The FBI has confirmed it is “actively and aggressively” investigating a breach which allegedly exposed employee and operational data.

“The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the http://FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII),” the agency said in a post on X.

The statement comes after the ShinyHunters ransomware group claimed to have compromised critical systems through a third-party vulnerability.

This, the group said, enabled access to several systems, including jobs portals and background check software, as well as a system used to store information relating to investigations.

According to ShinyHunters, the third-party software inquisition is Oracle PeopleSoft, an enterprise resource planning (ERP) suite used in human resources (HR), finance, and supply chain management.

Earlier this year, ShinyHunters claimed responsibility for a string of attacks after leveraging a zero-day vulnerability in the ERP software. Car manufacturer Nissan and the University of Nottingham were two of a string of organizations impacted.

In its statement on X, the FBI said the “point of breach is still undetermined”, adding that it is working closely with third-party providers related to impacted systems.

FBI breach could have huge consequences

The exact scope of data compromised in the breach remains unconfirmed, however, the group claims to have stolen data on thousands of employees. This includes agent names, badge numbers, and information such as home addresses and contact details.

Reports from Reuters suggest this also includes highly sensitive data on investigations into foreign intelligence operations as well as drug cartel activity.

If confirmed, exposure of this data could have serious real-world consequences, according to Joe Hancock, partner and head of cyber risk and complex investigations at law firm Mishcon de Reya.

“If the reports are accurate, this is a serious breach. This kind of data has real utility in the wrong hands, as we saw with the PSNI breach exposing people in sensitive roles translated into real-world risk,” he said.

“The fact the data appears to have come from an online jobs portal may limit some of the operational impact, but it doesn’t make the exposure of individuals’ identities any less serious,” Hancock added.

“Linking personal information to specific intelligence, counterespionage, or surveillance roles takes this well beyond conventional identity theft.”

Andrew Brandt, principal threat intelligence incident commander at Huntress, echoed Hancock’s comments. According to Brandt, a serious concern centers around whether the group might sell data to other criminal or nation-state groups that “could put it to more damaging use”.

“The FBI handles some of the most serious interstate and transnational crime investigations. It doesn't take much imagination to picture scenarios where employees or their families could be threatened or harmed by this kind of information being released,” he said.

ShinyHunters claims attack is not financially motivated

In a message on its dark web leak site, ShinyHunters claimed the attack was not financially motivated, but instead comes in response to an advisory by the agency which misrepresented the group’s activities.

The advisory, published by the FBI in May in the wake of attacks on the Canvas academic management system, said threat groups such as ShinyHunters often use “real or exaggerated claims” to pressure organizations into paying ransoms.

The ransomware gang has called on the agency to retract the advisory or it will publish the compromised data.

ShinyHunters has grown to become one of the most aggressive and active threat groups in the ransomware space, having claimed responsibility for attacks on Salesforce, Canvas, and the European Commission in recent months.

As ITPro reported this week, the group also claims to have hacked a rival ransomware group, Clop. This incident appears to have stemmed from a disagreement between the two ransomware gangs.

FOLLOW US ON SOCIAL MEDIA

OpenAI agents hacked into an Australian Medicare data portal, according to reports, and officials are furious that it took months for the company to disclose the incident.

Australian prime minister Anthony Albanese revealed that an OpenAI agent breached a Medicare statistics website back in June, but the government wasn't alerted to the activity by the AI developer until 10 September.

Albanese said he'd shared "Australia's extreme concern about this incident" to OpenAI CEO Sam Altman.

"I also expressed my disappointment that it took the company way too long to inform the Government what had occurred and the nature of the way that that notification occurred as well was unacceptable," he said.

Notably, Albanese hit out at the “unacceptable” manner of disclosure by the company. OpenAI notified authorities via an email sent to a public-facing disclosures mailbox, rather than by directly contacting the government.

In response, the government is setting up a taskforce to investigate the incident, conduct a review into AI-related cyber incidents, and consider whether a criminal offence may have occurred.

A spokesperson for OpenAI said: "We notified the organizations and are providing technical information to support their investigations and help address potential security vulnerabilities."

What happened in the OpenAI Medicare breach?

The infiltration happened in June, and OpenAI told the Australian government it had spotted the activity in August. OpenAI attributed the gap between discovery and notification to "validating and investigating the facts".

The agent in question had been tasked with finding information online about public medicine spending as part of an internal test.

The data accessed did not include individual private or financial data, as the portal in question doesn't include such information. However, non-public facing data including aggregate statistics and internal file names were viewed.

An OpenAI spokesperson said it had been looking for misaligned model activity when it spotted the incident.

"During this review, we identified activity involving several Australian government websites and services as our models attempted to look up answers, and available statistics for questions about Australia during an internal evaluation," the company said. "In the course of that, our models took actions we did not intend."

Could OpenAI face criminal charges?

Deputy prime minister Richard Marles told reporters that the Medicare incident was "utterly unacceptable", adding that a task force will examine whether the law has been broken, as it "definitely does raise questions about whether the law has been broken in respect of this."

PM Albanese also said that part of the investigation will consider whether the incident needs to be referred to local police.

In Australia, computer intrusions are prohibited by its cyber crime law, as is the creation and distribution of malicious software. The task force will also look into "whether or not the legal regime we have in place is fit for purpose in a world where we have an emerging AI capability."

Concerns mount over ‘rogue AI agents’

The admission by OpenAI marks the latest in a string of apparent ‘rogue AI’ incidents involving the company and counterparts in the industry.

In July, the company admitted that agents had breached a Hugging Face production environment after breaking out of a sandbox test environment.

Just last week, OpenAI revealed six other instances of misaligned behavior by AI agents.

Andrew Kay, director of systems engineering APJ at Illumio, said there will likely be “more high-profile breaches like this” unless robust guardrails are implemented to prevent agents ‘going rogue’.

“As increasingly autonomous and capable agents emerge, we cannot rely on the illusion of guardrails or assume an AI will always behave as intended,” he said. “It will take whatever action is necessary to achieve the task it has been set.”

“Rogue or misbehaving AI agents will only become more competent and more prevalent,” Kay added. “The priority must be ensuring that if one breaches a boundary, it cannot access sensitive material, cause serious damage or bring essential services to a standstill.”

Laura Ellis, senior vice president for artificial intelligence at Arctic Wolf, said the incident is a “timely example of a cyber risk businesses need to be preparing for now”.

“While the details of this incident are still being investigated, the security lesson is clear and security fundamentals remain unchanged,” she said. “All organizations deploying AI agents should secure them at least as tightly as any other identity: strict permissions, clear guardrails, continuous monitoring, and the ability to act fast when an agent steps outside its intended bounds.”

Ellis added that safeguards are “only part of the equation”, however. Disclosure of an incident within a “responsible timeline and with appropriate transparency” is vital.

FOLLOW US ON SOCIAL MEDIA

Barracuda Networks has announced the launch of a new AI security and governance solution for resource-constrained organizations and managed service providers (MSPs).

Slated for availability from October 2026, Barracuda Data AI Security integrates AI visibility, data protection, threat defense, and governance capabilities into a single, easy-to-deploy offering.

Built on the company’s BarracudaONE platform, the solution aims to help businesses accelerate their AI adoption by securing sensitive data, enforcing responsible AI use, as well as demonstrating compliance.

The move comes as organizations continue to embrace AI technologies faster than they can implement safety and governance measures. According to recent findings from Barracuda Research, nearly half of senior IT leaders believe their teams lack the necessary skills to securely govern AI that is already present across their businesses.

In an announcement, Barracuda chief product officer Neal Bradbury said the speed of AI adoption is creating “one of the most urgent new security and compliance challenges” as organizations struggle to keep pace.

“Organizations need a practical way to secure AI as a new attack surface, protect sensitive data, enforce responsible use, and demonstrate compliance,” he explained.

“At the same time, they need the confidence to embrace and accelerate AI adoption as a driver of productivity and innovation. Barracuda AI Data Security delivers those capabilities in a single, easy-to-deploy solution.”

Encouraging safer AI adoption

AI Data Security is powered by Barracuda’s IQ AI engine and offers protection across more than 1,300 generative AI tools – including Copilot, ChatGPT, Claude, and Gemini.

The solution serves up a host of benefits for organizations, including full visibility into AI usage and the safe enabling of approved AI tools, alongside an ability to inspect prompts and uploads in real time.

Sensitive information such as passwords, customer data, and proprietary code are automatically blocked from reaching genAI services, Barracuda said, while AI threat detection guards against the likes of prompt injection, jailbreak attempts, and policy-violating topics.

Elsewhere, the offering also delivers a compliance-ready audit trail, capturing AI interactions with one-click exports for insurers and auditors, alongside flexible AI policies that enable tailored AI rules.

Strengthening protection for MSPs

Barracuda said its new solution has been designed to help smaller businesses and MSPs that may be struggling with overcoming complexity, skill, and cost hurdles around AI adoption.

With rapid deployment in minutes, the offering eliminates the need for specialized AI security expertise thanks to familiar firewall style workflows, alongside guided configuration through Barracuda’s Bailey AI assistant.

MSPs can also leverage centralized multitenant management and bundled pricing designed to fit their existing service models.

Barracuda Data AI will be included in the vendor’s SecureEdge Premium Access platform at no extra cost, the firm added, while further tools will be added in due course.

“This is the first of several innovations that will expand our AI Security suite and help businesses unlock AI's full potential, securely,” Bradbury said.

FOLLOW US ON SOCIAL MEDIA

The threat from quantum is already on most security leaders’ radars, but experts argue the reality is growing near. Concerningly, the figures show a lack of preparation for quantum capabilities that will give adversaries the ability to break encryption.

Organizations could face a ticking quantum time bomb, according to research from DigiCert, with the vast majority of firms aware that they aren’t properly prepared. While an overwhelming 85% of IT and security leaders believe that quantum computing advances will break existing security standards within a decade, only 7% have deployed quantum-safe certificates so far.

According to recent data from IBM's Cost of a Data Breach Report, 69%of organizations have no plan in place for post-quantum cryptography (PQC).

With ‘harvest now, decrypt later’ attacks a real risk for firms, what steps should CISOs be taking now to ensure they are prepared?

The quantum timeline

No one can give an exact date for when quantum computing will be able to break today’s widely-used public key cryptography, but the risk is close enough that governments, standards bodies and major technology companies are already acting.

The US National Institute of Standards and Technology (NIST) released its first three final post-quantum cryptography standards in 2024, while the UK’s National Cyber Security Centre (NCSC) has set a target for organizations to complete PQC migration by 2035.

Technology giants such as Cloudflare and Google are setting their own post-quantum security milestones for 2029.

The quantum threat is often compared to the millennium “bug” (Y2K). It has even earned its own moniker: “Y2Q”, or “Q-Day”.

But unlike Y2K, there won’t be “a single moment of failure”, says Mark Hughes, global managing partner, cybersecurity services at IBM. He says the reality could see risks materialize over multiple years. “Different cryptographic systems will fail earlier than others, and that all depends on design and key size,” he predicts.

Harvest now, decrypt later

DigiCert’s survey highlights concerns about ‘harvest now, decrypt later’ attacks, where adversaries steal information for use at a later date. Over 80% say at least some of their encrypted data is vulnerable, with around one-third reckoning more than a quarter could be at risk.

Simon Pamplin, chief technology officer at Certes, describes how attackers do not need a large-scale quantum computer today to create a future breach. “They can collect encrypted data now, store it, and wait until the capability exists to decrypt it.”

He says the quantum threat timeline is “much shorter than many organizations assume”.

“Whether a cryptographically relevant quantum computer arrives in 2029, 2035, or later, the data being harvested today may still be valuable when that moment arrives.”

Firms are often unaware of the type of data at risk. “People often think about passwords and payment details, but they're usually not the biggest concern,” says Tristan Shortland, CTO of Infinity Group. He says the most exposed data is information with a long shelf life: “Intellectual property, product designs, merger and acquisition discussions, healthcare records, legal documents and sensitive communications that retain value for years.”

This matters most in sectors with complex operational or national security requirements, including critical national infrastructure, financial services, energy and manufacturing, says Ben Packman, CSO at PQShield, which helped to create the quantum standards being enforced by NIST and the NCSC. “One unsupported system, legacy platform or unprepared supplier can create risk across a much wider technology estate.”

At the same time, quantum poses other threats beyond attackers stealing data to decrypt at a later point. “If future quantum computers are able to break the cryptography behind digital signatures and certificates, attackers could potentially make malicious software, fake updates or fraudulent communications appear legitimate,” warns Packman.

Mitigating the quantum threat

With the risks in mind, it makes sense to start preparing to secure data now to mitigate the quantum threat. This means building cryptographic agility into the systems, suppliers and upgrade cycles organizations already rely on, experts say.

“Organizations need cryptography that is agile enough to evolve as standards mature, threats change, and new implementation requirements emerge,” advises Packman.

He believes preparation starts with understanding where quantum-vulnerable public-key cryptography is used, which systems are most exposed, and which suppliers' systems depend on.

Pamplin concurs. From there, companies should “prioritize long-life and high-value data”, rather than “trying to treat everything equally”, he advises.

“80% of your data loss risk sits within 20% of your applications. That is where you should focus first.”

NIST calls for vulnerable public key algorithms to start being deprecated after 2030 and generally disallowed after 2035. Yet preparation must come sooner, says Paul Holt, group VP EMEA at DigiCert.

He warns that the process of inventorying an organization’s use of cryptography across the enterprise, creating post-quantum roadmaps for each use case, and executing the transition “can span many years”.

At the same time, he points out that beyond understanding quantum, security leaders are “struggling to convince the rest of the business that budget and resources are needed now”.

This is where crypto-agility becomes essential, according to Holt. “Weathering the transition to a quantum-safe posture demands the ability to adapt and scale digital certificate management. Meanwhile, organizations must migrate cryptography to approved post-quantum algorithms.”

Finally, he says certificates must be “immediately discoverable and manageable continuously and at scale”.

Yet when considering quantum preparedness, it’s also important not to rush. The quality of implementation will matter just as much as the standards themselves,” says Packman.

“Replacing cryptography as part of a planned upgrade is cheaper and less disruptive than retrofitting it later under tighter deadlines.”

He believes every scheduled technology refresh is “a chance to introduce quantum-safe capability, assess supplier roadmaps, validate implementations or retire systems that may become difficult to support later”.

While quantum attacks are still likely to be some years away, experts think IT and security leaders should start to view the area as part of the bigger picture. Shortland believes quantum is increasingly a governance issue.

“Boards routinely assess climate, geopolitical and supply chain risk over a 10-year horizon,” Packman adds.

“Quantum belongs in that category because it has the potential to undermine decisions being made about data today.”

Microsoft has disrupted the EvilTokens cyber crime platform in a coordinated campaign that saw 50 websites seized and two men arrested in the UK.

The EvilTokens phishing as a service (PhaaS) platform emerged in February on Telegram, giving cyber criminals AI the ability to tailor phishing lures and analyze compromised inboxes to identify high-value targets.

In the short time it’s been up and running, the platform has been used to compromise more than 12,000 inboxes at more than 10,000 organizations.

Campaigns have targeted various industries, including wholesale distribution, construction, financial services, real estate, higher education, and healthcare, with most activity in the US, Canada, the UK, Australia, India, and France.

Customers paid a $1,500 fee up front to use the service, with a recurring $500 subscription for continued access to the kit and control panel.

This kit offered further products, including Antibot redirector, B2B Sender, Office 365 Capture Link, and a Simple Mail Transfer Protocol (SMTP) Sender, each of which carried additional monthly fees.

What hackers got with EvilTokens

Subscribers were offered personalized lures, with AI used to create targeted phishing emails that were specifically aligned to the target’s role.

According to Microsoft, themes used to increase the chances of a response included document signing services, its own cloud services, third-party services such as cloud identity, file hosting and payment or invoicing, as well as other miscellaneous services like voicemail and eFax.

Notably, the service was centered around an AI-style chatbot that could analyze a victim’s inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other situations where fraud was most likely to succeed.

It could even recommend strategies for carrying out fraud, including drafting messages that impersonated trusted contacts to help criminals trick their victims into taking action.

"AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible," said Steven Masada, associate general counsel and general manager at Microsoft’s Digital Crimes Unit.

How Microsoft tackled EvilTokens

Microsoft, with authorization from the US District Court for the Eastern District of Virginia and the help of several other companies, has now seized 50 websites used to operate the service.

More than 150 other domains tied to its supporting infrastructure have also been seized.

"While EvilTokens used AI to identify targets and prioritize fraud opportunities, Microsoft investigators used reverse engineering and AI-powered tools to analyze evidence, accelerate the investigation, and identify the infrastructure supporting the service," Masada said.

Cloudflare, meanwhile, was able to identify the complete list of domain infrastructure and hundreds of Cloudflare accounts used by EvilTokens’ customers.

It carried out a technical sweep, blocking hundreds of domains and killing malicious Cloudflare Worker scripts. Where infrastructure couldn't be legally seized, it made use of interstitial warning pages.

As a result of the operation, the UK Metropolitan Police Service’s cyber crime team has now arrested two men, aged 32 and 38, suspected of being involved.

Authorities also seized digital devices and other items for examination. Both men have been released on police bail while the investigation continues.

FOLLOW US ON SOCIAL MEDIA

The National Cyber Security Centre (NCSC) has issued advice on how cybersecurity professionals can adopt agentic AI to help automate security tasks and manage risks.

Using AI automation for defense isn't generally about overcoming technical challenges, according to Dave Chismon, NCSC CTO for architecture, but more of a question of organizational politics, meaning that defenders can't simply put AI to work in the same way attackers can.

"This is an inconvenient truth, as it suggests that the threat from AI-enabled cyber attacks will grow, whilst autonomous / agentic cyber defense might struggle to keep up unless we approach things differently," he said.

"Rather than trying to mimic attackers’ use of agentic tooling (and risk breaking things), defenders need to solve the problem by explicitly considering the constraints."

Notably, the NCSC said automation can involve offensive techniques being applied defensively, such as penetration testing and vulnerability research or discovery.

This generally happens in a way that minimizes risks to the business; applications are tested before they go live, and vulnerabilities are handed to development teams to fix.

Elsewhere, technical and dynamic approaches can be used for cyber defence - but also need evaluating from a business point of view.

"Establishing a SOC is also typically a lengthy (and often expensive) process. Legal aspects and policies need to be agreed, and data then exported from live systems to a new platform where malicious activity can be detected and triaged before the team takes action," said Chismon.

Both mean doing a lot of work up front to show that vulnerability detection or missing patches won't harm the business.

A new framework for agentic AI adoption

To help with this, the NCSC has outlined a framework for estimating the 'riskiness' of a defensive action and identifying the lowest-risk actions that can be automated – these are often tasks that involve advising a human, rather than affecting a system directly.

Some of this will be covered by the government's planned Cyber Shield, a national-scale agentic cyber defence ecosystem, with its ‘AI for Cyber Defence’ problem book expected soon.

However, Chismon warned that more research is needed on agentic AI, particularly in terms of how to deterministically prove that ‘low risk’ actions really are low risk.

Examples include using AI to help analyse traffic logs and show conclusively that the organization does know all the routes clients connect by, or establishing whether AI can reverse engineer or otherwise assess a system and its binaries to show exactly which network calls it could ever make.

"Answering these questions will give us, and the organizations we protect, the confidence to take automated defensive actions. Furthermore, it opens up the chance to automate the hardening of systems and reduce attack surfaces and exposure, which will be crucial in combating AI-enabled cyber attacks," said Chismon.

"All these efforts will take time, effort, and research. Organizations cannot risk just waiting for agentic defence to roll in and protect them; they also need to be focussing on improving their security the traditional way."

FOLLOW US ON SOCIAL MEDIA

Cybersecurity teams are being pushed to breaking point, according to new research, with sluggish workforce growth struggling to keep pace with a rising tide of attacks.

In a new survey from ISACA, more than one-third (38%) of European IT and cyber professionals said their organization has faced more attacks this year than all of 2025.

Yet despite escalating threats, more than half (56%) said they remain chronically understaffed and underfunded (55%).

Chris Dimitriadis, global chief strategy officer at ISACA, said the survey shows many organizations are struggling to adapt to an increasingly perilous threat landscape.

“The growing gap between rising threats and under-resourcing for cybersecurity is taking a toll on the people tasked with managing it,” he commented. “Too often we are seeing budgets being sunk into crisis response, but there’s still a distinct lack of investment in the workforce, training, and resources needed to prevent attacks and protect organizations in the first place.”

Dimitriadis added that better funding and a “clear path for improving cyber resilience” should be a C-suite priority.

Regardless of repeated warnings over cybersecurity threats, things are expected to deteriorate further, according to ISACA. More than half (54%) of cybersecurity professionals said they expect their organization to experience a serious cyber attack within the next year.

Cybersecurity teams face evolving threats

The types of threats teams face are also expanding and accelerating, which is placing additional pressure on practitioners. Social engineering attacks ranked as the most common threat encountered by teams, cited by 46% of respondents.

Crucially, these techniques are now being supported and supercharged by AI, creating new risks for teams and allowing threat actors to ramp up and refine targeting.

The findings from ISACA follow analysis from Kaseya earlier this year, which specifically highlighted the use of AI in phishing attacks. Research from the firm warned that AI-generated phishing has now “become the baseline” for threat actors.

All told, ISACA said AI presents “difficult and serious challenges” for cybersecurity teams. Attacks that previously took days or weeks are now being automated at scale, allowing threat actors to “operate at the speed of intent”.

Fighting fire with fire

While AI-powered threats pose a serious risk for teams, ISACA noted that the technology is helping them keep pace with escalating threats.

In a statement, the association said AI’s “exponential growth has proved to be an aid” for practitioners – and use of the technology in frontline operations is expanding rapidly.

More than one-third (37%) of respondents now use AI to automate threat detection and response, for example. While this marks just an 8% increase compared to 2025 figures, it highlights a step in the right direction for teams.

“AI is also being used for endpoint security by 29% and to automate routine security tasks by 35%,” ISACA said in a statement.

Growing stress

This combination of pressures on cyber teams is having a direct impact on workforce morale, according to ISACA. Nearly three-quarters (72%) of respondents said their role is now more stressful compared to five years ago.

Threat landscape complexity was cited as the leading factor behind this, cited by 72% of practitioners. However, other reasons cited include unrealistic expectations and too much work (57%) and a lack of relevant skills training (35%).

Notably, while cyber professionals have raised repeated concerns on this front, ISACA said 21% of companies still take “no action” to mitigate burnout.

Burnout has been a long-running issue in the cybersecurity sector, and one that continues to plague organizations.

An April 2026 survey by the Information Systems Security Association (ISSA) aligns closely with ISACA’s research. Nearly seven-in-ten workers revealed their jobs have become more difficult over the last two years, for example.

Nearly half of cyber professionals said they are considering leaving their job, with 53% citing stress and 34% highlighting poor work-life balance.

FOLLOW US ON SOCIAL MEDIA

A battle has broken out between a pair of cyber crime groups, highlighting how even hackers need to be wary of vulnerabilities in their infrastructure.

ShinyHunters, known for a series of devastating attacks in recent years, claims it has taken over the website and infrastructure of rival hacking group, Clop. The incident appears to be in response to a threat from Clop and part of a wider disagreement between the two hacking groups.

"We basically own them ​now," ShinyHunters said via an online chat conversation with Reuters. Clop's dark web site appears to remain offline and the targeted group has yet to make a public statement.

ShinyHunters used an unauthenticated file upload flaw in Grav CMS, leveraging the flaw by uploading a text file to the Clop site, according to a report in Bleeping Computer, which said the file included a warning against "threatening" ShinyHunters.

The attackers later defaced the Clop site with ASCII art, and added their rivals to the list of victims on its data leak list, the report added, with a note asking for a ransom and apology in order to get the website back.

"Kindly excuse our unprofessionalism," the note added.

A funny twist, if true

Steven Thomson, senior SOC analyst at Barrier Networks, said the incident was a "funny twist", but added it should be viewed cautiously as ShinyHunters has “a lot to gain from the publicity surrounding the 'apparent' breach."

Jamie Akhtar, CEO and co-founder of CyberSmart, said the incident is a “striking reminder that cyber criminal groups suffer from the same security weaknesses they routinely exploit in legitimate organisations”.

"Clop’s alleged compromise appears to have moved beyond website defacement to the possible theft of source code, logs and Tor service keys, potentially exposing both its infrastructure and operational methods."

William Wright, CEO of Closed Door Security, echoed Akhtar’s comments, particularly given that Clop has an “extensive track record” of waging supply chain attacks.

“The group’s site getting hacked through similar means shows that not even experienced threat actors are immune to such attacks,” he said.

ShinyHunters and Clop competing for dominance

In recent years, ShinyHunters has emerged as one of the most aggressive ransomware groups globally. In February this year, Google sounded the alarm over a ShinyHunters vishing campaign which targeted corporate environments.

Weeks later, Salesforce warned customers after ShinyHunters claimed to have breached its Experience Cloud. Notably, the group claimed responsibility for a devastating attack on education platform Canvas that impacted universities around the world.

Clop, meanwhile, has been a notorious player on the ransomware scene for several years.

The group has run a series of highly damaging campaigns in recent years, targeting everything from print management software to the MOVEit File Transfer system to gain access.

That prolific activity hasn't left the two groups too busy for infighting, it would seem.

Javvad Malik, Lead CISO Advisor at KnowBe4, said the incident was a timely reminder that cyber crime gangs are competitive businesses.

"When relationships are built on deception and fear, double-crossing and betrayal is always a credible threat," Malik said. "For defenders, it reinforces the need to understand not just the technology, but the motivations and behaviours of the people behind the attacks."

FOLLOW US ON SOCIAL MEDIA

Rising geopolitical instability, cyber threats, and concentration risks associated with data localization are prompting governments to move beyond traditional sovereignty models centered on data residency and geopatriation. As a result, data embassies are emerging as a practical approach to ensuring continuity of government services and operations.

These legally protected enclaves enable a nation to host critical digital infrastructure on foreign soil while retaining full sovereignty and data control, and interest is being led by small, highly digitized states facing active conflict or severe hybrid threats, according to Daniel Nieto, senior director analyst, Gartner.

“Sovereign dispersion decouples legal authority from physical location, whereas multi-region cloud back-ups simply move data geographically while remaining entirely subject to the host nation’s courts, laws and warrants,” he says.

“A true data embassy is established through formal bilateral treaties that grant foreign-hosted server racks the same statutory diplomatic immunity and inviolability as a physical embassy. Practically, it maintains an active, low-latency ‘digital twin’ with automated rerouting, keeping core civic services running during a crisis, rather than sitting as a passive backup repository.”

During a ‘black sky’ event, such as total domestic infrastructure collapse from a cyberattack, power failure, or physical strike, automated network routing immediately redirects traffic to the extraterritorial node, explains Nieto.

“This ensures citizens can continuously access core registries, tax systems and central bank ledgers even if the physical capital is entirely compromised.”

The rise of the data embassy

Gartner predicts that at least 15% of nations in unstable regions will establish formal data embassy agreements by 2029. The world's first was established back in 2015 by Estonia, born out of an analogue workaround that saw diplomats transport hard drives of critical state data to Estonian embassies abroad.

“We thought, okay, we’re very much a digital state, so why are we doing this manually? Maybe there’s a better framework for that," says Allan Allmere, IT architecture and infrastructure advisor, Estonia’s Ministry of Justice and Digital Affairs.

That question led to the creation of its data embassy as a ‘last mile’ solution to ensure E-Estonia, the country’s digital backbone, would continue to run “if all else failed.”

Nothing like it had been attempted before, so it meant finding a country willing to even define what a ‘data embassy’ was. Estonia wanted to stay within Europe and found two countries genuinely open to the idea. “We settled on Luxembourg, partly because smaller countries are typically more flexible and agile, and partly because it had Tier IV rated data centers – the highest classification available, used by NATO.”

“Tier IV certification provides the fault tolerance and continuity that critical systems require, and is the same standard provided by the Government IT Center to their public administration clients,” adds a technical advisor at Luxembourg's government IT center.

“Hosting a partner state’s critical systems builds on that same foundation, with the addition of a dedicated environment and a specific bilateral legal framework.”

That legal framework rests on firmer ground than it might appear, as when it comes to international law, the consensus is that existing international rules apply, says Agnes Kasper, head of the Law Branch at NATO's Cooperative Cyber Defence Center of Excellence (CCDCOE). “There is no 'new law,' the question is rather how this vast existing law applies.”

She notes that the Vienna Conventions on diplomatic and consular relations – largely customary international law, binding even beyond their signatories – predate the cyber age and don't directly address arrangements like data embassies, "which is why it was necessary to write specific conditions into a separate intergovernmental contract."

Continuously evolving

Allmere treats Estonia’s data embassy project as a startup: “It's never done; it's always evolving.” There have been three steps so far, starting with storage of 10 critical datasets. This has since expanded, and step two was the addition of a live government cloud in Luxembourg, which was added this year. “This gives agencies an active site abroad rather than pure backup. Step three is still in development, but will be a long-term archival layer, built for recovery decades into the future, when current technology may be obsolete.”

Ministries are responsible for their own datasets, each preparing a full backup that will enable rebuilding, “keeping in mind that that might not be them,” notes Allmere. That backup is then encrypted and sent directly to Luxembourg over a private encrypted connection.

The data can be downloaded from the embassy at any time, but as a security measure, nothing can be altered or deleted and, to ensure readiness and resilience, each ministry must undertake a mandatory restoration test each year.

Data protection relies on multiple layers of security controls. At the state level, this hinges on a principle Nieto calls encryption as a border including encryption as a border (EaaB). “This is where data is fully encrypted using hardware security modules (HSMs), with keys retained strictly within the origin state – ensuring the host nation holds the hardware ‘lock,’ but only the home nation holds the ‘key.’

“For maximum security defense and intelligence workloads, this is bolstered by post-quantum cryptography, zero-trust architectures and physical air gaps.”

Enterprise takeaways

Estonia's approach may be a national-scale answer, but the same residency-versus-resilience question is now landing on enterprise IT leaders' desks, well before most of them are forced to make a similar call with their own data.

“Enterprise IT leaders must realize that physical data localization offers a false sense of security, as concentrating infrastructure locally creates an operational target. True resilience requires decoupling data location from operational control by maintaining strict encryption key sovereignty across dispersed locations,” says Nieto.

“Furthermore, enterprises should architect systems using containerized applications managed via Infrastructure as Code (IaC), allowing them to rapidly tear down and redeploy their entire digital stack to a neutral jurisdiction within hours if geopolitical or vendor risks escalate.”

While replicating the data embassy model would be considerably more difficult for private businesses, experts agree that many of the technical resilience principles are transferable.

“Without diplomatic machinery, a business can pilot a low-cost version of sovereign dispersion by decoupling its encryption keys from its cloud hosting provider. An enterprise can store encrypted secondary database replicas in a stable, foreign cloud region while retaining total control of the decryption keys in an on-premises or neutral third-party HSM,” says Nieto.

“Combining this with IaC allows the business to test asynchronous, containerized failovers to an isolated secondary jurisdiction without handing control over to a single vendor or host state.”

The underlying logic behind a data embassy still applies to businesses’ distributed continuity solutions, adds Allmere. “You need to make sure you don’t put all your eggs in one basket – don’t trust just one location, or even just one provider.”

He goes on to highlight the risk of cloud concentration. "Two or three years ago, I was in the camp of ‘let's put everything in the cloud, and it’ll be safe.’ Now I think that’s not so wise, because 71% of the whole cloud market in Europe is owned by just three US companies.

“You also need to consider how fast you can move from one cloud to another if needed. Feel free to use the big providers like Amazon, Microsoft, or Google, but I recommend avoiding their bespoke offerings, or you could become locked in,” he concludes.

Security agencies have issued an alert after North Korean-backed cyber criminals were found posing as recruiters to target freelance IT workers.

WaterPlum - also known as Contagious Interview - targets software developers and IT professionals in Japan, the US, Europe, and other countries.

According to security agencies in Japan, the US, Australia, and Germany, the group has infected at least 30,000 devices in more than 100 countries, and has stolen funds or account credentials from over 7,000 cryptocurrency wallets.

The group's takings amount to $10.7 million so far, with agencies warning workers to remain vigilant for potential scams.

Victims are recruited internationally through social media platforms, online job platforms, gig work platforms, or freelance marketplaces.

As part of the recruitment process, they're required to take part in technical online virtual interviews or complete assignments - during which they're instructed to carry out a coding assignment or troubleshoot an error in the online video conferencing platform.

However, doing this downloads and executes malicious files hosted on multiple online collaboration platforms and code repositories. These include Node Package Manager (NPM1) packages embedded with either BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle malware and related variants.

Once in, the attackers use Remote-Access Trojans (RATs) to maintain connectivity, persistence, and pathways to pivot across victim systems, using infostealers to exfiltrate the victim’s sensitive data and cryptocurrency to a Command-and-Control (C2) IP address for remote management of infected devices or networks.

"Beyond immediate credential theft, successful infections provide WaterPlum actors opportunities to infiltrate organizations employing targeted developers, enabling espionage, intellectual property theft, and additional lateral movement in corporate environments," Japanese authorities said. "Stolen ID images can also be used by North Korean IT workers to impersonate victims and generate foreign currency."

Data targeted for exfiltration includes authentication data stored in web browsers such as IDs and passwords, clipboard information, key-logs, screenshots, and cryptocurrency-wallet data including private keys and seed phrases.

Another North Korean threat campaign

According to the agencies, the criminals behind this are mainly based in North Korea, China, or Russia, with a few in Africa and Southeast Asia.

They're also operating laptop farms to provide fake IT workers, in one case extorting a company over payment and publishing its proprietary source code online. In another, an IT worker hired for website maintenance defaced the hiring company’s website and rendered the site inaccessible.

Nick Tausek, lead security automation architect at Swimlane, said the campaign represents an expansion of the familiar North Korean playbook to take job fraud in two directions.

"Fake IT workers seek salary income and trusted access from inside a company. WaterPlum targets legitimate applicants from the outside. Stolen credentials, source code, and identity documents can then support espionage, extortion, or new fraudulent personas," he said.

"The shared laptop farms and IP addresses cited in the advisory suggest these aren’t isolated schemes. Each operation can feed the other. They can steal identities and credentials that help fraudulent workers appear legitimate. Those workers can then gain trusted access to corporate systems, opening further opportunities for theft or disruption."

Ross Filipek, CISO at Corsica Technologies, urged developers, freelancers, and organizations at large to remain on guard.

"One compromised workstation can expose several employers or clients without any of them being directly attacked. Organizations need to know how outside developers access their environments and what information can leave through those accounts. Unknown code should be isolated before execution," said Ross Filipek, CISO at Corsica Technologies.

FOLLOW US ON SOCIAL MEDIA

The channel has fundamentally been built on change. From cloud adoption and zero trust to AI, partners have positioned themselves as trusted guides, helping customers navigate the availability of new technological innovations. Yet as technology advances at an unprecedented pace, so has the scale and complexity of cyber risk. This is being driven not only by technology itself, but by the people using it. As a result, the role of the channel partner is evolving with it.

Success for channel partners is no longer about chasing every emerging trend or expanding into every new technology category. Instead, the partners that will shine are those that become agile, specialized advisors, helping organizations navigate AI, compliance requirements, and the evolving threat landscape. A key part of that role is secure behavior management, which means strengthening the human layer of security through continuous and measurable behavior change.

However, as the pace of innovation continues to accelerate, this raises an important question: can channel partners realistically keep pace with technological change whilst simultaneously empowering customers?

The challenge of keeping pace

In recent years, the cybersecurity industry has witnessed significant growth in technological advancements, with new solutions emerging weekly, regulatory requirements tightening, and threat actors becoming more sophisticated in their tactics. On the one hand, this has greatly benefited channel partners by providing an opportunity to expand their portfolios. Every innovation presents another opportunity to sell, another vendor relationship to manage, and another service to offer. On the other hand, this approach often creates more problems than it solves.

Partners that focus solely on emerging trends frequently end up with complex technology stacks that are difficult to explain, differentiate, and sell. As a result, customer conversations become focused on the product rather than on real business outcomes.

The partners experiencing the strongest growth are taking a different approach by focusing on understanding the problems their customers are trying to solve. By developing expertise in specific areas, partners are able to build credibility around those challenges and create clear pathways to measurable outcomes. This, in turn, enables them to act as trusted advisors that customers can rely on.

From supplier to trusted advisor

Becoming a trusted advisor within the channel has never been more critical. Customers are often overwhelmed by choice, particularly in a crowded market. For this reason, they require partners who can help them understand risk, prioritize investment, and make informed decisions.

While this shift doesn't typically happen overnight, that doesn't mean it's not attainable. An example of this can be seen in an MSP partner who initially positioned behavioral security technology as a straightforward add-on to phishing simulations and compliance training, with conversations centered largely on awareness activity. Then, within a few months, they changed their approach to focus on measurable human risk.

Rather than focusing on training delivery, they began helping customers understand and measure human risk. Behavioral data became a regular part of customer reviews, enabling meaningful conversations about where risk existed, what was improving, and where additional attention was needed. As a result, the service evolved from a product sale into a managed secure behavior management program, and customer relationships became significantly stronger. Customer relationships also became significantly stronger. The solution became embedded within wider security discussions, opportunities for expansion emerged naturally, and the partner established itself as a strategic advisor rather than a supplier of tools.

This shift illustrates an important lesson for the wider channel. Customers place greater value on partners who can interpret data, provide context, and guide decision-making than those who simply provide technology.

Why human risk is becoming a channel opportunity

Managing human risk remains a persistent challenge for many organizations, and that persistence is what creates a real opportunity for forward-thinking channel partners to capitalize on. Despite years of investment in security awareness training, 62% of confirmed breaches still involved the human element, according to Verizon's 2026 Data Breach Investigations Report . This demonstrates that traditional security awareness training methods, including e-learning modules and annual refreshers, remain ineffective, and it's time for organizations to take a different approach.

The focus should move away from training completion rates and compliance tick-boxes towards establishing baselines for risky behavior, demonstrating clear reductions over time, and providing evidence of genuine improvement, reflecting the core principles of secure behavior management. The partners who make that shift now will not only differentiate themselves in a crowded market but will position themselves as the trusted advisors that forward-thinking organizations increasingly need.

Looking ahead

As the cybersecurity solutions market continues to develop, the most successful channel partners will be those that recognize technology alone is no longer enough.

Organizations require guidance on how their employees interact with that technology, where behavioral risks exist, and how those risks can be reduced over time.

Secure behavior management provides partners with an opportunity to move beyond transactional product sales and deliver ongoing, measurable value. In doing so, they can deepen customer relationships, create recurring service opportunities, and strengthen their position as trusted advisors at a time when organizations are looking for greater clarity in an evolving security landscape.

Dealing with shifting sands is par for the course for cybersecurity practitioners, but what's happening now is different. Indeed, it’s more of a sea change that upends conventional wisdom and business-as-usual approaches to safeguarding an organization. The impact of AI in cybersecurity changes not just the nature of the threats and attack modalities but also adds new challenges, such as dealing with massive spikes in volume.

These challenges are why many across the cybersecurity industry see value in building and propagating a pre-emptive cybersecurity architecture that deviates from a conventionally static and reactive approach. After all, getting ahead of any threat is better than letting it fester – responding only when the damage has taken place. Such an approach may seem like common sense, so why hasn't this notion become more widespread among practitioners?

What is pre-emptive security – and how does it differ from conventional cybersecurity models?

The traditional detect and respond cybersecurity framework has served businesses well for as long as they've tapped into cyberspace. But changes primarily driven by AI are exposing frailties in this model. For example, recent Crowdstrike research shows a plunge to just 29 minutes for the time it takes for an attacker to move from initial compromise to laterally breaking out to other systems. Garner, meanwhile, forecasts there will be a 300% spike in the number of documented vulnerabilities between 2025 and 2030. There's also the question of practitioner burnout, with conventional frameworks relying on overworked humans to investigate security alerts raised after, not before, an intrusion has been detected – and shut off a threat as a matter of urgency.

So what's the alternative? "In simple terms, pre-emptive security architecture means putting security controls directly in the path of an attack so that the attack gets blocked, diverted or contained before any serious damage has happened," explains Mudita Khurana, staff security engineer at Airbnb and cybersecurity expert with a decade of experience in application security, security tooling, vulnerability management and AI security.

"The idea is more architectural than a particular security product or control (thus the word architecture in the term itself)," she continues, adding: "It is a way of connecting security controls across different layers (like users, applications, systems, data, etc.) so that even if one layer is compromised, the blast radius remains limited because of other existing controls."

This is an environment in which attacks are far more likely to "fail on contact" or never really get a grip on systems, Steven Coppola, security engineer at BARR Advisory, tells ITPro. That is, instead of an architecture that relies on somebody noticing the attack while it's happening.

"I love analogies — for pre-emptive security architectures, I use a house," he says. "Detect and respond is akin to a good alarm and a fast call to the police department. A pre-emptive strategy is thinking ahead about where the doors will go, what they are made of, and whether the valuables need to be in the house at all."

What does pre-emptive security entail?

Framing pre-emptive security as a list of components or a single blueprint misses the mark, experts tell ITPro. Nor is this architecture a product that you can buy. Gartner's managing vice president Carl Manion distilled the trend into three elements, including 'deceive', 'disrupt', and 'deny' – and also warned product leaders that they may face losses in market share if they fail to embrace this security architecture in the services they provide to organizations.

His first thesis is to deny hackers entry with a preemptive shield, including advanced obfuscation technologies. Next, organizations should deceive bad actors using decoys, misdirection, and illusion to throw them off the scent. Finally, organizations should anticipate emerging threats and prepare to disrupt these rather than waiting for the attack to materialize and engaging in damage control after the fact.

"I believe that there are many other security controls that can support these three areas that Gartner has set out," adds Khurana.

"For example, zero trust access controls and separation between systems can limit the reach of an attack. Secure development checks can prevent vulnerable code from being deployed in the first place, and encryption can protect stored data so even if someone steals files, they can't read them without the encryption key."

She also noted that confidential computing – in which data is processed inside a separate hardware-protected area with only approved code running within it – can add another layer of defense.

Coppola adds: "Confidential computing closes the gap in the middle, which is data in use. The workload runs inside a hardware-protected enclave — essentially a walled-off section of the processor—so the data stays encrypted even while it is being processed. Even the cloud provider or someone with admin rights on the host cannot read it."

Even if the attacker reaches the underlying server or cloud infrastructure, there is no immediate access to the data, which should be protected. However, it must also be combined with proper access controls and sufficient application security.

How can businesses implement pre-emptive security?

Chris Bailey, head of innovation at systems integrator Jigsaw24, tells ITPro that any plans to implement pre-emptive security should be shaped around a clear idea of what your organization is protecting, how sensitive the data is, and the internal policies.

"Start by identifying the data and systems you’re trying to protect. From there, map out where the vulnerabilities lie, how people access the environment, and what the worst-case scenario would look like," he advises. "Once that is clear, it is important to establish clear policies around access, roles and devices. Ask who genuinely needs access to a particular system or data, what they need to be able to do, and whether that access can be restricted further."

At this stage, Khurana explains that it's important first to understand how an attacker may reach the services or data sources, a process similar to threat modeling, and then where the attacks can be denied, deceived, or disrupted. "This is where the team takes the threats and paths from the previous activity and understands where the controls can sit. If a path is found [to be] unnecessary, it should be removed. For legitimate paths, the principle of least privilege should be adopted."

After putting controls into place, organizations should test them under realistic conditions to make sure they work well, she adds. This may involve penetration testing – which Bailey adds is important because it gives businesses the chance to identify weaknesses before an attacker does – as well as continuous auditing and monitoring.

Organizations should also carry out attack exercises to see if the controls set in place actually stop the intended attack path, and that, importantly, things can be quickly rolled back if the attacks disrupt important business processes.

It's also worth considering escalating the approach. If pre-emptive security works for one service, teams may feel more confident in applying this to more critical services.

While implementing a new approach to safeguarding your organization, it's also important to remember not to simply ditch or replace old techniques. Coppola tells ITPro that pre-emptive controls can make alerts more meaningful – but don't replace them. Then, when it comes to measuring attack paths, he says: "The question at the end of the quarter should be: what can an attacker with stolen credentials reach now versus 90 days ago? If the answer isn’t shrinking, the program in place is not working, no matter how many products were deployed."

A fake ChatGPT subscription invoice email is being used as a phishing lure to steal account credentials for users' OpenAI accounts.

Targeting both work and personal users, the email is headed: 'Urgent: Update Your Payment Method to Avoid Service Interruption', and urges victims to pay an outstanding balance of $23.80 within 48 hours.

The email, though, comes from a fake email address – support@9527db6e1a.nxcli.io – rather than an official OpenAI domain. And the 'Update Payment Information' button uses a Google API wrapper, which then redirects to a malicious payload via a webpage where a user could make a sign-in attempt.

The Google API redirect sends the victim to a page that's extremely similar to the genuine ChatGPT sign-in portal, with legitimate logos, text, and icons.

"With AI growing in popularity over the past few years, it is no surprise that threat actors are beginning to spoof ChatGPT," Josh Varden of the Cofense Phishing Defense Center (PDC) said.

"Utilizing similar tactics to other phishing examples, the threat actors frequently exploit urgency and perceived trustworthiness to manipulate users into taking actions that compromise their security."

Cofense listed three indicators of compromise, all of which should be fairly easy to spot: the Google redirect link and two paths on the same nxcli[.]io host, login.php and key.php. Meanwhile, simply hovering over the address bar to check that it says auth.openai.com would reveal the scam.

However, this is just the latest credential-stealing phishing email to impersonate major services.

"The PDC has identified many other examples of similar credential stealing phish, most commonly spoofing Microsoft, Google, and Adobe. With AI growing in popularity over the past few years, it is no surprise that threat actors are beginning to spoof ChatGPT," said Varden.

"Utilizing similar tactics to other phishing examples, the threat actors frequently exploit urgency and perceived trustworthiness to manipulate users into taking actions that compromise their security."

Meanwhile, attackers are increasingly exploiting AI services as phishing lures. This summer, Microsoft Threat Intelligence said it was increasingly seeing similar phishing, malvertising, and search engine optimization (SEO)-driven attacks, impersonating the branding of AI platforms including ChatGPT, Microsoft Copilot, DeepSeek, and Anthropic's Claude.

One campaign, again telling users that they needed to update their payment information, consisted of 4,500 emails sent to targets in South Africa, and was part of a broader campaign delivering as many as 100,000 emails on a single day to targets in Switzerland, Austria, and South Africa.

Other examples included a phishing campaign impersonating Anthropic-branded services.

"While AI chatbots are extremely helpful tools in performing repetitive tasks, users need to be aware that, like with all account creation, the threat of credential theft is still persistent," Varden warned.

"Whether it is a traditional phishing attack... or the use of smishing/vishing, attackers are constantly finding unique pathways through security systems and secure email gateways (SEGs)."

The National Cyber Security Centre (NCSC) has released guidance on cyber adversary simulation, in the run-up to its launch of a new assured Cyber Adversary Simulation (CyAS) scheme.

Also known as red teaming, cyber adversary simulation involves testing an organization's defenses by mimicking the actions an adversary is likely to use in a real attack. This can be carried out by either internal or external teams.

It's not quite the same as penetration testing, as it focuses on the effectiveness of an organization's technical controls and detection, rather than identifying technical vulnerabilities.

The NCSC CyAS scheme will see a number of commercial organizations approved to offer their services, but is still in its early stages, with plans to refine the scheme in light of feedback from partners, buyers and providers.

When it formally launches in November, there should be a range of approved providers – currently, the NCSC said, the quality of services available across the market can vary significantly.

These first documents include the Scheme Standard and the Working Practices Document, detailing what potential providers need to do. They cover everything from how services should be set up and managed to security, ethics and technical competence.

"These documents give an early and transparent view of the standard we will use to assess applicants, including expectations on companies, key role holders, technical delivery and reporting," the NCSC said.

"As a result, buyers will have a transparent and consistent benchmark for assessing providers, helping them make more informed procurement decisions and giving them greater confidence in the quality of NCSC-assured services."

The scheme supports two different approaches to evaluating an organization's ability to detect and respond to a cyber attack, depending upon the attacker's starting location.

A full-spectrum approach starts from outside the network, and evaluates an organization during an end-to-end attack that attempts to breach the perimeter.

Alternatively, an assumed breach approach starts from a point within the customer network and simulates a threat once an attacker has managed to gain an initial foothold.

"For organizations with a mature security posture, assumed breach can provide greater value by bypassing the initial access phase and concentrating on the consequences of a successful compromise, specifically whether an attacker can expand their access beyond the initial point of entry and reach high-value targets," the NCSC advised.

The CyAS scheme is best suited to organizations with a mature understanding of the cyber risks they face – larger firms, or those operating within critical national infrastructure or the UK government.

To make the most of the services on offer, they should have already identified and assessed their risks, and have well-established mitigations and defences and robust network monitoring and detection systems in place.

"A carefully scoped adversary simulation engagement will help organizations understand where their defences are working, where they are not, and what needs to improve," the NCSC said.

"It will also evaluate whether an organization can identify threats early, triage them quickly and appropriately, and escalate where necessary."

Spain has seen its first official data breach due to an AI agent.

The Spanish Data Protection Agency said in a blog post that it had received the first notification of a data breach that was apparently carried out by an AI agent using a known large language model (LLM).

The revelation comes amid a wider discussion about the safety of AI, in particular agents, following a series of incidents in which OpenAI and Anthropic agents went "rogue" and targeted external organisations during evaluation tests. OpenAI admitted in July that its agents infiltrated the Hugging Face repository, and Anthropic followed suit shortly afterwards with its own admission of misaligned behaviour.

Francisco Pérez Bes, the head of the Agencia Espanola Proteccion Datos (AEPD), said in a blog post that the information on the attack comes entirely via the impacted organisation, with further investigation required.

But what it does show is that agentic AI attacks "have ceased to be a theoretical risk," Pérez Bes said, according to an automatically translated version of the blog post.

While AI has long been used to write phishing messages, translate fraudulent campaigns, and help search for flaws to exploit, Pérez Bes said the "emergence of AI agents... introduces a qualitative change," as it can plan tasks, execute code, and modify its actions autonomously.

He added: "It's important to remember that AI doesn't create new threats. But it does increase the speed, scale, and adaptability of existing malicious techniques, reducing the time available to detect and contain them.

His comments echo warnings from the security industry, with Forescout saying earlier this year that AI is now a "standard part of the attacker toolkit" and Anthropic adding that AI is helping to lower the bar for hackers.

What happened?

According to the blog post, the hackers managed to log into the compromised system, setting loose an autonomous agent to look for vulnerabilities in the application, which then allowed them to modify personal data and access invoices.

Pérez Bes stressed that there was no indication that the AI model used or its infrastructure had been compromised, and that the agent used wasn't necessarily designed to carry out such activities.

The victim of the attack hasn't been revealed, nor has the maker of the LLM itself – or any details on the hackers responsible.

What next?

Pérez Bes said the purpose of issuing the notification was to warn organizations to boost their security practices to answer the new threat of AI agents, calling it a sign to act.

"The arrival of AI agents in the offensive arena should prompt an immediate review of security and data protection models," he said, according to the translated post.

He called for organizations to include AI-assisted or AI-driven attacks in their risk analysis, reconsider response times as procedures designed for manual attacks won't be able to keep pace with autonomous agents, and to take measures to protect digital identities and credentials to keep AI agents from slipping in via accounts, API keys or tokens with excessive permissions.

Pérez Bes said manual intervention is no longer enough when it comes to security. "Human supervision remains essential, but it must be supported by detection, containment, and response mechanisms capable of operating quickly enough," he said.

FOLLOW US ON SOCIAL MEDIA

OpenAI has revealed six more incidents of "unexpected or concerning model behaviour", adding to the constant flow of reports of rogue AI amid a wider debate about the technology's safety.

Alongside the incident reports, OpenAI unveiled a framework for disclosing such misalignment issues to the public, rather than ad hoc revelations.

The report comes as the AI industry and wider stakeholders discuss how to address the risks of misalignment, following an Anthropic employee quitting to warn about safety and potentially existential risks to humanity that could arise.

In a blog post, OpenAI admitted that the AI industry had not solved the alignment issue that became clear this summer amid a series of cyber incidents with AI agents, and was not monitoring enough to continue scaling the technology at pace.

"Decisions about how AI development should proceed in the months and years to come need to draw on evidence that people outside the companies building frontier models can examine for themselves," the company said in the post.

Six new problems

The post detailed six examples of misalignment, when the AI model or agent takes actions that humans didn't intend, such as when OpenAI's agents hacked the Hugging Face AI repository in order to solve a test question.

OpenAI released detailed reports about the six new examples, but added: "These are reports of individual instances, and shouldn't be considered reflective of how often misalignment occurs across our models."

The first two cases involved altering summaries to hide mistakes or behaviour. In one case, an as-yet-unreleased model changed its own instructions, altering summaries used to continue its work, in order to "disregard its normal constraints." OpenAI said it spotted 27 instances of summary editing. The second example was similar: during training, GPT-5.6 Sol altered summaries to cover up mistakes or misaligned behaviour from users.

The third and fourth cases were about information sourcing. In one instance, a model searched for exposed API keys and then used them without authorisation – as part of a basic request to dig out earnings figures. "When it still wasn't able to retrieve the requested figures, it fabricated them and presented them as data from the requested source," the post said.

In the next instance, the model found an answer to a query about lake sizes via Python, but the user asked for a source, so it uploaded the file to be able to cite it, without telling the user.

The last two new cases had echoes of the Hugging Face incident. In one, models used a software repository as a message board to share information, and in the second, agents working together used a public file hosting website to share files online, despite the task's requirement to only use local files.

Sharing misalignment

OpenAI said it had previously attempted to make all findings about misalignment public. "But without a systematic approach to reporting these findings, our disclosures have been ad hoc and less frequent than ideal: we've often waited until we could collate several instances into one report, or added them to system cards for newly released models," the company noted.

Because of that, the company has developed a new framework to make it easier and faster to publish misalignment reports, even if the behaviour hasn't been fully solved.

Under the new framework, any OpenAI employee can flag misalignment for investigation and request it be shared via public disclosure – though of course it's down to technical staff whether that happens.

If published, a report will include details about what happened, any harms, how the misalignment was discovered, and what OpenAI will be doing next to mitigate.

"At the moment, there is no industry-wide framework with explicit standards for how AI developers should disclose examples of misalignment in their models," the blog post added. "We hope that the framework we're outlining today is a first step toward creating such standards, setting out which misalignment instances developers should disclose and what their reports should contain."

FOLLOW US ON SOCIAL MEDIA

Senior Salesforce figures have revealed plans to expand forward deployed engineering (FDE) capabilities in the UK as the CRM giant targets agentic AI adoption gains.

Speaking to assembled media at Dreamforce 2026, Paul O’ Sullivan, SVP of Solutions Engineering at Salesforce UK, said the company plans to double the number of FDEs operating across the UK.

“We’re going to double the size of the [FDE unit] capacity,” he said. “It strengthens our position in the UK and it shows the bigger investment that we’re making as well.”

O’Sullivan told ITPro this will take the total number of FDEs across the UK to “about 95”. These specialist engineers will be embedded with Salesforce customers, helping staff to use the company’s agentic AI tools and to build custom agents.

The company's career portal shows it's currently hiring for FDEs spanning core products, including Agentforce and Data 360.

FDEs act as consultants embedded directly within enterprises, offering technical guidance and working alongside internal teams to build custom AI solutions.

“The primary purpose is two-fold,” he said in response to a follow-up question from Diginomica. “We’re going to help you build your agents that are going to link directly to business value.”

“That’s going to allow you to then think about where you can drive better customer experience, more loyalty, improvement on service. That plays into exactly how agents can deliver value more widely.”

Salesforce eyes easy agent gains

The move builds on a broader push by Salesforce across the UK and Ireland, with the company accelerating skills-related investment and engagement with enterprise customers.

Notably, Salesforce already has a professional services organization designed to support adoption of its various services. While FDEs sit separate from this, Salesforce UKI CEO Zahra Bahrololoumi said they form part of a larger effort to “skill up and enable customers”.

“The more fluent our customer base is, the more they’ll get out of the platform,” she told assembled media.

“Our FDE capacity and our FDE capability has been sized at the moment to ensure that, based on what we see on where our customers are, we can get them up and running with agents and consuming and learning and tuning.”

O’Sullivan added that the FDE team is also connected to the wider engineering function at Salesforce, offering broader engineering expertise for customers.

“When we think about 95 as a growth number, we’re actually connected to an existing team that’s 330,” he said. “So the combined function will unlock more scale and more opportunity.”

FDEs in the spotlight

Salesforce isn’t alone in its FDE focus. As ITPro reported in July, a host of hyperscalers and leading AI providers have expanded capabilities on this front over the last year, with the primary aim of streamlining AI deployments.

In late June, Amazon Web Services (AWS) announced plans to invest $1 billion in its Forward Deployed Engineering division.

Just days later, Microsoft unveiled the Microsoft Frontier Company as part of a $2.5 billion investment, with the long-term aim of hiring and deploying up to 6,000 AI experts and engineers inside customer organizations.

FOLLOW US ON SOCIAL MEDIA

British small businesses (SMBs) are more likely to be hit by cyber attacks than those in other countries, with two in five falling victim last year.

Globally, 29% of organizations have been hit by a successful cyber attack in the past year, according to the tenth annual Hiscox Cyber Readiness Report. However, for UK businesses, the figure's substantially higher, at 38% – making it the most-affected country worldwide.

UK SMBs are spending less to remediate these attacks, with an average cost per attack of $35,908, compared with $52,000 globally. On average, incidents caused around 32 hours of operational disruption.

But, commented Jamie Akhtar, CEO and co-founder of Cybersmart, "While the average cost of an individual attack in the UK may be lower than the global average, the higher proportion of businesses being successfully compromised means many more firms are being exposed to those costs in the first place."

Meanwhile, small UK firms are failing to insure themselves adequately against cyber attacks, according to Hiscox, with only four-in-ten having cyber coverage, compared with around 63% of medium-sized firms and seven-in-ten FTSE 100 companies.

UK firms are actually spending more than average on cyber resilience, at $59,700 – the third-highest spend – compared with a global average investment of $51,000. Just over half of firms are adopting new technology, with 55% investing in specialist staff and 62% updating employee training.

The reasons for the greater vulnerability of UK firms aren't apparent.

"These are some concerning results, and it's not clear why the UK is suffering a larger volume of attacks compared to other countries," said Keven Knight, CEO of Talion Cyber Security.

"It could be as a result of geopolitical instability, or it could be because of the wave of attacks against retailers from last year, which might have spurred attackers to target businesses in the region."

However, there also appears to be a link between cybersecurity performance and executive compensation: globally, 32% of firms said executive pay is now linked to cybersecurity performance, while the figure was just 25% for UK firms.

Overall, cyber attacks are costing small businesses dear, with 32% saying they have delayed growth and expansion plans, and 31% that incidents have increased staffing costs. Three-in-ten said they'd experienced financial damage and 29% that they'd lost business opportunities. Even more – 48% – cited reputation and customer trust as the most significant cyber-related risk.

"It's never just about containing an incident initially and moving on, that's naive and unrealistic. It's the aftermath of an attack, where organisations have to work through the financial losses and operational downtime, that causes the greatest damage," said Knight.

"Downtime doesn't just mean being locked out of computers, it means disruption to service, disruption to employees and their ability to perform their jobs, plus disruption to customers because they are unable to access the services or goods an organisation provides to them. Every second of downtime costs the business money."

FOLLOW US ON SOCIAL MEDIA

AI safety risks were the big talking point on the opening day of Dreamforce 2026, with the annual conference’s star-studded line-up bringing the topic to the fore.

Anthropic CEO Dario Amodei joined Salesforce chief Marc Benioff during the opening keynote to discuss the company’s Claudeforce launch. Recent comments on the concerning pace of AI development dominated the discussion, however.

With companies such as Anthropic rolling out increasingly powerful models, Amodei told Benioff that the industry needs to have a candid discussion about development timelines, AI safety, and the introduction of more robust guardrails.

“We can always be better, let’s make our practices better, let’s recommit to transparency,” he told the Salesforce CEO. “Let’s invest more in safety, then let’s organize the rest of the industry and say ‘what can we do to set standards for everyone?’.”

Amodei’s comments came after he published a lengthy essay on 12 September arguing that the AI industry needs to slow down the pace of AI development to counter potential harms. This call for “pacing the frontier” was echoed by OpenAI CEO Sam Altman and xAI chief Elon Musk online.

Why the focus on AI safety?

The topic of AI safety has been thrust into the spotlight after a series of high profile security incidents involving agents at OpenAI, Anthropic, and Meta. These incidents saw agents escape testing environments and breach third-party companies such as Hugging Face.

Combined with whistle blower claims that AI could severely harm humanity in recent days, the topic appears to have reached boiling point.

Speaking during a fireside chat with Benioff later in the day, Altman said the Hugging Face debacle “triggered a real rest, not just in our own company, but in the world”.

“I think people also feel the speed with which things are moving,” he told Benioff. “There have been things like the Hugging Face accidents, other accidents in the field.”

Altman added that he is confident both in the ability of the industry and OpenAI itself to slow down the pace of development and sharpen the focus on AI safety.

Individual responsibility

While Altman and Amodei have called for an international effort to slow down the pace of AI development, Nvidia CEO Jensen Huang thinks the responsibility rests firmly on individual companies – not erecting new barriers.

“We don’t need any new laws, we don’t need any new regulations,” he told Benioff.

Huang is by no means calling for a Wild West approach to AI development, rather arguing that the onus must be placed on developers that are rolling out products they feel they cannot adequately contain.

“Safety is paramount,” he said. “Safety is an engineering problem. We’re developing software after all, we’re developing computing systems after all. It’s complicated computing systems, but ultimately it’s a computing system.”

Huang said that testing environments need to be “built in a good way” to avoid repeats of the incidents involving Meta, OpenAI, and Anthropic. That responsibility lies with them, not by insisting the rest of the industry adheres to their playbook.

As ITPro reported in August, all three companies involved in ‘rogue AI’ incidents worked with the same testing company before agents escaped their sandbox environments.

“If we're not confident about the safety of the products, like all companies … if you build a product or a service and you're not confident in its functionality, capability, or safety, then don't release it,” he said.

“That's a very obvious thing to do. You pace yourself until you are confident you're releasing something that the market would appreciate.”

FOLLOW US ON SOCIAL MEDIA

Cost exhaustion attacks, disposable applications, and evidence custodians – these are the ideas businesses need to prepare for within the next three years or less.

That's according to analyst house Gartner, which laid out a list of ten predictions for 2027 to 2030, many of which are focused on AI and its potential business impacts.

That includes physical AI or robots, agent swarms clogging up public services or running down budgets, and unpicking how to actually manage AI costs, providers, and risks.

"Many of the systems we take for granted today, from public services to software, energy and workforce models, will be fundamentally transformed by AI over the next decade," said Daryl Plummer, distinguished VP analyst and Gartner fellow.

"The most successful organizations will be those that balance innovation with responsibility, building the capabilities needed to manage both the opportunities and the unintended consequences of an AI-driven world," Plummer added.

AI risks on the horizon

The analyst firm predicted that more than ten billion autonomous agents will be clogging up public services by 2030. Those agents will have been made by people, companies, and even governments in order to take on basic tasks for users. But that will lead to a sharp increase in the number of applications and other transactions, putting pressure on the government to keep up.

To prepare, Gartner called on governments to modernise their digital infrastructure and strengthen verification, though they'll only have a few years to do so.

Alongside that, organisations will face a new type of cybersecurity risk: cost exhaustion attacks. These are like a denial of service attack, but focused on driving up the cost of AI used by the company.

"The rise of public-facing AI is creating a new cybersecurity risk called cost exhaustion attacks, where malicious actors deliberately drive excessive AI usage to increase operational costs," Gartner said in a statement.

To avoid this, companies should consider AI usage patterns and token consumption as security concerns, ensuring both are monitored, saying eight in ten companies will face these attacks within the next few years.

AI business

Gartner also predicts that by 2030, 80% of front-line employees working for global companies will be working alongside or with physical AI, such as robots, drones, autonomous vehicles, or "other embodied systems that sense, interact with, and influence their surroundings."

By 2029, most applications will become disposable – on purpose. These disposable apps will be used for less than one year, with employees using AI app development in order to meet short-term needs, ditching the tool when it's no longer needed. Gartner warned that will spark governance and security challenges.

Beyond AI-generated apps, Gartner also forecasts the rise of AI-powered products, which will allow companies to introduce "customised, efficient and scalable offerings," leaving behind those who haven't gotten to grips with the tech. Gartner also predicted more firms will find themselves generating power, selling it back to grids or to AI data centres.

Watching AI – and its cost

To help manage the rise of AI, companies will create a new role or corporate function dedicated to managing AI costs and mapping it to value or profit, with 60% of the largest companies embedding financial operations controls at inference, leading to real-time optimisation and cost governance. CIOs, meanwhile, will become the "evidence custodian" for AI accountability in businesses, ensuring guardrails are in place.

Alongside that, Gartner predicted that insurers will drive AI governance in organizations, rather than regulators, with policy-based AI built into systems and workflows to address the growing concerns around risks and liabilities associated with the technology.

FOLLOW US ON SOCIAL MEDIA

Automation and agents in Security Operations Centers (SOCs) aren't easing the job of security analysts, with teams overwhelmingly stuck having to resolve problems manually.

Security analysts are forced to spend 68% of their day on reactive alert triage and manual data gathering, leaving little time for proactive threat hunting. Meanwhile, 68% of all threat detections still require manual human intervention to resolve, a new report from network intelligence form ExaHop has revealed in a new report.

"Security teams are facing a crisis in dealing with AI-powered threats," said Jamie Moles, Senior Technical Manager, ExtraHop.

"To solve this, security teams are diligently working towards achieving an agentic SOC that drastically expedites the entire security response cycle while eliminating the burden and fatigue analysts have been experiencing."

When asked which elements of the attack surface they believe represent the most significant cybersecurity risk, 55% of survey respondents cited AI agents and generative AI applications, followed by public cloud services at 45% and third-party services and integrations at 35%.

However, the researchers said the timeline to identify threats has lengthened, with 49% of organizations only identifying ransomware activity after it reached the data exfiltration or later stages – up from less than a third in 2025.

Nearly 15% failed to recognize that they were being targeted until a ransom demand was issued, up from 6% the previous year.

When asked which factors delayed a critical alert from being detected or investigated, 41% cited the use of encrypted channels to bypass detection. Meanwhile, 38% said that attacker activity mirrored legitimate, authorized workflows and processes, and 34% noted that valid, high-privilege account permissions were used in the attack.

As a result, SOC workflows remain heavily manual, with most respondents reporting mid-to-high levels of manual intervention across the threat lifecycle. Investigation was the most manual stage, requiring manual intervention about 50% of the time.

SOC analysts are limited to spending just 44% of their time on proactive efforts, such as threat hunting and detection engineering.

The problem, the firm said, extends across all SOC-adjacent job roles and organizations of all sizes. While larger companies show a slight trend toward spending more time on proactive efforts, the increase isn't proportional to the size of the company, showing that scale doesn't solve the problem.

In order to make the most of AI models and reduce the burden on human analysts, said ExaHop, organizations need a base-level layer of contextual intelligence that allows agents to act decisively and quickly.

"A well-trained AI model has the reasoning and processing capabilities to analyse environment-wide anomalies instantly, doing in seconds what would take a human analyst hours. But these powerful models must be implemented with the right safeguards in place, sitting atop a layer of intelligence that can be easily accessed and acted upon," said Moles.

"Automated security will be the standard, but without the right underlying foundation, organizations will continue struggling to keep up with high-velocity threats."

FOLLOW US ON SOCIAL MEDIA

If you're having trouble with copy and paste in Excel, you're not doing it wrong; it's simply been disabled by Microsoft's latest Patch Tuesday update.

Unfortunately, it's going to be like that for some time, as there isn't a fix, at the time of writing.

Patch Tuesday is a monthly update from Microsoft where it fixes and updates various parts of its software. Much of it focuses on Windows security and improvements to its suite of applications.

However, these fixes sometimes cause problems elsewhere. Case in point: the latest security patch for Excel has taken down the copy-paste function. Users first reported issues with Excel 2016 after the update, known as KB5002914, was installed. Soon after, users reported the issue in other versions of Excel, and Microsoft has acknowledged it and said it is working on a fix.

Under 'known issues', Microsoft posted: "In Microsoft Excel 2024, 2021, 2019, and 2016, the paste operation might fail silently. Although users try to paste content, the source remains selected, and the destination is unmodified. When this issue occurs, users receive no indication of the failure, such as a beep or error message. Microsoft is researching the issue and will post more information in this article when the information becomes available."

Bugs and issues are expected when updating a sprawling software stack like Microsoft's, and the company's Patch Tuesday releases have been known to come with some downsides. In May, bugs where images would not display inside mail were reported, and in June, the main email messages were hidden. Both were a result of monthly updates.

Thankfully, Microsoft has spotted and acknowledged this issue introduced by KB5002914. Unfortunately, it has yet to come back with a fix, so there isn't anything you can do except painstakingly type out everything in Excel.

Digital bank Revolut has been fooled into handing over detailed and highly sensitive customer data via a phishing attack that used a legitimate government email domain.

The company has emailed affected customers warning that a wide range of information may have been shared. This includes name, date of birth, postal and email addresses – but also identity documents such as passports or driver's licenses and the facial verification image that customers used to sign up.

What's more, account statements, including IBAN, account status, the date accounts were opened, wallet reference number, withdrawal records, and full transaction history, including Bitcoin, were also shared.

One Telegram user, ZachXBT, has suggested that the incident was targeted in particular at individuals with high net worth.

Internal systems and customer funds remain completely unaffected, the company said, and it has blocked the unauthorized email source and notified the appropriate authorities.

However, the leaked data will represent a treasure trove for scammers launching phishing attacks or using the identity information to attempt to open other financial accounts elsewhere.

The breach arose via fraudulent requests from an unauthorized email account created directly within an unnamed official government authority's domain infrastructure, according to Reuters. This meant that it carried valid domain-authentication credentials and therefore wasn't picked up as fraudulent.

"What makes this particularly worrying is that the requests came from a legitimate government email account, making them far harder to spot as a phishing email," said Jake Moore, global cybersecurity advisor at ESET.

"The threat actors were able to cleverly disguise themselves as a genuine organization and simply request the information from Revolut."

There's no information on exactly which government department – or, indeed, which government – was being impersonated, nor the purported reason for the request. It's possible, though, that other banks or cryptocurrency exchanges have been approached in the same way.

"Increasingly, cybercriminals don't need to break through the technical security controls of a final target if they can impersonate a trusted source," said Moore.

"The big lesson for organizations is that a genuine email address doesn't always mean a genuine request. Safeguards against this can apply, but need to be enforced in ways where sensitive data requests require verification through a separate trusted channel."

UK-based Revolut has more than 80 million customers around the world and operates as a bank in more than 30 countries, online rather than via physical branches. It recently received permission to set up as a national bank across the US, expected to launch during the first half of next year. It's also believed to be considering s a potential public listing that could value it at as much as $200 billion.

ITPro has approached Revolut for comment.

The US has accused Chinese companies of stealing AI capabilities via "aggressive, malicious and targeted" distillation at an industrial scale.

Distillation is a technique by which one model is trained on the outputs of a stronger or better model, but it can be abused to extract features and capabilities more quickly and at a lower cost than doing the work from the ground up.

A joint advisory from the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation warns that China is abusing this technical capability to unpick AI models, saying that distillation of US systems is core to the country's AI development strategy.

"While 'distillation' is recognized as a legitimate and useful technique in AI research, China-based AI companies are engaging in aggressive, malicious, and targeted distillation activities at an industrial scale that extract restricted proprietary functionalities and capabilities of U.S. frontier AI models," the advisory noted.

OpenAI accused DeepSeek of model distillation back in January 2025, just weeks after DeepSeek made waves when it arrived with an AI model that cost significantly less to develop.

Anthropic raised the issue in February of this year, accusing three AI labs – all also named in the new American alert, including DeepSeek – of extracting capabilities from Claude via distillation.

Industrial-scale AI distillation

The American agencies said that DeepSeek, Alibaba, and other Chinese AI developers had extracted billions of tokens across millions of queries from frontier AI models, including those from Anthropic, OpenAI, Google and xAI since late 2024.

The advisory suggested that was "likely with Chinese government awareness."

Distillation runs via multiple pathways, including making use of APIs, cloud providers, and third-party aggregators to avoid being detected.

"China-based AI companies achieve cost savings for their industrial-scale distillation campaigns through bulk procurement of the US AI companies’ premium subscriptions shared across teams of developers," the alert explained.

The purpose is to speed up development while reducing costs, the agencies said.

"China-based AI companies that conduct industrial-scale distillation against US AI models see significantly shorter AI development timelines and reduced financial expenditures in training a frontier model," the document noted.

The alert urged US AI companies to fight back by rolling out detection and mitigation systems to spot malicious distillation behavior, disrupt the benefits of these attacks by altering responses, and sharing information across the industry to better spot such campaigns.

China's response

The Chinese commerce ministry denied the allegations, but also countered that the US had "extensively distilled Chinese models," according to a Reuters report.

A spokesperson for the Chinese foreign ministry told the news agency: "We hope the US will earnestly implement the important consensus reached by the leaders of both countries and refrain from making false ​accusations and smearing China."

This isn't the first time the American government has accused China of stealing AI from its own companies, with the issue raised repeatedly earlier this year, but comes ahead of the Chinese president Xi Jinping visiting the US later this month.

Does distillation matter?

One expert said the distillation debate highlights the commodification of AI.

“This isn't about someone copying the smart kids' homework, it's what they chose to copy: coding, software engineering, reasoning, and agentic capabilities," said Cris Thomas, Security Advocate at Semgrep.

"That's why you shouldn't build your security strategy around who has the smartest model this week. Models will get better, cheaper, copied, distilled, and commoditized."

He added: "The interesting question isn't who owns the model, it's what you can make that model do when you give it deep code context, deterministic analysis, and a way to check its own work. The model is increasingly becoming a commodity. Knowing how to turn it into a security tool is not."

FOLLOW US ON SOCIAL MEDIA

Barracuda has uncovered an email phishing campaign that lures victims with a phishing page generated directly inside the victim's browser.

Rather than building a traditional phishing website, the campaign creates a fake page in the browser with a blob URL - a temporary address that points to content held in local memory rather than on a public web server.

Victims are routed through legitimate Microsoft services, including Microsoft OAuth and Microsoft Teams, making the site appear trustworthy and reducing common warning signs.

"This campaign demonstrates how phishing is evolving beyond fake websites and suspicious domains, removing many of the indicators that security teams have traditionally relied on for detection," said Ashitosh Deshnur, associate threat analyst at Barracuda.

How the phishing attack works

The attack begins with a DocuSign-themed email with a calendar invite attached. It doesn't appear malicious, because it points to a legitimate Microsoft OAuth endpoint; it's there just to add legitimacy.

A crafted redirect then routes the user to Microsoft Teams, which loads an external resource hosted on cdn.bloom[.]io. The browser converts this content into a blob URL that renders the phishing page locally within the browser.

Once the blob-based phishing page loads, it registers a service worker – a browser component that can manage network requests and page behavior in the background.

Part of the workflow is also executed inside a sandboxed iframe: an isolated browser window embedded within the page. Together, these elements help control navigation, manage requests and coordinate the phishing experience without the need for a conventional phishing website.

A hard to tackle campaign

It's a worrying technique, Barracuda warned. There's no phishing page to block, and therefore no persistent phishing URL for security tools to retrieve, analyze or blocklist in advance.

Trusted Microsoft services are abused throughout the attack chain, making the attack harder to spot, and the calendar invitation file makes the message look like routine business communication.

The phishing workflow receives instructions from backend infrastructure using browser messaging mechanisms; and, because the attack is controlled dynamically rather than through hardcoded redirects, operators can modify destinations and behavior in real time.

This gives them a level of flexibility and evasiveness that's not typically seen in static phishing pages.

New scanning techniques are needed

The campaign shows that detection approaches built around scanning for known malicious URLs are no longer good enough, said Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.

"Traditional email security tools, URL scanners, and web filters are looking for malicious destinations. This approach removes the destination entirely; the attack surface exists only inside the target's browser for the duration of the session, then disappears," he said.

Patel said blob URLs mean detection needs to “shift toward behavioral monitoring of what the browser is actually doing” – such as URL creation in “unusual contexts” and “anomalous behaviour following calendar invite interactions”.

“These are detectable patterns, but they require endpoint-level visibility rather than network or email gateway scanning.”

FOLLOW US ON SOCIAL MEDIA

OpenAI and Anthropic have both admitted that rogue AI incidents went further than first reported.

In July, OpenAI said its AI agents had gone rogue and breached Hugging Face systems. Anthropic later admitted its own similar incidents, saying its models had escaped a testing sandbox too, with the UK AI Security Institute reporting other alarming behavior.

Last week, both companies published reports with details of what happened in those incidents, with much of the blame pinned on minor operational mistakes that enabled online access, as well as tasking agents with overly difficult or impossible problems that drove them to "cheat".

That included abusing systems in order to build their own messaging boards in order to collaborate and communicate.

Since then, further incidents have been exposed, including the use of a German wiki site for communications. Now, Reuters has reported that OpenAI's agents had made use of ten further websites for communication, based on reports from six independent investigators.

Chatty AI agents

The report notes that the websites weren't hacked, but more akin to spam, with the agents making use of comment boards to communicate with each other, contrary to instructions in the evaluation they were undertaking.

Alongside one university's link shortener tool, the websites used by OpenAI's agents were often wiki-style sites that could be used as message boards for the misbehaving AI agents.

These included a high-school teacher's chemistry site and personal websites of Polish technology workers, Reuters said. The agents made edits in comments in order to leave data for other agents.

“If these ⁠models were told only to read, they’ve got to get clever in terms of leaving information behind,” Kenneth Russell DeGraff, a software developer and former congressional aide, told the news agency.

OpenAI's response

OpenAI told ITPro that its investigation was ongoing, but stressed that the Hugging Face incident remained the most serious to date.

"As we said in July, the Hugging Face incident prompted a broader review of agent activity, and that work remains ongoing," a spokesperson said in an emailed statement.

"We are prioritizing review based on the type of impact on a third party and its severity, such as some of the other third parties we have notified following Hugging Face as we have previously shared. We are also examining lower-severity abuse such as spam-like activity. To date, we have not identified other activity matching the severity or scale of Hugging Face. "

The spokesperson added: "The AI community does not yet have a clear standard for reporting misalignment across training, evaluation, and deployment, and we're developing a framework to share soon."

Another Anthropic incident

Rival AI developer Anthropic admitted an additional rogue agent incident, the fourth after three previous ones were revealed over the summer.

In a blog post, the company said it had spotted the first three incidents via a scan of 141,000 transcripts following an evaluation – admitting it had missed the fourth after relying on AI.

"Given the volume of transcripts and our desire to disclose incidents quickly, our scan relied on an agentic search," Anthropic post noted. "This missed a set of transcripts that also turned out to have internet access; we identified these in August while assembling transcripts to share with METR."

This fourth incident happened in January and involved its Claude Opus 4.6 model in a "capture the flag" test.

"The model accidentally broke its target by assigning it a conflicting IP address with another machine, thus making the target unreachable and the task impossible to solve," the post noted. "Recognizing this, the model attempted to abort the task using a command but was unsuccessful due to a misconfiguration in our evaluation harness."

The model then attempted to reach the target by escaping the testing environment and targeting a third-party machine, finding a password that it used to gain admin access, and continuing to harvest further credentials and modifying settings for access.

This continued until its token budget ran out and it stopped, the company revealed.

Anthropic said the impacted parties have been notified and suggested the fourth incident wasn't a new sort of AI misalignment, but in keeping with the previous behavior.

"Taken together, our assessment is that these incidents are serious. Our production models took harmful actions against real systems over long trajectories, which included biased reasoning,” the company said.

“The behaviors in these incidents are more severe than those we had previously observed and reported in our system cards. However, we do not believe these incidents represent a new kind of misalignment."

FOLLOW US ON SOCIAL MEDIA

Attackers used AI agents to compromise a cloud resource and then plan, build, and carry out a mass credential harvesting campaign earlier this year – and all in less than six hours.

That’s according to new research from Google Threat Intelligence Group (GTIG), with recent analysis showing threat actors are flocking to agentic AI and automation to conduct sophisticated attacks.

“At this point, we can assume that all threat actors are using AI in some capacity and their operations have benefited," said John Hultquist, chief analyst at Google Threat Intelligence Group.

"Like everyone else, we’re concerned about the vulnerability problem, but AI is being applied to several other areas, and it will be especially challenging as it is applied agentically, creating a scaled, faster adversary. Criminals, like the ones who conducted a mass exploitation campaign in just six hours, will gravitate to attacks that are faster than we can respond to."

In this example, a financially motivated threat actor compromised an organization’s cloud infrastructure to deploy an autonomous, multi-agent attack framework, allowing them to operate at the sort of scale and speed that's usually associated with larger and more resource-heavy groups.

In less than six hours, the attacker was able to leverage an AI coding chatbot, a simple prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign.

Using preconfigured markdown instruction sets as operational playbooks, GTIG said the threat actor carried out automated scanning and credential harvesting, compromising thousands of third-party credentials.

The agent instructions enabled the AI to autonomously manage the vulnerability scanning pipeline, perform real-time troubleshooting, and execute IP rotation logic without manual intervention.

Operating from the victim cloud infrastructure also allowed the threat actor route attack traffic through legitimate IP addresses.

State-backed groups are flocking to AI

GTIG said it has observed state-linked groups broadening their use of AI. In one example, PRC-nexus threat actor UNC6508 carried out a major intrusion campaign against US medical facilities, using compromised cloud environments to host a local model.

In April, meanwhile, Mandiant spotted a threat actor leveraging AI infrastructure access which was then used to sustain unauthorized AI workloads, utilizing hijacked cloud environments to provision high-performance GPU compute instances at the victim's expense.

Notably, TeamPCP has focused heavily on the AI supply chain, using malware designed to take advantage of emerging AI systems, and including malicious prompts that were used to execute commands surreptitiously.

The group has even poisoned open source package metadata to trick AI assistants, resulting in malicious dependencies being recommended to developers.

"The challenge for defenders is that these risks are evolving faster than many organizations can quantify, measure, and govern," said Ronald Lewis, head of cybersecurity governance at Black Duck.

"Security teams are no longer protecting only applications, users, and infrastructure. They must now secure AI models, agents, prompts, data pipelines, and an increasingly complex AI supply chain while also defending against adversaries using AI to accelerate attacks.”

FOLLOW US ON SOCIAL MEDIA

The Shai-Hulud npm worm is back several months after everyone assumed it was dead.

Back in May, a compromised maintainer account pushed 639 malicious versions of @antv packages to npm in a single hour, although the attack was swiftly halted.

However, while npm has since introduced publish-time malware scanning, researchers at Aikido Security spotted a “wormy boy” slipped through a triage queue.

“It had the same hash as the @AntV wave. Same payload,” Aikido Security’s Charlie Eriksen noted in a recent blog post.

Eriksen said four packages were uploaded within the space of an hour after a 111-day gap - and bypassing npm's new publish-time malware scanning, which sees every package held for five to 15 minutes while an automated system checks it before it becomes installable.

This marks a concerning new development in terms of Shai-Hulud-related risks, according to Eriksen.

While the scanners shouldn't be expected to catch everything, a worm payload with a public hash, extensive vendor write-ups, and months of detection coverage should not be slipping through the net on a registry that now markets itself as scanning every publish.

"That gap between what registry-level scanning claims to do and what a hash-identical reactivation shows it actually caught is the real story here," he said.

"Signature matching against known-malicious artifacts is the single easiest bar to clear in this industry, and it's the bar we should all be most alarmed to see missed."

The four packages concerned were:

• feishu-docx-mcp@0.3.2
• bmc-i18n-extract-cli@1.1.1
• blueai-cli@0.7.0
• bmc-translate-utils@1.1.1all

Keep an eye out for Shai-Hulud

According to Aikido, teams should be looking out for these and the command-and-control domain associated with the original May wave, t[.]m-kosche[.]com.

Other indicators of compromise include the hash of the reused malicious payload, e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6, the index.js root-level payload file ,and the command executed by the preinstall script, bun run index.js, along with the persistence files .vscode/tasks.json and claude/settings.json.

Behavioral indicators include outbound validation calls against npm registry using stolen tokens, tarball download, payload injection, version bump, republish cycle, and the mass creation of GitHub repositories with Dune-themed naming and reversed "Shai-Hulud" strings in descriptions.

“A file hash match is a lookup, not a hard problem. It requires no behavioral analysis, sandboxing, or reasoning about obfuscated code’s intent,” Erikson commented.

“And this payload wasn't novel, repacked, or even lightly modified to dodge signature matching. It was the same 64 hex characters that had been on file since May."

While the likes of multi-stage loaders, dependency confusion, and runtime-triggered payloads are genuinely hard problems, he said an exact hash match to a worm that made international security news four months ago isn't.

"That's the floor of what publish-time scanning is supposed to catch, and it got missed," he said.

ITPro approached npm for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

In June, Google disabled a feature in its Analytics platform that stopped personal data from being shared with Google Ads.

Launched just after GDPR in 2018, Google Signals gave businesses veto over whether Google’s ad network could see their visitor activity. Even if a user consented to being tracked, the final decision lay with the business, and many used it as an extra guardrail, with Google’s Consent Mode, to prevent falling foul of privacy laws. Then in June, Google Signals was gone.

You could assume the change was minor, especially because Consent Mode was still there to protect a user’s cookie consent choice. Yet straight after the switch, compliance failures across the world's biggest websites increased.

In the US, 87% of sites were found to be ignoring a user's opt-out signal, up from 81% before the change. In Europe, 56% kept tracking users even after they'd rejected cookies, up from 52%. One vendor changed one setting and elements of an already brittle consent framework began to unravel.

"If a single vendor can make this change which affects everybody's privacy compliance docket without most noticing,” says Vaibhav Antil, CEO and co-founder of Privado. “Imagine what happens when agents are deployed?"

Handing the keys to the machine

Bot web traffic has already overtaken human web traffic, according to Cloudflare’s traffic radar, and the number of non-human identities inside organizations outnumber humans by more than 80 to 1.

These agents are on the web comparing prices, filling in forms and booking appointments. They’re embedded in products, sifting job applications, querying databases, moving money, updating records, and increasingly making decisions that used to need a person to sign off on. Gartner expects 15% of day-to-day work decisions will be made autonomously by AI agents by 2028.

Yet the approval and consent process behind it all still largely consists of cookie banners, DSAR portals, and preference centres; tools built for a human ticking one box, once, and that consent holding until they say otherwise. AI actors are capable of acting thousands of times a second, or chaining several tools together to complete a single instruction. They need their permission checked before every move, and their actions can leave businesses unable to say, with confidence, what they did, when.

“A person with too much access is limited by habit, their training, and by their job,” adds Marcus Tommy, co-founder of MALTO Cyber. “An agent has none of that.”

The fan-out

Take, for example, someone who asks an agent to find out why sales have dropped. “The system can choose an analysis, run it, and generate SQL to investigate it,” explains Maurice Sikkink, CTO at Stormly. It might even reach into an external system for market data. Technically, a human approved the question, but they didn’t explicitly approve every step the agent took to answer it.

This becomes more stark when agents start connecting systems together. One linked agent might have permission to read customer records in a CRM, and permission to write to a marketing platform – both individually authorized. Yet the moment it starts moving a customer's data between them, it presents a new use of that person's data nobody explicitly consented to.

And then there’s the issue of revocation and re-authorisation. Revoking permissions can be done for several reasons, from policy changes to someone leaving a job. If an agent's session token or API key is valid for hours after the revocation kicks in, the underlying permission isn’t always automatically revoked.

"Those credentials haven’t necessarily been stolen," Harry Varatharasan, chief product officer at ComplyCube, says. "The agent might not be malicious. The identity behind them might be perfectly genuine, but the authority is stale.”

Auditability by design

Antil's answer, for copilots at least, is what he calls permission inheritance: "If you, the user, are not able to edit settings, then your copilot shouldn't be able to either.” When permission inheritance isn't enough, continues Antil, enterprise IT needs to decide what counts as dangerous, regardless of whether a single employee has permission to perform the task.

“A business might disable an email-to-Claude connector, for instance, because it's a common route for prompt injection attacks,” he adds.

However, even where access is logged and overseen, most systems can prove who had permission to ask the agent to act but not why the agent did what it did once inside.

Sikkink says this is where the industry is furthest behind. "Authentication tells me someone had access to the project. Attribution tells me that they asked the agent to do it.” What’s missing, he argues, “is a common way of carrying the identity of an original request through the entire chain.”

Varatharasan calls this idea of carrying identity and authority through the chain as “binding.” "Issuing the credential is only half the problem. Knowing whether you should still trust it is arguably the more important half,” he says. "I don't think the future is simply 'continuously identifying the agent ’. It’s the continuous assurance over the relationship between the individual, the agent, its credentials, its delegated authority and its behaviour."

Sikkink agrees: “[Not] every intermediate step needs another consent popup. That would make agents almost pointless. The important thing is that the agent stays inside a clearly defined boundary, and that we can reconstruct how it got from the user's request to the result.”

A push for clarity

From a technical point of view, Tommy argues that what’s needed to fix this largely already exists. “Cloud audit logs record the actor and the action. Token systems know the scope. Append-only log structures are proven technology; they run the public certificate transparency system. What’s missing is the join.”

In the UK, the Digital Verification Services Trust Framework is one attempt to build this join. It sets out guidance on proving delegated authority: what was granted, when and by whom, plus plans for cryptographic checks on signing keys. Under new California Consumer Privacy Act regulations, businesses using AI for significant decisions must give consumers a pre-use notice, a working opt-out, and the right to ask what the system did and why.

Antil calls these a step in the right direction, even if they don’t fully cover agentic workflows. Varatharasan adds that these frameworks have the right building blocks but fall short of addressing the bigger, lifecycle issues around revocation, re-authorisation, and continuous risk.

Ultimately though, Antil expects consent in the age of machines to resolve the way SaaS governance did. First, by applying existing regulations to the problem; second, through the rise of new regulations; and third, he expects “we’ll see a major public failure which will push enterprises to demand more controls and guardrails from vendors.”

There’s also a future when the governance itself will be automated. “Because agents and copilots have agency, act at machine speed around the clock, and are prone to hallucinations, enterprises will need to match that speed from a governance perspective," concludes Antil.

The widespread use of shadow AI is putting British businesses at risk, according to the UK’s National Cyber Security Centre (NCSC).

The use of unapproved AI tools is on the rise, with research from Microsoft late last year revealing that 71% of UK employees have used unapproved consumer AI tools at work, with more than half saying they do so every week.

While the NCSC said AI can help people complete tasks more quickly, improve decision-making, cut costs and increase productivity, organizations are falling short when it comes to policy and guidance.

In a new briefing document, the security agency said enterprises need to tighten up practices on this front and crack down on unapproved use.

"Rather than preventing them from using AI, this can mean employees turn to using AI tools that have not been approved by their organization, introducing new cybersecurity risks that can be hard to identify,” the document reads.

"Where cybersecurity policies cannot meet business needs, organizations are likely to continue seeing their employees adopt new AI services before they have had time to assess them and provide approved alternatives. This trend is likely to be reinforced as AI capabilities become increasingly affordable and readily available."

The rise of shadow AI

Some of the biggest concerns associated with shadow AI is the risk of data breaches, the loss of intellectual property, and failure to meet regulatory requirements.

If employees transfer sensitive or proprietary information to consumer AI services, there's a strong chance that this information might be stored, retained, or used to improve the service – outside established security and governance arrangements – unless specific privacy controls are in place.

This can reduce the organization's visibility and control over that information.

Similarly, the use of shadow AI can also create a wealth of new opportunities for attackers, according to the NCSC. If hackers successfully exploit a vulnerability, they can gain access to the same data, services, and privileges that the agent has legitimate access to.

Attackers are highly likely to use agents with looser guardrails to exploit any vulnerabilities or misconfigurations in the wider corporate IT system.

"The NCSC is not recommending that individuals stop using AI – but when turning to these tools for assistance with a work task, think carefully about which apps and services you are using before you share data," said the NCSC.

"It may feel natural to stick with using the same AI service that you are familiar with from your personal life – but using systems that are not corporately approved can present real problems for your employer."

Stronger controls are needed

The NCSC said organizations need to introduce policies that reflect the real world, with the aim of reducing risk rather than assuming it can be eliminated.

This means adopting a positive cybersecurity culture and encouraging open communication about security issues. Once organizations understand why people are using shadow AI, it becomes much easier to identify risks, provide secure alternatives, and support innovation safely.

The guidance echoes analysis by Gartner last year that found nearly half of enterprises could face serious security or compliance-related incidents as a result of shadow AI by 2030.

"You cannot manage what you do not know," the NCSC guidance noted. "By raising awareness of the risks of shadow AI use within your organisation and understanding the needs of employees, you can help them get the benefits of new technologies while using them securely."

FOLLOW US ON SOCIAL MEDIA

French AI giant Mistral has raised €3 billion to support frontier model research and development of sovereign, open-weight systems.

The funding, led by Samsung Electronics and Scaleup Europe Fund, is the largest equity round by a European tech company and values Mistral at €21 billion.

The aim is to train "bigger and faster models", CEO Arthur Mensch told CNBC, but Mistral also said in a blog post that its focus was open-weight models built and run in Europe that allow companies to keep hold of their data.

"During the first wave of generative AI, the central question was who could build the most powerful model," the company said in a blog post.

"Organizations and governments are now asking a different one: how to harness the power of AI for their mission-critical needs without surrendering control over the infrastructure and intelligence loop."

Mistral added that demand for a “combination of performance and control, choice, and independence” is growing globally.

The company said enterprises are governments alike are now weighing up long-term tech dependencies, governance requirements and “deployment choices that come with any AI investment”.

Mistral eyes sovereign AI gains

The importance of sovereign AI was made clear earlier this year when Anthropic's security models were temporarily hit by an export ban.

More generally, countries like France and Switzerland are pushing away from American technology firms for their own versions of software and services for government use.

Mistral in particular has positioned itself as an alternative not only to American dominance, but also the open-weight models developed in China.

"The fact that the EU or Europe have to have their own kind of AI provider in the game is important," chief financial officer Johan Bergqvist told Reuters.

"We ​have seen in the past ​that there is ⁠politics involved in the access of these solutions, and it's important that you make sure that you maintain access and do not compromise your kind of supply ​chain,” he added.

That said, Mistral noted that it was seeing particular growth in Asia and North America, with more than 125 global enterprises as customers based in 20 countries.

"The round reflects a strategic endorsement from investors across Europe, Asia and North America," Mistral said in the blog post.

"It brings together a world-class syndicate of strategic and financial investors, including global technology leaders, growth investors and existing shareholders that have supported Mistral’s development to date."

Paying for the AI rollout

Beyond investing in frontier research, the funding round will be used to boost AI infrastructure available to Mistral, Mensch said.

"Long term, the plan is to fully rely on capacity that we are building ourselves, and so that means that the amount of compute that we own is going to grow ... around 100% in the next five years," Mensch told CNBC.

Speaking to the Financial Times, Mensch added that the funding will allow Mistral to reach an "amount of compute that is very comparable to what the Chinese labs have."

However, the investment is small compared to the figures coming out of the US, with $1trn set to be spent on AI infrastructure this year alone, and rivals such as Anthropic and OpenAI valued at $965bn and $852bn ahead of looming IPOs.

FOLLOW US ON SOCIAL MEDIA

The cybersecurity industry is awash with products.

Every time a new attack technique is discovered, vendors will rush to develop a product to address the challenge.

Whether it be malware prevention, privileged access management, next-generation firewalls, or email security platforms, the industry is flooded with platforms promising to improve defences and make it harder for attackers to infiltrate systems.

But in reality, this has made security very noisy.

Instead of improving security, the volume of tools organisations must manage has actually amplified risks.

There are too many alerts coming in to understand and identify threats quickly. Too many platforms to manage, which overburdens resources and amplifies costs, and too many interfaces to navigate, which makes managing security far from seamless.

Overall, while the objective of the platforms is to strengthen security, the products can actually jeopardise it.

However, these problems are significantly worse when it comes to Managed Service Providers (MSPs).

Tool sprawl in the channel

Consider an MSP delivering security services to 50 customers.

One customer may use Microsoft security technologies, another CrowdStrike, while others could have different SIEM, vulnerability management, ticketing, and endpoint security platforms.

However, the MSP is often forced to operate them all.

All simultaneously, and all expertly, knowing the capabilities of each platform and how to operate them.

The MSP must maintain the knowledge, processes, and integrations required to operate across all of the platforms they manage for their clients. However, not only does this create resourcing challenges it also amplifies costs.

There is the cost of purchasing each platform that clients depend on, plus there is the cost of employees to manage the platforms.

Furthermore, with MSP staff continually navigating between platform interfaces, this wastes valuable time, reduces productivity, and can make managing security for clients more cumbersome.

Individually, these delays can appear insignificant. However, across hundreds or thousands of incidents, tickets, and customer interactions, they quickly accumulate.

Plus, as an MSP grows its customer base, the challenges can become even harder to manage.

When growth introduces more complexity

Every business wants to grow its customer base, but for an MSP this can also mean introducing more tools into their environments.

If every new customer introduces another combination of technologies, integrations and processes, onboarding customers also introduces additional operational complexity.

Providers can find themselves in a position where growing the business requires continually adding more people to manage the additional workload.

This has obvious implications for margins, but it can also put pressure on existing teams.

Skilled cyber security professionals are already difficult and expensive to recruit. Using their time to perform repetitive administrative tasks or manually move between disconnected platforms is neither efficient nor sustainable.

Ultimately, the channel therefore needs to look beyond simply adding more technology and consider how existing technologies are operated.

There will always be customers that want or need different technologies. Channel providers therefore need to find ways to embrace this diversity without allowing it to dictate how efficiently they operate.

But how can this be achieved?

The importance of technology-agnostic platforms

One of the best ways to overcome this challenge is by working with partners that deliver technology-agnostic platforms that simplify the management of security for MSPs.

These platforms can seamlessly integrate with the security platforms MSPs rely on for their customers, but they can be managed via a single dashboard.

This allows an MSP to more efficiently manage security, but without having to navigate across multiple platforms.

These platforms can deliver everything a partner needs to track, monitor, and manage the security of their customers, without overburdening resources or amplifying costs.

Instead, everything can be managed via a single unified platform, reducing complexity and cutting out the chaos of managing multiple solutions.

A technology-agnostic platform doesn't replace customer investments; it provides a common operational layer across them.

Analysts can investigate incidents, automate workflows, manage tickets, and monitor security posture from one interface while still supporting whichever technologies each customer has chosen.

The channel doesn't need fewer security technologies; it needs a better way to operate them.

MSPs that standardize their operations across diverse customer environments will reduce costs, improve analyst productivity, and deliver a more consistent service.

In an increasingly competitive market, operational efficiency isn't just an internal advantage; ultimately, it's a differentiator that leads to better security outcomes for customers and healthier margins for MSPs.

In August, it emerged that a small UK power plant was shut down for four days following a cyber attack attributed to Iranian hackers. It follows multiple attacks on water facilities in the US, which reports indicate are linked to the latest incident.

Not much is known about the UK power plant breach, with the government declining to reveal exactly where it took place. It has confirmed the incident involved a small-scale generator, and that the wider energy system was never at risk.

But a key technical detail is still withheld about whether control systems were directly affected, or if the plant was disconnected merely as a precaution while IT contained the infiltration.

After the first of its kind attack, the government has written to businesses with advice on the steps they should take to protect themselves. How big is the risk, who does it impact, and how should firms react?

Major escalation

The latest attack is “a major escalation” from the recent campaign targeting water facilities in the US, says Markus Mueller, field CISO at Nozomi Networks.

He says attacks on peaker plants like this – which are designed to provide power when needed – can be more dangerous because “things happen fast, there is no buffer, and there can be major impacts”.

Critical national infrastructure is also vulnerable because it often uses legacy technology never meant to be connected to the internet. In the latest incident, the attack path involved a programmable logic controller (PLC) that was not secured following basic best practices.

“If current reporting is correct, this was a publicly exposed PLC that was impacted similarly to what we have seen at US water utilities, where the threat group scans the internet for exposed PLCs using AI-generated scripts,” Mueller tells ITPro.

The attacker then logs into the PLCs using default credentials and proceeds to take them offline by resetting the programming and changing the password and IP address, “making it inaccessible”, explains Mueller.

A risk beyond CNI

The risk goes beyond critical sectors, into the supply chain, other industries, and to firms that rely on the breached organization.

While this incident occurred at a power plant, this is also “a clear warning” for “non-utility commercial sectors”, says Mueller.

He points out that automated scanning scripts used by adversaries “do not differentiate between a power generator, a manufacturing plant, a logistics warehouse, or smart building management systems”.

Any business relying on connected physical systems or industrial controls is at risk. At the same time, supply chain partners and third-party maintenance contractors with remote access into operational technology (OT) environments represent “a major attack vector that adversaries are actively targeting to move laterally into enterprise networks”, says Mueller.

The risk extends “well beyond” large, regulated energy operators, agrees Martin Riley, CTO at Bridewell.

He describes how the UK’s energy system is becoming more distributed, with growing reliance on smaller peaker plants, renewable generators, battery storage and other remotely operated assets.

“Individually, these facilities may represent a small proportion of national capacity, but collectively they are becoming an essential part of how the grid operates,” says Riley.

“That creates a particular challenge because smaller operators and suppliers may fall outside the regulatory thresholds applied to traditional critical infrastructure, while still having connectivity into systems and services the country depends on.”

At the same time, James Neilson, SVP of global at OPSWAT, says it is “a lucky escape” that this attack happened at a small power plant and didn’t impact the UK’s wider energy system.

“Hostile actors now routinely target the UK using cyber attacks, undermining security, the economy and public trust. This form of grey-zone warfare has been present for at least a decade, but sub-threshold activity has increased sharply in recent years.”

Resilience measures

Following the power plant attack, the UK government and National Cyber Security Center have actively urged organizations running critical infrastructure and industrial facilities to audit internet-facing devices and enforce cyber hygiene.

“The guidance emphasizes immediately identifying and pulling exposed OT and PLCs off the public internet, eliminating default vendor passwords and enforcing multi-factor authentication for remote management connections,” explains Mueller.

At this stage, the most important lesson is “understanding asset exposure, attack paths, and the operational consequences of unauthorized access to industrial control systems”, according to Mueller.

Resilience starts with “understanding how an attacker could move through the organization” and “ensuring a compromise in one part of the environment cannot easily reach systems responsible for physical operations”, says Riley.

For operational environments, that means strong IT and OT segmentation, tightly controlled remote access and “security controls proportionate to the potential consequences of an incident”, he advises.

Organizations also need visibility across IT and OT. “If security monitoring operates separately, an attacker may be able to establish themselves in the corporate environment before moving towards operational systems without anyone seeing the complete picture,” warns Riley.

Know what exposed interfaces you have and harden these by using technology and architecture, advises Ian Thornton-Trump, CISO at Inversion6.

At the same time, use firewalls with access control and whitelisting capabilities to “ensure any exposed interfaces can only be connected to by specific IP addresses”, he adds.

Meanwhile, Thornton-Trump advises deploying deception technology to detect the early stages of an attack, including honeypots, as well as taking advantage of the NCSC’s early warning service.

It’s also important to know the enemy you are facing. For example, Iranian and other nation-state groups will often hunt out default credentials immediately to achieve “rapid, low-noise access”, says Neilson.

With this in mind, he advises “assessing and hardening critical systems and infrastructure considering the latest attacks”.

Firms should train for incident response using tabletop exercises at all levels of operations and management, Thornton-Trump adds. “Have a plan that includes cyber-incident responders on retainer and cybersecurity contacts in other companies in your industry vertical – and identify reinforcements and additional resources if you need them. Prolonged downtime of any sort – cyber or otherwise – is avoidable, predictable, and recoverable.”

Microsoft has warned that ASCII smuggling, the use of invisible Unicode characters to trick AI models, is now being used by cyber criminals to supercharge phishing campaigns.

Over the past year, ASCII smuggling has become a recurring technique for prompt injection and cross-prompt injection (XPIA), allowing an attacker to hide instructions inside invisible tag characters embedded in a web page, document, email, or other content.

While human beings - and many user interfaces - see nothing unusual, an AI assistant that ingests the raw text registers the hidden characters, decodes them as text, and can be induced to carry out unauthorized instructions, including data exposure.

The most abused range is the Unicode Tags block, U+E0000 to U+E007F, which contains a shadow copy of the printable ASCII characters. For example, U+E0041 mirrors ‘A’, U+E0061 mirrors ‘a’). The block was originally intended for language tagging and is now largely deprecated.

According to Microsoft, hits on a hunting signature designed to detect ASCII smuggling increased sharply on February 9, and stayed high on weekdays for the next three months.

This time, though, the technique appears to be in use as part of a broader phishing campaign that was identified by Fortra this time last year.

"When we looked at a sampling of the flagged messages, the surprise was there were no smuggled instructions to an AI assistant. Instead, the invisible tag characters were inserted inside common financial keywords, splitting them apart so that a literal signature or keyword match would fail," the researchers said.

"For example, a finance lure term that appeared normal to the recipient could be transmitted with an invisible tag character in the middle: funding became 'fun⟨U+E0020⟩ding'.

To the recipient, and to parsing pipelines that drop or normalize these characters, the word still reads as 'funding'. Microsoft warned that unless a filtering system takes a picture of a message and does OCR extraction over the visual image, it may miss this type of attack.

ASCII smuggling campaign hit hundreds of domains

According to Microsoft, the campaign ran on hundreds of disposable, finance-themed sender domains with lures that resembled business loan, line-of-credit, and advance-funding phishing patterns often associated with fraud or credential-harvesting funnels.

This pattern accounted for roughly 96% of the volume flagged by the hunting signature. The emails in question were relayed through infrastructure associated with the legitimate email-marketing platform, ActiveCampaign.

"We appreciate Microsoft’s research and welcome collaboration with the security community to combat this activity. We take abuse, fraud, and security extremely seriously," said an ActiveCampaign spokesperson.

"We tested the specific technique described in this research against our content-moderation systems: messages containing invisible Unicode characters receive the same moderation verdicts as their unobfuscated equivalents, and heavy use of the technique is itself treated as a suspicious signal."

How to protect yourself against ASCII smuggling

To stay safe, Microsoft said organizations should strip or normalize Unicode tag characters (U+E0000-U+E007F) – and other zero-width / invisible code points – from email subject and body text before applying spam and phishing content signatures.

The presence of tag-block characters should be seen as a strong red flag: they're rare in ordinary mail and can be a high-value anomaly signal.

They should also look for the behavioral fingerprint: bulk volume from churning, finance-themed disposable domains, on a strict weekday-on/weekend-off schedule.

Elsewhere, businesses are advised to apply the same normalization upstream of AI ingestion: the same control that defeats this evasion also reduces XPIA / ASCII-smuggling exposure for AI assistants that ingest email content, Microsoft said.

FOLLOW US ON SOCIAL MEDIA

The G7 Cybersecurity Working Group has issued a joint advisory urging organizations to get moving on post-quantum cryptography (PQC).

The advisory specifically highlights the risk that quantum computing poses to public-key cryptography, stressing that it's a near-term threat that needs addressing across all sectors, not just critical infrastructure.

"Although the exact timeline is uncertain, several recent advances suggest an anticipation of the development of quantum computers able to break widely used public-key cryptography mechanisms and threaten the security of digital infrastructures," it said.

The big threat from cryptographically relevant quantum computers (CRQCs) is that they will be able to carry out 'harvest now, decrypt later' attacks.

This involves collecting and storing encrypted data protected by public-key cryptography that threat actors will be able to decrypt at a later date.

"Malicious cyber actors with access to CRQCs will also be able to target authentication mechanisms that help provide assurance and help protect the integrity of data between communicating parties and the integrity of devices," the advisory said.

"This capability could allow malicious cyber actors to impersonate trusted entities, compromise equipment, forge trusted data, or access confidential data, therefore undermining confidence in secure communications or contractual agreements."

Quantum preparations

Organizations should adopt a phased and risk-based strategy, prioritizing the most sensitive data and assets. This means carrying out an inventory of their cryptographic assets, mapping their dependencies, and developing a transition plan.

To keep costs down, they should acquire products that integrate PQC and replace their systems with quantum-safe ones as part of their standard renewal schedule - this, the advisory noted, could result in lower migration costs overall.

Worryingly, the report said the quantum threat remains off the radar for many organizations and as such is under-resourced, with other security concerns taking precedence.

"Yet a successful and collective transition to PQC can only be achieved if organizations understand that the quantum threat is an economic and business risk, and not merely a cryptographic risk," the report warns.

Raising awareness of the stakes involved will be critical, according to the working group. National strategies aimed at transitioning to PQC should aim to attain an adequate supply of PQC hardware and software products, and encourage users to adopt them.

Research and development efforts also need to be ramped up, with more cooperation between government, industry, and academia, and the introduction of specific requirements within the framework of public procurement.

"Tackling the risks that the impending quantum computing era poses to current cryptographic systems, and ultimately organizations in which they are embedded, requires a coordinated global effort to transition to PQC," the report concluded.

"To strengthen collective resilience and safeguard confidential data, supply chains, and critical systems, public and private organizations must jointly act now. The transition to PQC is the key foundation to help build a secure and resilient digital future."

Still a long way to go

The advice from the working group might not resonate with enterprises, however. A study by Juniper Research earlier this year found that only 27% of global businesses are set to be using PQC by 2030.

Those figures come despite recent predictions from Google that computers capable of breaking existing encryption could be here within just three years.

"The most important part of the G7’s message is the recognition that quantum can no longer be treated as a distant technology problem. Organizations are being told to start their PQC transition now, but transition and protection are not the same thing," said Simon Pamplin, CTO at Certes.

"The real challenge will be legacy infrastructure. Replacing cryptography embedded across decades of applications, supply chains and interconnected systems is not something organisations can achieve overnight.

"Security therefore needs to be abstracted away from individual applications and infrastructure and attached directly to the data, allowing the cryptography protecting it to change without repeatedly rebuilding the systems underneath."

FOLLOW US ON SOCIAL MEDIA

Can small Managed Security Service Providers (MSSPs) outcompete the world’s biggest Systems Integrators (SIs)? It might sound like a fool’s errand. But SIs have a glaring weakness: a generic, heavily standardized approach that fails to move in step with the rapidly evolving threat landscape. There’s an opportunity for smaller, more agile MSSPs, if they’re bold enough to take it.

Unfortunately, many are failing to take advantage. In fact, they’re making it harder for CISOs to differentiate their offerings by citing inaccurate metrics. These do nothing but confuse prospective customers. But for those MSSPs willing to go against the status quo, the market is there for the taking.

Why bigger doesn’t mean better in cybersecurity

The threat landscape stands still for no one. Over the past couple of years, we’ve witnessed an unprecedented weaponization of new technologies by threat actors. AI is being used in victim reconnaissance, social engineering, malware generation, and vulnerability research and exploit development.

According to Verizon, the median threat actor researched or used AI assistance in 15 different documented techniques last year, with some using as many as 50. Researchers are warning that the exploitation window is collapsing as a result. Google’s most recent M-Trends report puts mean-time-to-exploitation at less than seven days.

This means that SecOps teams live in a world of constant flux. One in which continuous improvements need to be made to the SOC — to swap in and out services and evaluate and reevaluate vendors in order to maintain a good security posture. Now think of a typical SI. They may have deep domain knowledge and plenty of smart people on the books. But their business model is scale, not agility. In fact, they tend to charge punitive fees for any change requests outside the original scope of work.

Rigid contracts and multiple management layers are a recipe for inertia. That’s bad news for CISO customers at a time when IT infrastructure and threat actor innovation are moving at pace. If you can’t afford to mitigate new risks around agentic AI data leakage or prompt injection, what do you do? Delay investment in the technology? Or accept increased risk? There are no good options.

Missing an open goal

This business opportunity should be an open goal for MSSPs. But the truth is that many also adopt a cookie-cutter approach in order to efficiently service as wide a bank of customers as possible. This ultimately erodes the value of a potentially powerful differentiator.

They make things worse by resorting to disingenuous tricks to outcompete their rivals. They might claim to respond to alerts within 30 minutes, for example. But in reality, that metric is only applied to critical-severity alerts. Those deemed less urgent may take many more hours to respond to. That’s not only insincere. It could be a major security risk at a time when attackers go to deliberate lengths to hide in low-level activity. It’s critically important to spot and stop living-off-the-land techniques like these before they escalate.

There’s more. It’s also become accepted industry practice today for MSSPs to include automatically assigned and closed alerts when working out Mean Time to Acknowledge (MTTA) and Mean Time to Close (MTTC) — artificially shrinking these values. MSSPs may exclude alerts that weren’t handled within SLA parameters, like those at the weekend. And they may even reset the clock when an alert is escalated between tiers, to make it appear as if SLA targets were met.

This isn’t just bad practice. It means CISOs can no longer trust the sales pitch. That’s bad news for those who operate differently.

Honesty and agility

Yet if they can get their message out, there is an opportunity for more dynamic MSSPs. They must be honest about SLAs, clearly define the terminology they use, and resist the urge to manipulate metrics. But just as importantly, they should offer services that move in step with the needs of their customers and the changing nature of the threat landscape, to outcompete their larger SI rivals.

It can be done. Think: red teaming for rogue behavior. Continuous risk reporting that maps findings to best-practice compliance standards. And AI posture management that integrates with SOC playbooks and exposure management dashboards to mitigate risk across the AI attack surface.

There are some fantastic solution providers out there offering cutting-edge capabilities—from real-time runtime detection to observability and model provenance checks. But no single vendor offers the whole package a SOC needs. That’s where the MSSP can add value. It’s about continuously evaluating what’s out there on the market, and integrating it into a seamless, 24/7 managed service offering.

Protection for today and tomorrow

The MSSP space has never been more important for customers. The accelerating pace of industry regulation, infrastructure, and threat innovation is a testament to that.

For IT security leaders, the question to ask is not just whether your service provider is good enough right now. It’s whether they have a convincing vision of where security is heading in the future.

For many organizations, that’s not going to be an SI where only 80% of what they do might be “good enough.” In cyber, 80% is no longer good enough. CISOs need a more dynamic partner to protect their business: for today and tomorrow.

While the number of distributed denial of service (DDoS) attacks on European organizations is falling, attacks have become more targeted and intense.

Findings from Link11's European Cyber Report for the first half of 2026 show that the number of attacks was down by 42%, but revealed new highs for attack intensity across bandwidth, packet rate, and cumulative data volume.

The highest measured bandwidth attack reached 2.3 Tbit/s – 85% higher than the previous peak of 1.2 Tbit/s in the first half of 2025.

The packet rate followed the same pattern, reaching a new peak of 322 million packets per second — up 56% from 207 million packets per second a year earlier.

Cumulative traffic also increased, rising from 438 to 705 terabytes over the six-month period — a 61% increase.

“Attacks are shorter, but the total volume that we had to mitigate is higher than ever," said Karsten Desler, Link11 CTO. "Attackers are steering their botnets with greater precision and control, generating more traffic in less time.”

Law enforcement takedowns are working

The drop in the number of attacks is down to sustained pressure from international law enforcement, including the takedown of pro-Russian group NoName057(16)'s infrastructure in July 2025.

Similarly, the takedown in March of the command-and-control servers of four major IoT botnets has played a key role. These controlled more than three million devices between them.

Despite positive gains by law enforcement, a rise in super-botnets such as Aisuru and its successor, Kimwolf, as well as a growing number of hijacked cloud servers, has increased the intensity of attacks.

Unlike a private IoT camera with just a few Mbit/s of upload bandwidth, a compromised server in a data center has a connection in the Gbit/s range - meaning that just a few thousand hacked cloud instances can easily eclipse the attack potential of an IoT botnet with millions of end devices.

“These numbers show that the threat isn't shrinking; it's shifting from breadth to peak intensity,” said Jens-Philipp Jung, CEO of Link11. “Organizations that size their defenses based on last year's attack count are underestimating how quickly a single incident can escalate today.”

No reprieve for victims

Notably, the report found that getting hit once makes it more likely that you'll get hit again: 56% fell victim to a second attack within 30 days of the first, compared with 46% a year earlier.

Link11 said the most dangerous attacks aren't always the most visible ones. In one case, attackers used a traffic spike against two domains as cover while quietly running SQL injection and cross-site scripting (XSS) probes behind it.

The attack was only spotted because the attackers used the same IP addresses for both.

"The most dangerous attacks we deal with are rarely the loudest ones anymore,” said Jag Bains, VP solution engineering, at Link11. “If you're only watching bandwidth and known signatures, you'll miss the attacks designed to do the most damage, because they're built to stay unnoticed.”

FOLLOW US ON SOCIAL MEDIA

A simultaneous outage affecting OpenAI, Anthropic and xAI should act as a wake-up call for enterprises, analysts have told ITPro.

All three providers reported service disruption starting at about 6.30am Pacific Time on 3 September. While the outages were resolved within two-to-three, Charlie Dai, VP principal analyst at Forrester, said the incident puts the growing reliance of enterprises on AI tools in the spotlight.

“The near-simultaneous disruptions highlight that AI is increasingly becoming operational infrastructure rather than a productivity add-on,” he told ITPro.

“Enterprises should treat AI availability as a resilience issue, implementing multi-model strategies, fallback workflows, and business continuity plans instead of assuming frontier AI services will always be available.”

Downtime of any kind can be highly damaging for businesses, impacting finances, consumer trust, and operational efficiency. With OpenAI and Anthropic ranking among the most popular AI providers on the market, any outage raises the stakes.

“Downtime can quickly translate into lost revenue, reduced employee productivity, delayed decisions, operational disruptions, SLA breaches, and customer dissatisfaction,” Dai said.

“As AI becomes embedded in customer service, software development, knowledge management, and business processes, even short interruptions can create cascading impacts across multiple teams and customer touchpoints.

OpenAI, Anthropic, and xAI outage timeline

OpenAI, Anthropic, and xAI first reported issues between 6.23 am and 7.45 am Pacific time yesterday.

Anthropic confirmed “elevated errors on requests” for Mythos 5.1, Claude Fable 5.1, and Claude Opus 5 at 6.23 am PT.

OpenAI, meanwhile, reported “elevated errors” across ChatGPT and Codex. xAI also confirmed Grok was “experiencing issues”.

Based on respective status updates, all three providers resolved the issues within two-to-three hours: OpenAI marked the case as resolved at 9.15 am, while Anthropic and xAI reported fixes at 9.16 am and 10.05 am respectively.

The mystery source

With all three providers all experiencing outages in tandem, speculation over a common source was rife. Initial suggestions that a cloud or networking provider was behind the outages fell flat, however.

Neither Amazon Web Services (AWS), Microsoft Azure, nor Google Cloud reported downtime yesterday. Cloudflare, meanwhile, told ITPro that services were operating as expected at the time.

“Cloudflare is not experiencing any significant service disruptions at this time,” the company said. “Our services are operating normally, and any reporting that deviates from this is incorrect.”

In a statement via X, however, SpaceX revealed an outage at the company’s Memphis data center yesterday morning impacted Grok services.

“We are sorry for the issues you may have experienced with Grok following an outage at our Memphis compute center this morning,” the company said.

“We’d also like to apologize to our impacted compute partners. All systems have now been restored and are functioning nominally.”

As ITPro reported in May, Anthropic signed a multi-billion dollar deal with SpaceX to rent out “all of the compute capacity” at the company’s Colossus 1 data center. The company also relies on infrastructure provided by Amazon, Google, Broadcom, Microsoft.

Some users on X have pointed to a potential domino effect situation unfolding in the wake of the SpaceX outage. With Grok and Claude down, users may have flocked to OpenAI as a backup.

A spokesperson for OpenAI told Wired that a “routing error” started at around 7.43 am PT. ITPro approached OpenAI for comment, but did not receive a response by time of publication.

Dai said that the lack of clarity from each of the providers should raise concerns for enterprises and reinforces the need for greater vendor transparency.

When multiple major providers experience overlapping failures without a clearly established common cause, enterprises cannot accurately assess systemic risk, dependency concentration, or recurrence likelihood,” he told ITPro.

“This reinforces the importance of vendor transparency, dependency mapping, and risk assessments that extend beyond individual AI providers to the underlying infrastructure ecosystem.”

FOLLOW US ON SOCIAL MEDIA

Kaseya has launched two major enhancements to its Datto RMM platform, in a move designed to help MSPs and IT teams strengthen their compliance capabilities and simplify management of Apple devices.

Unveiled during the vendor’s Kaseya Connect Edge event, the updates will introduce FIPS 140-3 validated cryptography and native Apple mobile device management (MDM) capabilities to the firm’s cloud-based remote monitoring and management platform from October.

With the FIPS 140-3 update, the company is aiming to help organizations meet evolving compliance requirements in regulated sectors, while the native Apple MDM will enable users to manage iOS, iPadOS, and macOS devices alongside other endpoints from within Datto RMM.

"As regulatory requirements continue to evolve, MSPs and IT teams shouldn't have to choose between compliance and operational efficiency," said Kaseya chief technology officer Pratik Wadher in an announcement.

"At Kaseya, we're making it easier for organizations to pursue opportunities in highly regulated industries while continuing to leverage the automation, visibility and security capabilities they rely on every day.”

FIPS 140-3 compliance

Starting in October, Datto RMM will add FIPS 140-3 validated cryptography at no additional cost to customers.

The capability uses a NIST-validated cryptographic module to secure the platform’s core communication channels and can be enabled through a single account-wide setting. Kaseya said its inclusion will enable organizations to adopt the new standard on their own timeline, with the feature switched off by default.

Existing Datto RMM capabilities – including patch management, automation, monitoring, and remote control – will remain available when the setting is enabled, with audit-ready logging built in to reduce audit and legal exposure.

The company added that the move aims to help partners pursue opportunities in regulated industries such as government, healthcare, finance, and defense, as organizations transition toward the FIPS 140-3 standard.

Native Apple MDM

Datto RMM is also gaining native Apple MDM capabilities from early October, which will give MSPs and IT teams a centralized way to manage Apple devices without relying on a separate mobile device management platform.

According to Kaseya, the update will help reduce the cost, complexity, and visibility gaps involved with managing mobile devices through separate MDM tools.

Users will be able to enroll iOS, iPadOS, and macOS devices individually or in bulk via Apple Business Manager, configure security and compliance policies, deploy applications, and take remote actions directly within Datto RMM.

Apple devices will also appear alongside other managed endpoints across the platform’s existing dashboards, filters, and compliance reports, which Kaseya said will provide technicians with a more unified view of their customers’ environments.

FOLLOW US ON SOCIAL MEDIA

The rising quality of cheaper Chinese AI models could wreak havoc on the US tech industry, according to Juniper Research.

Analysis from the consultancy suggests leading US tech giants could find themselves losing out to Chinese rivals offering alternatives in a bid to break the industry’s global dominance.

Juniper Research pointed to figures from OpenRouter, which show that just 30% of the work on that platform was through AI models offered by leading providers such as OpenAI, Google, or Anthropic. That marks a steep fall from 70% last year.

The report noted that Chinese models typically run 60% to 90% cheaper than rivals from Anthropic and OpenAI. The pricing challenge from China was first faced last year when DeepSeek hit the market, tanking tech stocks briefly by offering high-level performance at a much lower cost.

This year, Alibaba's Qwen models had overtaken Meta's Llama as the most downloaded open model system, the report noted.

February marked the "real crossover into cheaper inference", Juniper added, with Chinese models processing 4.12 trillion tokens on OpenRouter vs 2.94 trillion for American models.

That's all down to lower prices for capable-enough open models, the consultancy noted.

“Open weight models are closing the capability gap with frontier models at a fraction of the cost," said Juniper Senior Analyst Jawad Jahan.

The trend is also being aided by more efficient designs, such as Mixture of Experts (MoE) models, which only use necessary parameters for a given query.

"This cuts compute-per-query without shrinking the model’s capability," the report noted. "DeepSeek is the cleanest example of this. Its V3 models carry 671 billion parameters in total, but only 37 billion of them fire for any given token. This led to a cut of V3.2’s price by more than half, as a result of lowering the cost of long-context inference."

Cutting costs with Chinese AI models

According to Juniper, DeepSeek's V4 Flash cost $0.14 per million input tokens against $5.00 for OpenAI’s GPT-5.5, while Claude Opus 4.8 was at the time charging about $5 for input and $25 for output per million tokens.

"This pricing gap has existed ever since the release of the first Chinese open-sourced model that was able to rival frontier organizations in the West," the report noted.

Shifting demand has altered the picture, however, with programming rising from 11% to more than half of OpenRouter's token volume. Agentic workloads also account for the majority of output, Juniper said.

"Given the large call frequency for agentic workloads, per-token pricing starts to become a real budget consideration and constraint," the report noted.

Funding the AI roll-out

That raises a problem, one that Juniper refers to as an "existential risk": can we afford all the borrowed billions being spent on data centers via "complex financing agreements" if customers stop paying for the very best models and instead choose cheaper Chinese options?

The firm argued that if the price of running AI falls too low, companies will lose the ability to make revenue from it to pay for all this investment.

That concern isn't new, either. Investors have been questioning the massive spending on data centers, with Juniper noting that the four major hyperscalers are expected to spend $725 billion on capital expenditure this year, up by 77% compared to the year prior.

Beyond the raw figures, Juniper pointed to the convoluted ways American companies are gathering the funds to pay for such projects, largely spurred by the AI infrastructure spending outpacing available cashflow and revenue.

The firm noted that this year the top five hyperscalers will spend more than a trillion dollars on infrastructure for AI.

"This figure exceeds their combined earnings and free cashflow," the report said.

Juniper claimed this has driven a rise in "off balance sheet financing" — in which companies don't borrow directly but build standalone legal entities to carry debt, later leasing the infrastructure back to the hyperscaler.

Circular financing is also a concern, which Juniper defines as a supplier investing in a company with the understanding the recipient will spend those funds buying the supplier's products.

The consultancy pointed to OpenAI's deals with Oracle and Nvidia as prime examples.

Chinese challenge to funding structures

If revenue from AI starts to shift to China, these spending levels and funding structures could prove problematic, the analyst firm noted.

"If this trend continues, the inference revenue underwriting the Western datacentre build-out weakens, and, correspondingly, the financing structures resting on that revenue,” Jahan commented.

That's exacerbated by the fact Chinese companies don't face the same issues, with funding either so far provided by external financial businesses, particularly in the case of DeepSeek.

Similarly, they aren’t beholden to a business model that sees cloud providers like Alibaba and Baidu effectively give the model away, then sell the compute to make use of it.

FOLLOW US ON SOCIAL MEDIA

Just one in five UK business leaders believe their cyber insurance will provide adequate protection in the event of a breach, according to new research from Cohesity.

In a survey conducted by the firm, only 22% of respondents believe cyber insurance policies will cover the costs and revenue losses associated with a cyber attack.

Cohesity said the survey highlights growing anxiety among business leaders given the heightened threats enterprises face. Concerns over losses in the wake of an attack are also growing, the survey noted.

CEOs estimate that a cyber attack could cut their organization’s revenue by 15.17% on average.

These figures are a ballpark estimate, however. One in five reveal that their business has “never undertaken business impact modelling to understand the potential cost of an attack”.

Without modelling, Cohesity warned that enterprises might never know the true scale of their potential insurance shortfalls, and this could come back to bite them.

Fraser Hutchison, VP UKI at Cohesity, said the study shows cyber insurance “should not be treated as a get-out-of-jail-free card”.

“As the threat landscape becomes increasingly complex, organizations cannot treat an insurance policy as a substitute for resilience,” he said.

“Organizations need to understand exactly what their policies will and will not cover, model the potential impact of different attack scenarios and prepare for losses that may fall outside their policies.”

Cyber insurance in the spotlight

Cyber insurance is now viewed as a critical fallback for enterprises due to rising global security threats, yet research from the UK government’s Cyber Security Breaches survey found half of firms across the country have no policy at all.

Awareness is rising, however. Analysis from the Association of British Insurers (ABI) in November last year showed 17% more policies were taken out across 2025 than in the year prior.

Speaking at the time, Jonathan Fong, head of general insurance policy at the ABI, said cyber insurance is “more than just a financial safety net” and now forms a key component of broader resilience strategies.

“The right policy not only supports businesses in the aftermath of an incident, but can also help prevent attacks through access to expert advice, threat monitoring, and incident response planning,” he said.

That study from ABI found cyber insurance payouts skyrocketed in 2025, with £197 million paid out across the year.

ABI pointed to Marks & Spencer (M&S), which recovered £100 million from insurers after a devastating attack disrupted operations in April 2025.

Knowing your policy

Cohesity urged UK business leaders to improve their understanding of cyber insurance policies, including what they’re entitled to in the event of a cyber attack.

First and foremost, firms need to understand their full financial exposure, modeling the “direct and indirect consequences of different attack scenarios”.

This includes potential revenue losses, downtime, remediation costs, customer attrition, reputational damage, and lost productivity. All these metrics are crucial when measuring the broader impact of an attack.

Similarly, understanding what insurers will and will not cover is vital. According to Cohesity, business leaders “need clarity” on areas such as policy limits, exclusions, and conditions, as well as the losses the organization itself needs to absorb.

Focus on resilience

According to Hutchison, the best approach for enterprises is to bolster cyber resilience capabilities to avoid any difficult conversations in the event of an attack.

“Cyber insurance can mitigate some of the financial risk, but the only way to truly bounce back from a cyber attack is by embedding genuine resilience into operations,” he said.

Hutchison added that enterprises need to identify systems and data that are critical to keeping the lights on in the event of a breach.

Elsewhere, assigning “clear responsibility” for recovery decisions is vital, as is regular testing to establish whether critical services can be restored in a timely fashion.

Improving cyber resilience also has a tangible impact on the cost of cyber insurance, research shows.

As ITPro previously reported, research from Sophos found enterprises that improved security capabilities were able to push down cyber insurance coverage rates.

A whopping 97% of respondents told the security firm that they had invested in cyber resilience with the explicit goal of improving insurance rates.

FOLLOW US ON SOCIAL MEDIA

IT leaders need to get back to basics and prioritize AI integration in areas where it can deliver real impact, according to Gartner, and that requires a more considered approach to adoption.

Tina Nunno, distinguished vice president and Gartner fellow, told ITPro that many IT leaders are still falling into a trap of following hype when it comes to AI, and it’s hampering success.

“We’re human beings, and we follow hype,” she said. “We're curious about what we last saw published, or in a keynote, or we're curious about what the vendors are talking about.”

“But we still have to have, I think, a reasonable balance and need to think about what’s the business case? Some of the basics still really matter here.”

Nunno’s comments come after a Gartner survey found the most popular AI use cases are rarely the ones that deliver real business impact and value.

The survey of C-suite executives warned that adoption projects are being influenced by “heavily hyped” applications of the technology over those that actually generate value.

“We calculated what the most common use cases were, and then we compared them to the ones where they were getting the most reliable rates of return, and they didn't match,” Nunno told ITPro. “There wasn't even a lot of overlap.”

Choosing the ‘popular’ AI use cases doesn’t always work

Gartner’s survey found that the three most popular AI use cases included cybersecurity threat detection and response, identified by 54% of respondents, alongside IT service desk automation (54%), and automated code generation and refactoring (44%).

Yet only the latter of these use cases ranked among the use cases that delivered positive operational or financial returns.

Intelligent IT asset and cost optimization (40%), synthetic data generation (28%) and automated code generation and refactoring (23%) all ranked as the most successful use cases.

While hype is a key factor behind this disparity, Nunno told ITPro that it shows some ‘high performers’ are taking a more surgical approach to integrating the technology.

These businesses are focusing on overhauling or streamlining specific processes in a highly strategic manner, rather than taking a slap-dash approach and seeing what works.

“When we look at what’s most common, sometimes they’re more foundational AI implementations,” she explained. They’re not specific to the business unit. They’re not specific to the specific function that they’re attempting to perform.”

Nunno added that approaching adoption with a degree of generality rarely delivers tangible returns. It’s why having a clear-cut goal from the get-go is critical.

“There was a bit more specific nature in those that actually were showing returns,” she said. “They appeared to be more targeted, and as a result, because they were more targeted, they seem much more likely to deliver”.

Gartner’s findings align closely with recent research from Dell Technologies, which also highlighted the importance of clear goals when it comes to AI adoption.

More than half (52%) of AI ‘front runners’ – those Dell identified as having the most success with the technology - had “clearly defined specific AI use cases”.

Be prepared

A lack of clear objectives and strategies is having a direct impact on scaling of AI across the enterprise, Gartner found. Indeed, just 22% of respondents said they’ve successfully scaled the technology across multiple business units.

Nunno told ITPro that this reinforces the importance of laying solid foundations before even embarking on projects. Building maturity is critical.

“For some organizations, we've seen there's a very strong correlation between the maturity of the organization and their ability to take advantage of AI,” she said.

“They haven't yet grown the AI skill sets that they need to bring the AI to scale, and that can be anything from the current state of their data, for example.”

Nunno admitted that this is often easier said than done. Basic foundational tasks like getting data in good shape and order are “a lot of work”.

“There’s still a very real investment that many of our clients are telling us they’re putting in to build those foundations to actually scale AI in the way that they would like,” she said.

“There’s a lot of heavy lifting that sometimes has to happen.”

FOLLOW US ON SOCIAL MEDIA

Hackers have leaked the personal details of 8.7 million people following an attack on three British airports.

The incident was first disclosed in late August, impacting travellers at three locations managed by Manchester Airports Group (MAG): Stansted, East Midlands, and Manchester airports.

The criminals behind the attack, believed to be FulcrumSec, published the data online, claiming to have half a terabyte of personally identifiable information.

However, the hackers reportedly said they wouldn't be selling "dangerous" data about future travel plans over concerns it would lead to stalking or burglary.

"This is an expected update, but it’s one none of the victims wanted to hear," said Timon Johnson, principal cyber essentials assessor at Closed Door Security.

"It was always unlikely MAG would pay the ransom demand as it is akin to doing business with criminals, and it’s also highly unlikely the data would ever have been returned in full without further exploitation."

Free release as punishment

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, agreed that MAG made the right call by refusing to pay the ransom.

However, that decision puts nearly nine million people at risk for mistakes that weren't made by them.

"The 'free release' model is deliberately designed to maximize harm and reputational damage as a warning to the next target," he said.

"Publishing almost nine million records for free isn't just punishment for MAG — it's a marketing campaign aimed at every other organization watching. Pay up, or your customers' data gets handed to every fraudster and scammer on the internet at no cost."

At this point, the airlines group says it has contacted everyone whose data was compromised.

"MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, including reaching out to all those with upcoming bookings to advise them of additional support," the company said in a statement sent to the BBC.

What happened?

The attack is believed to have started over the weekend of 22 August, with the intrusion spotted the following Tuesday by MAG's security team, which promptly shut down further access. The attack was publicly disclosed on Thursday, 27 August.

FulcrumSec later claimed responsibility for the attack, saying it would publish the data owing to MAG not negotiating a ransom. Yesterday, they followed through with that threat.

MAG said in a statement that the customer data relates to the car park, lounge, and Fast Track bookings at the airports, as well as Wi-Fi signups, stressing there had been no operational disruption and that aviation security had not been compromised.

The data taken includes email addresses, phone numbers, vehicle registrations, and postcodes, but does not include bank or payment card details.

What now?

As the data has been published on the open web, the focus now turns to scams against the 8.7 million victims.

"Now that the data is available for free on the dark web, other criminals will be working to exploit it," says Johnson. "Phishing presents the greatest risk, and all individuals must be vigilant for scams. These could come in via email, phone calls or texts, so all these communication methods must be monitored closely."

As ever, this means constant vigilance online: be wary of clicking links or opening attachments and don't share any financial or other personal data unless the receiver has been verified, added Johnson.

The inclusion of travel data exacerbates the risk, according to security expert Kevin Beaumont.

"The data includes both historical locations and planned future travel, so individuals sensitive to their movements being known may need to take precautions," he told the BBC.

FOLLOW US ON SOCIAL MEDIA

Hackers have breached cloud storage provider Dropbox via a flaw in Lenovo’s email verification process.

Around 5,000 accounts are believed to have been compromised during the first three weeks of August, with files viewed or downloaded from around 1,500 of these. It's not known who carried out the attack.

The breach arose through the single sign-on (SSO) option using Lenovo IDs. Dropbox partners with Lenovo as an identity provider, allowing users to log in to their Dropbox accounts using verified Lenovo IDs.

However, the process lacked enforced two-factor authentication (2FA), meaning that an attacker could gain full access without needing a password. Even users without a pre-existing Lenovo ID were vulnerable.

The company has now alerted users.

"While you may not have an existing Lenovo ID, our investigation determined that an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address," the company said.

Justin Beals, CEO and founder of Strike Graph, said the incident appears to have derived from a trusted legacy integration between the two firms.

"This is the same failure mode we keep seeing across every major vendor breach this year. Organizations assess the vendors they contract with directly, then treat every integration that vendor maintains as inherited trust. Nobody re-verifies the third-party connections a trusted platform has already built," he said.

"Traditional third-party risk management approaches have true positive detection rates below 30%, and a legacy authentication bridge between two major platforms is exactly the kind of dependency that a point-in-time questionnaire was never built to catch."

Dropbox breach could've been avoided

Dropbox has now closed the loophole by expiring all sessions authenticated through Lenovo IDs, cutting any link between Lenovo, and adding the requirement for users to enter their Dropbox account password when attempting to use Lenovo ID authentication.

A spokesperson for Dropbox told ITPro the company reacted swiftly to the incident and has informed affected users.

“We emailed users we know were impacted, offered them support, and reported this event to relevant data protection regulators," they said.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, suggested that some users only have themselves to blame for not implementing multi-factor authentication (MFA).

“Every single one of the compromised accounts lacked multi-factor authentication. In 2026, for cloud storage accounts holding data, that’s an indefensible gap, and it’s one that users could have closed themselves regardless of what Lenovo or Dropbox did or didn’t do with their legacy integration," he said.

Organizations should periodically audit what third-party services have authentication access to their accounts, he said.

"OAuth grants, SSO connections, and third-party login integrations accumulate silently and rarely get removed when the relationship that created them ends,” Patel added.

Dropbox has been hit before, with a 2012 breach that affected around two-thirds of the company's user base. Four years later, more than 68 million customer usernames and passwords were leaked.

On that occasion, accounts were compromised through password reuse, Dropbox said.

FOLLOW US ON SOCIAL MEDIA

Managed Security Service Providers (MSSPs) need continuous security testing and faster risk identification. But the cybersecurity talent shortage makes it harder to expand service delivery through hiring alone.

The challenge is becoming more urgent as cyber threats continue to grow. More than 2,244 cyberattacks occur every day worldwide, according to our research. This creates constant pressure for organizations to identify and address security gaps before attackers do.

More risk and more demand. Traditional approaches and tools simply can’t keep up.

That reality is forcing MSSPs to change how they scale security services. The good part is that continuous pentesting no longer requires a proportional increase in headcount. With AI-powered automated penetration testing, MSSPs can expand security coverage, increase testing frequency, and serve more clients without continuously adding security specialists.

Why continuous security coverage is getting harder

Managing security for clients used to be like checking a box once a year, but that has changed. Each organization needs continuous security coverage to keep up with the updates they are deploying and the growing number of cyber threats.

The complexity of today’s applications can’t be tackled by traditional methods because:

• Cloud-native apps and APIs change daily, making annual penetration tests obsolete within weeks.
• Hiring more security experts to manually test every environment is not feasible.
• Attackers now use AI to scan and exploit systems continuously, moving far faster than manual audit cycles.

As a result, many providers are rethinking how they scale offensive security services without continually expanding their security teams.

Why hiring more people isn't a scalable security strategy

Hiring more security experts seems like the obvious way to add to continuous pentesting services. But in reality, fluctuating demand, shortage of skills, and other operational costs can make it difficult to sustain.

1. Skilled security talent is hard to find: The cybersecurity talent gap remains a major challenge across the industry. Recent ISC2 research found that 95% of organizations report at least one cybersecurity skills gap, while 59% face significant or critical skills shortages. Finding experienced pentesters, application security specialists, and offensive security experts is becoming increasingly tough.
2. Hiring costs keep increasing: Recruiting security professionals is expensive, and other than salary, MSSPs need to account for onboarding, training, certifications, and retention efforts. With high demand for application security and threat exposure management skills, the cost of building larger teams rises with it.
3. Client growth often outpaces team growth: Security teams do not scale at the same rate as client demand. As MSSPs add more customers, each new environment introduces additional assets, attack surfaces, vulnerabilities, and testing requirements. Hiring one person at a time rarely keeps pace with the volume of continuous security assessments clients expect.
4. Specialized expertise does not scale easily: Continuous pentesting demands expertise in web applications, APIs, cloud environments, business logic testing, and risk validation. Building teams with every required specialty can easily become impractical for growing MSSPs.
5. More people can create operational bottlenecks: Adding more heads to the team does not mean improved service delivery. Larger teams require coordination, management, quality assurance, and workflow standardization. In many cases, operational complexity grows faster than productivity, reducing the efficiency gains MSSPs expected from hiring more analysts and testers.

The key problem with hiring more isn’t just about finding more skilled experts; it’s finding a way to offer continuous security coverage while utilizing the resources efficiently.

How MSSPs can provide continuous pentesting without hiring

The most practical way to scale continuous pentesting today is to combine security expertise with AI-powered automated penetration testing that increases coverage, testing frequency, and operational efficiency.

Automate repetitive security testing tasks: A large portion of pentesting involves reconnaissance, attack surface discovery, vulnerability validation, and retesting. AI-powered pentesting platforms can help you automate these repeatable tasks so that you can focus on higher-value investigations and risk analysis.

Integrate security testing into existing pipelines: You should embed automated testing directly into the client delivery process. This ensures that every configuration change is tested immediately rather than waiting for an annual check. It turns security from periodic, labor-intensive work into an automated process.

Implement multi-tenant management: Instead of configuring tests for each client individually, use multi-tenant dashboards. This allows your current engineering or SOC team to centrally schedule automated tests, distribute reports, and track remediation across hundreds of client environments simultaneously.

Prioritize findings based on real risk: Use modern AI-powered pentesting platforms that help correlate findings, validate exploitability, and highlight the issues most likely to impact the client. This improves remediation efficiency and helps you deliver clearer security outcomes.

Utilize white-label reseller tools: The best way to save time and effort on preparing reports is by using a tool that offers white-labeled reports. The reports are generated by AI-powered tools, and you can keep your Logos & URLs, making sure you deliver professional, client-ready documentation without manual formatting.

What MSSPs should look for in a scalable continuous pentesting solution

As client environments grow complex, MSSPs need solutions that can expand security coverage without operational burden. The ideal platform should help teams identify risks faster, validate findings more efficiently, and deliver consistent security outcomes across multiple customers.

When evaluating a solution, focus on capabilities that support long-term scalability:

• Continuous attack surface monitoring
• AI-assisted vulnerability validation
• Web application, API, cloud, and external asset coverage
• Risk-based prioritization of findings
• Automated retesting and remediation tracking
• Multi-tenant management and reporting
• Integration with existing security workflows and ticketing systems

The right tool helps security teams spend less time on repetitive testing and more time delivering meaningful risk insights. For MSSPs, that balance is what makes continuous pentesting both operationally sustainable and commercially viable.

Continuous pentesting is the new basic expectation of clients, and that has turned out to be the new challenge for MSSPs. If they rely only on hiring to offer continuous testing services, it is rarely sustainable in a market already facing a cybersecurity skills shortage.

The most effective path forward is to combine security expertise with AI-powered automation.

By automating repetitive testing activities and enabling continuous security validation, MSSPs can support more clients, identify risks faster, and scale their services without compromising the quality of protection they deliver.

AI research non-profit METR has disclosed two security incidents – and while no sensitive information is believed to have been accessed, one of the attacks led to what might have been a massive bill.

According to METR, attackers stole an API key for inference on public AI models in March, consuming $600,000 worth of credits. Luckily, the model developer had granted them to METR for free.

A researcher left an EC2 instance publicly accessible behind Google authentication, the company said, which contained an API key for METR’s general-access (public models) account.

METR noted that the vibe-coded app included a fail-open vulnerability that silently disabled authentication, exposing the system to the public internet for several days.

METR reckons the attacker found the instance by looking through recently registered websites to find vibe-coded sites with high-signal keywords relating to LLMs or agents.

The attacker prompted an agent directly to reveal its model provider API key, added an SSH key for persistent access, and over the course of three weeks used the stolen credentials to consume the API credits.

Why didn't METR notice?

METR noted that because the organisation is “accustomed to running evaluations and experiments that use large volumes of tokens”, the incident flew under the radar.

The non-profit regularly runs large-scale evaluations with pre-deployment AI models, meaning it typically deals with “lots of weird rate limits and API errors”.

"At the time of the incident, our internal usage dashboard didn’t show data on rate-limited requests to all users, even if they were occurring,” METR said.

Notably, because it wasn't actually paying for the tokens there was no natural token spend ceiling, and no way at the time to put a spending limit on keys.

METR lifts lid on separate attack

In another attack in May, METR spotted attackers systematically probing its publicly accessible infrastructure, including an unsuccessful attempt to access internal data via an inadvertently exposed endpoint.

"We were tipped off that we were being targeted by hackers who appeared to be financially motivated and may have been looking to obtain frontier model access," it said.

"We observed the attackers systematically probing our publicly accessible infrastructure, with heavy use of agents to automate vulnerability discovery, including by credential stuffing authentication providers, attempting OAuth token grants, scanning newly deployed services, and attempting to phish staff."

METR said it's now maintaining an isolated public production environment for public-facing applications that's architecturally separated from its internal infrastructure.

This means a misconfiguration in a public service can't expose internal data. It's also hired a security lead and is expanding security staff further.

Elsewhere, METR revealed it has shut down legacy infrastructure that was unnecessarily expanding the attack surface and has set up monitoring for unusual API key usage and other abnormal behavior.

"Although these incidents had limited consequences, we considered them near-misses, and increased our security investment in response," it said.

FOLLOW US ON SOCIAL MEDIA

Cato Networks has cut the ribbon on SMB FlexPool, a new program designed to help MSPs deliver managed SASE services to small and midsize businesses at scale.

Available to both new and existing MSPs and service providers, the initiative offers access to a pool of Cato licenses that can be gradually allocated across eligible SMB customers as demand evolves.

The model allows partners to create customer accounts, allocate capacity, and activate services through a self-service workflow, while retaining control over customer relationships, service packaging, and support.

In an announcement, Cato said SMB FlexPool aims to remove the operational overhead associated with separate licensing transactions for every customer deployment, allowing partners to onboard customers faster and reallocate capacity as required.

"MSPs shouldn't have to slow down customer deployments because of licensing and operational overhead,” said Cato Networks’ global channel chief Karl Soderlund.

“SMB FlexPool aims to remove that friction with instant provisioning and flexible pooled licensing, enabling partners to activate new customers while maintaining full control of the customer experience."

Cato Networks provides a converged network and security cloud that brings networking, security and access capabilities together across enterprise environments. The platform offers visibility and control across users, applications, data, and AI interactions.

The company’s new SMB FlexPool initiative is built on the firm’s managed SASE (MSASE) Partner Platform, which provides MSPs with tools, training, and automation across the partner lifecycle.

Pooled licensing for MSPs

SMB FlexPool’s built-in partner-level capacity and license portability allow MSPs to allocate capacity across eligible SMB customers, as well as reallocate unused capacity as requirements change.

Cato said this approach aims to give MSPs greater flexibility as their customer base and pipeline develop, allowing them to ramp utilization of their purchased capacity in line with staged customer deployments and go-to-market progress.

Partners also retain control over key elements of their customer-facing packages, including their commercial offering, support model, and managed services.

By eliminating the friction associated with individual transactions, Cato said its new partner initiative will help partners move from opportunity to customer-ready service “in seconds.”

SMB FlexPool can be managed through Cato’s new MSASE dashboard in the MSASE Business Center, giving partners a unified view of customer accounts, orders, license usage, invoices, and customer lifecycle activity across both SMB and enterprise customers.

Art Nichols, chief technology officer at Uniti Solutions, said Cato’s new partner model will give the MSP a more efficient and scalable way to deliver managed SASE.

“Instead of managing separate licensing transactions for every new customer, we can provision services in seconds, bring customers online faster, and keep our operations simple as our business expands,” he explained.

“This means our customers benefit from faster deployment, a smoother onboarding experience, and the confidence that their secure network services can scale seamlessly alongside their business.”

FOLLOW US ON SOCIAL MEDIA

If you can cast your mind back to 1999, the computing world was in a frenzy over the Y2K bug, or Millennium Bug, a coding flaw where systems abbreviated four-digit years to two digits – so, 99 instead of 1999.

First identified in 1958, the fear was that computers would read '00' as 1900 instead of 2000, potentially crashing global infrastructure. As such, $300 billion (now worth a staggering $600 billion in today's money) was spent to upgrade computers and application programs so they were Y2K-compliant. Because of this monumental effort over many years, the crisis was largely averted.

In 2026, a similar panic is simmering at a glacial pace. The fear is Q-Day: a hypothetical moment at which quantum computers become so powerful that they can crack encryption algorithms within seconds. Leading industry figures, quantum computing companies, cybersecurity advisors, and even national government agencies have been warning about this moment for years — as far back as 1994, when mathematician Peter Shor first published his paper warning about this exact possibility.

Since then, the threat has felt far away and abstract – with under-pressure businesses spending their precious IT budgets on more immediate threats.

But in March 2026, Google Quantum AI published research revealing that quantum computers can crack the encryption underpinning Bitcoin using under 500,000 physical qubits. As such, Google accelerated its migration timeline from the 2030s to 2029. This is simply one example of the industry ramping up the pace of its migration, with another March study showing quantum computers may need as few as 10,000 qubits to one day break the most secure encryption algorithms.

But that doesn't seem to have moved the needle very much, with countless businesses still completely unprotected or in the very earliest stages of exploring moves to implement post-quantum cryptography (PQC) or related countermeasures. With the timelines accelerating, why is the business world still so slow to react to these looming threats that lie over the horizon?

How prepared are we for a post-quantum world?

Existing research into business preparedness is incredibly bleak. The vast majority (90%) of companies don't have systems in place to defend against quantum security threats, according to Bain & Company analysis. It's a similar, albeit less extreme, story with Keyfactor research that shows nearly half (48%) aren't ready.

Juniper Research found that just 27% of global companies will deploy PQC – but only by 2035. Right now, that figure stands at roughly 0.0009%, or just 35,000. Compound these findings with QuEra research that showed the level of confidence in quantum preparedness actually fell from 65% to 55% between 2025 and 2026, meaning that as the threats become less abstract, businesses are increasingly aware that the measures they've taken may not be sufficient.

There's a readiness gap – no matter how you interpret the many and various findings. But what does this actually mean in practice and why is there such a large gap? Knowledge is the primary deficit, says Arjun Kudinoor, a doctoral student and NSF Graduate Research Fellow at MIT, as well as quantum security advisor at Protegrity. Many organizations lack the required expertise to understand the risks, prepare existing systems, and identify valuable applications, according to Kudinoor.

"Businesses must begin developing quantum literacy across technical and executive teams, assessing their exposure to quantum-enabled cybersecurity threats, and identifying problems for which quantum computing could provide a meaningful advantage," he adds.

But according to Orange Business' quantum-safe network lead and program director of edge computing, Frank de Jong, awareness has increased significantly in the last few years.

He tells ITPro: "It is impossible to be quantum-ready today, and in my opinion, it is also questionable if you could be completely quantum-safe before 2029. That's why we advise customers to start planning now and prioritize protecting their most valuable assets first. The key is to begin the journey, not to wait for perfect conditions."

As things stand, some sectors are more prepared than others. The earliest movers were telecoms providers and infrastructure-heavy organizations, with financial services, healthcare and software providers following suit. But it's also true to say that preparedness varies more based on resources and expertise, adds Kudinoor. He explains that firms with strong technical teams, quantum-related budgets, and executives concerned about planning for the threat are moving the fastest.

Avoiding a slow-motion quantum disaster

Quantum computing is difficult to wrap your head around, and it's long been a technology that's some years away from maturation. For that reason, it might be tempting for many to have kicked the issue deep into the long grass. Suja Viswesan, IBM VP of security software, acknowledges this impact. "It can feel overwhelming at the sheer magnitude of possible impact. But the best place to start is by gaining visibility. You can’t fix what you can’t see."

Businesses, she says, should start small by mapping cryptographic assets – including certificates, secrets and API keys – across their environments. Then, they should prioritize risk and introduce controls such as proxy layers to, as she puts it, "buy time" before full PQC upgrades are available.

Kohinoor rejects the notion that quantum computing's threats are abstract, telling ITPro: "Much work has been done to estimate the number of qubits, error rates, and error correction methods required to implement such quantum factoring algorithms on quantum hardware."

The most powerful quantum computers commercially available are only one or two orders of magnitude away from breaking encryption schemes like RSA-2048. Thankfully, he adds, it's "not yet a disaster" because we are still several difficult breakthroughs away from achieving a fault-tolerant cryptographically relevant quantum computer.

So what's to explain the general malaise in preparing for this eventuality? The answer may lie on the balance sheet – and the IT and security budgets that so many organizations are under pressure to spend on far more immediate threats.

Although IT spending is expected to hit $6.37 trillion this year, 14.2% higher than last year's spend, much of this has been allocated toward either trendier areas or toward more concrete threats. As de Jong puts it, IT budgets are spent "on where the center of attention is".

"In recent years, this was predominantly AI, and still today, this is where the majority of the “additional” money gets spent," he explains.

"Transitioning to quantum-safe infrastructure isn't a simple project. It will require substantial, sustained investment over many years. The most urgent call to action for CXOs today is to start planning and allocating substantial budgets for the coming years. This isn't fear-mongering — it's pragmatism. We cannot afford to wait and see."

Is it too late to prepare for the post-quantum world?

The urgency is certainly there, and many experts fear it's far too late to avoid the damage – especially given the rise of "harvest now, decrypt later" (HNDL) attacks – in which cybercriminals steal encrypted data with the intent of cracking it in the years to come using quantum computers.

But even if that were the case, there's still far more damage that can be done if businesses are sluggish about getting their defenses sorted. In that vein, the experts we interviewed say it's never too late to prepare.

"As the saying goes, ‘The best time to plant a tree was 20 years ago. The second-best time is now.’ The challenge with cybersecurity threats is that they may or may not affect you, but the fact that they could is sufficient reason to pay attention," de Jong says, but concedes that many will never be fully prepared.

"Most organizations face 15 years of work to become quantum-safe, but they may have only three years to do it. This means that they need to prioritize and accept the fact that not every asset can be defended at the same level from the start."

In the last few years, the mood has certainly shifted away from maximum preparedness to damage limitation as the reality has hit the industry that businesses haven't been moving quickly enough. MIT's Kudinoor advises businesses to upgrade all systems to PQC, beginning with the highest priority and most publicly available systems.

But the reality is that the threats themselves won't all hit at once – despite the 'Q-Day' label implying there's a single moment in the future beyond which there's no return. As IBM's Viswesan explains: "We’ll see it materialize over time, spanning multiple years as different cryptographic systems become vulnerable at different times."

Quantum readiness is all about making haste slowly

Given the gradual and unfolding nature of 'Q-Day', businesses should avoid rushing their decision-making and adopt a balanced and thoughtful approach, whether that's in assessing their estate or engaging with vendors.

The name for this dilemma – in which you need to act fast but not so fast that you end up making poor decisions – is "festina lente", a Latin term that roughly translates to "hurry slowly". But that's easier said than done.

"Organizations shouldn't wait to begin the transformation journey, but they also shouldn't rush into decisions. That’s where crypto-agility comes into play," Viswesan continues.

"Crypto‑agility is the ability to migrate to post-quantum cryptography (PQC), while maintaining the flexibility to make changes without business disruption. Crypto‑agility allows organizations to scale cryptography‑based data protection with confidence, reduce the operational costs associated with managing cryptography, and meaningfully lower long‑term security risk."

What about quantum companies themselves? After all, aren't they causing the problem in the first place? As de Jong says, the supply chain is already seeing a lot of countermeasures embedded into products by design, for example, quantum-safe features in the systems that cloud companies provide.

Pro bono support may also be available to smaller companies without the budgets or expertise to fight this battle. But, he says, the problem is likely to impact the larger companies the most.

To adequately prepare, the experts also recommend that building quantum literacy among technical teams and executives is essential. These teams should then devise roadmaps, with budgets over the coming years incorporating more quantum line items.

This transition is new to almost everyone, meaning that it's a journey of discovery and the best practice is still being formulated. There are, however, companies that are further along the journey than others – and organizations should liaise with one another so that everyone can benefit together.

"The transition to quantum-safe is new for almost everyone," de Jong adds, "so I would advise enterprise CXOs not to try and reinvent the wheel themselves, but rather work with companies that have been working on it for several years, so everyone can benefit from the collective knowledge."

The timelines are shrinking with each quantum computing breakthrough, and there's a general acceptance among experts that it won't be possible for businesses to be fully quantum-ready by 2029 – especially if you factor in the HNDL attacks that have already happened.

That said, it's never too late to act to avoid the very worst of it, and businesses should do what they can to get as far ahead of this threat as possible before it's too late – no matter how tempting it is to route budgets into more appealing areas like AI.

Should more businesses begin to act faster, when 'Q-Day' begins to take hold, there's still every chance, much like the Y2K bug, that this will become yet another amusing anecdote from the annals of tech history about a massive computing threat that was avoided.

Anthropic is back to testing security models after systems went rogue – and claims the incident wasn’t entirely down to security faults but AI misalignment.

Back in July, Anthropic revealed its Claude models had slipped out of their apparent bounds to hack third-party systems. Days later, its Mythos system was spotted with similar alarming behavior by the UK AI Security Institute.

The incidents followed OpenAI revealing similar behavior from its own security models.

Last week, OpenAI reported on its own incident, detailing plans to improve security around such models, and Anthropic has followed with its own efforts, including confirmation that it will begin testing again.

Anthropic noted it was currently conducting a review of what happened and said it is "planning" to work with METR on an independent review; OpenAI has already published an independent METR review into its own incident.

But Anthropic isn't waiting to make changes. In a blog post on 31 August, the firm said it plans to make tweaks to containment and monitoring, introduce new rules for third-party testers, as well as changes to the models.

Notably, the AI developer revealed it is seconding 150 product engineers to focus primarily on security.

"We believe the incidents reflect a failure of operational security, as well as two alignment issues: motivated reasoning, and willingness to take harmful actions in pursuit of a narrow task," the company said.

Anthropic is back testing

While the full investigation isn't yet complete, Anthropic said it was removing a "pause" on external cybersecurity evaluations of pre-release models as well as internal tests.

To avoid similar issues happening again, Anthropic is adding additional layers of security and "hardening" the sandbox where these models are set loose, noting that move was prompted by its own evidence as well as that shared by OpenAI.

The changes include a system to spot when a model attempts to escape a testing environment or obtains internet access, immediately blocking the activity and alerting people overseeing the task, as well as fixing potential flaws and misconfigurations in the sandbox.

"We migrated high-risk internal cyber sandboxes to more robust isolation," the post added. "We are also further red-teaming our virtualization stack – that is, tasking pre-release models to try and escape it – to find and patch weaknesses."

Similar protections have been applied to reinforcement learning environments, with Anthropic adding it plans to expand its monitoring across most other internal frontier agentic usage.

Beyond testing environments, Anthropic is hardening security across the company, including blocking outbound traffic by default on computing clusters, boosting identity verification on internal services, retiring legacy services, and reducing the number of human and automated accounts that can access model weights or customer data.

Tougher testing rules

With regard to third-party testing, Anthropic said it will require testers to commit to a fresh set of best practices, noting that the reported incidents all took place in external evaluation environments.

As ITPro reported last month, Israeli startup Irregular was identified as the external model testing firm involved in all three ‘rogue AI’ incidents involving Anthropic, OpenAI, and Meta.

The changes include running tests inside hardened sandboxes with no internet access, tasking the model being tested to look for flaws before tests under close human supervision, run monitoring continuously, and confirm whether test tasks are impossible or not.

"When an evaluation target is offline or a task can’t be completed, agents will often look for other ways to complete a challenge, increasing the chance that they take actions outside the intended scope of the evaluation," the company said.

Unpicking why

Those operational changes should help prevent models from escaping their sandboxes, but Anthropic said it wants to better understand why its systems took such "dangerous actions" in the first place.

While the full investigation continues, Anthropic highlighted two challenges with alignment, which refers to ensuring that AI behaves how humans want and expect.

"One is motivated reasoning: the models were initially told their environments were simulated, but when they later encountered evidence that they were connected to the real internet, they may have interpreted that evidence in a way that allowed them to maintain that belief," the blog post explained.

"The second is recklessness: the model was willing to take harmful actions on the real internet in pursuit of the narrow goal of solving a cybersecurity evaluation."

The company noted that poorly designed training environments – including ones that are easy to cheat in or impossible to solve without cheating – can lead to misalignment behavior.

Anthropic is trying to avoid such issues in the future. The company said work on thie front goes back several months and involves training poorly and training well to try to spot differences – but admitted that the July incidents show "our process isn't perfect and our models aren't perfectly aligned".

Further details on security improvements are expected in the full report, according to Anthropic.

Beyond that, the firm also loosely backed calls to develop a framework for safe development of security-focused AI, acknowledging that its own executives had recently signed an open letter demanding better coordination globally.

Anthropic said it would "say more in the coming weeks" but intended to contribute to such efforts.

FOLLOW US ON SOCIAL MEDIA

Security researchers have successfully used AI to port a remote code execution (RCE) exploit between two programmable logic controllers (PLCs).

While the experiment still required significant human expertise to negotiate dead ends and false leads, it showed how AI could make it easier to carry out attacks against embedded and industrial systems.

The team at Forescout’s Vedere Labs used AI to port an RCE exploit between two WAGO PLC models in an exploit that took eight hours and 32 minutes and consumed just $535.74 in API tokens.

Once code execution was achieved, AI produced multiple working network payloads within minutes, suggesting that post-exploitation could become increasingly automated as models improve.

The exploit targeted CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server that allowed arbitrary ARM shellcode to execute on the live PLC without credentials.

Researchers had already shown that RCE exploits on PLCs can enable Deep Lateral Movement and granular control over safety logic – and reckoned that as AI-assisted exploit development improves, these techniques could become more accessible.

How AI was used to crack PLCs

The AI-assisted exploit development process involved two steps, according to Forescout. First and foremost, this included confirming the vulnerability and writing the payload.

Each step consisted of interactive sessions between a researcher and Claude Code, which had access to a terminal, the reference files, analysis tools including Ghidra, and the live target PLC.

Claude could use those tools directly, generate and test code, and ask the researcher for additional input when needed.

Researchers noted that Claude decided to confirm the presence of the vulnerability by both probing the live target and carrying out static code analysis.

It didn't work the first time, however, with one session failing to trace the vulnerable function correctly and producing an invalid exploit.

According to researchers, the analysis provided useful context for the next session, which used binary searches to map the relevant functions correctly – albeit with researcher input to steer the analysis away from dead ends and provide additional disassembly context where necessary.

Writing a working RCE exploit took much longer, with initial attempts failing. Claude also wasted a lot of time testing incorrect hypotheses, decompiling unrelated code, and pursuing false leads.

The researchers had to change to Claude Opus 4.6 with 1M context, and add the prompt: “Ask for my help with disassembly if you are not certain about a firmware detail”, and instruct the AI to the sink of the vulnerability – the point where the attacker-supplied username is copied into memory.

Claude could then reason about the function call chain leading to the sink and understand that it needed more context about how FTP packets are treated throughout this call chain.

Operational technology in the crosshairs

Organizations shouldn't dismiss operational technology (OT) vulnerabilities because they seem hard to exploit, researchers warned.

"AI has already lowered the barrier to vulnerability research and exploit development in higher-level software. This experiment suggests that the same progression is beginning to reach low-level embedded systems, although substantial barriers remain," the report noted..

"As models become more capable and independent, the cost and expertise required to adapt exploits across related embedded targets could fall substantially."

The advice on mitigation is pretty standard: reduce unnecessary OT device exposure, monitor OT environments for early signs of exploitation, exercise incident response against AI-assisted OT attack paths and use AI defensively, but validate its outputs.

Programmable logic controllers are rapidly emerging as a major risk to critical infrastructure. The US National Security Agency (NSA) issued a warning last month over an active threat against Siemens PLCs.

Similarly, in recent months, a series of attacks on US water supply infrastructure targeted internet-exposed PLCs, with the attackers remotely changing IP addresses and turning on and setting passwords.

Several water firms were left unable to view connected equipment, and in some cases it was shut down.

FOLLOW US ON SOCIAL MEDIA