, is actively exploiting vulnerabilities in Fortinet and Schneider Electric products. These aren’t just IT systems; they’re often part of the operational backbone in sectors like manufacturing, energy, and utilities. OT environments tend to lag behind in vulnerability remediation, making them attractive targets. Security leaders in these sectors should be reviewing patch status and incident response plans for their OT assets. The stakes are high, as disruptions here can impact not just data, but physical processes and public safety.

As AI becomes more deeply embedded in critical sectors—banking, healthcare, public services—the risks are evolving. In banking, for instance, AI is fundamentally transforming everything from customer service to fraud detection. But industry experts warn that governance frameworks must evolve in parallel to manage emerging cyber risks. The unchecked adoption of AI in financial services could expose institutions to new attack vectors and increased regulatory scrutiny. CISOs should be advocating for updated governance policies and cross-functional oversight of AI deployments. It’s not enough to simply adopt AI; organizations need to ensure that controls, compliance, and risk management keep pace.

Healthcare, financial services, and the public sector are facing heightened risks related to shadow AI and data sovereignty. Shadow AI refers to the proliferation of unsanctioned AI tools—technologies being used outside of official IT oversight. New data from Nutanix shows that these sectors are particularly vulnerable, as unsanctioned tools and cross-border data flows increase the risk of regulatory non-compliance and data breaches. For security executives, the priority should be on discovering and controlling shadow AI, and ensuring that all AI deployments align with data residency requirements. The regulatory environment is only getting more complex, and organizations need to be proactive in managing these exposures.

On the governance front, we’re seeing the emergence of formal standards for AI management. NeenOpal has become one of the first organizations to achieve ISO 42001 certification—the new international standard for AI management systems. This is a significant milestone, signaling a growing industry focus on formalizing AI governance and risk management practices. For CISOs, it’s worth evaluating whether ISO 42001 is applicable to your own AI programs. Achieving certification can be a way to demonstrate due diligence and regulatory alignment, especially as expectations around AI oversight continue to rise.

There’s also a broader industry conversation about the real risks of AI. A recent analysis from Unite.AI argues that the biggest risk isn’t the underlying AI models themselves, but the pace and scale of uncontrolled adoption across enterprises. Without robust controls, organizations risk introducing systemic vulnerabilities and compliance failures. Security leaders should be championing centralized AI governance and enforcing clear adoption guidelines. This isn’t just a technical issue—it’s an organizational one, requiring buy-in from leadership, IT, legal, and business units.

Zero-trust architectures are becoming central to managing these risks. DXC Technology recently announced a partnership with Primary to launch an AI-native zero-trust platform, designed to address the unique security challenges of enterprise AI. This reflects a broader trend: embedding zero-trust principles directly into AI infrastructure. For CISOs, this is a good moment to assess the maturity of your own zero-trust initiatives, especially as AI workloads proliferate. Zero-trust isn’t a silver bullet, but it’s a critical component of a modern security strategy—one that assumes breaches will happen, and focuses on minimizing impact.

Threat detection is also evolving. A new perspective from InfoWorld suggests that GitHub’s activity logs can serve as a form of endpoint detection and response, or EDR, for code supply chain threats. By monitoring developer behavior and repository changes, organizations can detect early signs of compromise or malicious activity in their software supply chains. This is especially relevant as more organizations rely on open-source components and external code. Integrating code repository monitoring into broader threat detection strategies can provide earlier warning and help prevent downstream compromises.

AI-driven threats themselves are advancing rapidly. Attackers are using AI for automated attacks, deepfakes, and advanced social engineering. A comprehensive review calls for a proactive approach to AI threat modeling and continuous adaptation of security controls. For CISOs, this means ensuring that security teams are trained to recognize and respond to AI-enabled attack techniques. The threat landscape is dynamic, and defenses need to evolve just as quickly.

Let’s take a step back and look at the strategic implications of these developments. First, the active exploitation of zero-days in widely used platforms—SharePoint, SonicWall, Chrome—demands accelerated patch management and a layered defense strategy. It’s not enough to patch after the fact; organizations need to be able to detect and respond to exploitation attempts in real time.

Second, the unchecked adoption of AI, especially in regulated sectors, is increasing systemic risk and regulatory exposure. Governance frameworks must keep pace with the speed of AI integration. This means not only updating policies and procedures, but also ensuring that there’s cross-functional oversight and accountability for AI deployments.

Third, supply chain vulnerabilities—particularly those involving AI dep

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is evolving at a pace that challenges even the most prepared organizations. We’re seeing a convergence of sophisticated threats targeting both traditional IT infrastructure and the rapidly expanding universe of AI-powered platforms. The stakes are rising, not just because attackers are getting smarter, but because the tools and technologies we rely on for productivity and innovation are themselves becoming attack vectors.

Let’s break down the most pressing developments shaping today’s risk environment, and explore what they mean for security leaders, risk executives, and organizations navigating this complex terrain.

First, let’s talk about the weaponization of trusted cybersecurity tools. Microsoft has issued a warning about China-linked threat actors who are repurposing legitimate security software as launchpads for ransomware attacks. This is a significant shift in tactics. Instead of relying on custom malware or obvious exploits, these actors are blending their malicious activity into the normal operations of security tools that organizations already trust and depend on.

Why does this matter? When attackers use tools that are already whitelisted or deeply integrated into your environment, traditional defenses like signature-based detection or simple allowlists can’t catch them. The malicious behavior looks like business as usual. For security teams, this means it’s time to reassess trust boundaries within the Security Operations Center. Rigorous monitoring of security toolchains, enhanced anomaly detection, and a healthy skepticism about what’s considered “trusted” are now essential. The days of assuming that your security stack is inherently safe are over.

This trend is part of a broader escalation in supply chain and toolchain attacks. We’re seeing attackers focus not just on direct exploitation, but on the software and services that organizations rely on every day. Take the recent alert from CISA regarding a command injection vulnerability in Progress LoadMaster. This isn’t just another patch-it-when-you-can issue. The vulnerability is being actively exploited in the wild, giving attackers the ability to execute arbitrary commands and gain unauthorized access to affected systems.

The risk here isn’t limited to a single device or application. Once inside, attackers can move laterally, escalate privileges, and exfiltrate sensitive data. The implications for enterprise networks are serious. Immediate patching is critical, but so is a thorough review of any exposed instances and a reassessment of how these systems are monitored. Vulnerability management can’t be a quarterly exercise—it needs to be continuous, with a focus on rapid detection and response to active exploits.

Another example comes from Atlassian’s Rovo AI platform. A critical vulnerability has been discovered that allows attackers to steal enterprise data with a single click. This is a stark reminder of the risks associated with integrating AI-driven tools into core business processes without adequate security vetting. AI platforms are often adopted quickly to drive innovation and efficiency, but their security posture can lag behind.

For organizations using Rovo AI, the immediate priority should be patching and reviewing access controls. But the bigger lesson is about the need for a disciplined approach to onboarding new AI tools. Security teams must be involved early in the evaluation process, and there must be a robust process for assessing and mitigating risks before deployment. The speed of AI adoption can’t come at the expense of security fundamentals.

Attackers are also getting more creative in how they evade detection. Researchers have found that Play ransomware is disguising itself as PsExec, a legitimate Windows administration tool. This tactic allows the ransomware to blend into normal IT operations, making it much harder for defenders to spot malicious activity. For incident response teams, this complicates the process of distinguishing between legitimate and malicious use of administrative tools.

The takeaway here is the importance of behavioral analytics and strict application whitelisting. It’s not enough to know what’s running on your endpoints—you need to understand how those tools are being used, and whether their behavior matches expected patterns. Endpoint security strategies must evolve to focus on context and intent, not just binaries and signatures.

Supply chain compromises remain a persistent threat. Attackers are exploiting vulnerabilities in TrueConf Server to replace legitimate client installers with PhantomCore malware. This is a classic supply chain attack: users think they’re downloading a trusted update, but they’re actually installing malware that can steal credentials and provide persistent access to attackers.

The practical implication is clear: organizations need to verify the integrity of their software distribution channels. This means checking hashes, using secure update mechanisms, and monitoring for unauthorized changes to deployment artifacts. It’s not just about protecting your own systems—it’s about ensuring that the software you distribute or consume hasn’t been tampered with upstream.

Developer environments are also under attack. Malicious actors are distributing fake Solidity Pro browser extensions, turning trusted developer tools into vectors for credential theft. This campaign targets the software supply chain at its source, aiming to compromise the very people who build and maintain critical applications.

For organizations with active development teams, this underscores the need for rigorous extension vetting and endpoint monitoring in development workflows. Developers are high-value targets, and their environments often have elevated privileges and access to sensitive code repositories. Security controls must extend into the development pipeline, with a focus on both prevention and rapid detection of compromise.

Endpoint protection remains a cornerstone of effective cyber defense, but there are still significant gaps. Sophos has highlighted that endpoints lacking adequate protection are enabling Interlock credential theft campaigns to go undetected. Attackers are increasingly targeting user credentials as a primary objective, knowing that compromised identities can unlock access to a wide range of systems and data.

Comprehensive endpoint detection and response coverage is no longer optional. Organizations need visibility into endpoint activity, the ability to detect suspicious behavior, and the tools to respond quickly when threats are identified. This is especially important as attackers shift to “living off the land” tactics—using legitimate tools and credentials to move stealthily through networks.

On the geopolitical front, we’re reminded that critical infrastructure remains a top target for cyberattacks. Authorities in the UAE have successfully foiled attacks aimed at vital sectors, although details remain limited. This incident reinforces the importance of sector-wide threat intelligence sharing and coordinated defense. National infrastructure is a high-value target, and defending it requires collaboration across organizations, industries, and government agencies.

Zooming out to the strategic level, one of the most pressing challenges is the rapid adoption of AI in business operations. Multiple sources report that the pace of AI deployment is outstripping the development of effective governance models. Issues of trust, transparency, and accountability are surfacing as organizations scale their AI initiatives. This is especially true in regulated sectors like finance, where the lack of clear governance frameworks is becoming a competitive disadvantage.

Security leaders need to accelerate efforts to formalize AI governance. This means defining clear policies for AI usage, establishing oversight mechanisms, and aligning governance frameworks with both risk appetite and regulatory expectations. The goal is to ensure that AI systems are not just innovative, but trustworthy and resilient.

Recent analysis has also exposed structural vulnerabilities in current AI safety guardrails. Automated controls designed to keep AI systems in check are proving susceptible to adversarial manipulation. This raises serious questions about the reliability of AI safety architectures, particularly in high-stakes environments where errors or manipulation could have significant consequences.

Organizations must reassess their approach to AI safety. This includes investing in robust adversarial testing, strengthening the design of safety guardrails, and continuously monitoring for new types of attacks. AI safety isn’t a one-time exercise—it’s an ongoing process that needs to adapt as threats evolve.

The broader market is also shifting in response to these challenges. The Security-as-a-Service market is projected to reach $51 billion by 2033, reflecting a strong move toward cloud-based, managed security solutions. For many organizations, this approach offers a way to address skills shortages and scale defenses quickly. However, it also introduces new third-party and supply chain risks.

When you outsource security functions, you’re extending your trust boundary to external providers. This makes third-party risk management and oversight more important than ever. Organizations need to ensure that their service providers adhere to the same—or higher—standards as their internal teams, and that there are clear mechanisms for monitoring, reporting, and responding to incidents.

Geopolitical developments can also have immediate operational impacts. Japan’s top cyber official has confi

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Today’s cyber and AI risk landscape is shaped by a convergence of persistent, sophisticated threats and rapidly evolving regulatory expectations. The headlines this week underscore just how dynamic—and demanding—this environment has become for security leaders, risk executives, and boards alike.

Let’s start with a campaign that’s making waves in the threat intelligence community: Russian threat actors are actively exploiting insecure hotel Wi-Fi networks to compromise Microsoft 365 accounts. This isn’t a theoretical risk; it’s a real-world campaign targeting business travelers and remote workers—precisely the people who are often handling sensitive company data outside the office perimeter.

The attackers are using man-in-the-middle techniques to intercept authentication tokens as users log in over poorly secured networks. In some cases, they’re even bypassing multi-factor authentication by stealing session tokens, which grant access to cloud resources without needing to re-authenticate. This highlights a persistent vulnerability in cloud identity systems: session hijacking remains a weak point, especially when users connect from public or semi-public networks.

For organizations, the implications are clear. It’s not enough to rely solely on MFA or traditional endpoint controls. There needs to be a layered approach—robust endpoint security, continuous monitoring of cloud access patterns, and user awareness training that specifically addresses the risks of public Wi-Fi. High-risk users, such as executives and frequent travelers, should be prioritized for additional scrutiny and support. And it’s critical to have clear incident response playbooks for cloud account compromise, since attackers are increasingly targeting identity as the new perimeter.

Shifting to the vulnerability landscape, we’re seeing the impact of AI on both sides of the equation. A new AI-assisted tool, dubbed the HTTP Terminator, has uncovered novel HTTP desynchronization techniques and even a zero-day vulnerability in Apache web servers. These kinds of vulnerabilities allow attackers to manipulate web traffic in ways that can lead to data breaches or disrupt services.

The key takeaway here is that attackers are now leveraging AI to automate and scale their search for weaknesses. This accelerates the arms race between defenders and adversaries. Security teams can’t afford to rely on periodic vulnerability scans and manual patch cycles. Instead, they need to prioritize rapid patching, tune web application firewalls to detect anomalous HTTP traffic, and invest in monitoring that can spot the subtle signs of desynchronization attacks.

This is a wake-up call for organizations that haven’t yet integrated AI-driven tools into their own vulnerability management programs. The same technologies that attackers are using to find flaws can—and should—be used defensively to identify and remediate risks before they’re exploited.

In parallel, we’re seeing a significant ransomware threat tied to a vulnerability in WinRAR, the ubiquitous file archiver used across enterprise environments. CISA has issued an alert about active exploitation of this flaw, with attackers using malicious archive files to gain initial access and deploy ransomware payloads.

Given how widespread WinRAR is, especially in organizations that handle large volumes of compressed files, this vulnerability represents a high-impact risk. The immediate action here is straightforward: patch all instances of WinRAR as soon as possible, and reinforce user education around the dangers of opening unexpected or suspicious attachments. This is a classic example of how a seemingly innocuous tool can become a vector for major attacks if it’s not properly managed.

Let’s turn to the regulatory front, where momentum is accelerating globally. At the FutureCrime Summit, experts addressed compliance with India’s Digital Personal Data Protection Act—better known as the DPDP Act—and the growing imperative for responsible AI. The panel’s message was clear: organizations must align their AI deployments with privacy regulations and ethical standards, or risk enforcement actions.

This isn’t just an Indian issue. We’re seeing a broader trend of national regulators asserting authority over AI, with new guidance emerging from Kenya’s Office of the Data Protection Commissioner. Kenya’s draft guidance on AI emphasizes transparency, accountability, and data protection. It calls for risk assessments, human oversight, and clear documentation of AI decision-making processes.

For multinational organizations, this means compliance programs can no longer be one-size-fits-all. There’s a need to harmonize AI governance across jurisdictions, adapting to local expectations while maintaining a consistent global standard. This is a complex challenge, especially as regulatory frameworks continue to evolve and diverge.

In the UK, recent failures in AI containment have prompted a re-examination of governance frameworks. The message from experts is that approval processes alone are not sufficient controls. Instead, organizations need continuous risk monitoring, robust technical controls, and clear lines of accountability. As autonomous systems proliferate, static governance approaches are quickly becoming obsolete.

This leads to a broader point that’s gaining traction among thought leaders: responsible AI requires board-level oversight, human accountability, and risk-based governance. It’s no longer enough for AI risk to be managed in isolation by technical teams. The lack of board engagement and clear accountability structures is increasingly seen as a material risk—both from a regulatory perspective and in terms of reputational impact.

CISOs and risk executives should be proactive in engaging with boards and executive teams to ensure that AI risk is integrated into enterprise governance. This includes establishing clear policies for AI lifecycle management, embedding risk-based controls, and ensuring that human oversight is maintained throughout the AI development and deployment process.

The recent Hugging Face incident has brought the complexity of AI security into sharp relief. The debate sparked by this incident highlights a common pitfall: focusing too narrowly on technical containment of AI models, while overlooking broader risks such as supply chain vulnerabilities, data poisoning, and the integrity of open-source components.

What this incident makes clear is that AI security programs need to expand their scope. It’s not just about securing the model itself, but also about monitoring the entire ecosystem—third-party libraries, data sources, and dependencies. Supply chain risk in the AI context is real, and it requires the same level of attention as traditional software supply chain security.

As organizations begin deploying autonomous AI agents, another layer of complexity emerges: securing the identity and access of these non-human actors. New research is highlighting the risks of agent impersonation, privilege escalation, and unauthorized actions by AI-driven systems.

Securing autonomous systems requires strong authentication and authorization controls—not just for human users, but for the AI agents themselves. Monitoring must extend to both human and non-human identities, with clear audit trails and the ability to quickly revoke access if suspicious activity is detected. This is an area where many organizations are just beginning to develop best practices, but it’s quickly becoming a priority as autonomous agents move from pilot projects to production environments.

At Black Hat USA 2026, the industry’s response to these evolving risks was on full display. Vendor announcements focused heavily on identity, cloud, and supply chain security, with an emphasis on automated threat detection, zero trust architectures, and enhanced visibility into third-party risk.

These innovations reflect the reality that attack surfaces are growing more complex, and that integrated, scalable security solutions are needed to keep pace. Automated threat detection and response are no longer optional; they’re essential for organizations that want to stay ahead of sophisticated adversaries.

On the policy side, federal agencies are being urged to design AI governance frameworks that can adapt to rapid technological change. Static policies are seen as inadequate in the face of fast-moving AI adoption and emerging risks. Instead, the recommendation is for continuous risk assessment, agile controls, and cross-functional collaboration.

This approach is relevant not just for government, but for any large organization navigating the challenges of AI integration. The pace of innovation means that governance frameworks must be flexible, with mechanisms for ongoing review and adaptation.

Another challenge that’s coming into focus is the issue of AI export controls. Governments are discovering that AI technology doesn’t respect borders—models and data can be transferred digitally, making enforcement of export restrictions a significant challenge. For multinational organizations, this creates compliance headaches and underscores the need for close collaboration between CISOs, legal, and compliance teams.

Tracking AI assets, understanding where models and data reside, and ensuring adherence to evolving export controls is now a critical part of enterprise risk management. This is an area where clear policies and robust asset management are essential.

Stepping back, there are a few strategic implications that cut across all of these developments.

First, cloud identity and remote access remain high-value targets. Session hijacking and token thef