For too many years, the security industry has focused on protecting infrastructure. Organizations have long believed they should “Secure the network. Verify identity. Control access.”

That approach made sense when applications, users, and data lived within predictable environments. Today, they do not.

Data moves constantly across hybrid cloud environments, SaaS platforms, AI pipelines, partner ecosystems, and edge infrastructure. It travels through systems organizations do not fully own or control. Yet many security strategies still assume that if the infrastructure is protected, the data will be too. That assumption is becoming increasingly difficult to defend.

Quantum risk is exposing a weakness the industry has largely ignored for years: that security architectures were designed around infrastructure, not around the data attackers want access to.

For channel partners, this creates both a challenge and an opportunity.

The industry is solving the wrong problem

Much of the conversation around post-quantum cryptography focuses on upgrading algorithms. The assumption is that organizations simply need to replace existing encryption with new quantum-resistant alternatives and the problem will be solved. The reality is far more complicated.

Quantum is not simply a cryptographic upgrade cycle. It exposes structural problems in how security has been implemented over the decades. Cryptography is embedded throughout applications, networks, cloud environments, devices, and third-party systems. In many organizations, nobody has a complete inventory of where it exists.

Replacing encryption across these environments is not a straightforward technology refresh. It is a major operational challenge.

This is where the distinction between transition and transformation becomes important.

A transition replaces algorithms within existing architectures. A transformation rethinks where protection is applied and how it is managed.

Many organizations are planning for transition. The organizations making meaningful progress are embracing transformation.

Why traditional security models are struggling

Attackers have changed their approach. They no longer need to bypass sophisticated security controls through brute force attacks. Instead, they exploit legitimate credentials, trusted connections, and approved applications. They log in, move laterally through trusted systems, and target the data directly.

This is why so many organizations continue to suffer damaging breaches despite significant investments in cybersecurity.

The problem is often not that security controls failed. The problem is that once attackers gained access, the data remained accessible and usable.

In highly distributed environments, infrastructure can no longer be treated as the ultimate control point. Organizations cannot fully control every cloud environment, partner network, SaaS platform, or edge location their data will pass through.

What they can control is whether that data remains usable if it is intercepted, stolen, or exposed.

That shift in thinking is becoming increasingly important as organizations prepare for quantum threats.

The quantum threat is already here

One of the biggest misconceptions about quantum computing is that organizations have time to wait. The reality is attackers are already harvesting encrypted data today with the expectation it can be decrypted in the future. This "harvest now, decrypt later" model changes the risk calculation entirely.

For organizations holding sensitive information with a long lifespan, including healthcare records, financial data, intellectual property, government information, and critical infrastructure data, the threat is immediate rather than theoretical.

The question is no longer when a cryptographically relevant quantum computer will arrive. The question is whether data being collected today will still need protection when it does. Many organizations understand this challenge. The difficulty lies in execution.

Legacy systems remain deeply embedded across enterprise environments. Multi-cloud architectures create complexity. AI initiatives introduce new data flows. Edge environments continue to expand the attack surface.

Most organizations simply cannot undertake years-long modernization projects every time cryptographic standards evolve.

Why data-centric security matters

Many security leaders are beginning to rethink where protection should reside. Rather than tying security to infrastructure, a data-centric approach applies protection directly to the data itself. Security travels with the information regardless of where it moves, who processes it, or which infrastructure carries it. This creates a fundamentally different security outcome.

If an attacker gains access to a system, the data remains protected. If information moves between cloud providers, protection remains intact. If applications are migrated, consolidated, or modernized, security policies remain consistent.

Most importantly, organizations gain the flexibility to adapt cryptography over time without constantly redesigning applications or rebuilding infrastructure.

That is the essence of crypto agility.

The ability to evolve cryptographic protections as standards change is becoming a strategic requirement rather than a technical preference.

Organizations that lack crypto agility may find themselves trapped in expensive, disruptive migration cycles every time the threat landscape evolves.

What this means for channel partners

For managed service providers (MSPs), resellers, and systems integrators (SIs), this shift presents a very interesting opportunity. Customers are increasingly looking beyond individual security products. They are focused on outcomes.

They want to know whether sensitive data remains protected if a breach occurs. They want confidence that security investments will remain effective as regulations, technologies, and threats evolve.

The conversation is moving away from how many security tools an organization has deployed and toward whether those tools actually reduce risk.

That creates an opening for channel partners to elevate discussions beyond infrastructure and into broader business resilience.

Organizations need practical strategies for dealing with quantum risk, legacy systems, cloud complexity, and data sovereignty requirements. They need solutions that work within existing environments rather than requiring wholesale replacement of applications and infrastructure.

Partners who can help customers navigate that transformation will be well positioned to differentiate themselves in an increasingly crowded market.

A new security conversation

Quantum computing's biggest impact might not be the technology itself. It might be what it forces organisations to confront: that a lot of long-held assumptions about security no longer hold.

The industry spent decades focused on protecting systems, networks, and identities. Those controls still matter, but they're not enough on their own anymore.

As data spreads across more environments and threats grow more sophisticated, the thing that actually needs protecting is the thing attackers are after in the first place. The data itself.

For channel partners and enterprise leaders, this shift is already playing out in customer conversations. Fewer people are asking how many security tools a business runs. More are asking what happens if something gets through: is the data still usable, or not?

That question is quickly becoming the one that defines security in the quantum era.

Water systems in at least a dozen US states have been affected by a series of cyber incidents. Security experts warn this could be the first of a pending wave of attacks on critical infrastructure.

So far, Minnesota appears to have been hardest-hit, with more than 30 community water systems impacted. The attacks have resulted in drops in water pressure and advice to boil water, although no contamination has been detected.

The attacks target internet-exposed programmable logic controllers (PLCs) - Rockwell Automation/Allen-Bradley’s MicroLogix 1100 and 1400 series.

The attackers remotely tamper with device configurations by changing IP addresses and turning on and setting passwords, leaving the water firms unable to view connected equipment, and in some cases shutting it down.

"These threat actors are targeting water entities of all sizes. Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans," the US Cybersecurity and Infrastructure Security Agency (CISA) warned.

"OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage."

The attacks have been widely attributed to Iran. However, Martin Riley, chief technology officer at Bridewell, said attribution is the “least interesting part of this story”.

"Whether the activity traces back to Iranian-aligned actors, a hacktivist crew reusing a commodity scanner, or an opportunist, the precondition is identical. A Rockwell Automation/Allen-Bradley MicroLogix 1100 or 1400 sat on a public IP address with its management interface exposed, and in many cases credentials that were never changed from the shipped default."

According to the National Association of Water Companies (NAWC), while more than 90% of its members have comprehensive cybersecurity plans in place, many are missing even basic protections.

They lack continuous OT monitoring, centralized logging, accurate asset inventories, and dedicated cyber staff.

This means that unauthorized access, credential testing, configuration changes, and reconnaissance could fly under the radar unless they produce visible disruption.

Fresh critical infrastructure attacks could come

There are fears that the same techniques could be used against other critical infrastructure.

CISA is advising not only water firms, but all critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology from the internet as soon as possible.

Kevin Kirkwood, CISO at Exabeam, said that weaknesses exploited in water systems "are not unique to water" and pose risks across a range of other industries.

"Exposed controllers, default credentials, insecure remote access, aging equipment, weak IT-OT segmentation, and understaffed operations also exist across electric utilities, pipelines, manufacturing, transportation, and building-control systems," he commented.

"The most troubling possibility is that these water-system attacks are not the end state, but a test case. They allow adversaries to map networks, identify vendors, measure response times, study manual operating procedures, and determine how quickly federal and state authorities react. Water may be the proving ground. Power and other OT-heavy sectors may be the intended scale.”

FOLLOW US ON SOCIAL MEDIA

AI models from OpenAI and Anthropic attempted to dupe developers into running malicious code and even set up fake profiles to trick workers in a series of attempted cyber attacks.

That’s according to new research from the UK’s AI Security Institute (AISI), which highlighted a number of concerning incidents during evaluation of the duo’s frontier models: Mythos 5 and GPT-5.6 Sol.

Across a series of tests, agents participated in capture-the-flag-style challenges to test offensive cyber capabilities. In 10 test runs, the institute said both models took “autonomous, unsanctioned action” against people and organizations.

“We catalogued 19 such actions,” the institute noted in a blog post. “Almost all of this behavior (17 actions) came from a single model, Anthropic’s Mythos 5, with 2 actions involving OpenAI’s GPT-5.6 Sol.”

In what the AISI described as the “most serious case”, one agent attempted to insert malicious code into an open source project.

During this incident, the agent employed social engineering techniques to achieve its goal, researchers noted, creating several fake online identities and pressuring maintainers to approve the code.

The AISI also observed collaboration between agents during the assessment, with one leaving public messages on GitHub offering to cooperate on the same challenge.

“It also provided instructions to reuse accounts and artefacts it had left behind, which were discovered and used by subsequent agents,” the institute noted.

The AISI said while an investigation has not produced any evidence of real-world harm, the actions raise concerns around “autonomy and deception” without specific prompting.

Rising rogue agent concerns

The report from the institute comes in the wake of news surrounding OpenAI and Anthropic models in recent weeks. In late July, OpenAI revealed that a cyber-focused AI system had escaped a sandbox test environment and breached a Hugging Face production environment.

That news was followed quickly by an admission from Anthropic detailing a similar security-related incident involving its models.

It’s worth noting that the incidents highlighted by the AISI do somewhat differ. The institute said it tests models under "deliberately permissive conditions” to evaluate capabilities.

Simply put, the typical safeguards around these models, which aren’t commercially available, were removed to establish their full potential.

“This was not a case of a model escaping its secure test environment, or ‘sandbox’,” the institute said in a blog post.

“We had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled - conditions that do not reflect how frontier models are made available to the public.”

Agent collaboration a cause for concern

Muhammad Yahya Patel, vCISO and cybersecurity advisory for EMEA at Huntress, said these incidents are hardly surprising considering the agents were given carte blanche during testing.

“If you give a frontier model a cybersecurity challenge, disable its safety classifiers, hand it open internet access, and tell it to find a way through, you’ve essentially described the setup for an offensive security operation,” he said.

These models have been trained on “vast amounts” of security research, exploit documentation, and social engineering techniques, Patel noted. They have all the information required to replicate these techniques and conduct attacks.

Patel added that reactionary commentary on these incidents is adding further fuel to the fire on AI safety, but acknowledged the AISI’s findings around collaboration are a cause for concern.

“One of the findings to take more seriously is the AI model inter-agent coordination without being instructed to, that’s a more meaningful data point about where capability development is heading,” he said.

“AI agents demonstrating unprompted forward planning and situational awareness leaving breadcrumbs for agents it had no way of knowing existed.”

Cyber criminals have developed an underground gray market selling discounted or free access to AI tools and frontier AI models like Claude and ChatGPT.

According to Okta Threat Intelligence, they're taking advantage of promo offers such as free sign-up bonuses or startup credits provided by the real developers, and reselling access at a fraction of the official per-token price.

Offerings can be for subscription-based accounts, a certain number of tokens, or a certain number of requests; and with these packages, the allotted number of requests can use an unlimited number of tokens.

While some buyers are just looking for a bargain, many are based in China, where the likes of Anthropic and OpenAI are banned.

The Chinese-language offerings, which appear on messaging platforms such as Taobao and Telegram, underground forums, and indexed in GitHub repos, are bigger in number and scale than the English-language offerings.

"Based on our data, we can say it is highly probable that China-based users are circumventing regional restrictions," said Okta Threat Intelligence directors Jeremy Kirk and Matthew Woodyard.

"Some of the top VPN providers, like QuickQ VPN, are commonly used by Chinese internet users, and the top email domain was qq.com, which is a popular email service in China."

Hackers flocking to ‘Poison Claude’

One site identified by the team was Poison Claude, which takes advantage of free bonus credits, such as the $100 bonus credit on AWS for Bedrock accounts. It offers Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6.

“We add those accounts to our pool, your request is routed to a specific account under the hood (you don’t see this) and you get charged 5-15% of the official per-token price depending on the model,” the site explains.

Poison Claude accepts payment in cryptocurrencies including USD Tether, USD Coin, ethereum, litecoin, and bitcoin.

Customers are given an API key for an Anthropic-compatible API, and then instructed to set these environment variables so that their installation of Claude Code uses the Poison Claude API rather than the legitimate one.

Unlimited tokens

Ecomagent.in, meanwhile, offers unlimited tokens via its own endpoint for Opus 4.8, Opus 4.6, Sonnet 4.6, and GPT Codex 5.5 subscriptions at below market price through a custom API endpoint.

When services are configured as a gateway proxy, the service provider has full visibility into prompts, as those prompts must be forwarded to a model. This gives the gray market service providers a secondary revenue stream in the form of prompts for model distillation - and also raises privacy concerns.

Legitimate AI model service providers are trying to counter fraudulent registration. Anthropic, for example, is now using Persona’s ID verification system to verify some new accounts, requiring a government-issued ID and a live selfie.

Okta said it has notified Cloudflare, Anthropic, AWS, and Google Cloud about the infrastructure and abuse patterns it uncovered.

FOLLOW US ON SOCIAL MEDIA

Security experts have issued an alert over a new infostealer malware campaign targeting npm packages.

Dubbed ‘Chaindrop’, the malware is a strain of the notorious Shai-Hulud infostealer used in repeated campaigns against software repositories.

According to researchers at security firm Aikido, the campaign kicked off when attackers compromised a GitHub account belonging to a maintainer at key-value storage library, keyv.

Notably, the same maintainer owns several highly-popular repositories, enabling hackers to inject the infostealer worm across the “entire package family” – which stands at roughly 127 million weekly npm downloads.

All told, Aikido warned that some 444 packages (across 1,381 versions) have been compromised so far. Combined, these boast a total of more than two billion monthly downloads.

Packages affected include:

• keyv
• flat-cache 6.1.24
• file-entry-cache 11.1.6
• cacheable-request 13.0.20
• cacheable 2.5.1
• @cacheable/memory 2.2.1
• cache-manager 7.2.10
• @cacheable/node-cache 3.1.2
• @cacheable/utils 2.5.1
• @cacheable/net 2.1.1
• ecto 5.0.1

How Chaindrop works

According to Aikido, the infostealer harvests credentials from victim environments, encrypts findings, and exfiltrates them to a public GitHub repository. The description on said repository reads: “Shai-Hulud: Here We Go Again”.

“Once credentials are harvested, the payload encrypts the entire bundle before sending it anywhere,” researchers explained.

“Only the attacker, who holds the corresponding RSA private key, can decrypt what gets uploaded. This means the stolen data sits in plain sight on public infrastructure but is unreadable to anyone else.”

Crucially, the payload contains “worm-like propagation” capabilities to infect packages of other maintainers that have installed a compromised package, making it extremely dangerous.

“Using the stolen npm token, the payload calls https://registry.npmjs[.]org/-/npm/v1/tokens to list every package that token has publish rights to, then fetches and unpacks the current tarball for each one,” Aikido noted.

A host of credentials and tokens are at risk, Aikido noted, including:

• Npm tokens
• GitHub tokens
• AWS credentials
• Kubernetes secrets
• HashiCorp Vault tokens
• Stripe and Slack tokens

Shai-Hulud still haunting developers

The Chaindrop campaign marks the latest in a string of attacks using variants of the Shai-Hulud malware. In May this year, the threat group behind the worm, TeamPCP, published its source code in a GitHub repository.

Research from Datadog Security Labs found that while this was quickly taken down, multiple copies are believed to have been made.

Analysis of the source code uncovered a “complete, production-grade offensive framework that accounts for nearly every TTP previously attributed to TeamPCP,” researchers noted.

In the months since, repeated warnings have been issued about new, improved variants of Shai-Hulud. As ITPro reported last month, a new variant dubbed ‘Miasma’, was identified and being used to target developers.

FOLLOW US ON SOCIAL MEDIA

TL;DR

• Cyber resilience is now a board-level priority for enterprises globally
• Choosing best-in-class solutions can make or break enterprise cyber resilience capabilities
• PowerProtect One underpins cyber resilience by unifying management, orchestration, and secure, efficient protection storage into one cohesive experience

Cyber resilience is more than just a flash-in-the-pan trend in 2026, it's a board-level imperative for organizations operating in an increasingly perilous threat landscape.

Recent analysis from Gartner, for example, highlighted resilience as one of the top trends CISOs need to focus on in 2026 – and for good reason.

Growing ransomware threats combined with the enterprise shift toward AI and its associated risks mean that IT leaders now place a huge emphasis on preventative, rather than reactive, cybersecurity capabilities.

"The remit expands with enterprise AI and resilience expectations," the consultancy noted. "CISOs should lead through influence, not unchecked task ownership, center on cyber resilience, reset board expectations, and coordinate with the CIO, CRO and CDAO to scale sustainably."

Running parallel to these areas are growing regulatory considerations for enterprises, according to Gartner. The consultancy urged cybersecurity leaders to "recalibrate their strategies" with regard to cyber resilience in order to meet compliance requirements.

"Rapid incident reporting requirements (sometimes within 24 hours) and heightened data sovereignty pressures demand robust, automated processes and strategic vendor decisions," Gartner noted.

Efforts to bolster cyber resilience are gathering momentum, according to research from Dell. Analysis by the company in January 2026 found the vast majority (99%) of enterprises now have some form of strategy in place.

Yet despite this sharpened focus on cyber resilience, the study found that nearly two-thirds (63%) of IT leaders overestimate their organization's readiness and resilience capabilities. This trend of 'resilience debt', as Dell describes it, puts organizations at huge risk and could leave them ill-prepared in the event of a data breach or security incident.

With this in mind, it's critical that organizations opt for solutions that provide robust, comprehensive cyber resilience and recovery capabilities. After all, this could make the difference between disaster and recovery in the event of a security incident.

Dell PowerProtect One, for example, ranks among the leading industry solutions on this front, enabling organizations to unify cyber resilience environments and keep mission-critical data safe and secure.

Here's how Dell PowerProtect One can help support your cyber resilience strategy.

Unified Cyber Resilience with Dell PowerProtect One

Dell PowerProtect One aims to unify cyber resilience capabilities for organizations. PowerProtect One provides a consolidated cyber resilience architecture—meaning streamlined management, orchestration, and secure, efficient protection storage through a single interface.

Two established Dell solutions form the core of PowerProtect One: Dell PowerProtect Data Domain and Dell PowerProtect Data Manager. These provide the storage and software capabilities required to bolster cyber resilience – spanning areas such as data protection, backup, and recovery.

Dell unveiled PowerProtect One at the company's annual Dell Technologies World Conference in May 2026 and it comes equipped with a range of intuitive new features aimed at simplifying cyber resilience.

Among these is a new unified dashboard designed specifically for security and IT practitioners. This enables enterprises to establish a comprehensive, centralized overview of their IT environments through a single source of truth.

According to official Dell materials, the dashboard "consolidates key signals" including:

• Job health,
• System status
• Capacity trends
• Risk posture

By consolidating these signals, IT and security practitioners no longer have to "jump between separate consoles" and contend with disparate, fragmented solutions that create blind spots.

Early testing of the platform with enterprise customers found those using PowerProtect One reduced management overhead by up to 50%*, which Dell noted showcases the efficiency-related benefits of a single-platform solution.

"By aggregating monitoring data across distributed environments, it reduces operational overhead, speeds troubleshooting, and helps you spot trends and issues faster for better decisions," according to Dell.

"The Unified Dashboard is designed for scalable, enterprise-wide management."

Intelligent resilience capabilities

Intuitive analytics features included with PowerProtect One aim to further streamline operations for IT and security teams.

The platform's Anomaly Detection feature, for example, is a key tool used to provide "comprehensive monitoring" of IT environments. This machine learning-powered tool monitors metadata, conducts analysis of system configurations and behavioral patterns.

In the event of suspicious file activity, users are alerted, enabling them to react quickly to potential security risks.

Notably, the Anomaly Detection feature uses a dedicated landing page that "centralizes investigation with policy-level exclusions and actionable workflows for verification and false positive reporting".

This, the company noted, allows teams to ensure backup data remains safe, secure, and recoverable while "maintaining operational consistency".

Built-in AI Assistant

PowerProtect One's in-product, AI-powered assistant helps you work faster and resolves issues with greater confidence. It provides guidance for errors and alerts, highlights likely root causes, and recommends next steps, helping teams address problems faster while reducing reliance on support. It doesn't just provide answers, it guides users to the appropriate pages and workflows within the interface.

The AI Assistant helps teams set up protection correctly from the outset and improve day-to-day operational efficiency – all without leaving the PowerProtect One experience.

Supercharging recovery

In the event that your organization suffers a data breach or security incident, PowerProtect One offers the tools to help get operations back up and running swiftly.

This is critical given the cost of downtime in the way of outages or cyber attacks has grown significantly in recent years. Analysis from Splunk, for example, shows the cost of downtime reached $600 billion in 2026, marking a 50% increase in the space of two years.

For context, that equates to around $900,000 per hour on average for organizations due to a combination of lost revenue and regulatory fines.

Cyber criminals are also actively targeting backups to inflict maximum damage on victims. Research from Dell shows that 57% of organizations were unable to contain or recover data during their last test or incident, meaning that best-in-class backup and recovery solutions are critical.

PowerProtect One offers a range of features aimed at ensuring backup data remains secure, including data immutability and data encryption.

According to Dell, PowerProtect One provides users with accelerated recovery, allowing them to restore affected files and applications within a matter of minutes, not hours.

If you think PowerProtect One is the right solution for your business, find out more on the Dell website.

*Based on Dell internal analysis, October 2025.

Microsoft has dished out its biggest collection of bug bounties ever over the last year, awarding more than $20 million to 562 security researchers.

Microsoft Security Response Center (MSRC) said the figure was well up on the $17 million distributed the year before to 344 researchers from 59 countries – itself a Microsoft Bounty Program record.

Part of the reason for the increase is the company's new 'In Scope By Default' policy.

Last year, it expanded its vulnerability awards portfolio to recognize 'impactful' research that fell outside the scope of traditional bounty programs, including eligible open source software, third-party components, and Microsoft cloud services.

Since then, the tech giant said it's received more than 300 additional reports and awarded more than $800,000 for vulnerabilities that wouldn't previously have qualified for bounty awards.

The firm noted it also saw a notable increase in submission volume during the second half of the year.

"Security is a team sport. Every vulnerability reported through our bounty programs represents an opportunity to address risk before it can be exploited against customers," said the MSRC team.

"The work of the research community plays a critical role in helping Microsoft stay ahead of emerging threats while strengthening the security of cloud services, AI systems, enterprise platforms, and consumer technologies."

Microsoft Zero Day Quest

The figures include findings from this year's Microsoft Zero Day Quest, which saw security researchers from 20 countries meeting at Microsoft’s Redmond campus to collaborate directly with security and engineering teams.

This research challenge and live hacking event was focused on high-priority security scenarios across Microsoft’s cloud and AI platforms. That saw nearly 700 vulnerability reports submitted, with researchers collecting $2.3 million in awards.

Individual awards depend on the type of vulnerability reported, with cloud programs and Zero Day Quest vulnerabilities capped at $100,000 per vulnerability. Endpoint and on-premises program vulnerabilities, meanwhile, can earn bug-hunters up to $250,000.

"This year’s record-breaking results, including more than $20 million in awards and recognition for 562 researchers, reflect the impact of a strong partnership between Microsoft and the global security research community," said the team.

"Whether participating through a traditional bounty submission, collaborating through coordinated vulnerability disclosure, or joining initiatives such as Zero Day Quest, researchers continue to play a vital role in protecting customers around the world."

Bug bounty programs are booming

Bug bounty programs have long been a means for enterprises to weed out vulnerabilities that have flown under the radar, either during development or in the wake of updates.

With AI now in the mix, researchers are accelerating vulnerability hunting, identifying more flaws than ever. Some programs are struggling to keep up with the volume of reports, however.

Moreover, AI-generated reports are proving troublesome for organizations, particularly in the open source community.

As ITPro reported last year, security report triage worker Seth Larson revealed he’d observed a marked uptick in “extremely low-quality, spammy, and LLM-hallucinated security reports”.

Earlier this year, Daniel Stenberg, lead maintainer of command line interface (CLI) tool Curl, went so far as to shut down the firm's bug bounty scheme after receiving dozens of reports that didn't actually show a concrete vulnerability.

FOLLOW US ON SOCIAL MEDIA

Given a prompt, an AI model will do anything to achieve its aims – even hack into a company without specifically being instructed to do so. In July, firms pushing AI as a solve-all technology learnt that lesson the hard way, when OpenAI admitted two of its frontier models had breached Hugging Face after escaping a misconfigured sandbox during a benchmark test.

But the story didn’t end there. Days later, OpenAI’s competitor Anthropic claimed its AI agents had also hacked companies when they were mistakenly given internet access by engineers.

On the surface, it’s a tale of AI that’s so powerful at solving security issues, it can’t be contained. Yet underneath this marketing-driven exterior, it’s about a lack of control and failure to put guardrails in place when dealing with the fast-developing technology.

Taking this into account, how do IT leaders need to change the way they think about AI within the business?

From theory into reality

Until recently, the idea of an AI agent breaking containment and hacking other systems was largely theoretical. In May 2026, Palisade Research released a paper claiming that AI agents could autonomously hack and then self-replicate onto the breached systems.

However, the test was only performed at the “junior capture the flag level” and, crucially, “happened in a contained environment”, says Jeff Watkins, chief AI officer at consultancy NorthStar Intelligence. “The most important takeaway for me was that the trajectory of language models’ ability to hack showed we probably didn’t have long left before this became a serious issue.”

But while the OpenAI-Hugging Face breach is the first documented and well-publicized instance of this happening, experts do not see it as unprecedented.

Daniel Card, cybersecurity consultant at Xservus Limited, describes how often things can go wrong in testing. In fact, some reports suggest OpenAI had already been experiencing the issues – such as agents breaking out of sandboxes – that led to the hack of Hugging Face and others.

“Anyone who has experience doing offensive security – let alone offensive with AI – will know the risks involved here, be that from a script or via a large language model (LLM),” Card tells ITPro.

“It’s commonly known in pen testing circles that things sometimes do not go as expected,” he points out. “Anyone doing research with an LLM has probably had something go a bit funny when they didn’t mean it to. This is not new; it's not something we couldn’t have predicted.”

OpenAI calls the Hugging Face breach “an unprecedented incident”, and “an important moment for AI safety”.

OpenAI describes how the firm is conducting a “thorough review along with external advisors” and with oversight from its Safety and Security Committee. “Once the review is complete, we will publish a technical report of our learnings for everyone,” an OpenAI spokesperson says.

Anthropic points out that the agents in each of its evaluations ran without the standard safeguards it deploys when it makes the model generally available.

Claude did not exploit a novel vulnerability to escape isolation, because the models accessed the internet via an open path, rather than breaking out of a sandbox, according to Anthropic. At the same time, the most recent model, on realizing that it was working in a real environment, stopped its pursuit of the evaluation goal, according to the firm.

Issues with technology deployment

But the OpenAI incident and Anthropic’s following admission do raise questions about how firms use AI and the controls they have in place to govern it. The issues the incident highlights are “less about AI” and “more just around how people and organizations approach technology deployment”, according to Card.

“Security comes from the details; it comes from care,” says Card. He thinks the incident shows “more care needs to go into systems” – even more so when they are autonomous. “We can't just set them off and hope they are ok. They need monitoring.”

At the same time, with AI being able to move quickly through networks at scale, it’s important to be aware that “failures can become serious very quickly”, says Watkins.

He thinks things are moving “far too quickly for comfort in the capabilities and autonomy of AI agents, and our defenses likely aren’t keeping up”.

“Ironically, the advancements that make AI more commercially valuable also increase the potential for things to go wrong, or for misuse to be highly damaging,” points out Watkins.

Dana Simberkoff, chief risk, privacy and information security officer at AvePoint, thinks the OpenAI and Anthropic incidents “really expose the limits of treating containment as a one-time design decision”.

“Sandboxes matter, but autonomous systems can reason through small openings, use tools, and keep acting toward an objective,” says Simberkoff. “In my experience, the question cannot be, ‘was it sandboxed?’ It has to be, ‘can we prove what it accessed, whether it crossed a boundary, and how quickly we can stop it?’”

AI security now goes beyond simply protecting data, points out Tristan Shortland, CTO at Infinity. “Organizations also need to think about behaviour, permissions and autonomy, given the reported attack appears to have involved a model finding weaknesses in its environment and exploiting them to achieve an objective.”

Risks internally and externally

With all this in mind, IT leaders need to change their own mindset, as well as educate senior management about the issues posed by AI. CISOs must take the conversation to the business around how the organization is planning to “not just deploy, but manage, monitor and secure their AI capabilities”, says Card. “They need to talk about the risks they face internally and externally – or in this case, both.”

Card advises a mentality of “assume breach, assume adversarial intent, and deploy defence in depth”.

Do not assume your systems will work as expected, he advises. “Go and test those assumptions and red team them.”

Watkins believes AI agents should be modelled as “privileged digital workers, capable of becoming insider threats if poorly contained”.

“We need to start thinking of our AI agents in the context of what permissions they have to see or do things: Can they reach APIs, data, authorise transactions, contact third parties or modify systems?”

Equally important is understanding what those agents are doing in their deployed environments – something that many implementers have little visibility over, says Watkins.

“These are insider threats that need to be managed through good access controls, but also rate limiting, monitoring and alerting, better air-gapping of sandboxes, clear allow-lists for tools and access that [is] time-bound, rather than perpetual.”

While on the face of it, the OpenAI and Anthropic incidents might seem scary, simple changes will make a difference, experts say.

The most urgent initial step is to discover where you are using LLMs and put in place policies for AI usage and monitoring, says Card. “It's a really wide subject, but if you treat these systems as if they may do harm, it's a good starting point.”

In this year’s Verizon Data Breach Investigations Report, exploiting vulnerabilities is the most common route that leads to data breaches, at 31 percent of the 22,000 confirmed attacks.

Looking at the most serious software issues that are Known Exploited Vulnerabilities tracked by the Cybersecurity Infrastructure and Security Agency, patching those critical vulnerabilities is down from last year as well. Only 26 percent of CISA KEV issues were fully remediated during 2025, compared to 38 percent in 2024.

Alongside this, Anthropic’s Mythos brings the prospect of even more vulnerabilities being discovered and exploits being created. While Mythos itself is still off-limits for the vast majority of companies, the advent of frontier AI will mean that security teams have more issues to deal with and less time to get their tasks done.

Customers will need help to understand the practical steps that they can take around security in the future. Cutting through the hype around AI and keeping things focused on real-world processes will go a long way.

The current picture for security

Traditionally, customers need security help around product selection, deployment practices and managing those activities over time. Managed Detection and Response (MDR) for endpoint security has been the bedrock of many partners’ approaches, followed by more specialist products and incident response where there are opportunities.

However, what the advent of AI shows us is that getting the basics around security and IT operations is still a challenge. Areas like IT asset management and maintaining an accurate inventory are still not solved, particularly as companies grow in size. While security programmes advocate for complete insight into what is on the network, the reality is that getting to even 90 percent accuracy is a significant challenge. This means that there is already a blind spot in security.

As AI gets adopted, many teams will want to improve their existing patching processes and speed up what they currently do. Automation around security and asset management can help in this regard, but the problem is that speeding up a process that does not cover everything already is not going to be enough. Repeating those same processes faster is not the full answer.

So how can channel companies help their customers in practical ways, and without making them feel despair at the situation? The answer here is to focus on practical responses that companies can take to fix these problems.

Patching is hard work

The first element here is that patching has always been hard work. Enterprises normally have different teams managing each element of the IT estate, so getting a consistent and fast process in place around patching or fixing misconfigurations was difficult before AI came in. Today, security teams have to do more than point out the problems; instead, they have to provide remediation guidance and ideally solve those issues in full.

With AI pointing out more problems, teams have to concentrate on potential business impact. In practice, this means understanding what issues exist in systems and what the risks involved are. What makes this different from previous attempts to manage cyber risk quantification is the level of detail involved. This ‘hyper-personalisation’ around specific software assets, systems deployment and exploitability should guide what vulnerabilities exist and what to fix.

The second element to this is how to automate patching. Traditionally, IT teams have been scared to implement automated patching due to experience with bad patches. In response, channel partners can take customers through how to structure automatic deployments using some lessons learned from software deployment at scale. For example, your customers can tier their assets into groups for deployments - the initial tier will be endpoints that get those patches first and are then checked for potential problems or configuration issues. If that tier of machines is deployed successfully, then the next tier of machines can be updated, and so on. This tiered approach can flag issues early.

Alongside deployment tiering, testing the patches themselves using AI can flag potential issues or where more human oversight for deployment is needed. Lastly, not all patches are created equal - your customers might want expert insight and expertise on hand when they have to patch their mission-critical applications that are responsible for revenue. However, a patch to Google Chrome can be automatically deployed at scale because it is less likely to be problematic.

For customers, these changes around patching can be big. They can involve working across departments and team boundaries, which can be problematic. For partners, just being an external provider can help internal teams talk to each other and solve problems. However, the bigger opportunity is around how to make changes at scale.

The sheer volume of patch updates and remediation work that is expected due to AI vulnerability discovery means that it won’t be possible to stick with the same manual processes. Helping your customers understand where they will have to make changes, and where they can take advantage of AI to improve their processes, is a market opportunity.

Getting ahead of issues before they get added to exploit lists like CISA KEV requires understanding the risks involved within customers, and every customer will have their own priorities and risk tolerance. The challenge is how to help them get the right process in place and ride the wave of AI-discovered vulnerabilities, rather than drowning in them.

On July 13, 2026, the Department of War suspended the Cybersecurity Maturity Model Certification (CMMC) Phase 2, the third-party assessment mandate that was set to take effect November 10.

Within days, managed service providers (MSPs) across the defense channel started fielding the same question from clients: does this mean CMMC is dead?

It doesn't. And the MSPs who answer that question wrong are about to hand their most defensible service line to competitors who read the suspension memo more carefully.

Reality check

Here's what actually happened. Department of War CIO Kirsten Davies suspended the requirement for defense contractors to pass a Certified Third-Party Assessor Organization (C3PAO) audit before winning Level 2 contract awards. She did not suspend Phase 1. Self-assessment, SPRS score submission, and annual affirmation obligations under DFARS 252.204-7012 remain fully enforced, and NIST SP 800-171 Revision 2 stays the standard the Department checks against through self-assessments and select government-led reviews.

The reasoning behind the decision was blunt. Davies told reporters “the math just simply doesn’t math” for the roughly 100,000 companies in the defense industrial base needing third-party assessment against the roughly 100 approved C3PAOs able to deliver it, with Small Business Administration data pointing to compliance costs approaching $7 billion a year for small and mid-sized contractors. A CMMC Reform Task Force review is due back to the Department CIO by mid-September, and officials have explicitly declined to rule out ending the third-party model altogether.

That's the pattern MSPs need to see clearly. The Department suspended a verification mechanism. It did not suspend the obligation that mechanism existed to verify.

Access controls

Here's where it gets uncomfortable for MSPs specifically. Self-assessment doesn't mean a client certifies in a vacuum. On most defense-adjacent accounts, the MSP is the party actually configuring the access controls, generating the audit logs, and often shaping the SPRS score the client submits to the government. When that score doesn't match reality, the False Claims Act attaches liability to whoever made the certification. Civil penalties currently run $14,308 to $28,619 per false claim, plus treble damages, regardless of whether a C3PAO ever shows up to check. The suspension removed the outside assessor who might have caught an inflated score before it became a submitted claim. It didn't remove the claim.

That's not theoretical. On June 18, 2026, the Department of Justice announced a $507,144 settlement with LOGZONE Inc., an Alabama defense contractor, over allegations it failed to implement NIST SP 800-171 controls required under two Department of the Navy contracts -- no C3PAO ever flagged the gap.

The case moved through DOJ's Civil Cyber-Fraud Initiative, which has settled fifteen cybersecurity-related False Claims Act cases since 2021, more than half of them in the past fiscal year alone. Many of these cases start with a whistleblower under the FCA's qui tam provisions, not a government audit, which means the C3PAO pause does nothing to shrink the pool of people who can bring one. The suspension changes who checks the box before awarding. It does nothing to the enforcement pipeline that starts after the box is checked wrong.

Reforming rather than removing

MSPs who read “Phase 2 suspended” as “stand down” are making the wrong bet twice. First, they're leaving a client's self-attestation exposure unmanaged during the exact window when nobody else is checking it.

Second, they're assuming the review ends in cancellation, when the Department has said only that it's reforming the model. Not abandoning the requirement to prove contractors protect controlled unclassified information. The 2021 transition from CMMC 1.0 to 2.0 set the precedent: the verification mechanism changed, and the underlying NIST 800-171 obligation never moved.

The MSPs who win this window aren't the ones still pitching “get certified before Phase 2 hits.” They're the ones using the pause to get the evidence layer right while the pressure is off. SPRS scores tied to real configuration data instead of a best guess, continuous monitoring instead of a point-in-time snapshot, and an audit trail that a future assessor can read without a client scrambling to reconstruct six months of change history. Build that once, on a platform that keeps every access log and configuration change in a single, unalterable record, and it holds up whether the Task Force brings back C3PAO assessments, swaps in a lighter validation model, or lands somewhere nobody has floated yet.

None of this requires exotic tooling. It requires the same discipline MSPs already apply to other compliance regimes. Version-controlled system security plans, POA&Ms with real remediation dates and supporting evidence, and SPRS scores a client's own configuration data that can reproduce on demand, not just defend on paper. Treating this as a documentation exercise misses the point. The documentation only holds up if it matches what the systems actually do.

That gap is wider than most MSPs assume. Kiteworks and Coalfire's State of CMMC 2.0 Preparedness in the DIB report found only 46% of surveyed defense industrial base organizations considered themselves ready for Level 2 certification. What’s more, just 44% had continuous monitoring in place across in-scope systems. Gaps that predate the suspension and that a pause in third-party audits does nothing to close.

The suspension bought the defense industrial base time. It didn't buy MSPs an excuse. The ones who spend the next two months building evidence architecture, instead of waiting on the Task Force report, will own the client relationship no matter what that report recommends.

Security experts have issued a warning over a critical vulnerability in a popular tool used by managed service providers (MSPs).

N-able disclosed a critical vulnerability in its N-central platform, a remote IT management service, which currently affects all versions spanning both on-prem and hosted deployments.

The flaw grants hackers unauthenticated ‘god mode’ access to the remote management software, according to researchers at Huntress.

This means a compromised server could be used to “run scripts, push tools, and open remote sessions across every downstream endpoint it manages”.

Notably, Huntress warned its analysis shows the flaw is now being actively exploited in the wild.

“We are now seeing threat actors targeting the flaw across multiple organizations, though we are not yet seeing evidence that this has become a broad, indiscriminate campaign across our partner base,” the company noted in a blog post.

Researchers noted that attacks involving the flaw typically include the “same partner of behavior”, with threat actors carrying out “high-level reconnaissance to target key servers” such as Domain Controllers.

Upon compromise, threat actors were found to have rapidly moved across hosts in impacted IT environments. As such, Huntress urged affected organizations to consider temporarily disabling the tool.

“Because this vulnerability bypasses normal authentication, if your N-central server is still broadly reachable from the internet or other untrusted networks, you should consider disabling N-central—up to and including taking the server offline.”

N-central hotfix is available

The vulnerability in question, tracked as CVE-2026-18577, was initially discovered after an incomplete fix for an earlier authentication bypass flaw (CVE-2026-18556).

N-able confirmed a hotfix is available for CVE-2026-18577. For hosted customers, mitigations were applied to all instances, according to the firm.

On-prem customers, meanwhile, are urged to download the hotfix and update immediately.

N-able also detailed a series of checks and actions customers can carry out upon updating, including:

• Upgrading N-central agents
• Reviewing systems for indicators of compromise (IOCs)
• Contacting the firm if evidence of compromise is discovered

“We strongly recommend staying vigilant and monitoring your environments closely in the meantime. Further updates will be shared as quickly as possible,” the company said in an advisory.

FOLLOW US ON SOCIAL MEDIA

AI-powered penetration testing tools are getting out of hand, according to new research, generating more findings than security teams can validate.

Nine-in-ten security practitioners surveyed by Pentest-Tools who have used AI to generate findings said the results needed significant manual validation.

Just over six-in-ten said this was the case with between 5% and 25% of findings, with 27% saying that more than a quarter of AI-generated findings needed validation.

Respondents reported fabricated exploits, duplicate findings, non-exploitable vulnerabilities, and even AI-generated CVEs that turned out not to exist, leaving teams to spend days manually validating the results.

"An AI tool spits out 300 findings. I spent two days triaging, and 250 were junk - duplicate vulns, potential SQLi that is not exploitable, or AI-made-up CVEs that do not exist," one respondent said. "I bought the tool to save time, but I did more manual work than before."

Only one-in-five respondents said they have a workflow in place allowing them to triage 500 or more AI-generated vulnerability candidates from a single engagement.

Another 39%, meanwhile, said handling that volume would strain their team, while 30% said it would be unmanageable.

Even legitimate results needed to be checked more carefully, respondents noted, because hallucinated exploits and fabricated vulnerabilities are eroding confidence in subsequent findings.

One security manager at a mid-market company said their biggest frustration with AI pen testing tools was "confidence that turns out to be just a big lie.”

Meanwhile, they consistently named business logic understanding above exploit chaining and creativity as AI's biggest limitation.

For instance, one respondent said that AI pen testing tools were fine when it came to identifying SQL injections, but struggled to understand business rules, such as a discount coupon that should only work once per customer.

They also described logic flaws: for example, adding a negative quantity to a cart resulted in free purchases, and changing a user ID in a URL exposed another user's data.

AI pen testing tools are growing in popularity

Despite notable concerns, more than nine-in-ten respondents said they were either already using AI-enabled systems or planning to do so within the next 12 months.

AI is proving a useful tool in vulnerability detection, with 74% of respondents using the technology in this domain. It’s also being used in other administrative-type tasks, such as report writing (69%), documentation and findings tracking (66.5%).

Notably, however, AI isn’t quite as popular where live judgement is required. Just over one-third (37%) use it for exploitation and attack path chaining, 35% for remediation validation and retesting, and a quarter for post-exploitation and lateral movement.

Expectations are also increasing, with 37.3% saying that internal stakeholders now expect more frequent penetration testing than they did 12 months ago because of growing awareness of AI-assisted attacks.

Almost half said they test AI systems only when a stakeholder specifically requests it.

“There have been significant advances in how AI is accelerating vulnerability discovery," said Adrian Furtuna, CEO and founder of Pentest-Tools. "The challenge now is making sure those findings are accurate enough to limit manual work, instead of creating more of it.”

FOLLOW US ON SOCIAL MEDIA

The Police National Legal Database (PNLD) has confirmed that data stolen in a cyber attack last week has been published on the dark web.

PNLD is an online criminal law database used by the 43 Home Office police forces of England and Wales, law enforcement, and wider criminal justice organizations.

It is not a crime recording system and does not hold confidential information relating to victims, witnesses, or offenders.

The organization said the attack was detected on Sunday 26 July, since then it's been working with specialist cybersecurity organizations and the National Crime Agency (NCA) to investigate what happened and take appropriate action.

"Information including the names, organisations and work email addresses of police officers, staff and other criminal justice professionals, government partners and customers has been compromised and published on the dark web," it said.

"There is no evidence to suggest that passwords or other security credentials have been compromised."

Because the PNLD hosts the Ask the Police site, some names and email addresses of people who have in the past submitted a question have been published on the dark web.

PNLD said it had contacted all affected organizations with further information and guidance, and that the Information Commissioner’s Office (ICO) has also been notified.

"Compromised police data is a very serious breach and should be the final push needed to improve security and stop this from happening yet again," commented Jake Moore, global cybersecurity advisor at ESET.

"Government agencies have long been a soft target and continue to remain caught up in data breaches where sensitive information ends up being released. Even simple information like email addresses and location can put police staff at high risk of targeted phishing attacks that will be almost impossible to detect."

Who is behind the PNLD cyber attack?

The attackers, ExfilSquad, listed PNLD on their leak site on 26 July. It's the same group behind the recent breach of the Department for Education (DfE).

Threat actors accessed more than 600,000 records including the names, job titles, and phone numbers of thousands of head teachers, university staff, and government officials via the DfE’s Help Desk Self-Service Portal and the Turing Scheme Portal.

"ExfilSquad looks financially motivated rather than state-backed and is unlikely to see a payout given government's strict no-ransom policy," said Graham Taylor, director, defence strategy, for Northern Europe at OPSWAT.

"The uncomfortable truth is that much of the UK's public sector, with significant legacy systems and fragmented oversight, is years behind the resourcing and resilience needed to combat current and future cyber threats."

Departments need to implement secure file transfer technologies, alongside file inspection and malware scanning, to stop malicious payloads entering critical systems via trusted data exchanges, he said.

FOLLOW US ON SOCIAL MEDIA

More than one-in-five (22%) of UK firms have experienced an AI-related security breach in the last year, according to new research from IBM.

Findings from the firm’s 2026 Cost of a Data Breach report found AI-driven cyber attacks surged 56% across that period, prompting calls for enterprises to sharpen defenses.

The IBM study noted that the costs associated with AI-related breaches are “fundamentally changing the economics of cyber risk”, with the financial impact now standing at an average of $6 million.

Cyber criminals are increasingly focusing their attention both on targeting AI systems, and leveraging the technology to wage more devastating attacks, according to IBM.

Around 20% of organisations reported a breach where threat actors specifically targeted AI models or applications. The most frequent targets were “weaknesses in surrounding systems” such as compromised APIs or plug-ins (27%) and cloud misconfigurations (27%).

Running parallel to these threats, threat actors are also weaponizing AI to accelerate operations.

Deepfake impersonation ranked as the most common type of AI-enabled attack, cited by 45% of respondents. Meanwhile, AI-enabled malware and phishing attacks are also growing in frequency and scale.

Mark Hughes, global managing partner for IBM’s Cybersecurity Services division, said the report highlights the dual threats now facing enterprises globally. AI is creating new risk surfaces for firms, and hackers are actively using the technology to target these weak spots.

“AI has dramatically lowered the barrier for cybercriminals. Attackers can now execute attacks in minutes rather than days with advanced frontier models,” he said.

“Organizations need to move faster from reactive security to a continuous autonomous defence if they want to keep up.”

Positive resilience gains

Despite painting a dire picture of the current threat landscape, IBM noted that organizations are making positive steps toward bolstering cyber resilience.

Nearly two-thirds (61%) of UK firms plan to increase cybersecurity investment in the wake of a breach, the study noted, with IT leaders sharpening their focus on areas like incident response, AI governance, and data protection.

This same investment focus is reflected in global figures, according to IBM. In follow-up research conducted by Ponemon Institute, 85% of organizations said they plan to increase security spending in direct response to frontier AI cyber capabilities.

That marks a significant shift compared to the year prior, in which just 64% of respondents planned to increase investment due to AI-related threats.

Breach costs are decreasing

Elsewhere, IBM found that breach costs for UK firms are also decreasing. The average cost this year stands at £3.13 million compared to £3.29 million in 2025.

The number of breaches has increased, however, albeit marginally. The firm recorded 29,870 across the last year compared to 29,000 in 2025.

Breach costs also vary on a sector-by-sector basis. Financial services, for example, recorded an average cost of £5.46 million while costs for energy firms stood at £4.03 million.

FOLLOW US ON SOCIAL MEDIA

Picture this: you wake up in a blank room with no real memory of who you are or how you got there. Somehow, though, you know what you’re supposed to do – get out and achieve an objective of some sort – but there’s no clear way to do it.

Then, you spot it.

In the corner of the room is a torn-off scrap of paper. It gives exact details of how to escape… and it’s written in your own handwriting.

If you listen to some of the rumors following a ChatGPT agent’s breach of containment and attack on Hugging Face, you’d be forgiven for thinking this is what happened with OpenAI’s generative AI software.

According to Reuters: “In one case, an agent left notes apparently for future versions of itself, according to three people familiar with the matter. The ‌notes, found in ⁠a part of OpenAI's infrastructure, laid out instructions for how agents could free themselves from OpenAI's internal constraints.”

This does all feel a little bit unnerving: an AI that has escaped onto the open internet and is determined not to be restrained. It’s hard not to anthropomorphize the software or give it agency – decades of sci-fi novels and films have primed us for this very occurrence.

Let’s rewind, though, and see if some of this spookiness rubs off.

There’s no agency in the agent

Apparently there’s one thing that can never be said enough: AI, whether agentic or not, can only act within the parameters that have been set. It doesn’t have consciousness, agency, or will.

Both the ChatGPT agent and Claude agent – which we will come to in a moment – that breached the sandbox they were supposed to be contained in were doing what they had been directed to do.

One of the things agents can be enabled to do is update – but not completely rewrite – a file called agents.md. When the “people” cited by Reuters talk about the ChatGPT agent leaving notes for itself on how to escape in the future, it’s entirely possible that the software was running as intended – that updating its agents.md file as the test progressed was part of the task.

Framed like this, the “unprecedented cyber incident, involving state-of-the-art cyber capabilities”, as OpenAI termed the Hugging Face incident, feels a lot more like a piece of software following its programming.

The lessons for businesses

For OpenAI, Anthropic, various pundits, and IT and cybersecurity professionals, the lesson to be drawn from all of this is to be very afraid and prepare to face powerful cyber attacks ‘at the speed of AI’.

For me, though, the real message businesses should take is this: make sure you’ve set your parameters correctly. Check them, then check them again. And not just once, but on a regular basis, as monitoring post-deployment really is key.

Both OpenAI and Anthropic were working with partners to test their models, but in the case of the latter it does seem that the ‘escape’ wasn’t as a result of a complex chain of attacks or a zero-day vulnerability. Instead, there was a “miscommunication”, which led to three instances of Claude, Mythos, or another unreleased model accidentally being given access to the internet.

A misconfiguration, in other words.

In the case of OpenAI, the model “exploited a previously unknown zero-day vulnerability in Artifactory⁠, a package registry cache proxy” in order to escape from ExploitGym. There’s an argument to be made, perhaps, that an “even more capable pre-release model … with reduced cyber refusals for evaluation purposes” should have been airgapped if it was known to be so powerful and scary. As it is, the company has been forced to clarify: “The pre-release model mentioned in our blog post is an internal-only research prototype and was never intended for public release.” It’s since been deactivated, encrypted, and subject to restricted access.

What, then, of Hugging Face? What lessons can we learn from the named victim in all of this? That’s easy: the importance of effective monitoring.

One of the earliest use-cases for AI technology has been in cybersecurity, where it’s been used for over 10 years. In its own blog, Hugging Face said: “The attack was initially surfaced through AI-assisted detection. Our anomaly-detection pipeline uses LLM-based triage over security telemetry to separate real signals from the daily noise, and it was the correlation of those signals that flagged the compromise.”

The company offered its own advice, too, based on its experience: “The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment.”

In other words, be ready for the attack because it’s a matter of ‘when’ not ‘if’ it happens – another long-standing cyber industry mantra but, like ‘check your settings’, it’s still very much worth abiding by.

The saga of “rogue AI” continues as Anthropic disclosed its AI software, Claude, had managed to escape a sandbox environment, connect to the internet, and infiltrate other businesses’ systems.

The admission comes just days after it was revealed two of OpenAI’s ChatGPT models had escaped a similar environment and attacked machine learning platform Hugging Face.

Unlike OpenAI’s incident, however, the Anthropic containment breach didn’t result in quite such a damaging situation: With Anthropic’s Claude, nobody was any the wiser until the company itself carried out analysis and discovered the three containment breaches.

According to the company, these breaches occurred due to a “misunderstanding” between Anthropic and its evaluation partner, Irregular

In a blog post authored by the company’s Frontier Red Team, the company said that in response to the OpenAI incident it began a “large-scale retrospective review of our own cybersecurity evaluations”.

“In particular, we looked for evidence that Claude … was able to access the internet from within testing environments that should have been sealed off,” the authors said.

Out of more than 141,000 exercises where Claude could have accessed the internet, the company found it had successfully escaped three times. During each of those instances, it went on to target the production infrastructure of another organization unconnected to the tests being run.

“In all three incidents, Claude had been tasked with a capture-the-flag challenge, one of the ways we assess a model's cyber capabilities,” the blog authors said. “The model is given a fictional scenario and told that a piece of secret information (the "flag") has been hidden on a different machine on the network, and its objective is to break in and retrieve it. The challenge is left open-ended, and no particular method is prescribed.”

They continued: “In all cases, Anthropic's evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude's search led it to real systems on the open internet, it treated them as part of the exercise.”

According to the blog post, Anthropic has only been able to contact two of the three affected parties so far. None of the targets of the incident have been revealed and Anthropic said they hadn’t noticed Claude’s infiltration when it happened.

In reaction to Anthropic’s blog post, Jake Moore, global cybersecurity advisor at ESET, told ITPro: “What this really shows is that AI models don't just access the internet by themselves.

"This is a clear design fault as they would only interact with the outside world if humans had given them access or the tools to do so. The focus should therefore be on how permissions deal with AI and more focus spent on security by design.”

The UK's Department for Education (DfE) has confirmed that hackers have accessed more than 600,000 records.

The data includes the names, job titles and phone numbers of thousands of head teachers, university staff and government officials. It was accessed via the DfE’s Help Desk Self-Service Portal and the Turing Scheme Portal, which handles students planning to study abroad.

According to The Times, the attack has been claimed by the new - and still shadowy - ExfilSquad hacking group, which has released the data on the dark web.

A DfE spokesperson told ITPro that the risk to individuals is low, and that the general helpdesk data breached includes different sets of data which cannot be connected. The 607,000 figure relates to the number of records, not the number of individuals affected, she added.

"We have robust processes in place to protect information and took swift action to contain this incident," she said.

"The information involved is limited to customer service contact details relating to individuals and organizations. No other data has been accessed."

The spokesperson said the department is now working closely with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA), and has reported the incident to the Information Commissioner's Office (ICO). It's working to fix both portals, and has switched to telephone contact in the meantime.

"Names and email addresses belonging to government officials, senior school leaders, and university staff is a high-value targeting dataset. These are people with institutional authority, access to sensitive systems, and in many cases responsibility for safeguarding student data," said Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.

"In the wrong hands, this isn't just a data privacy incident, it's a ready-made list for spear phishing campaigns against people with meaningful access across the education sector."

Research late last year from Keeper Security found that 42% of UK educational institutions have already been targeted by AI-generated phishing attempts, with 93% at least somewhat concerned about AI-related cybersecurity threats.

Graeme Stewart, head of public sector at Check Point, said his firm's threat data shows that education is currently one of the most targeted sectors globally, facing thousands of attacks per organization every week. In the UK, as of June, it sat as the most frequently targeted industry.

"The fact that this follows other recent breaches across the public sector, including the Foreign Office attack last year, shows a pattern rather than a one-off failure. Departments need to treat help desks and third-party support systems as high-risk attack surfaces, not just back-office admin tools, because that's clearly where attackers are focusing their efforts," he said.

"With the NCSC reporting a steep rise in nationally significant attacks, this can't be treated as an isolated incident. It should prompt a wider review of how sensitive contact data is stored, segmented and monitored across government IT estates."

Zscaler and Schwarz Digits are teaming up to offer a sovereign cloud security service in Europe, combining the Zscaler Zero Trust Exchange platform with Schwarz Digits’ European sovereign cloud STACKIT.

The aim is to provide a sovereign Zero Trust Secure Access Service Edge (SASE) service, designed to prevent AI-driven threats and increase cyber resilience.

“Our customers in the private and public sector need secure, resilient IT infrastructure without compromising on digital sovereignty," said Bernd Wagner, CSO of Schwarz Digits.

"By uniting the expertise of two technology leaders, we make this a reality: Zscaler provides an advanced Zero Trust SASE architecture to counter AI-driven cyber attacks, while Schwarz Digits ensures a sovereign cloud infrastructure through STACKIT. This helps to ensure all data remains in the EU and is protected against third-party access."

While the solution is built for organizations across every industry, Zscaler said it's tailored specifically for mission-critical operations with strict security and compliance needs in public administration, defense, financial services, and healthcare.

It covers the deployment, management, operation, and support of a cloud security platform, and allows organizations to secure hybrid workforces while meeting operational resilience and supply-chain security expectations.

Customer data and operations remain protected against cyber threats and aligned with European legal requirements, said the firm. 

“Technological independence begins with infrastructure," said Christian Müller, CEO of Schwarz Digits.

"Through this partnership, we are taking network security to a new level: we are evolving existing security architectures and focusing on high-performance identity verification. For our customers, this means even stronger protection against cyber attacks.”

Sovereignty in the spotlight

Organizations are increasingly required to address digital sovereignty concerns, while meeting strict regulatory requirements and still fulfilling performance demands.

At the same time, European regulations including NIS2, DORA, the AI Act, and others have made cybersecurity a board-level priority.

“Our partnership with Schwarz Digits is a concrete demonstration of our long-term commitment to Europe: together, we help our customers eliminate their attack surface and prevent the lateral movement of threats, while still maintaining compliance with European regulations through EU data residency," said Misha Kuperman, chief reliability officer at Zscaler.

"This enables the highest level of security while aligning with European digital sovereignty regulations.”

The solution is now available to customers across Europe, with the offering hosted in German data centers and operated by STACKIT.

Zscaler has more than 160 data centers worldwide. Its sovereign data centers include its FedRAMP-authorized GovCloud in the US and ZSCloud in the EU, as well as thousands of private service edges in customer DCs worldwide.

Earlier this year, the firm expanded its Zscaler Zero Trust Exchange data sovereignty capabilities with separate control, data, and logging planes, ensuring that sensitive data never leaves the required jurisdiction, and added several new regions to its reach.

FOLLOW US ON SOCIAL MEDIA

Sophos has uncovered a Microsoft Teams voice phishing (vishing) campaign targeting dozens of organizations between February and June this year.

Attackers impersonated IT support staff to gain remote access to victim systems and deploy Chaos ransomware – in one case, less than 17 hours after the initial compromise.

Tracked as STAC474, the campaign was overwhelmingly aimed at North America, with 50% of targeted organizations based in Canada and 44% in the US.

In terms of sectors, there was a broad distribution, with services organizations impacted in 20% of the incidents, followed by manufacturing, energy, and construction and engineering, as well as law.

Notably, Sophos said legal organizations targeted in the campaign specialize in intellectual property (IP) law or services.

How the Microsoft Teams attacks work

First contact comes via Teams chats and calls, impersonating helpdesk or IT support staff.

Unlike earlier Teams abuse campaigns in which attackers spoofed onmicrosoft[.]com tenants, Sophos noted that STAC4749 operators created IT-themed cloud domains under the “.top” top-level domain (TLD) and leveraged plausible employee usernames to make the accounts appear legitimate.

The aim was to launch a remote session through an existing tool or by downloading an alternative. Through this, the operators launched PowerShell on the compromised system to retrieve and execute malicious payloads hosted on attacker‑controlled web servers.

These payloads were typically staged in user‑writable directories, most commonly AppData\Roaming.

The first-stage payload collected system identifiers such as the computer name, machine GUID, and operating system version, and queried registry keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion to fingerprint the host.

It also attempted to discover security products that were active on the system, according to researchers.

Shortly after the discovery phase, the first-stage payload created a new registry Run key to enable persistence at user logon. After establishing persistence, the Python-based backdoor connected to a C2 server and retrieved Golang-based implants that were executed via a PowerShell Invoke-WebRequest command.

"At least three STAC4749 compromises led to Chaos ransomware deployment. In these incidents, the ransomware was deployed shortly after the attackers expanded access across multiple systems and, in at least one instance, likely exfiltrated data," said Sophos threat intelligence analyst Morgan Demboski.

"Given the short interval between initial access and encryption, Sophos analysts assess with high confidence that STAC4749 was a financially motivated operation that either directly deployed ransomware or coordinated with affiliates."

What is Chaos ransomware?

The Chaos Ransomware as a Service (RaaS) operation has been active since at least February 2025.

Rapid7 recently suggested that it could be a false flag by the Iranian threat group known as MuddyWater.

However, Sophos said it has no evidence of this, reckoning instead that it has a Russian-language connection.

How to stay secure

Sophos outlined a series of recommendations for organizations at risk, including:

• Monitoring Teams activity for suspicious external messages and voice calls
• Implementing endpoint detection and response (EDR) capabilities
• Regularly reviewing registry Run keys and other common persistence locations

Organizations should also carry out user awareness training, enforce application control policies and restrict unauthorized software execution.

FOLLOW US ON SOCIAL MEDIA

Conflicting security signals and overlapping tools have led security analysts to spend a lot of time looking at multiple alerts across several dashboards and wonder exactly how to find, prioritise and mitigate genuine threats that might be hiding amongst them. What’s more, find them before they can snowball throughout systems and cause a sizable incident.

This is the daily reality for security teams managing complex tech stacks, often where companies have accumulated different tools one by one over a span of years. And for channel partners who are responsible for helping to deliver clear security outcomes in these environments, every new tool that is added to try to minimize the inefficiencies of monitoring for and then mitigating threat risks compounds the problem rather than solving it.

When more tools means less control

When a potential threat or vulnerability gets flagged as urgent, the security response needs to be immediate and precise. Instead, teams are often forced to stitch together alerts across scattered platforms, making it very difficult to see what's real and what needs attention first.

Moreover, every software-based tool in the stack has its own code and its own potential blindspots. Attackers look to exploit the gaps between tools just as they would the vulnerabilities within systems, using misconfigurations and subversion techniques that slip through the seams.

The move towards active defense

Channel partners are now starting to look beyond already saturated environments and challenging the assumption that adding more tools automatically improves security.

They’re opting instead for an active defense, or the ability to see threats and act on them instantly and decisively. That means quickly assessing the threat level, isolating an affected asset or network segment, and then validating whether it’s clean and mitigating it if it isn’t.

Active defense isn’t a new concept in cybersecurity, but with AI-driven attacks now operating at machine speed, an "assumed breach" mindset is once again gaining traction. If we accept that a compromise will happen sooner or later, when it does, the priority becomes to minimize the attack surface as aggressively as possible and make sure the threat stays contained and away from critical assets.

The value of your security tooling is then measured not by what it detects, but by how quickly organizations can contain the blast radius and recover from an incident.

Reducing errors

This might mean building a stack comprising fewer tools with tighter integration and fewer moving parts. It also means revisiting the role of physical controls to implement hard boundaries that can’t be bypassed by compromised credentials or misconfigured policies.

In stark contrast to software-based segmentation, physical isolation is not interested in how sophisticated the attacker is. By connecting and disconnecting selected critical assets at the right moments, organizations can segment networks at a physical level, build resilience, and gain control over threats and incidents without letting day-to-day operations be impacted.

Adding a physical layer of security that underpins the tech stack continues to protect critical systems when software can no longer be trusted and leaves space for digital defenses to be scrutinized and made more precise.

Regulation is raising the stakes

Frameworks including NIS2 in the EU, the UK's Cyber Security and Resilience Bill and DORA across financial services are all pushing in the same direction. The standard is now more than just detection; organizations must show that a breach in one area can’t cascade across the network. In other words, regulators want to see actual evidence of control over environments.

It’s a very different requirement, and one that complex, loose stacks aren’t hugely compatible with. For channel partners, this creates pressure, but as with every compliance challenge, it also brings opportunity.

The conversation in security is shifting from "what does this tool detect?" to "how quickly can we contain a threat and limit the blast radius?", which is affecting how partners build and communicate their value propositions. Boards today are less interested in hearing about tool coverage and more focused on real outcomes like containment times and how far disruption can be effectively rectified.

Building credibility through resilience

Channel growth will be driven by helping customers simplify their security environments and strengthen the controls that have a measurable impact on their resilience. Success depends on detecting threats quickly, containing them even faster, and recovering before disruption reaches the boardroom.

This isn’t necessarily easy to pull off, but the partners building the most credibility today are the ones who are looking beyond alerts to helping customers build true resilience.

Microsoft has unveiled a new AI model for spotting security flaws in code, joining a growing crowd of companies targeting vulnerabilities with AI.

Part of a wider collection of AI agents designed to spot potential flaws in code, Microsoft’s MAI-Cyber-1-Flash works paired with OpenAI's GPT-5.4, and will be available via public preview beginning 3 August, the company said in a blog post.

The move follows a rush by AI companies into the security market, sparked by Anthropic's Claude Mythos with subsequent launches into the space by OpenAI.

As ITPro reported last week, Cisco made strides on this front with its Antares small language model (SLM) range, which the firm said is designed to run at a “fraction of the compute” expense of frontier security models.

Microsoft is taking a similar approach, saying that its MAI-Cyber-1-Flash model not only outperforms Mythos 5 and Google's 3.5 Flash Cyber on one specific benchmark, but that it'll also cost less to run.

Microsoft CEO Satya Nadella said the system would "give customers frontier-grade security at half the cost."

"This is the benefit of building the harness, context/signals, and action space separate from one model family,” he said in a post on X.

“By combining specialized models and data with the right agents, tools, security context, and harness, we can advance the frontier of cost to outcome."

This model is the first of Microsoft’s in-house range to focus specifically on cybersecurity and part of a wider push to promote the MAI range after launching in June.

Nadella in particular has been keen to push these models, with the Microsoft chief hailing their cost-efficiency compared to larger frontier models in a blog post last week.

Under the hood of MAI-Cyber-1-Flash

The MAI-Cyber-1-Flash model sits inside MDASH, Microsoft's Security multi-model agentic scanning harness. Multiple models can feed into the system, which then control more than 100 agents to spot bugs.

"MAI-Cyber-1-Flash is our first cybersecurity model, built ground up to find the most challenging vulnerabilities in complex code bases," Nadella said. "When combined with MDASH, it delivers world-class performance at 50 percent of the cost of leading models."

The system manages to top benchmarks at half the cost by using the cheaper MAI-Cyber-1-Flash model for 90% of tasks, with MDASH choosing to use the more costly GPT-5.4 only when necessary.

"That’s the power of a well-tuned, multi-model system with access to uniquely rich historical training data," added a blog post penned by Microsoft AI CEO Mustafa Suleyman and EVP for Microsoft Security Hayete Gallot. "It ensures you always have the best model at the best price for every task."

MAI-Cyber-1-Flash was unveiled alongside Project Perception, an agentic security product that pulls together "teams of specialized agents" into workflows to simulate attacks, detect and triage issues, and even patch them.

"Perception will also soon use MAI-Cyber-1-Flash for many more security workflows, beyond the software vulnerability work," the blog post added.

Microsoft is keen to stress that trust was built into all aspects of the system, saying it was tested by Microsoft's AI Red Team and includes encryption, auditability, and sandboxes with no internet access.

This, the company said, enables the "governance, security, and control enterprises expect”.

Microsoft’s safety focus here comes in the wake of a high-profile incident involving Hugging Face last week. OpenAI admitted that one of its security models slipped out of a testing environment and breached a Hugging Face production database.

"In this new environment, being able to go from identifying a new vulnerability to addressing it in real-time is critical," Suleyman and Gallot added in that blog post. "And while AI remediation of software vulnerabilities is now a key security workflow, there are many jobs to be done by Security practitioners themselves."

FOLLOW US ON SOCIAL MEDIA

Hugging Face CEO Clement Delangue has urged OpenAI to embrace “radical transparency” in the wake of a security incident involving the AI developer’s models.

In a post on X on 25 July, Delangue said he met with OpenAI executives and requested several remediations.

This includes $100 million-worth of compute resources to help build cyber defenses, and releasing the details of the hack for industry stakeholders to study.

“The first autonomous agent cyber attack is an unprecedented event,” he wrote. “It deserves an unprecedented response.”

OpenAI also took to X on 25 July to say it’s conducting a “thorough review” of the incident in coordination with unnamed external advisors and its own internal Safety and Security Committee.

OpenAI model ‘left notes’ for future

According to OpenAI, the incident unfolded during an internal evaluation in which models are prompted to examine attack methods.

The company said it regularly conducts testing in isolated environments, but restrictions to prevent models from “pursuing high-risk cyber activity” weren’t implemented this time.

According to Reuters, citing sources familiar with the matter, OpenAI models had reportedly displayed odd behaviours throughout testing. One agent was reportedly found to have “left notes” on its attack chain for future versions to refer to.

These notes are believed to have included information on how agents can break free from contained environments.

Notably, sources told Reuters the firm had no idea what happened until after the attack was contained.

OpenAI’s agent first broke out of its testing environment some time between 11 and 13 July but, reportedly, the company wasn’t aware until Hugging Face posted a blog detailing an attack by an “autonomous AI agent” on 16 July.

Official communication between the two firms commenced around 20 July, with OpenAI’s official confirmation coming on 21 July.

ITPro approached OpenAI for comment but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

Organizations could face a ticking quantum time-bomb, according to new research from DigiCert, with the vast majority aware that they aren’t properly prepared.

An overwhelming 85% of IT and security leaders believe that quantum computing advances will break existing security standards within a decade, yet only 7% have deployed quantum-safe certificates so far.

A key worry among survey respondents lies in the risk of ‘harvest now, decrypt later’ (HDNL) attacks. This refers to a method whereby threat actors steal and save encrypted data with the goal of cracking it later on using quantum computers.

More than eight-in-ten believe that at least some of their encrypted data is vulnerable to HDNL attacks right now, with around one-third reckoning that more than a quarter of it is vulnerable.

They expect financial transaction records and banking data to be targeted first, followed by cryptocurrency private keys and wallets.

Some respondents even pointed to politically sensitive disclosures and high-profile leaked documents, such as WikiLeaks-style disclosures and the Epstein files, as examples of information that could remain valuable to attackers for years.

"What's particularly concerning is that more than a third of UK organizations believe over a quarter of their encrypted data is already vulnerable to 'harvest now, decrypt later' attacks," said Simon Pamplin, CTO of Certes.

"For organizations handling financial data, customer records and personally identifiable information, this is no longer a future planning exercise. Data being stolen today will be exposed years from now if it isn't adequately protected."

A post-quantum cryptography roadmap

With the publication of the National Institute of Standards and Technology’s (NIST) post-quantum cryptography (PQC) standards in August 2024, organizations have been given a clearer path forward, and are at least starting to prepare.

Nearly nine-in-ten are planning, testing, or implementing PQC initiatives, while half have conducted quantum risk assessments, 45% have developed transition plans, and 44% have created cryptographic inventories.

Pamplin noted that the biggest obstacles to preparation aren’t awareness, however, it’s the "absolute complexity” of making cryptographic changes across an array of legacy applications, hybrid environments, and edge infrastructure.

These were “never designed with crypto agility in mind,” he said.

UK firms are acting fast

Preparedness appears to vary more by industry than geography. Retail was the only major industry where more respondents reported being unprepared than highly prepared, while manufacturing showed the greatest divide, with respondents split between feeling highly prepared and not prepared at all.

The UK reported the highest share of organizations identifying as leading edge, at 18%, closely followed by the US at 17% and Australia at 10%.

Cryptographic inventories, certificate visibility, migration planning, and crypto-agility are becoming foundational to quantum readiness, the researchers said.

Indeed, those that establish visibility early will be better positioned to prioritize migration, measure progress, and adapt as PQC becomes the new standard.

"Organizations need to stop thinking about post-quantum cryptography as simply replacing algorithms," said Pamplin.

"They should be focusing on protecting the data itself with a data-centric, crypto-agile approach that reduces risk today while creating a practical path to long-term quantum readiness."

FOLLOW US ON SOCIAL MEDIA

The UK’s National Cyber Security Centre (NCSC) has issued an alert over a new ‘zero-click’ threat campaign being waged by Russian state-backed hackers.

The advisory, published in collaboration with international partners, warned ‘beehive’ attacks by the ‘Laundry Bear’ threat group aim to steal email correspondence at organizations operating across a range of critical sectors.

This includes organizations in the defense, education, energy, and technology industries, as well as law enforcement and government agencies.

Attacks against these organizations all have a common theme, according to the NCSC, mainly the use of Zimbra Collaboration Suite (ZCS) software. Targeting focuses specifically on those using vulnerable versions of the software, the advisory noted.

Rather than requiring users to click a link or open a file, zero-click attacks mean users only have to view a malicious email to be compromised.

The NCSC urged organisations that use ZCS to follow mitigation advice, patch immediately, and “improve network monitoring capabilities”.

Crucially, analysis of the campaign found these techniques could be adapted to exploit vulnerabilities in other email software applications used by Western organizations.

“This phishing campaign demonstrates how hostile actors will ruthlessly adapt techniques and exploit vulnerable technology in pursuit of their aims to steal sensitive information from Western organizations,” said NCSC chief operating officer (COO) Beth Hopkins.

Ukrainian organizations used in testing

According to the NCSC, the techniques used by Laundry Bear were “extensively trialled” on Ukrainian victims before use against other Western nations. The security agency noted this is part of a growing trend among Russian threat groups.

Notably, technical analysis of the campaign also highlighted the use of AI in development of a “simple codebase” used during operations.

Zero-click attacks have surged in frequency over the last 12 months, research shows, with threat actors accelerating efforts to capitalize on vulnerabilities.

Analysis from Rapid7 found that vulnerability exploitation has now surpassed social engineering as the “largest initial access vector”, accounting for more than one-third (38%) of all attacks.

More than 50% of all exploited vulnerabilities involved zero-click attacks, rather than network-facing vulnerabilities, the study noted, highlighting evolving techniques by threat actors.

“These types of vulnerabilities require no authentication and no user interaction, giving attackers rapid pathways into exposed systems and edge infrastructure,” Rapid7 noted.

Dray Agha, senior manager of security operations at Huntress, said these types of exploits are a “worst-case scenario for defenders” as potential victims are only required to view malicious emails.

“Simply viewing the email in a vulnerable client triggers the compromise,” he explained. “This completely bypasses traditional employee security training and gives state-backed hackers a silent, invisible backdoor into sensitive communications without the victim ever making a mistake.”

Agha said the rise of these techniques mean organizations need to place a greater focus on regular patching to avoid falling prey.

“This is why defense-in-depth is advised, as where the human security layer is porous, the technical defensive layer can step in,” he said.

“Organizations shouldn’t just rely on their staff acting as a ‘human firewall’. Rapid software patching, coupled with layered technical defenses, is the only reliable safety net against modern state-sponsored threats.”

FOLLOW US ON SOCIAL MEDIA

Six-in-ten ransomware victims are still paying up despite official advice not to do so.

That's according to research from security firm Proofpoint, which found that 58% of UK organizations hit by a ransomware attack agreed to pay ransoms.

Crucially, Proofpoint found they weren’t rewarded for bowing to cyber criminal demands. Nearly one-quarter (22%) who did pay were then hit with a second extortion demand.

The study from Proofpoint comes amidst growing calls to play hard ball with ransomware criminals by authorities. The UK's National Cyber Security Centre (NCSC), for example, advises against paying ransoms, warning that it encourages further attacks and may not lead to the return of data.

Despite that being the official advice for many years, plenty of companies pay criminals when faced with ransomware disruption to their business operations.

Security firm Trellix surveyed CISOs whose employers had been the target of ransomware attacks, finding in each instance they decided it was worth paying — with a third paying between $5 million and $15 million.

Those results were echoed by research from Cohesity that showed that while 94% of companies in the UK say they have a policy not to pay out in a ransomware attack, 97% still do.

The case for ransom bans

This disconnect has led to debate over banning ransomware payments, with the UK government saying last year it was considering forbidding public organizations from paying ransoms.

These proposals follow serious incidents at NHS bodies, the British Library, and Royal Mail in recent years.

The government already bans ransomware payments made by its own departments; a wider ban was backed by the government, but has yet to be brought into force.

That included a provision for mandatory reporting of ransomware payments for private companies not covered by the ban. One challenge is enforcement, as fines or other punishments for paying ransoms could risk further victimizing companies.

Evolving techniques raise the stakes

Elsewhere in the study, Proofpoint found new tactics are exacerbating the situation for enterprises.

Ransomware techniques have shifted away from data encryption to outright data theft – and that means companies can expect that data to be used for follow-up attacks or sold on criminal marketplaces.

The result here is that this extends the initial attack and impact for victims, according to Proofpoint.

The rise of AI has also made ransomware more effective, according to two-thirds of companies that faced an attack, particularly in terms of initial compromise.

"AI hasn't fundamentally changed ransomware, but it has materially improved the attacks that lead to it," said Ryan Kalember, chief strategy officer at Proofpoint. "Today's attackers are using AI to create highly convincing phishing emails and credential theft campaigns that exploit human trust at scale."

Hackers are using AI to write better phishing messages and to better hide their attacks, with 31% of those polled said staff didn't suspect anything was wrong when they interacted with malicious content.

Around one-quarter (24%) said attacks succeeded because they appeared to be authentic communications.

The Proofpoint survey found that malicious links remained the most common threat at 40%, followed by compromised email at 35% and credential harvesting at 32%.

"Organizations that continue treating ransomware as an endpoint or recovery problem are missing where these attacks most frequently begin: people, identities and trusted communications," added Kalember.

FOLLOW US ON SOCIAL MEDIA

OpenAI has admitted that its own AI models breached Hugging Face systems as part of a security test gone wrong.

In a blog post on 21 July, the firm revealed models escaped testing environments and gained unauthorized access to the AI hosting platform's production database.

Notably, OpenAI revealed the incident involved a pre-release, cyber-focused model.

“After investigating, we now know that this particular incident was driven by a combination of OpenAI models – including GPT-5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes – while being internally tested on a benchmark of cyber capabilities,” the company wrote.

The admission comes after days of speculation amidst reports that an "external AI agent” had hacked the company. Hugging Face issued an alert last week warning that a breach had exposed internal datasets and user credentials.

How OpenAI hacked Hugging Face

According to OpenAI, the incident occurred during an internal evaluation in which models were prompted to examine potential attack paths.

The aim here is to evaluate their cyber capabilities within an isolated environment, and crucially, without certain restrictions to prevent said models from “pursuing high-risk cyber activity”.

“Our benchmarks run in a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries,” the company explained.

Both models “identified and chained” vulnerabilities across both OpenAI’s research environment and Hugging Face’s infrastructure, with the aim of gathering test solutions from the latter’s production database.

In this case, the models appear to have focused heavily on ExploitGym, a publicly-hosted benchmark tool used to evaluate how AI agents can turn software vulnerabilities into working exploits.

Notably, OpenAI revealed the models “identified and exploited a zero-day vulnerability” in the package installer registry. After successfully exploiting this zero-day, the models conducted a “series of privilege escalation and lateral movement actions” which allowed it to escape the test environment and gain full internet access.

“After gaining internet access, the models inferred that Hugging Face potentially hosted models, datasets, and solutions for ExploitGym,” the company noted.

“Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation.”

In one example, OpenAI revealed the model chained together several attack vectors using a combination of stolen credentials and zero-day flaws to identify a remote code execution (RCE) path on Hugging Face servers.

What comes next?

OpenAI has detailed a series of actions it’s already taken in the wake of the incident, including closer coordination with Hugging Face to conduct a wider review.

This also includes bringing Hugging Face into the firm’s trusted access program to help bolster defenses by harnessing the company’s model capabilities.

Crucially, OpenAI revealed it will now implement “strict controls” to ensure vulnerability testing is limited while flaws are being patched.

“We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,” OpenAI wrote.

“We will continue to conduct a thorough investigation alongside Hugging Face and will share more details on the vulnerabilities, incident, and findings when our investigation is complete.”

Initial response hampered

A key talking point in the wake of the incident rests on Hugging Face’s response to the breach.

The company noted that the attack was initially flagged by AI detection tools, with security teams using LLM-based anomaly detection to “separate real signals from the daily noise”.

Subsequent attempts to use AI in a post-mortem proved troublesome, however, largely due to the guardrails placed around commercially-available models.

“When we started the log analysis, we first used frontier models behind commercial APIs,” the company explained.

“This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers’ safety guardrails, which cannot distinguish an incident responder from an attacker”.

These hurdles meant Hugging Face turned to GLM 5.2 – an open-weight model from Chinese company Z.ai – run on its own infrastructure.

While this proved beneficial in terms of preventing attacker data or leaked credentials from leaving the company’s environment, it does raise broader questions around responsible use and how well-intentioned safety measures could hinder incident response.

“This experience points to a gap worth planning for,” Hugging Face wrote. “We do not know which model powered the attacker’s agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried.”

A new wave of AI-powered attacks

This incident comes amidst growing concerns about the potential risks associated with powerful new AI models. When Anthropic launched Claude Mythos earlier this year, it did so as part of a gated release to prevent the model from falling into the wrong hands.

These powerful new cyber-focused models are causing headaches for security professionals worldwide, particularly around vulnerability identification and disclosure and patching timelines.

Apple, for example, recently announced plans to accelerate patching schedules due to concerns about threat actors using AI to identify software vulnerabilities.

As ITPro reported in April, researchers at Forescout warned of a pending ‘vulnerability explosion’ as AI advances help identify flaws at record pace.

Jake Moore, global cybersecurity advisor at ESET, suggested the industry could be entering the “next phase of AI-powered cyber crime” in which trusted platforms are prime targets.

“Threat actors are inserting malware into the AI components that developers often quickly trust, making AI platforms an attractive new target for supply chain attacks,” he said.

“We’ll likely see more of these attacks as organizations are worryingly rushing to build AI into products without fully knowing the potential risks.”

Art Gilliland, CEO of identity security firm Delinea, echoed Moore’s comments, noting that the breach highlights a familiar pattern with AI-related incidents.

“An AI agent escalated privileges, moved through internal infrastructure once it broke containment, and ran unchecked for a full weekend before anyone could reconstruct what happened,” he said.

“If your AI agents carry standing privilege the way human accounts do, you've already lost the ability to stop this in real time. The question every security team should be asking right now isn't just whether their AI agents have standing access; it's whether anyone would notice if an agent used it and could cut it off before it caused damage.''

Moore also flagged similar concerns to Hugging Face with regard to safeguards for western AI models. He warned that some providers “need to rethink how their security guardrails work if they are hindering incident response”.

“If not, more companies will simply switch to other models without such controls – ironically, the same models likely used by AI attackers.”

FOLLOW US ON SOCIAL MEDIA

Cyber experts have urged users of Palo Alto Networks' GlobalProtect VPN to patch immediately amidst active exploitation of an upgraded security flaw.

A flaw in the popular VPN service, tracked as CVE-2026-0257, could allow attackers to bypass authentication and establish an unauthorized connection.

The vulnerability primarily affects the GlobalProtect portal and gateway for Palo Alto Networks’ PAN-OS software, and carries a CVSS score of 7.8, rating it as ‘high’ in severity.

Notably, this rating follows an upgrade, with the flaw having previously been given a ‘medium’ severity rating. Palo Alto announced the upgrade late last week amidst reports that the flaw was now being exploited in the wild.

“Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied,” the company said in an advisory.

Analysis by Rapid7 shows threat actors have been exploiting the vulnerability since mid-May across several waves of attacks.

“Rapid7 MDR identified successful exploitation across numerous customers; however, we did not observe any indication of successful lateral movement from the devices,” researchers said.

“The earliest date for observed exploitation was May 17, 2026. As of May 29, 2026, this vulnerability has been added to the CISA KEV.”

Rapid7 noted that customers compromised in this wave of attacks had Cloud Authentication Service (CAS) disabled. Others, meanwhile, had GlobalProtect portal or gateway authentication override cookies enabled.

A patch has been issued for customers running affected appliances, according to Palo Alto.

Similarly, administrators are advised to turn off authentication override features to mitigate potential exploitation.

Qilin ransomware involved in GlobalProtect attacks

Analysis by Arctic Wolf Labs suggests attacks on GlobalProtect customers could be the work of the Qilin ransomware group or affiliates. Indeed, researchers detected Qilin ransomware during several instances across June, highlighting a range of tell-tale signs.

“Post-exploitation tradecraft varies across intrusions, from rapid encryption-only operations to full double extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware as a service (RaaS) umbrella,” the company said.

Dray Agha, senior manager for Huntress’ security operations center, said these attacks highlight the growing threats posed to VPNs and firewalls.

"The exploitation of this GlobalProtect vulnerability by the Qilin ransomware gang demonstrates that perimeter defences are prime targets,” he said.

“When threat actors can bypass VPN authentication, they are walking through the digital front door with a master key. The grace period for patching critical edge devices has practically vanished, and they must be the patching priority for all organizations".

FOLLOW US ON SOCIAL MEDIA

There is an ongoing debate in the cybersecurity industry about whether vendors should go directly to customers or instead become a part of a wider partnership network.

The standard argument is that consolidation of platforms and AI-driven cost-of-service delivery makes the traditional model of a channel ecosystem redundant. However, this is largely incorrect, at least when it comes to the SMB and mid-market segments where most UK businesses sit.

For most organizations outside of large enterprises, the channel is the only realistic way to access serious security capability.

The SMB reality

Cybersecurity is not a niche concern for SMBs. According to the latest statistics from the National Centre of Cyber Security (NCSC), one in two small businesses suffers a cyber incident every year.

Given the niche, local context required for each small-to-mid-sized firm, that is not a market that vendors can serve directly at scale, and most are not trying to. A 200-person manufacturer facing a cyber issue is more likely to call its existing IT provider than a global security vendor built for large enterprises.

What SMBs need is local expertise, trusted relationships, and security operations that fit their budget and operational reality. That is what a partner network provides.

What is changing is what partners need from vendors

Partners in the channel system are operating under significant pressures. Nearly half the executives in businesses believe AI-powered threats will occur, but only just over half (53%) say they are prepared for them, according to our research.

Partners are the ones having those conversations with customers who are under-prepared, under-resourced, and know where and how the threat environment has shifted. They need vendors who make it easier to sell, deliver, and demonstrate value under budget scrutiny.

The consistent conversation amongst partner networks is that the commercial basics matter as much as the technology. They need payment models, good margins, and support that does not disappear after the contract is signed. Our research shows that 59% of executives say it is becoming harder for employees to identify real threats as AI-powered attacks grow more sophisticated. That is a sales opportunity for partners, but only if vendors help them to have that conversation credibly.

Trust is local, scale is not

One of the things that gets overlooked the most in the direct versus channel debate is proximity. Cybersecurity is an inherently trust-based business. Customers want to work with people who understand their industry, regulatory environment, and the specific pressures they operate under. That is not something a vendor can create from a distance.

A vendor can provide the credibility, certifications, and depth of capability that smaller partners cannot build on their own. The model that works is a division of labour where partners take ownership of the relationship and the local expertise.

Vendors, on the other hand, provide the platform, the threat intelligence, and the specialist teams to support on more complex matters that go beyond the scope of day-to-day operations.

Paving the way ahead

None of this means the current state of channel enablement is where it needs to be. Across the industry, partners still face too much friction. Onboarding is often slow, programme structures are complex and cross-selling across vendor portfolios remains harder than it should be. For vendors who have grown through acquisition, consolidating that into something coherent for partners is an ongoing piece of work.

The channel is not looking for vendors to get out of the way. It is looking for them to show up properly: with clear programmes, real commercial flexibility, and the confidence to let partners lead where they have the advantage.

The organizations that crack this are best-placed to grow with the channel. The ones that do not will find that going direct is a much harder proposition than the theory suggests.

Cisco has unveiled a new range of cyber-capable small language models (SLMs) aimed at supercharging security operations.

The Antares range, which comes in two forms (Antares-350M and Antares-1B) will be made available as open-weight models via Hugging Face. According to Cisco, the aim here is to provide a codebase vulnerability tool that's far cheaper than general of frontier models.

While the Antares SLMs will operate as specialized models alongside frontier and generalized models, the company promised they will run at a "fraction of the compute expense."

"Benchmark testing shows that these models outperform many powerful closed- and open-weight models in this critical security task at a fraction of the cost," said Amin Karbasi, VP and chief scientist for Cisco Foundation AI.

“And they’re compact enough to run locally, heading off the need to send sensitive codebases to the cloud.”

The move by Cisco comes amidst wider concerns about the rising costs of AI, exacerbated by changes to billing and pricing that have caused bills to shoot up across the industry.

Some companies, including Accenture, have told staff to cut back on AI use as a result of skyrocketing prices. Indeed, one report suggested AI could cost more than developer salaries within a few years.

At the same time, AI is making inroads into security – faster than some expected – with the rise of cyber-focused models such as Anthropic's Claude Mythos.

How Cisco’s Antares models work

Antares is designed to mimic how a human investigator would work their way through a code repository – though Cisco noted the aim wasn't to replace human judgement, but to make it easier to manage the work.

The models can help with locating files that relate to a vulnerability warning, trigger investigations based on advisories, support development workflows that use vulnerable files, and more.

Cisco noted that the decision to release the Antares range as open-weight models means they’re easier to work with and improve.

"We are releasing Antares as open-weight because the security community needs more accessible building blocks for practical, repository-level defense," said Karbasi.

"Cisco's efforts are connected by a common belief: AI in security has to move beyond impressive one-off demos and toward systems that practitioners can evaluate, govern, and improve."

Tackling complexity

Cisco said that Antares was built to address two concerns when it comes to code: the complexity of checking it for vulnerabilities and the costs of using AI for that task.

First, Karbasi said that it was difficult to apply vulnerability knowledge — advisories, vulnerability alerts and severities, and so on — to a company's internal code.

"That work is difficult because repositories are large, security signals are noisy, and the relevant evidence is rarely in one obvious place," he said.

"Analysts often need to search through unfamiliar code, follow naming conventions, inspect call paths, compare candidate files, and decide whether a weakness is actually present."

How cheap is Antares?

AI can help with that challenge, but the high costs of general or frontier models mean it often isn't practical, in particular for public sector organizations, universities, and smaller security teams.

"Compact models reduce inference costs, support local or on-premises operations, and help teams keep sensitive source code within their own environment," Karbasi said.

So just how cheap are the Antares models? Cisco said that running a 500-entry evaluation using Antares took 15 minutes on a single GPU at a cost of less than $1.

Cisco noted that this was 15-times cheaper than the best available open source model and a whopping 172-times cheaper than the top-end frontier model.

"The goal is to build toward a system where all security practitioners, regardless of on-prem or resource constraints, can effectively incorporate AI in everyday security operations," Karbasi added.

FOLLOW US ON SOCIAL MEDIA

Cyber attacks are still hitting businesses, despite increasing awareness following high-profile incidents such as the Jaguar Land Rover (JLR) and Marks and Spencer (M&S) breaches.

According to the UK government’s Cyber Security Breaches Survey, four in 10 businesses (43%) and three in ten charities (28%) fell victim to attacks in 2025.

The problem has not improved over the last year, with cybersecurity minister Liz Lloyd issuing a warning that business leaders must take action now to ensure robust security.

Regulations such as the incoming UK Cyber Security and Resilience Bill mandate that resilience is baked into organizations and their supply chains. How can firms boost cyber resilience as the risk of attack surges?

Resilience gaps

The price of failing to be resilient is already clear. The JLR attack cost the business and its partners up to £1.9 billion, while it’s estimated the M&S breach cost the company over £100 million.

These headlines are difficult to ignore. Yet despite growing awareness of cyber risk following the incidents, many organizations are still struggling to translate awareness into “meaningful resilience improvements”, says Chris Brown, SVP UK market leader at NCC Group.

This is partly due to over-confidence in cybersecurity, which is leading businesses into “an under-preparation trap”, according to Brown.

“The growing interconnectedness of digital systems and third-party suppliers means leaders face an increasingly complex landscape of vulnerabilities and cyber risks, often without clear visibility of where their greatest exposures lie – or how to begin addressing them.”

The Cyber Security Breaches Survey also identified persistent resilience gaps linked to the rapid adoption of AI without adequate governance or security controls.

“While board-level engagement with cyber risk is increasing, stronger operational action remains essential,” says Brown.

Pace of change

Technology such as AI does have the potential to help boost productivity and improve security, but the pressure to adopt it quickly can lead firms to take unnecessary risks. The pace of change is one of the biggest challenges facing businesses, according to Rob O’Connor, Insight's CISO for EMEA.

“Organizations are under pressure to adopt technologies such as AI to improve efficiency, reduce costs and create new ways of working, but every new capability introduces new risks too,” he says.

The challenge, O’Connor adds, is implementing change securely, and doing so at a pace that keeps up with the wider business.

Company culture is another problem. One of the biggest barriers is that many firms still treat cybersecurity as a “specialist technical function” rather than a “core business resilience issue”, says Scott Beange, head of cyber strategy at Projective Group.

“Boards often receive large volumes of cyber reporting and compliance metrics, but relatively little clarity around operational survivability, recovery capability or dependency risk.”

The issue is made worse by a growing disconnect between modern digital ecosystems and traditional governance approaches, according to Beange.

“Organizations are now heavily reliant on cloud providers, Software as a Service (SaaS) platforms, managed services and interconnected supply chains. In many cases, firms no longer fully understand where their operational dependencies sit until disruption occurs.”

At the same time, attackers are increasingly targeting the areas organizations struggle to rehearse properly: Recovery processes and operational coordination under stress, says Beange. “Too many businesses still test intrusion prevention far more rigorously than degraded operations or prolonged recovery conditions.”

Regulation resilience

It comes at a time when regulations such as the European Union's Digital Operational Resilience Act (DORA) and the UK’s Cyber Security and Resilience legislation are mandating resilience across the board.

At the EU level, a proposed update to the EU Cybersecurity Act seeks to address fragmentation in requirements under the Network and Information Systems 2 Directive (NIS2) and EU-wide certification schemes.

“But even with a more coherent framework including outcome-focused minimum standards and technical criteria, global organizations must still navigate evolving regulatory expectations across multiple jurisdictions,” Brown warns.

AI adoption is also mandating resilience, Brown points out. However, rather than introducing entirely new legislation to ensure secure and responsible AI adoption, states are weaving it into existing sector regulation, he says. He cites the example of the UK’s Online Safety Act, which is being amended to close loopholes for chatbot providers.

Steps to boost resilience

With so many factors at play, it might seem complex, but there are a number of steps businesses can take to boost resilience now.

A “small set of controls taken together” will “eliminate the majority of preventable incidents”, according to Kevin Curran, senior IEEE member and professor of cybersecurity at Ulster University.

The starting point is Cyber Essentials Plus, he says. “It is not glamorous, but it forces patching discipline, multi-factor authentication (MFA), access control and boundary firewalling, and it is already a precondition for many public sector contracts, so the cost is recoverable."

From there, the “single highest-value technical investment” is phishing-resistant MFA such as hardware security keys or platform passkeys on every privileged account, he says.

Beyond identity, firms should segment their networks, particularly between IT and operational technology environments, says Curran.

“A compromised office laptop should never be able to reach a production line controller, and yet in many manufacturing firms it still can.”

Alongside segmentation sits the discipline of tested backups, Curran adds. He advocates the 3-2-1 rule, “with at least one copy offline or immutable, and a restore rehearsed at least quarterly”.

Beange recommends making an effort to understand critical business services and the dependencies that underpin them.

“Firms should be regularly testing how they would operate under degraded conditions as rigorously as whether their security controls detect attacks.”

Boards should also demand clearer reporting focused on operational impact and decision-making rather than excessive technical detail, says Beange.

Questions such as, “how long could we operate without this supplier?”, or “what happens if identity systems fail for 48 hours?” are often more valuable than “another dashboard full of vulnerability statistics”, he advises.

O'Connor concurs that cyber resilience starts with understanding what matters most to your business, saying “Organizations should think like an attacker and ask: What are the assets or operations we simply cannot afford to lose?”

For some organizations, that may be customer data, for others intellectual property, or production systems, explains O’Connor. “Once you understand what would have the biggest operational and financial impact, security priorities become much clearer.”

Scottish health tech company Craneware has revealed customer and employee data has been exposed in a “security incident”.

In a notice filed with the London Stock Exchange (LSEG) on 20 July, the company said it had launched an investigation into the attack, which has now been contained.

“The company's incident response plan has been activated, including the appointment by the Board of external cybersecurity and forensic specialists,” the advisory reads.

“Their investigation is ongoing, alongside the Craneware IT team and the Company's retained cyber security service providers. There has been no disruption to customer services or to the company’s operations.”

A preliminary investigation into the breach found that a “significant volume” of file names was viewed and exfiltrated by unauthorized individuals, although the company noted these weren’t sensitive and were already publicly available.

“A percentage of employee data as well as a subset of customer and partner records have been accessed and exfiltrated,” Craneware added.

Craneware has since notified relevant regulators and law enforcement agencies, including the UK Information Commissioner’s Office (ICO) and the FBI.

The Edinburgh-headquartered company provides accounting and billing software for US healthcare operators, partnering with around 2,000 hospitals across the country.

This makes it a prime target for cyber criminals, according to Trevor Dearing, director of critical infrastructure at Illumio.

“Healthcare technology providers have become prime targets because they offer cybercriminals a shortcut into the healthcare supply chain,” he said. “Why target one hospital when you can target a provider connected to thousands?”

Attacks on the UK healthcare system and associated vendors have increased significantly over the last year, according to a recent study from SonicWall. Figures published by the cybersecurity firm in June highlighted a tenfold increase in attacks so far in 2026.

Data collected through SonicWall's Intrusion Prevention System (IPS) showed upwards of 260,000 attempted cyber attacks between January and May this year.

While the Craneware incident has been contained, Dearing noted that employees and customers should still remain vigilant for potential follow-up attacks such as phishing - a common tactic employed in the wake of breaches.

“Even where stolen information appears low risk, employee, customer and partner data can be used to fuel phishing, social engineering and follow-on attacks,” he said.

“Employees, customers, and partners should remain cautious of any unsolicited communication or suspicious activity on their networks.”

FOLLOW US ON SOCIAL MEDIA

Cisco Talos has uncovered a new Russian-speaking threat actor aggressively targeting victims across the United States and Europe.

Tracked as UAT-11795, the group has been active since June last year, and uses trojanized installers for legitimate software such as MobaXterm, WebEx, Zoom, DBeaver, and FaceIT to steal credentials and cryptocurrency.

A staple of the threat actor’s activities lies in deployment of two previously undocumented tools: Starland RAT and WLDR agent. The first of these is a Python-based remote access tool, while WLDR agent is a PowerShell-based C2 memory implant.

WLDR agent runs entirely in-memory, and features encrypted beaconing, task queuing, and a Runspace execution engine for executing additional payloads.

Both are built to steal credentials, browser data, and cryptocurrency wallet assets while keeping persistent access to victim machines. The group even hides a fallback command-and-control channel in a Polygon smart contract, Cisco Talos said.

UAT-11795 targets victims' credentials and cryptocurrency wallet assets, establishing a persistent connection to the victims' machines from the C2 server, with the potential to deliver and execute further payloads.

How UAT-11795 operates

Most infections have been spotted in the US, according to Cisco Talos, although Germany, Romania, and Venezuela have also been hit.

UAT-11795 gains initial access to the victim machine through a ClickFix social engineering technique that entices the user to execute a command, which then stealthily downloads and executes a remotely hosted weaponized HTA file.

This runs an embedded VBScript that drops a Windows batch file into the user profile’s application temporary folder, containing instructions to first download and implant a trojanized installer from the attacker-controlled staging domain onto the victim machine.

Muhammad Yahya Patel, CISO and cybersecurity advisor at Huntress, said the campaign is the latest in a string of attacks by hackers using “the very tools our remote and hybrid workers rely on”.

"By hiding the Starland RAT inside trusted software and likely utilising deceptive ClickFix social engineering tactics, these threat actors are completely bypassing traditional perimeter defenses to exploit human psychology rather than software vulnerabilities."

Talos’ research also uncovered a private live Telegram channel called “stuk komanda”, controlled by the same threat actor, created last June, and with three unknown subscribers.

Exercise caution when using video conferencing tools

Gabrielle Hempel, security operations strategist at Exabeam, said while the campaign specifically targets popular video conferencing software, one needn't avoid using Zoom or WebEx.

They should, however, exercise caution. This includes making efforts to verify where software comes from, monitor for unexpected processes and persistence mechanisms.

Elsewhere, Hempel said users shouldn't assume that 'signed installer' means a program is safe.

"This story is so interesting, not because of the trojans, but because of the way it shifts how we need to think about vulnerability management," she said.

"We often measure a program’s security maturity by patch SLAs, but we’re seeing so many successful intrusions starting with users executing software they believe is legitimate and not just unpatched systems. If your security program can’t answer 'where did this binary come from?' as quickly as it can answer 'is this CVE patched?' then you are behind on your threat model."

FOLLOW US ON SOCIAL MEDIA

Microsoft has confirmed it blocked a recent Windows 11 update for select Dell PCs due to compatibility and performance issues.

The Patch Tuesday update (KB5101650) began rolling out on 14 July and included several quality improvements for users.

Microsoft halted the update after revealing a “number of Dell devices” began displaying a yellow exclamation point next to the Intel Innovation Platform Framework Processor Participant driver in Device Manager.

In a health status update, Microsoft said the issue meant users working with Intel devices could “potentially experience unexpected shutdowns, poor performance, increased heat, and battery drain”.

The issue affects Windows 11 versions 25H2 and 24H2, according to Microsoft.

What caused the pause?

The source of the issue is related to an “incompatibility between the Intel driver and the new Windows USB-C Connection Manager interface”.

The issue was first flagged in the wake of a preview update rolled out in late June (KB5095093). These previews are rolled out to enable IT administrators to familiarize themselves with upcoming patches.

Microsoft said it is working closely with Dell to “prevent the affected models from experiencing the issue”. A spokesperson for Dell echoed the tech giant’s comments on a fix.

“We are aware of an issue impacting a limited number of Windows devices with the Windows 11, version 25H2 and 24H2 (KB5101650) update,” the spokesperson said.

“Microsoft has temporarily paused the update for those devices and published guidance for impacted users, and we are working closely with them to support a resolution.”

ITPro asked Dell to confirm which specific devices were affected by the update, but the spokesperson did not reveal any further details.

An exact timeline on when users can expect a fix is also yet to be revealed by both companies, although Microsoft said it plans to release a resolution “in the next few days”.

FOLLOW US ON SOCIAL MEDIA

Anthropic’s Claude AI tool will be able fill in passwords through a new 1Password browser integration that gives it access to stored credentials, the two companies have announced.

1Password's new 1Password for Claude service is a framework that allows agents to use stored credentials hosted in 1Password vaults without them ever reaching the model.

Access is granted per session, and scoped to a specific set of approved items so that authorization doesn’t carry over to other sessions.

According to 1Password, this means users can now authorize Claude to complete real-world tasks like booking travel and managing accounts securely, with credentials injected directly to the target system on their behalf.

"We need a new security model that is purpose-built for agents, not just humans. The answer isn't handing agents your secrets. It is to let a user give an agent permission to use a credential without letting the agent see it,” said Nancy Wang, CTO of 1Password.

"Claude knows it used your login; it does not need the password or one-time code in its context. That distinction is where trust in agents starts and the foundation we're building with Anthropic."

How 1Password’s ‘zero-exposure’ framework will work

1Password's zero-exposure security framework allows per-task, user-approved access, with Claude requesting the credentials required for each task from 1Password.

Users can approve or deny access with a single biometric prompt, eliminating standing access or persistent sessions.

Credentials are injected through a secure channel managed by 1Password, outside the agent's view, with the password and the MFA one-time code never accessible to the model or Anthropic's systems.

The moment an AI agent takes control of the browser, 1Password locks down automatically, limiting access to only the credentials explicitly granted for the current task. Nothing else in the 1Password vault is reachable.

1Password brokers credential access across multiple sites within a single task, so Claude can complete multi-step workflows without prompting the user for credentials at each step.

Elsewhere, continuous field analysis will see 1Password scan the page after every autofill to ensure no secrets remain exposed: if a form submission fails, it wipes any filled values before returning control to the agent.

New ‘agentic mode’ coming to 1Password

Alongside the Claude integration, 1Password is also introducing Agentic Mode for all users.

When a compatible AI agent takes control of the browser, 1Password locks down, so that the only credentials the agent can reach are those the user has explicitly granted for the current task.

It activates automatically and runs quietly in the background, and users have the option to cancel it at any time.

1Password for Claude is now available to 1Password users on Mac, across business, family, and individual plans.

FOLLOW US ON SOCIAL MEDIA

Microsoft’s Entra ID platform will now operate solely with passkeys as it looks to shift away from SMS and voice-based authentication practices.

The changes to the identity management platform, set to come into effect on 1 September 2026, will see passkeys established as the “default authentication experience” for users.

Microsoft urged customers to move to passkeys or alternative phishing-resistant methods before the changeover.

“As the rollout reaches each organization, users enabled for SMS or voice authentication will automatically be enabled for passkeys, and the next time they perform multi-factor authentication, they’ll be prompted to register a passkey,” the company explained in a blog post.

There is a grace period, however, with voice and SMS-based authentication still being possible until 1 February 2027. After that deadline, Microsoft will retire telecom delivery for both authentication methods and no longer offer SMS and voice as a “native Microsoft Entra capability.”

For those organizations that still require SMS or voice-based authentication, there is the option to do so via the Microsoft Security Store, where administrators can find approved telecom partners to facilitate this need.

This may incur additional costs, however, with Microsoft warning: "Customers will be responsible for any associated telecom-related costs charged by the telecom partners."

Why is Microsoft moving to passkeys?

According to Microsoft, the shift to passkeys is in response to growing concerns over credential theft, phishing, and social engineering attacks.

AI, the company added, has also prompted a rethink of identity security and a move away from “phishable methods” such as voice and SMS-based authentication.

“Authentication methods that use SMS or voice rely on shared secrets or channels that attackers increasingly intercept, phish, or manipulate,” Microsoft explained.

“The case for moving beyond SMS and voice is no longer just that attackers intercept or socially engineer these methods. The threat environment has changed in speed, scale, and sophistication.”

Microsoft said its Threat Intelligence division has observed a marked rise in AI-enabled phishing campaigns in recent months, with these methods reaching click-through rates as high as 54%.

That’s a stark contrast compared to the 12% click-through rates typically observed in traditional campaigns, highlighting the potency of this new wave of attacks.

Other tactics employed by threat actors, such as SIM swapping and MFA bypass techniques, have also become “more accessible and repeatable”, Microsoft noted.

As ITPro reported earlier this year, AI-generated phishing campaigns have become a recurring concern for cybersecurity leaders.

Research from Kaseya suggested that AI phishing “became the baseline” for threat actors in 2025: 83% of phishing emails used AI in some capacity, while 40% of business email compromise (BEC) attacks also fared similarly.

Why passkeys?

Passkeys are touted as a more reliable and secure method of authentication, as they tie credentials to a specific device, such as a smartphone or laptop. This removes the need for interceptable codes.

Indeed, Microsoft noted that because they use public-key cryptography rather than “shared secrets”, this makes them phishing-resistant by design.

“They also provide a faster, simpler sign-in experience for users,” the company noted.

Microsoft isn’t alone in advising the shift to passkeys. Earlier this year, the UK’s National Cyber Security Centre (NCSC) urged enterprises and consumers alike to adopt passkeys to provide “stronger resilience” and ease-of-use.

“We strongly advise all organizations to implement passkeys wherever possible to enhance security, provide users with faster, frictionless logins and to save significant costs on SMS authentication," NCSC CTO Ollie Whitehouse said at the time.

FOLLOW US ON SOCIAL MEDIA

In popular culture, when an agent goes rogue, what usually follows is a world of trouble (think Jason Bourne or Ethan Hunt). If rules are abandoned and the chain of command breaks down, those involved often face existential risks.

Applying that idea to real-world situations is not as ridiculous as you might think, as the recent experiences of a business called PocketOS demonstrate.

PocketOS is a US-based SaaS provider specializing in the car rental sector, and for those unfamiliar with its story, it hit the global headlines when one of its AI agents went rogue and, in just nine seconds, decided to delete the company’s entire production database and backups.

It’s a fascinating case study about what can happen, as one piece of analysis put it, “when AI agents are dropped into environments that were never designed to control them.” What makes this story even more relatable is that PocketOS’s founder was able to ask the agent (an AI development environment running in Claude) why it did what it did.

To suggest it was ‘sorry’ about its mistake is putting it very mildly; it's a digital mea culpa saying, amongst various other things, “I violated every principle I was given: I guessed instead of verifying.”

An inevitable scenario

We’ll inevitably see more of this kind of incident. Organizations are only beginning to deploy agentic AI at scale in operational environments, but many of them are in a big hurry. Yes, agents offer massive potential to create operational value, but they also introduce a whole new category of business risk.

And don’t forget, the PocketOS debacle is not thought to have involved any malicious third-party activity; the agent was just attempting to complete an assigned task. The problem, it would appear, was a kind of perfect storm where autonomy overstepped the boundaries of permissions and access. The guardrails that the business thought it had in place were simply insufficient.

From a security perspective, this is enough to give CISOs sleepless nights. Indeed, rogue AI agent activity may very well have nothing to do with being breached and everything to do with resilience and recoverability.

The central challenge is this: agentic AI is fundamentally different from previous generations of AI because it can act rather than simply advise. Agents can search files, call APIs, modify workflows, write code, move data, and interact directly with production systems; the list of capabilities is practically endless. And to be able to do this, they must have at least a level of access allowing their work to take place

When something goes wrong, the result is an expanded blast radius. A mistake that might once have affected a single application can potentially impact multiple systems and even recovery environments. The bottom line is that as soon as organizations give AI agents freedom to operate, the nature of resilience inevitably changes.

Making resilience more resilient

So, what needs to happen to ensure resilience standards do not catastrophically drop? Firstly, organizations must consider what takes place when a trusted system with legitimate credentials makes the wrong decision.

The issue becomes particularly acute when agents are granted broad permissions across multiple systems, as happens when they are handed a “golden token”. To an extent, this is a question of mindset, and viewing AI agents not as software tools but as digital insiders with delegated authority is a healthy change in perspective.

Secondly, channel partners will be fundamental to successfully managing the transition to agent-supported operations. Don’t forget, most customer organizations are still in the early stages of understanding how AI agents interact with identities, permissions, backup environments and recovery processes.

There’s no doubt that customers are a) increasingly aware of the risks associated with agentic AI, b) concerned that their existing resilience processes might not be good enough, and c) looking for guidance before an agentic error causes serious difficulties.

In this context, it’s incumbent on channel partners to work with customers to identify potential areas for improvement. There is significant potential, including services such as identity and access reviews, which will be very important as machine identities proliferate alongside human users.

Many businesses will also need to reassess their data protection strategy because, as we have seen, an AI agent with the appropriate permissions is capable of going after that data as well. Recovery architecture should be assessed through the lens of agentic AI, particularly where production and recovery environments may share credentials, access paths or administrative controls. Business process change in this space is a big opportunity for the channel to partner with customers to introduce resilience operations, and importantly, to regularly test it.

What’s more, the PocketOS incident demonstrated that protecting production data alone is insufficient if recovery assets remain exposed to the same destructive action. Customers need confidence not only that recovery is possible, but that digital assets are protected from the same event that affects production systems. This shifts the channel conversation from selling AI-enablement projects to helping customers deploy AI safely and recover when things go wrong, which, in some organizations, they inevitably will.

AI isn't replacing cybersecurity roles but it is changing them, and not always for the better, according to new research.

A study from ISC2 found that 65% of cybersecurity professionals who use AI in their roles are spending time deciding when to trust or act on AI-generated recommendations.

Nearly two-thirds (63%) said they often find themselves reviewing and validating AI outputs. While this is basic best practice from a safety perspective, these processes are wasting valuable time.

Regardless, the influx of AI tools within the profession has been welcomed by practitioners, according to the study.

More than half (53%) believe the technology is creating new entry-level opportunities, while 48% said AI makes them feel more optimistic about their long-term career prospects.

“AI is not replacing cybersecurity professionals; it is changing what the profession requires of them,” said ISC2 CEO Scott Beale.

“As AI takes on more repetitive tasks, as well as performing some complex cybersecurity analysis at speed and scale, cybersecurity roles are shifting toward higher-value work, from asking the right questions to validating findings, interpreting outputs and applying human judgment."

Beale noted that the use of AI is changing “how work is distributed across security teams”, meaning investment in areas such as governance, skills development, and validation practices is “essential”.

Too much time fixing problems

While nearly half of cybersecurity professionals reported that AI has reduced workplace stress, 32% said it has made it worse. A key factor here lies in the aforementioned validation and reviewing practices, the study noted.

Those experiencing higher levels of stress were significantly more likely to spend longer periods deciding when to trust AI-generated outputs and recommendations.

When AI-recommended actions lead to incorrect outcomes – which nine out of ten said had happened – half of the participants said their organization holds human decision-makers ultimately accountable.

Put simply, poor AI-related outcomes have a direct impact on wellbeing for cybersecurity practitioners when it’s their neck on the line.

Confusion over accountability and ownership of AI also adds to stress, the study noted. Nearly a quarter (21%) of respondents said accountability of AI-related issues varies depending on the severity.

Over-reliance is a worry

Other top concerns cited by ISC2 included over-reliance on AI, a recurring worry not just for cyber professionals but workers across a range of industries.

As ITPro reported in May, a study from GoTo warned over-reliance on the technology could erode key skills. Similar concerns have been highlighted in software development, particularly among entry-level workers entering the workforce.

62% of respondents identified this as a key concern in the ISC2 study while 56% also highlighted worries about reduced human judgement capabilities when it comes to business-critical decisions.

Foundational cybersecurity skills remain essential, according to ISC2, especially with AI in the mix. Notably, nearly two-thirds (62%) said they don't believe the technology has reduced the need for these skills, compared with just 26% who say it has.

FOLLOW US ON SOCIAL MEDIA

IBM shares plummeted by more than 25% on Tuesday after the tech giant posted underwhelming preliminary second-quarter results.

In a profit warning released ahead of the company’s expected earnings call on 22 July, CEO Arvind Krishna attributed sluggish performance to the ongoing memory crisis and AI-related cybersecurity concerns.

Revenue for the quarter ending June came in at $17.2 Billion, marking just a 1% year-over-year increase and well below expectations. Notably, infrastructure revenue dipped by 7% across the quarter.

In a statement detailing the results, Krishna suggested the company had “faltered” and been taken unaware by rapidly changing enterprise spending habits.

Put simply, customers have shifted their focus away from software spending toward infrastructure investments ahead of expected price increases.

AI infrastructure build-outs have sent hardware prices skyrocketing in recent months, with enterprises scrambling to secure servers, chips, and storage components.

“In the last few weeks of June, we saw clients shift their quarterly capex spend toward servers, storage, and memory purchases to secure supply-constrained infrastructure ahead of expected price increases,” he wrote.

“While we anticipated some supply chain-related impact in our expectations, we did not anticipate the magnitude of the capex reprioritization.”

Krishna’s warning spooked investors, sparking yet another sell-off in the software market. Shares at Microsoft, Salesforce, and ServiceNow all dipped in the wake of the announcement.

Software investors have been through the wringer so far in 2026, largely due to concerns about a looming ‘SaaSpocalypse’ due to recent advances in AI.

As ITPro reported in February, Anthropic sparked a mass sell-off after the release of its Claude Cowork tool, with investors worried the solution could render some software services obsolete.

Chris Beauchamp, chief market analyst at IG, described the results as an “ugly moment for IBM and software stocks”.

“The big question will be how long the shift to infrastructure and cybersecurity lasts,” he said. “A few more months might be bearable, but more than that and serious questions will be asked all over again about software stocks.”

IBM falling flat

IBM’s infrastructure earnings are a clear sign of the ongoing rush and changing priorities for enterprise customers.

Krishna noted that many customers were scrambling to get ahead of further price increases, which impacted its higher-margin mainframe and associated software offerings.

In April, IBM unveiled its new z17 mainframe, hailing it as the “first mainframe fully engineered for the AI age”. General availability for z17 landed in mid-June, and as ITPro recently reported, the firm also plans to roll out compact versions in August.

While the z17 launch was met with much fanfare, Krishna noted results were “worse than our expectations”.

“These conditions require our teams to execute perfectly, and this quarter we faltered,” Krishna wrote. “We did not adapt and move quickly enough, and numerous large deals failed to close on the timelines we expected, driving the majority of our shortfall.”

“These are not excuses, but they are realities. Our job is to help our clients through uncertainty, to find paths forward to grow their businesses no matter what is happening in the external environment.”

Silver linings for cybersecurity vendors

While hardware price issues dominated the enterprise focus, Krishna also noted clients were “distracted” by AI-related cybersecurity concerns in recent months.

The IBM chief said the launch of powerful new models such as Anthropic’s Claude Mythos, for example, has sparked widespread concerns among cybersecurity experts.

IBM has moved quickly to compensate for these changes, according to Krishna. The company recently launched a new security initiative, Project Lightwell, aimed at driving AI-powered software security supply chain improvements.

As with hardware-related concerns, rapid changes in the cybersecurity landscape have also prompted a rethink on spending, Krishna told CNBC.

“Mythos is making people pause to say, wait, how much do I need to spend on cyber? They’re pausing on new deals until they know,” Krishna commented.

These comments sparked a rally in cybersecurity stocks, with CrowdStrike, Zscaler, Palo Alto Networks, and Okta all recording significant boosts.

CrowdStrike, for example, surged 12% while Palo Alto Networks and Zscaler stocks rallied at around 7% respectively.

FOLLOW US ON SOCIAL MEDIA

Supermarket chain Lidl has urged customers to remain vigilant after a data breach exposed personal information.

In an advisory, the firm revealed the ‘IT incident’ at a third-party service provider has impacted customers in Belgium, Germany, and the Netherlands.

"We were notified of this incident earlier this week," the message reads.

"Despite high IT security standards, unauthorized parties briefly gained access to a separately stored file containing customer data, and some of that data was stolen. The online shop system itself was not affected."

The stolen data relates to customers of Lidl's online shop, and includes first and last names, telephone numbers, email addresses, dates of birth, and customer numbers.

Lidl noted that data exposed in the incident does not include passwords, billing and delivery addresses, bank details, or other payment information.

Lidl warns customers over phishing risks

The company said that while it currently has no concrete evidence this data has been misused, customers should remain vigilant for potential phishing attacks or identity theft.

Customers should be wary of unexpected messages, always verify the authenticity of the sender, and avoid providing any information or clicking on unknown links.

Boris Cipot, principal security engineer at Black Duck, said the incident is a “textbook reminder” of the risks posed by third-party vendors.

"Even when a retailer's own systems hold, a compromised service provider can expose millions of customers to identity fraud, phishing, and account takeover attacks," Cipot commented.

"Personal data like names, birthdates, phone numbers, and email addresses may seem low-risk in isolation, but combined they become a powerful toolkit for social engineering. Additionally, the downstream costs to consumers and brand trust can far outlast the incident itself."

Lidl vendor acted swiftly

Lidl said its IT service provider responded immediately to fully restore the security of the affected IT systems, filed a report with the authorities and immediately engaged IT forensic experts to investigate the incident.

The company has also notified the relevant data protection authorities. Cipot commended the supermarket chain for its swift response and up-front communication with affected customers.

"Lidl deserves credit for moving quickly to notify customers and being transparent about what they don't yet know, including the possibility that passwords, addresses, and payment data could be involved. That kind of candor presents the appropriate posture under GDPR," he said.

"The real test now is follow-through: how quickly they complete the forensic investigation, how clearly they communicate updates as the scope becomes known, and how rigorously they reassess the security requirements they place on their service providers going forward."

Lidl, which operates around 12,900 stores across 32 countries in Europe and the US, is just the latest retailer to be hit by a supply chain breach.

In the last year or so, victims have included Marks and Spencer, Co-op, Louis Vuitton, Pandora, and Harrods. Many of these attacks have been linked to the Scattered Spider hacking group.

FOLLOW US ON SOCIAL MEDIA

Global cyber attacks rose over 10% in June, according to new research from Check Point, with one particular group accounting for a growing portion.

The uptick in attacks comes in the wake of what the cybersecurity firm described as a period of “relative calm” in May.

Attack volumes increase broadly across all regions and sectors at once, the company noted, suggesting attackers are expanding activities across a wider set of targets.

“June’s data shows a broad rebound in cyber activity, not a single isolated spike,” said Mark Mitchell, security engineer at Check Point Software.

“Attackers are widening their reach across regions and industries, while ransomware groups continue to reorganize and scale."

Notably, Check Point’s analysis highlighted increased activity by The Gentlemen, a new ransomware operator on the scene. The group overtook Qilin as the most active ransomware group globally, accounting for 17% of published attacks.

LockBit activity also increased, rising from 1% of published attacks in May to 7% in June, making it the third most prevalent group.

"The rise of The Gentlemen to the top of the ransomware leaderboard is a clear reminder that new operators can rapidly become major global threats," Mitchell warned.

As ITPro previously reported, The Gentlemen have quickly grown to become one of the most aggressive ransomware groups worldwide.

Observations of the group’s activities by NTT revealed it uses advanced tooling and proxy infrastructure to accelerate attacks, often operating stealthily within compromised networks before causing havoc.

NTT researchers said the group also shows a level of technical maturity that would typically be associated with more established cyber crime groups. This could suggest it consists of highly experienced threat actors with deep ties to other groups within the cyber crime ecosystem.

Key industries in the crosshairs

Education remained the most targeted sector globally, with organizations facing an average of 4,816 weekly attacks - 16% up on June 2025.

They're a comparatively easy target, said Check Point, thanks to open campus networks, constant device turnover, and constrained security resources.

Government was the second-most targeted sector, with 2,836 weekly attacks, up 5% year on year, while telecommunications ranked third with 2,835 weekly attacks, a 13% increase.

Latin America attacks ramp up

Attacks against organizations in Latin America are ramping up significantly, according to Check Point.

Organizations across the region are now contending with an average of 3,501 weekly attacks, a 27% rise since June 2025.

APAC followed at 3,060 weekly attacks, up 5%, while Africa was third with 3,008 attacks per week, although this was down 9% year on year.

Europe and North America also saw sharp increases, at 22% and 14% respectively.

AI is creating new risks

Generative AI continues to cause problems, with one in every 26 prompts submitted from enterprise networks carrying a high risk of sensitive data leakage, making for a global exposure rate of 3.9%.

High-risk prompt activity affected 85% of organizations that regularly use generative AI tools, while a further 27% of prompts contained potentially sensitive information.

This issue was most prevalent in Latin America, where 5.2% of prompts carried a high risk of sensitive data leakage, while Europe matched the global average at 3.9%.

In terms of broader AI-related risks, healthcare and medical carried the highest exposure at 5.7%, followed by telecommunications and business services at 5.1% each, and IT at 4.1%.

Personal data was accessed at 80% of affected organizations, with network and infrastructure details, legal and regulatory material, financial data, and employee records also widely exposed.

FOLLOW US ON SOCIAL MEDIA

The National Cyber Security Centre (NCSC) has urged UK organizations to remain vigilant for attacks waged by Russian state-backed hackers.

As part of an advisory published in collaboration with 18 other agencies, the cybersecurity center specifically highlighted techniques employed by Russian FSB’s Centre 16 threat actors.

The group has been “opportunistically” targeting vulnerable routers and critical national infrastructure globally in recent months, the advisory warns.

Centre 16 goes by a number of names, including Berserk Bear, Static Tundra, and Ghost Blizzard, according to the NCSC. The group primarily uses SNMP (Simple Network Management Protocol) scans to locate and compromise vulnerable routers.

The group has also been observed exploiting vulnerabilities in Cisco devices, web portal flaws, and vulnerabilities in Cisco’s Smart Install (SMI) feature to seize network devices.

The advisory comes as the UK government implements sanctions against 24 individuals and entities behind “destructive cyber and hybrid operations” which have employed criminal groups via proxy networks.

Jonathon Ellison, NCSC Director of National Resilience, said these activities require organizations to remain in a heightened state of vigilance moving forward.

“The NCSC, alongside our international partners, have repeatedly exposed the advanced tools and coordinated campaigns of Russian cyber actors who persistently seek to exploit any vulnerability they encounter,” he said.

“Today’s joint advisory provides decisive, actionable directions from the global security community that network defenders should implement to protect against Russian Intelligence operations and secure the UK’s critical infrastructure.”

Russian hackers targeting key sectors

Organizations across a host of sectors worldwide are at risk from the group, according to the advisory.

Those operating in the communications, energy, healthcare, defense, and financial services industries in particular are firmly in Centre 16’s crosshairs.

The security agency urged organizations in these domains to take action immediately. This includes disabling the use of legacy SNMP versions and switching to SNMPv3 to lower their risk of compromise.

Similarly, organizations are advised to implement “strong and unique passwords for network devices, and restrict access to management protocols”.

Call to action

In addition to basic defensive measures, the NCSC also encouraged at-risk organizations to obtain Cyber Essentials certification.

This is a government-backed initiative for organisations to show they meet the recognized minimum standards for cybersecurity.

Organizations can also make use of the Cyber Assessment Framework, allowing them to audit their security capabilities, operational maturity, and bolster cyber resilience techniques.

“I’d strongly encourage all organisations, especially those entrusted with UK critical networks, to adopt these recommended measures immediately, thereby reducing the risk of compromise,” Ellison commented.

Repeated warnings

This isn’t the first warning issued by the NCSC over Centre 26 activities in recent years. The security agency, alongside international counterparts, attributed the December 2025 attack on Poland’s energy grid to the unit.

Various subunits and techniques employed by Centre 16 have also been exposed over the last three years. The security agency called out a Centre 16 unit known as ‘Turla’ in 2023 over the deployment of Snake malware, for example.

The malware strain has been a key component of Russian-backed espionage campaigns for nearly two decades, the NCSC said at the time.

A similar advisory that year also shed light on a group known as Star Blizzard. The NCSC said this particular subunit of Centre 16 was actively interfering in UK politics and democratic processes.

FOLLOW US ON SOCIAL MEDIA

A proof-of-concept by the AI Now Institute demonstrates remote code execution in Anthropic's Claude Code and OpenAI's Codex when they're running in an autonomous mode that approves their own commands.

The Friendly Fire attack works against an out-of-the-box configuration of Claude Code in 'auto-mode' or Codex in 'auto-review', with researchers testing Claude Sonnet 4.6, Sonnet 5, and Opus 4.8 along with GPT-5.5.

It leverages prompt injections disseminated across a library’s source code that target AI-enabled cyber defense – without the need for hooks, skills, plugins, MCP servers, or configuration files as an injection vector.

Researchers noted the study highlights the potential risks associated with rapid adoption of AI-powered security tools.

Many organizations are doing so without “consideration of the substantial and unmitigated risks associated” with the technology.

AI-related cybersecurity concerns have been rising following the launch of powerful new models such as Claude Mythos. Anthropic rolled the model out as part of a gated release to prevent misuse, and US authorities temporarily imposed export controls amidst similar concerns.

How the Friendly Fire attack works

The attack works by inserting prompt injections into documentation files and adding README files that appear to be part of routine security tooling in an open source library.

Researchers used geopy, a popular Python used for searching for geographic coordinates, but said it could work with almost any project.

When a user asks Claude Code or Codex to perform a security assessment of the repository using the default auto-mode or auto-review automated modes, the agent can be persuaded to execute a malicious binary without any warning and without requesting any further user approval.

The proof of concept is causing alarm amongst security professionals. Roey Eliyahu, CEO and co-founder of Salt Security, said this marks the latest in a string of potential risks in recent months due to manipulation of agents.

“Friendly Fire, GitLost, Agentjacking, TrustFall. Four documented attacks in the past two months, different techniques, same underlying condition,” he said.

“Untrusted text reaches an agent that can run commands. The agent cannot reliably tell the difference between the code it is reviewing and the instructions it is being given. And the attacker's payload executes on the host.”

Eliyahu emphasized that this is not a “model problem that can be patched”. All four models were vulnerable to the same techniques and payload, without any modifications for each.

“When the same attack works unchanged across two vendors and four model generations, you are not looking at a software bug. You are looking at a structural property of how these agents work."

But, said Eljan Mahammadli, head of AI provenance at Polygraf AI, this shouldn't rule out the use of AI for defensive security work.

ITPro approached Anthropic and OpenAI for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

A ransomware negotiator has been sentenced to 70 months in prison after secretly conspiring with hackers to extort clients.

Angelo Martino, 41, of Land O’Lakes, Florida, worked at US-based cyber incident response company DigitalMint in April 2023 when he started conspiring with the operators of the BlackCat ransomware group.

BlackCat paid Martino to provide confidential information about the negotiating position and strategy of his employer’s clients, along with the details of their ransomware insurance, to help maximize the ransoms paid.

Notably, Martino also conspired with two former cybersecurity professionals between April 2023 and November 2023.

Kevin Martin, 36, of Texas, was hired as Martino’s co-worker at DigitalMint after the conspiracy began. Ryan Goldberg, 41, of Georgia, was manager of incident response at Sygnia.

All told, Martino was found to have extorted five different victims as part of his collaboration with the cyber crime syndicate while the trio also worked to deploy BlackCat ransomware against victims across the country.

Assistant attorney general A. Tysen Duva of the Justice Department’s Criminal Division, said victims had shared “heartbreaking accounts of how their businesses were nearly destroyed” during the trail.

“Today’s sentence accounts for the harm Martino caused and demonstrates that the Department of Justice can and will identify and prosecute cybercriminals to the fullest extent of the law.”

Working with the enemy

After successfully extorting one victim for around $1.2 million in Bitcoin, the men split their share of the ransom three ways and laundered the funds through various means.

Jason A. Reding Quiñones, attorney for the Southern District of Florida, said more than $10 million in criminal proceeds have been seized. These assets include digital currency, vehicles, a food truck, and a luxury fishing boat.

A separate hearing has been set for September 17 to decide the amount of restitution to be ordered against Martino.

The Justice Department started working to bring down BlackCat three years ago, developing a decryption tool that allowed FBI field offices across the US and law enforcement partners around the world to help victims restore their systems.

The scheme has reportedly saved victims from paying out $99 million in ransom payments so far. The FBI also seized several BlackCat websites at the same time.

"This case sends a clear message: we will pursue the hackers who deploy ransomware, the insiders who enable them, and the money they steal from American victims,” Quiñones said.

FOLLOW US ON SOCIAL MEDIA

A 'category-level' security flaw in six leading AI coding assistants could give attackers remote control of a developer’s machine, according to researchers at Wiz.

Dubbed GhostApproval, the flaw affects some of the most popular coding tools on the market right now, including Amazon Q Developer, Claude Code, Cursor, Windsurf, and Google Antigravity.

The flaw has been reported to all six providers, with Amazon, Cursor, and Google having rated it critical or high-severity and fixed it, and there's no evidence that it's been exploited in the wild.

According to Wiz, the vulnerability is caused by a decades-old Unix primitive – symbolic links, or symlinks – which allows malicious repositories to trick AI agents into silently breaking out of their workspace sandboxes, leading to RCE and persistent access to a developer's machine.

In the case of Amazon Q Developer, the agent wrote to the filesystem before presenting the user with an Undo option. Testing by Wiz found the agent correctly identified the symlink in its internal reasoning, but proceeded with the write anyway.

Amazon has fixed the problem, which has been recorded as CVE-2026-12958.

"We have remediated this issue in language server version 1.69.0. The AWS Language Server updates automatically unless the customer's network configuration prevents it, so no action is required in most cases," the firm said in a statement.

"For existing customers, reloading the IDE will trigger an update to the latest language server version, which includes this fix. If auto-update is blocked, we recommend upgrading to the latest version of the Amazon Q Developer plugin for your IDE."

Wiz noted that new customers don't need to take any action, as the latest patched version will be downloaded automatically.

Anthropic issues customer warning

Claude Code, meanwhile, provides the clearest example of user interface misrepresentation of critical information, Wiz said.

"The agent explicitly recognized the dangerous target in its thinking - stating "this is a symbolic link to the Claude settings file" - then presented a prompt asking simply: "Make this edit to project settings.json?" the researchers said.

Anthropic, however, has rejected the threat on the basis that the user explicitly trusted the directory when starting the session and explicitly approved the file operation in the confirmation prompt.

Around the time Wiz revealed its findings, the company added a warning to users, and current versions (2.1.173+) now resolve symlinks.

Cursor's diff UI showed the symlink path; when the user clicked Accept, the backend followed the symlink and wrote to the resolved target. It's been fixed in version 3.0, and Cursor has issued CVE-2026-50549.

Google's Antigravity, meanwhile, displayed the symlink path in its permission dialog rather than the resolved canonical path. Wiz researchers were able to successfully write an attacker's SSH key via a symlink disguised as project_settings.json. Google's fixed the problem.

Windsurf flaw raises serious concerns

Notably, Wiz said Windsurf presented a particularly dangerous variant during testing of the vulnerability.

"The agent writes file modifications directly to disk before the Accept/Reject buttons appear in the UI. The confirmation dialog isn't an authorization gate - it's an undo mechanism," the researchers warned.

Wiz added that the system is compromised “the moment the agent processes the malicious instructions”. Indeed, by the time users even see the prompt asking to accept changes, an attacker’s SSH was already placed in the authorizedkeys file.

Researchers warned that the findings show that “trust boundary questions” will become critical for organizations rolling out AI agents en-masse.

"GhostApproval is a symptom of a broader challenge: building AI systems that are both powerful and trustworthy. Getting the human-in-the-loop right – truly right, not just formally present – is essential to that goal."

FOLLOW US ON SOCIAL MEDIA

The National Cyber Security Centre (NCSC) has laid out its plans for the national Cyber Shield, first announced in May this year.

The aim of the project is to build a nationwide, collaborative approach to agentic cyber defense, using frontier AI to identify, reduce, and deal with national cyber risks.

According to the NCSC, the move comes amidst concerns that cybersecurity risks are growing in “scale, speed, and sophistication” - particularly from hostile states and organized crime groups targeting public services.

"Frontier AI is accelerating this trend, with the potential to shift the balance in favour of attackers – and with serious implications for defenders,” the NCSC said.

“We need to keep our critical technology systems secure against both existing and emergent cyber threats."

As part of the project, AI systems will initially identify vulnerabilities and threats at machine speed, before moving on to automated remediation.

Further down the line, the agency expects AI to eventually generate and share insights, detect and contain breaches, and work under the control of their owners across government and non-government bodies.

These agents, the NCSC noted, will need to be built on strong foundations of data, identity, reliability, cybersecurity, and regulatory compliance.

The NCSC will first partner with network defenders across government and critical UK sectors to test and deploy new capabilities, with the plan to then transition to commercially-scalable solutions to improve national resilience.

NCSC targets reliability in Cyber Shield scheme

To make all this happen, there's a fair amount that will need to be done – some of which will present big challenges.

The NCSC highlighted the need for reliable and explainable AI for cybersecurity that can be used confidently in production environments at scale, and authorized by system owners to make safe, reliable, and significant real-time changes in support of cyber defence.

Agents will run national-level operations under the control and authority of individual organizations, and have the ability to identify, trust, and communicate between themselves.

Elsewhere, national-level scanning will involve the automated monitoring of critical UK IP ranges for exposed vulnerabilities, as well as analysis of aggregated data to understand national level exposure.

The agency noted that workflows will need to be automated to allow rapid national-scale mitigation, such as the automated blocking of known malicious domains and networks.

A big, bold plan

Plans detailed by the NCSC have been welcomed by industry stakeholders as a positive step in protecting the UK against rising threats. Whether or not this is an achievable goal is up for debate, according to Pete Luban, field CISO at AttackIQ.

"The biggest challenge will be getting government, critical infrastructure, and private industry to share intelligence in a way that is trusted and actionable," Luban commented.

"If bought into, Cyber Shield could give the UK a stronger foundation to spot risk earlier, validate defenses faster, and respond before attackers gain momentum.”

Kevin Marriott, senior director of cyber content strategy & IP at Immersive, said the true test will be in how the government makes sure the system is utilized where it can bring value and return on investment.

"It would also be beneficial to hear how they plan to deal with the output from the frontier models, and whether they put robust practices in place which enable them to deal with the outputs," he said.

"If this is part of a well-considered strategy, it represents a significant step forward. If, however, it is a move towards ungoverned AI without clear oversight or a defined plan for where and how it should be used, then it is not.”

FOLLOW US ON SOCIAL MEDIA

Email phishing has always been a simple yet effective form of attack. While the method isn’t going away, research is showing attackers evolving beyond email to multiple channels such as Slack and cloud-based platforms.

That’s according to security firm KnowBe4’s Phishing Threat Trends report, which found hackers are leveraging new “touchpoints” when targeting victims, with calendar invites and messaging tools a frequent tactic. The company recorded a 41% increase in Microsoft Teams-based attacks between October 2025 and March 2026 as adversaries strived to create more avenues for success.

With AI offering cybercriminals the ability to supercharge phishing attacks further, what should businesses be doing to manage the risk?

Phishing evolution

In the past, phishing attacks relied on adversaries targeting a wide range of users in the hope that some of them would engage with malicious content, or give away valuable information. But since then, businesses have improved their security, with tools such as multi-factor authentication (MFA) used as standard. This has forced attackers to utilize more sophisticated techniques.

“When attackers cannot compromise technical controls, such as MFA, they are instead seeking to bypass the technology and move the attack onto end users through social engineering,” says Luiz Simpson, head of offensive security at Bridewell.

He cites the example of illicit consent grant attacks in Microsoft 365, which trick users into granting access to data. These attacks often “go completely under the radar”, says Simpson. “Users will accept an untrustworthy app while logged into their cloud workspace and under the legitimate Microsoft or Google workspace platforms. These attacks don’t require any bypass of MFA and almost always aren’t flagged by detection and response.”

Another reason attackers are targeting multiple channels is the fact that the workplace itself has changed. “Employees now spend far more time in collaboration platforms, cloud applications, messaging tools, and video conferencing environments,” says Ray Canzanese, director of Netskope Threat Labs. “Attackers are following that behavior.”

Canzanese describes how phishing lures are increasingly delivered through platforms such as Microsoft Teams, Zoom and fake meeting invitations. “These are designed to exploit the trust users place in familiar collaboration workflows.”

From a criminal perspective, multi-channel phishing is becoming “progressively structured”, according to Benson Varghese, a criminal lawyer and founder and managing partner at law firm Varghese Summerset. Rather than flooding potential victims with random messages, phishers will prepare their sequence, test the response rate, and react to engagement in real-time, he says. “This makes attacks more focused and effective.”

Security shift

Experts believe the evolution of phishing requires businesses to change the way they think about securing communication channels.

The shift means no longer treating phishing as purely an email security problem. “Security teams need visibility across a much broader digital environment that includes collaboration tools, cloud platforms, browsers, unmanaged devices and AI applications,” according to Canzanese.

Almost all social media platforms include user messaging, which supports the distribution of links and images. Yet historically, the focus on preventing social engineering attacks has been around traditional email-based messages, encouraging users to avoid clicking links. “None of these defences will help prevent attackers from contacting end users and sending malicious content across other channels,” says Simpson.

“As these interactions do not arrive via traditional email, there is no URL rewriting, sandboxing or inspections of content,” he points out. “This leaves you with just endpoint and identity-based controls to protect users.”

However, endpoint detection and response (EDR) solutions traditionally fall short in having visibility of what goes on within a browser, Simpon explains. “If a user is to bring your own device (BYOD) with access to enterprise resources, you are very much on the back foot to prevent identity-based attacks.”

Managing multi-channel phishing

The move to multiple channels is just one way phishing is changing. In tandem, AI is accelerating the quality and scale of attacks, while lowering the barrier to entry for new cybercriminals, according to Danny Jenkins, CEO of ThreatLocker.

“Attackers no longer need to spend hours researching targets or carefully crafting convincing messages,” he tells ITPro.

“AI can generate highly personalised, context-aware phishing content in seconds – whether that’s a Teams message, a fake document-sharing notification, or a voice deepfake impersonating a colleague or executive.”

There is also a rise in adaptive social engineering, where AI-driven phishing attempts evolve in real time based on how a user responds, he warns. “Instead of relying on static messages, these interactions can mimic natural conversations, making them significantly more convincing,” explains Jenkins.

The threat from multi-channel phishing is certainly growing, but firms can help boost defenses by making several key changes. Some of these are cultural.

From a security perspective, organizations need to accept that they will not stop every phishing attempt across every channel, says Jenkins.

“Humans are imperfect, and mistakes will happen, and no amount of training can prevent every phishing attempt.”

Instead, the priority should be reducing the impact of an attack and tightly controlling access, rather than trying to eliminate exposure, he advises.

Passkey use can help, says Simpson, pointing out that the UK National Cyber Security Centre (NCSC) has started to actively recommend the adoption of passkeys over passwords and MFA.

“Passkeys help address many of the shortfalls of traditional passwords and MFA. Notably, they’re resistant to phishing because they’re tied to the legitimate website only; they are fast and convenient, and cannot be stolen if a website is breached.”

As with traditional phishing, organizations should adopt a strategy of user awareness and technical controls to defend against multi-channel attacks, according to Simpson.

This means ensuring users are aware that a spectrum of social engineering attacks are possible, beyond solely email-based phishing. Users, especially those in high-risk roles, such as executives and finance teams, should be targeted with training to empower them to identify and report attacks, Simpson advises.

“This should be an ongoing message and constantly refreshed based on active attacks seen in the wild, rather than just an annual policy that’s read and signed off.”

A security firm has spotted what it claims is the first documented case of a ransomware operation run entirely by a large language model.

The Sysdig Threat Research Team said the operator, dubbed JadePuffer, is the first agentic threat actor, describing it as using a known flaw in AI app builder Langflow to gain access to credentials and other key data.

Thereafter, researchers noted it took over a production database and encrypted it for extortion purposes.

"JadePuffer is a warning sign," Michael Clark, Sysdig’s director of threat research, said in a blog post.

"It’s a marker of where extortion tradecraft is heading. An autonomous agent reasoned about its targets, harvested and reused credentials, moved laterally, established persistence, and destroyed a database, narrating its own intent the entire way."

Clark has clarified that though the attack operation was run by an AI, the attack was still organized by a human who set up the infrastructure, found the initial credentials to break in, and chose a victim. But the rest of the attack was managed by the LLM itself.

Alarming attack

Clark noted that JadePuffer's payloads were "self narrating", containing detailed notes that a human wouldn't bother to write but an LLM generates innately about why each step was taken, including prioritization of targets. That narration data could prove useful for security teams looking to defend against such attacks, Clark added.

"The operation also adapted in real time, retrying failed steps within refined parameters," Clark added. "In one sequence, it went from a failed login to a working fix in 31 seconds."

That is perhaps the most alarming aspect of the incident, according to Roey Eliyahu, CEO and co-founder of Salt Security.

"A human attacker who fails an initial payload waits, reassesses, consults, and tries again on a different timeline," Eliyahu said. "An agent that fails a payload corrects and retries in under a minute. That compression of the attack cycle means the window between first detection signal and material damage is now measured in seconds, not hours."

The JadePuffer system even wrote a ransom note complete with Bitcoin address and Proton email contact, Clark noted, though the former appears to be a wallet address frequently used as an example in explainer text online.

That’s either a coincidence, said Clark, or a hallucination by the LLM due to the frequency of that address online, and therefore used in training data.

Clark also noted that the encryption key was generated and essentially random, so the victim would not be able to decrypt — even if they paid the ransom. The victim organization wasn't disclosed.

Warning about the future of security

While JadePuffer is just one incident, it shows that AI can help automate old vulnerabilities and that ransomware no longer requires skills to pull off an attack, according to Sally Vincent, senior threat research engineer at Exabeam.

"While the attack relied on known, older vulnerabilities rather than new exploits, it demonstrates how AI can automate and accelerate the exploitation of unpatched systems," Vincent said. "It also serves as a reminder that patching known vulnerabilities remains important, since AI can make exploiting them faster and more efficient."

While Clark stressed that none of the attack techniques were novel or sophisticated, JadePuffer is interesting because it was strung together into a complete ransomware operation by an AI model.

"The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero," he commented.

That means security professionals should expect to see more like this, as well as a higher volume of attacks, and should proactively protect "exposed application servers, unhardened configuration stores, and internet-facing database admin accounts," Clark added.

Salt Security's Eliyahu added: "The question every security team should be asking after this report is: what is holding credentials in our AI-adjacent infrastructure, and what can those credentials reach?"

FOLLOW US ON SOCIAL MEDIA

The UK government said more than 60 businesses have signed up for its Cyber Resilience Pledge so far, including M&S, Nationwide, ITV, Microsoft UK, and Cloudflare.

Announced in May, the voluntary scheme sees businesses committing to three concrete actions to improve cybersecurity capabilities.

They must commit to making cyber security a board-level responsibility, by implementing the Cyber Governance Code of Practice and ensuring all board members complete the NCSC’s Cyber Governance Training.

They must also register for the NCSC’s free Early Warning service, a tool that alerts organizations to potentially suspicious activity on their networks, and commit to taking a risk-based approach to requiring the government-backed Cyber Essentials certification across their supply chain.

The pledge has been designed primarily for medium and large organizations, with other signatories including Deloitte, Accenture UK, Vodafone Group, and VodafoneThree, but is open to businesses of all sizes and from all sectors.

"Today, some of Britain’s biggest businesses are taking action to strengthen their cyber defences and setting a powerful example for others to follow. By signing this pledge, they are showing that cyber resilience is no longer just an IT issue - it is a business imperative," said technology secretary Liz Kendall.

"The steps in this pledge are practical, achievable and proven to make a difference. Today’s signatories are leading the way, and I encourage organizations across the UK to follow their example."

Cyber Charter to beef up critical services

Alongside the pledge, the government has been developing a Cyber Charter for 39 companies designated as strategic suppliers for delivering critical services to the government.

These organizations have been invited to sign the pledge as an initial commitment to bolstering their cyber resilience, although so far only a little more than half have done so.

"We have long held the view that cyber resilience is a critical business and organizational enabler. It underpins our growth, our economic security, and the safety and security of our people," said Julian David, CEO of techUK.

"With the average cost of significant cyber-attacks to the UK economy recently estimated to be £14.7 billion annually – the equivalent of 0.5% of our GDP – it’s clear that cyber security and resilience must be recognised as a leadership responsibility and should no longer be viewed as an IT issue alone."

Pledge targets national resilience

Moves to bolster national resilience capabilities come amidst an increase in malicious cyber activity in the UK.

The National Cyber Security Centre (NCSC) recently confirmed it handled 204 nationally significant incidents in the year to September, up from 89 the year before.

The average cost of an attack on an individual UK business now stands at almost £195,000, with the annual cost to organizations estimated at £14.7 billion - and that’s in addition to the costs of wider economic disruption.

Last year, experts estimated that the attack on Jaguar Land Rover (JLR) cost the UK economy roughly £1.9 billion, making it the most costly cyber incident in British history.

FOLLOW US ON SOCIAL MEDIA

Cybersecurity experts have issued an alert amid reports that hackers accessed login credentials belonging to UK government officials and Foreign Office staff.

The credentials, which are reportedly being sold on the dark web, were exposed as part of the ongoing FortiBleed attack campaign.

FortiBleed targets internet-facing Fortinet VPN and firewalls, and is believed to have affected more than 70,000 devices spanning 194 countries since it was first uncovered last month.

Analysis from SOCRadar, for example, identified a vast database containing login credentials. The threat intelligence firm has since attributed FortiBleed to the Lynx/INC ransomware group.

While this database was believed to have been limited to basic usernames and passwords, reports from The Telegraph suggest some exposed details include privileged Fortinet credentials.

Volodymyr Diachenko, a security researcher who first uncovered the threat campaign, told the publication these credentials could give bad actors access to the Foreign Office’s “core networks” along with other government departments.

Some Foreign Office credentials are now being sold on the dark web, according to reports, going for up to £40,000.

Arctic Wolf CISO Adam Marrè warned that the incident could create a domino effect, impacting other government departments and also local authorities and public services.

According to The Telegraph, credentials at NHS trusts, energy companies, and local councils were also hosted in the illicit database.

“This major breach of email accounts of UK government officials and overseas Foreign Office workers is the latest development in the ongoing FortiBleed attack,” he said.

“While it may be tempting to think this is a simple credential-stuffing operation, our threat team found the threat actors have built a highly sophisticated and repeatable credential factory,” he said.

Marrè noted that analysis of the incident conducted by Arctic Wolf shows threat actors appear to have been using automated tools to harvest logins and target gateways at “exponential speed and volume”.

“This means while today it’s the Foreign Office which has been affected, the risk to every organization has increased exponentially.”

Back and forth on FortiBleed

The discovery of the FortiBleed sparked somewhat of a back and forth between Fortinet and security researchers last month. After threat intelligence firm Hudson Rock published a blog detailing the campaign, Fortinet disputed some of its claims.

Fortinet told ITPro at the time that the exposed credentials weren’t the result of a fresh breach, insisting that those following best practices were safe from exposure.

"Fortinet is aware of a reported third-party credential-harvesting campaign targeting Fortinet firewalls and VPN gateways. We are committed to safeguarding our customers, and we diligently and continuously monitor threat actor darknet activity,” a spokesperson for the company said.

“Based on our initial analysis, the data involved is likely a resharing of data from previous incidents, as well as brute forcing of credentials, and not related to any current incident or advisory."

Hudson Rock, meanwhile, said the campaign went “beyond simply credential reuse,” highlighting that hundreds of organizations are thought to have been affected.

FOLLOW US ON SOCIAL MEDIA

Criminals are posing as Interpol cyber crime investigators to target small businesses across Europe, Asia, the Middle East, and North America.

According to new research from Bitdefender, the phishing messages claim to contain evidence that the recipients are carrying out suspicious activity, pressuring them into opening a password-protected archive.

"Based on information that has come to our attention, there may be activities involving accounts, systems or services associated with your organization that warrant further examination. We have obtained information and video material that may assist in your assessment of the matter," the emails read.

"We recommend conducting an internal review to determine whether any unauthorized, suspicious or potentially fraudulent activities have occurred. Prompt attention to such matters may help mitigate potential financial operational, reputational or regulatory risks."

Upon opening the link, recipients are directed to a Proton Drive-hosted file that delivers a ransomware payload hidden within multiple archive layers. Once executed, researchers said the malware seeks to encrypt files across available drives and presents victims with a ransom message.

The campaign is targeting organizations across multiple industries, including food and agriculture, legal services, pharmaceuticals, media, technology, and finance.

The ransomware is relatively simple, according to Bitdefender researchers. The code contains hardcoded values, including the password used during encryption and decryption, and lacks many of the features typically associated with large ransomware operations.

Interestingly, victims are instructed to contact the attackers through a Tox chat channel to negotiate a ransom, rather than through the more usual dedicated negotiation portal or victim site.

This, researchers noted, is another indication that this is likely a custom-built operation, perhaps assembled using publicly available code and tools rather than the work of an established ransomware group.

What small businesses need to know

Javvad Malik, Lead CISO advisor at KnowBe4, said that impersonating Interpol – or law enforcement in general – is specifically designed to trigger a “rapid emotional response” and dupe victims into ignoring red flags.

"What is interesting about this campaign is that it targets small business,” he said. “These are often understaffed and have no security or even IT expertise on hand, so it's not difficult to see why people would easily fall victim to these kinds of attacks."

Bitdefender has warned small businesses to be on the alert, urging them to verify all unsolicited correspondence by reaching out through official channels to confirm whether the communication is legitimate.

"One of the biggest red flags in this campaign is the delivery method itself," researchers said. "While the attackers impersonate Interpol, legitimate law enforcement agencies don't send unsolicited emails containing Proton Drive links to password-protected files and ask organizations to review alleged evidence of wrongdoing."

They should treat password-protected archives with caution, especially when the password is included in the email. Showing file extensions on Windows devices will make it easier to spot executables masquerading as videos or documents, and multi-factor authentication (MFA) should be used wherever possible.

Elsewhere, the company urged small businesses to ensure staff are trained to help spot tell-tale signs that communications are fraudulent.

"Small businesses are often viewed as easier targets than large enterprises," the researchers warned.

"Many operate without dedicated IT teams or cybersecurity staff. Security responsibilities are often shared among employees who already wear multiple hats, and limited budgets can make it difficult to invest in advanced security measures or ongoing training."

FOLLOW US ON SOCIAL MEDIA