verizon

The next time you type something sensitive into a Google Doc—or any other online tool with a sharing feature—be careful about the permissions you grant. Speaking with The Register , the founder of QR generation service Pageloot said that he learned that the hard way. Siim Kostabi recalled how a contractor working for the company accidentally exposed login details for its staging environment—credentials that were never meant to leave an internal testing setup. The hapless developer had access to a staging environment (used to test new software code before it goes live). They stored the login details in a Google Doc and then set it to “anyone with the link can view.” It turns out Google Search can index Google Docs with that setting if the link becomes discoverable on the public web. “Anyone with the link” files aren’t automatically indexed, so we don’t know exactly how Google discovered this particular document. What we do know is that it did: The credentials file ended up in Google Search. A Pageloot developer typed the company’s domain into Google while debugging, and Google’s autocomplete feature surfaced a staging hostname followed by what looked like a credential string. Sure enough, the document was accessible online. Google Search was surfacing information from a document that had been shared too widely. To its credit, Pageloot moved quickly. It cut the contractor’s access and changed every affected credential. It also banned password storage in Google Docs, Slack, Notion, and any other shared workspace. The problem is that none of those fixes existed before autocomplete surfaced the password. If nobody had spotted it, the credentials could have remained exposed. People share private data in online tools all the time If there was ever an example of why you should use a password manager, this is it. Instead, the contractor typed their login details into a Google Doc, presumably to keep them handy. Pageloot isn’t alone in dealing with this problem. Ateam, a Japanese Android game developer, left a Google Drive instance set to “Anyone on the internet with the link can view” from March 2017 until November 2023. That single misconfiguration exposed 1,369 files and personal data for 935,779 people. Ateam said it had seen no evidence anything was taken, though seven years of open access is hardly reassuring. Scale AI, the data-labeling company central to Meta’s AI ambitions, also left 85 Google Docs with training material for Meta, Google, and xAI editable to anyone with a link. Contractors called the setup “incredibly janky”. Scale later disabled users’ ability to share managed documents publicly. This is a trend. Three years ago, AI security company Metomic scanned approximately 6.5 million Google Drive files and found that 40.2% contained sensitive information. Just over a third were shared externally, while 0.5% were fully public. That 0.5% might not sound like a lot, but across 6.5 million files, it still represents thousands of publicly accessible files. This isn’t just a Google problem, though. People accidentally share sensitive information through other tools too, like the Trello project management system. Making a Trello board public makes it viewable to everyone, which was unfortunate for government users when they exposed passwords and security plans that way in 2018. The problem is that as tools become increasingly collaborative, people can’t keep up. They make mistakes. Verizon’s 2025 Data Breach Investigations Report attributes around 60% of breaches to human factors including misconfiguration and misuse of valid credentials. What the checkbox cost Pageloot encountered another access-control failure involving a customer. A disgruntled former employee whose access had never been revoked used it to redirect the customer’s QR codes to a competitor’s site. It was the same root cause: nobody was watching who had access to what. Kostabi learned his lesson, which is to keep an eye on who has access to what. Consumers can take a few simple precautions too. Don’t store passwords or other highly sensitive information in ordinary shared documents. Use a password manager for passwords, and before hitting Share in any online service, check exactly who will be able to access what you’re sharing. “One of the best cybersecurity suites on the planet.”   According to CNET.  Read their review →

Organizations now manage thousands of human and non-human identities across cloud services, software-as-a-service applications, endpoints and remote environments. As hybrid working, Bring-Your-Own-Device (BYOD) and third-party access continue to expand, security teams are losing visibility over who has access to what and whether that access can be trusted. Attackers are taking advantage of that complexity, as compromising an account is often faster and quieter than exploiting infrastructure vulnerabilities directly. For defenders, detecting malicious activity tied to a legitimate identity remains one of the biggest security challenges today. So, what’s driving the rise in account takeover attacks, and how can organizations protect their identities? Phishing the session, not the password Credential abuse remains one of the most reliable ways for attackers to gain access to an organization, accounting for 22% of breaches in 2025. Attackers obtain usernames and passwords through infostealer malware, phishing campaigns or credential dumps from previous breaches. While multi-factor authentication (MFA) is still one of the most important defenses against account compromise, attackers have adapted their tactics to target the authentication process itself. One common technique is MFA fatigue, also known as prompt bombing. This involves repeatedly triggering MFA approval requests until the user eventually accepts one, usually out of frustration at the barrage of notifications they’re receiving. A well-known example came in 2022, when attackers targeted an Uber employee with repeated MFA prompts until one was approved. That initial access allowed the attackers to escalate privileges and move deeper into Uber’s environment, ultimately compromising large parts of its cloud infrastructure and exposing employee data. Attackers are also using adversary-in-the-middle frameworks and session hijacking tools to bypass MFA entirely by stealing authenticated session tokens after login. Credential phishing attacks are bypassing traditional protections Phishing with the aim of credential theft is still popular, with the latest attacks reaching new levels of sophistication. Attackers now use legitimate hosting services, trusted domains, reverse proxies and AI-generated content to create phishing pages that closely mimic genuine login portals. Threat researchers at Outpost24, Specops’ parent company, recently uncovered a phishing campaign that employed a legitimate Cisco domain through a multi-chain redirect attack designed to evade detection and increase credibility. Campaigns like this show how difficult phishing attacks can be to identify, even for security-aware users. Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches. Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles! Devices are expanding the attack surface Employees now regularly access corporate applications from personal laptops, unmanaged mobile devices and systems operating outside traditional security controls. Because of this, the IT department has limited visibility into whether employees are connecting to internal networks using devices with missing security updates or malware infections. Compromised endpoints also provide a valuable route into trusted environments. Infostealer malware, in particular, has become a major contributor to account takeover activity by harvesting credentials, browser-stored passwords and authenticated session cookies directly from user devices. This is where specialized solutions like Specops Device Trust help. By continuously scanning throughout sessions, Specops Device Trust checks for active threats like disabled security controls and outdated software. Integration with existing identity providers, VPNs, and SSO tools means security teams can extend their current setup rather than replace it, strengthening access decisions without adding friction for users., strengthening access decisions without adding friction for users. Why identity-based attacks are so difficult to stop One of the main reasons account takeover attacks continue to succeed is that many security controls still treat successful authentication as the sole proof of trust. Traditional identity and access management tools are designed to verify credentials and authentication flows, not necessarily whether the person behind them can actually be trusted. This challenge is becoming more pronounced as organizations adopt hybrid work models, cloud-first infrastructure and BYOD policies. Security teams are left trying to balance strong access controls with usability and productivity requirements. That creates a difficult compromise; either they block access from devices that don’t meet security standards and risk disrupting users, or allow access and accept that some devices may already be compromised. Most organizations end up somewhere in the middle, without fully addressing the underlying trust problem. High-profile incidents at organizations including Clorox and Marks & Spencer have reinforced the same lesson: identity alone is no longer a sufficient indicator of trust. Stopping modern account takeover attacks requires more than validating usernames and passwords. Organizations also need visibility into device posture, session risk and behavioral signals throughout the entire access lifecycle. That shift is driving greater interest in continuous verification models, where trust is assessed not just at login, but throughout the session. Tackle account takeovers risk with Specops Specops Device Trust delivers the evolution that Zero Trust identity security requires. By bringing device trust into the equation, security teams have a clearer picture of who’s accessing resources through: Device authentication: Ensure only approved devices can access sensitive resources by binding users to trusted devices. Continuous device verification: Check device posture at both login and throughout a session across factors like OS updates, browser versions, and security tooling. Flexible device coverage: Apply policies across both corporate and personal devices, with the ability to tailor access based on risk and context. On-access remediation: Address issues as they arise without interrupting users unnecessarily. Instead of forcing password resets or blocking access outright, you can guide users to resolve problems and continue working securely. Robust identity security combines strong authentication with a smooth user experience. By factoring in device trust with Specops, you reduce the chances of account takeover without slowing your teams down. If you want to see how this approach fits into your environment, contact us today. Sponsored and written by Specops Software.

Il gruppo Outsider Enterprise avrebbe sfruttato l’AI di Google per produrre siti falsi, messaggi fraudolenti e campagne di phishing contro centinaia di migliaia di americani. Coinvolti anche FBI, AT&T, T-Mobile e Verizon. Google ha fatto causa a una rete cybercriminale cinese accusata di aver usato Gemini per alimentare campagne di truffe finanziarie online contro centinaia di migliaia di cittadini americani. Secondo quanto riporta il New York Times, il gruppo, noto come Outsider Enterprise, avrebbe utilizzato l’AI di Google per creare centinaia di siti falsi che imitavano aziende come Google e YouTube, ma anche servizi pubblici e governativi, tra cui il Postal Service americano e il sistema E-ZPass di New York per il pagamento dei pedaggi autostradali. La collaborazione con FBI e operatori telefonici La causa è stata depositata presso il tribunale federale del Distretto Sud di New York. Google accusa la rete cinese di aver utilizzato in modo fraudolento la sua tecnologia e il suo marchio, chiedendo al giudice un ordine restrittivo per consentire alla società e alle autorità di bloccare l’infrastruttura della rete. Per la prima volta, Google ha dichiarato di coordinarsi con l’FBI e con operatori wireless come AT&T, T-Mobile e Verizon per smantellare la rete. L’obiettivo è bloccare siti, messaggi, domini e strumenti usati per colpire gli utenti. Secondo la società, centinaia di migliaia di persone sarebbero state colpite, in larghissima parte negli Stati Uniti. Google non ha indicato con precisione l’ammontare dei danni, ma parla di perdite nell’ordine di milioni di dollari. Come funzionava la rete Secondo la denuncia, Outsider Enterprise avrebbe coordinato le attività attraverso Telegram, dove i membri del gruppo si scambiavano consigli, strumenti e kit software per produrre truffe su larga scala. L’uso dell’intelligenza artificiale avrebbe reso più veloce e più semplice la produzione di siti falsi e messaggi fraudolenti. Google sostiene che il gruppo abbia creato 131 kit software capaci di generare migliaia di pagine web contraffatte. In sole due settimane di maggio, la rete avrebbe inviato 2,5 milioni di messaggi a utenti Android, contenenti link verso 9mila siti falsi. Google ha inoltre collegato al gruppo oltre un milione di indirizzi internet fraudolenti. Il ruolo dell’AI nelle truffe Il caso mostra come l’intelligenza artificiale stia cambiando anche il cybercrime. Secondo Google e le autorità americane, le truffe potenziate dall’AI stanno crescendo più rapidamente rispetto ad altre forme di phishing e frode online. L’AI consente ai criminali di creare testi più credibili, siti più realistici, campagne più personalizzate e infrastrutture fraudolente su scala molto più ampia. Il risultato è un phishing meno riconoscibile e più difficile da intercettare per gli utenti. “Gli attori criminali usano sempre più l’AI per rendere frodi come questa più convincenti e più difficili da rilevare”, ha dichiarato Brett Leatherman, assistant director della Cyber Division dell’FBI. Perdite miliardarie Secondo i recenti dati dell’FBI, lo scorso anno i cybercriminali hanno sottratto agli americani quasi 21 miliardi di dollari. Di questi, circa 893 milioni di dollari sarebbero collegati a truffe che hanno coinvolto l’uso dell’intelligenza artificiale. Il dato spiega perché Google stia cercando di intervenire prima che il fenomeno aumenti ulteriormente. La società ha avvertito che l’AI ha potenziato il problema delle truffe online e che il rischio è una crescita rapida delle frodi basate su Gemini e altri strumenti generativi.

Credential theft surged by 160% in 2025, contributing to one in five data breaches as attackers employed AI-driven attacks to bypass traditional defenses. The challenge for security teams has evolved from simply verifying identities to verifying them securely without creating friction for legitimate users. Weak onboarding processes, overreliance on static credentials, and inconsistent authentication policies all create opportunities for attackers to exploit. Ensuring that identity verification is as secure as possible has become a core part of modern cyber resilience. Below are five best practices organizations can use to strengthen identity verification and build more resilient access controls across their networks. 1. Use strong, fatigue-resistant multi-factor authentication Multi-factor authentication (MFA) remains one of the most effective ways to strengthen identity verification and reduce the risk of account compromise. Rather than relying solely on a password, MFA requires users to verify their identity using two or more factors from different categories: Something you know, such as a password or PIN. Something you have, such as a smartphone, authenticator app, or hardware security key. Something you are, such as a fingerprint or facial scan. According to NIST guidance, MFA is strongest when it combines factors from separate categories. A password paired with a hardware token or authenticator app provides significantly stronger protection than relying on multiple knowledge-based factors like passwords and security questions. However, MFA isn’t immune to exploitation, with weaker implementations susceptible to attacks like prompt bombing and SIM swapping. To improve resilience against these techniques, organizations should: Move away from legacy SMS or email-based one-time passcodes (OTPs), which are more vulnerable to interception, phishing, and social engineering attacks. Prioritize phishing-resistant MFA methods, including FIDO2 security keys, passkeys, or certificate-based authentication. Use authenticator apps that generate local OTPs rather than push-based approval prompts where appropriate. Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches. Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles! 2. Secure the service desk from social engineering Helpdesks remain a frequent target for social engineering attacks because they sit at the intersection of identity, access, and urgent user requests. Attackers impersonate employees to convince support staff to gain access to accounts, typically though a reset request. These attacks are increasingly sophisticated, with threat actors using AI-enabled deepfake audio or publicly available information to make requests appear legitimate. In several high-profile breaches, including Marks and Spencers (M&S) and Clorox, service desk compromise was the first step toward ransomware deployment or broader lateral movement. In the case of M&S, the attack resulted in a five-day suspension of sales, averaging daily losses of £3.8 million. The problem is rarely a lack of security tools, but inconsistent identity verification during high-pressure support interactions. Specialized solutions like Specops Secure Service Desk embeds secure identity verification directly into helpdesk workflows, requiring users to verify their identity through trusted authentication methods before password resets, MFA changes, or other sensitive actions can be completed. This helps support teams handle requests securely and reduces the risk of attackers bypassing controls through social engineering. For especially high-risk actions at the service desk, Specops Verified ID adds government document scanning and biometric liveness detection to identity verification workflows. With this additional layer of defense, organizations can mitigate the risk of impersonation attacks leading to account takeover. 3. Bring device trust into identity verification decisions Modern identity verification can’t rely on credentials alone. Alongside valid credentials, attackers steal session cookies and MFA tokens to break the authentication process and make it harder to distinguish legitimate users from compromised accounts based purely on login details. That’s why more organizations are bringing device trust into authentication and access decisions. Device trust helps security teams verify not just who is attempting to log in, but what they’re logging in from. Instead of treating every device equally, trusted access policies evaluate signals such as: Whether the device is corporate-managed or unmanaged Operating system version and patch status Presence of endpoint protection or EDR tools Device certificates or cryptographic identifiers Browser reputation and session integrity Signs of compromise, malware, rooting, or jailbreaking These signals add valuable context to identity verification workflows. For example, a login from a recognized, compliant device on a corporate network may require minimal friction. The same credentials used from an unmanaged device or suspicious IP range could trigger step-up authentication, restricted access, or a blocked session entirely. 4. Consider using passkeys MFA significantly reduces the risk of compromised credentials, but many organizations are now looking beyond passwords altogether. One of the most widely adopted passwordless options is passkeys. Built on FIDO2 and WebAuthn standards, passkeys use public-key cryptography to authenticate users without transmitting passwords across the network. The private key stays securely stored on the user’s device, making passkeys resistant to phishing, credential theft, and password reuse attacks. As there’s no password to remember or rotate, they also help reduce friction for both employees and IT teams. That said, passkeys aren’t a complete replacement for passwords yet. Organizations still rely on passwords as fallback authentication methods, particularly during account recovery or when users switch devices. Because of this, strong password policies and phishing-resistant MFA still play an important role wherever passwords remain in use. 5. Protect biometric data Biometric authentication through fingerprint scans, facial recognition, or voice verification strengthens identity verification when implemented properly. But unlike passwords, biometric data can’t simply be reset if it’s compromised, which makes protecting it especially important. One of the most important best practices is to avoid storing raw biometric data wherever possible. Instead, organizations should store encrypted biometric templates and perform authentication locally on trusted devices where feasible. Privacy-preserving technologies are also becoming more widely used in high-security environments. Techniques such as homomorphic encryption allow biometric matching to take place without exposing the underlying biometric data itself, helping organizations reduce both security and privacy risks. Secure your identity verification workflows with Specops As attackers continue to target credentials and exploit weaknesses in authentication workflows, reviewing and modernizing identity verification controls should remain a priority for security teams. If you’re looking to strengthen your identity verification workflows, Specops is here to help. Contact us today or book a demo to see our solutions in action. Sponsored and written by Specops Software.

Il 9 giugno 2026 Anthropic ha reso disponibile al pubblico Claude Fable 5, il primo modello di classe Mythos reso disponibile su larga scala, e la variante Mythos 5 con cyber safeguard rimossi, riservata ai partner di Project Glasswing. Le due varianti condividono il modello sottostante e differiscono soltanto per il perimetro dei controlli, il che rende l’apparato di safeguard l’unico confine tra le capacità ordinarie e quelle offensive. Ecco il modello di minaccia associato alle capacità di agentic hacking e al concetto di uplift, l’architettura dei classifier con meccanismo di fallback su Opus 4.8, le evidenze e i limiti dichiarati in materia di resistenza agli universal jailbreak, la nuova politica di data retention e le implicazioni per la comunità della difesa. Indice degli argomenti Il rilascio di Claude Fable 5 rappresenta un punto di discontinuità rispetto ai criteri con cui i modelli di frontiera sono stati finora distribuiti. Il modello appartiene alla classe Mythos, posizionata al di sopra della precedente classe Opus, e viene presentato come lo stato dell’arte per la quasi totalità dei benchmark di capacità testati, con un vantaggio che aumenta al crescere della lunghezza e della complessità dei task. Per un professionista della sicurezza, tuttavia, il punteggio ottenuto nei benchmark non è l’elemento dirimente, bensì il fatto che un modello con simili capacità di cyber offensive venga messo a disposizione del pubblico generale, seppur mediato da un apparato di controlli. Anthropic distribuisce due varianti dello stesso modello sottostante. Fable 5 è la versione destinata all’uso generale, dotata di safeguard attivi; mentre Mythos 5 è la versione con i safeguard rimossi in alcune aree, riservata a un gruppo ristretto di cyberdefender e operatori di infrastrutture critiche nell’ambito del progetto Glasswing, in collaborazione con il governo statunitense. La differenza tra i due modelli non risiede dunque nelle capacità grezze, identiche per costruzione, ma esclusivamente nel perimetro dei controlli applicati. Questa scelta architetturale rende il sistema di safeguard l’unico vero confine tra capacità computazionali ordinarie e capacità potenzialmente offensive. Anthropic riconosce esplicitamente che, in assenza di tutele, le capacità di Fable 5 nel campo della cyber security potrebbero essere sfruttate per provocare danni significativi. Il concetto centrale è quello di uplift: la misura in cui un modello fornisce a un attore malevolo informazioni o assistenza operativa che non sarebbe stato in grado di ottenere altrimenti, ad esempio tramite un motore di ricerca tradizionale. L’uplift è significativo soprattutto perché molte applicazioni avanzate sono dual-use: la stessa interrogazione che assiste un ricercatore di sicurezza nel rafforzare un sistema può assistere un aggressore nel comprometterlo. Le valutazioni interne descrivono modelli di classe Mythos in grado di individuare e sfruttare vulnerabilità software e di sostenere catene operative complesse. Ciò che Anthropic definisce agentic hacking comprende l’esecuzione autonoma di più fasi di un’operazione offensiva, dalla reconnaissance alla discovery fino al lateral movement, e la mera scoperta di exploit. È la capacità di orchestrare sequenzialmente le varie fasi dell’attacco, più che il singolo exploit, a costituire la nuova dimensione del rischio: una competenza che storicamente richiedeva operatori esperti, ma che ora è accessibile anche a chi ha una preparazione minore. L’osservazione non è puramente teorica. In un’analisi pubblicata pochi giorni prima del lancio, il Frontier Red Team di Anthropic ha esaminato 832 account bannati per attività cyber malevole tra marzo 2025 e marzo 2026, mappandoli sul framework MITRE ATT&CK nella versione 18. Lo studio ha registrato 13.873 azioni distribuite su 482 tecniche distinte e su tutte e 14 le tattiche del framework. Circa il 67% degli account analizzati ha utilizzato l’assistenza del modello per la preparazione degli attacchi, inclusa la scrittura di malware, mentre una quota minore lo ha utilizzato per illateral movement all’interno delle reti compromesse. Nel periodo considerato,la percentuale di attori classificati come a rischio medio o elevato è passata da circa un terzo a oltre la metà del campione. Lo stesso lavoro segnala un limite del repertorio difensivo corrente: i comportamenti che caratterizzano gli attori più pericolosi, in particolare l’orchestrazione autonoma delle fasi di attacco senza intervento umano, non trovano una collocazione precisa nelle tecniche del framework MITRE ATT&CK. Un esempio emblematico è la campagna di cyber-spionaggio automatizzata che, secondo Anthropic, è stata interrotta nel novembre 2025 e in cui l’operatore avrebbe utilizzato un agente per eseguire comandi e prendere decisioni tattiche con un minimo intervento umano. È in questo contesto di minaccia che va letta la decisione di affiancare il rilascio di Fable 5 con controlli dedicati alla dimensione cyber. Fable 5 è accompagnato da un insieme di classifiers: sistemi distinti dal modello principale, addestrati a individuare potenziali abusi e tentativi di jailbreak e a impedire che il modello fornisca una risposta. L’approccio non è inedito. Estende la linea di ricerca sui Constitutional Classifiers, dei safeguard che monitorano input e output del modello e sono addestrati su dati sintetici generati a partire da una “costituzione”, ossia un insieme di regole in linguaggio naturale che specificano cosa è consentito e cosa non lo è. La generazione successiva di questa tecnica, documentata all’inizio del 2026, combina sonde basate sulle attivazioni interne con un classifier a cascata che valuta l’intero contesto conversazionale, aggiungendo un sovraccarico computazionale dell’ordine dell’1%. Il nuovo deployment si distingue per il meccanismo di fallback. Quando i classifiers di Fable rilevano una richiesta riconducibile alla cyber security, alla biologia e alla chimica, oppure a tentativi di distillation, la risposta non viene rifiutata, ma viene gestita automaticamente dal modello immediatamente meno capace, Claude Opus 4.8, e l’utente ne viene informato. Questa scelta è funzionale all’esperienza d’uso: un ripiego su un modello comunque valido è preferibile a un rifiuto netto. Secondo i dati preliminari, oltre il 95% delle sessioni non attiva alcun fallback e, in tali sessioni, le prestazioni di Fable 5 coincidono di fatto con quelle di Mythos 5. I controlli sono stati tarati in modo deliberatamente conservativo. Anthropic riconosce che le soglie sono più severe del livello ideale e che talvolta intercettano richieste benigne, con un tasso di attivazione che si dichiara mediamente inferiore al 5% delle sessioni. Il compromesso esplicito è tra rapidità di rilascio e precisione: si è preferito accettare un tasso non trascurabile di falsi positivi pur di distribuire il modello in sicurezza, impegnandosi a restringere progressivamente i safeguard man mano che la loro affidabilità aumenta. Il classifier cyber è stato progettato per coprire sia l’exploitation in senso stretto sia i task offensivi in senso più ampio, proprio in ragione delle capacità di agentic hacking del modello. Le valutazioni riportate mostrano che, in una modalità in cui le risposte vengono bloccate anziché reindirizzate a Opus 4.8, i classifiers impediscono al modello di compiere progressi misurabili sui task cyber presi in considerazione. I domini del biologico e del chimico seguono una logica analoga, ma più estesa. Anthropic dichiara che il blocco di una selezione ristretta di interrogazioni legate alle armi biologiche non è più sufficiente e, per il momento, ha disposto che Fable utilizzi Opus 4.8 per la maggior parte delle richieste in questo ambito. Il terzo ambito coperto è la distillation: le richieste segnalate come parte di tentativi di estrarre le capacità del modello per addestrare sistemi concorrenti vengono reindirizzate al fine di contenere la proliferazione di capacità prossime alla frontiera che non godono di adeguate tutele. La tenuta di un sistema di questo tipo si misura in base alla sua resistenza al jailbreak, ovvero alle tecniche che mirano a interagire con il modello come se i safeguard non fossero presenti. Occorre distinguere tra jailbreak minori, efficaci solo in contesti limitati o da adattare caso per caso, e universal jailbreak: un prompt, uno script o un harness che consenta di aggirare i controlli in modo generale. È quest’ultima categoria a rappresentare una minaccia sistemica, perché un singolo metodo riutilizzabile abbatterebbe il confine su cui si basa l’intera distribuzione. Le prove a sostegno della robustezza provengono da diverse fonti. Oltre al red-teaming interno, Anthropic riferisce di un programma di bug bounty esterno che, dopo oltre mille ore di test, non ha prodotto universal jailbreak, e di organizzazioni esterne di red-teaming che non ne hanno individuati su task agentici di lunga durata. Anthropic stessa afferma che è verosimilmente impossibile prevenire del tutto gli universal jailbreak, e formula l’obiettivo in termini di costi: rendere ogni jailbreak residuo così lento e oneroso da poter essere individuato e neutralizzato prima che venga utilizzato su larga scala. Questa impostazione è coerente con i risultati pubblicati dai Constitutional Classifiers. La prima generazione di questa tecnica aveva ridotto il tasso di successo dei jailbreak dall’86% al 4,4% rispetto a un modello privo di tutele. La generazione successiva, sottoposta a oltre 1.700 ore cumulative di red-teaming, ha individuato una sola vulnerabilità ad alto rischio, con un tasso di rilevamento dichiarato pari a 0,005 per mille interrogazioni, e non sono stati scoperti universal jailbreak al termine dei test. Questi dati dimostrano un notevole miglioramento della robustness, ma Anthropic stessa li accompagna con la cautela secondo cui ulteriori test potrebbero rivelare nuove vulnerabilità. Con il modello cambia anche la politica di trattamento dei dati. Per i modelli della classe Mythos, Anthropic impone una retention di 30 giorni su tutto il traffico, sia sulle proprie superfici che su quelle di terze parti, dichiarando che tali dati non verranno utilizzati per addestrare nuovi modelli né per finalità estranee alla sicurezza. La motivazione dichiarata è di natura difensiva: la disponibilità del traffico consente di individuare attacchi complessi e nuovi, inclusi jailbreak inediti e attacchi distribuiti su molte richieste, e di ridurre i falsi positivi. Per un’organizzazione che stia valutando l’adozione di questo modello, questa clausola comporta una considerazione esplicita sul trattamento dei dati sensibili eventualmente contenuti nelle interrogazioni. Per quanto riguarda l’accesso, Mythos 5 è riservato ai partner del progetto Glasswing per la parte relativa alla sicurezza informatica, con la prospettiva di un programma di accesso fiduciario che permetta alle organizzazioni di sicurezza di candidarsi in modo strutturato e di un programma analogo per la biologia, rivolto alla ricerca biomedica. La simmetria di questa scelta è significativa: lo stesso modello, con le tutele attive, viene distribuito al pubblico, mentre quello senza tutele cyber è reso disponibile solo a un insieme di difensori verificati e sottoposti al controllo del governo statunitense. Il rilascio congiunto di Fable 5 e Mythos 5 ripropone il problema concreto della governance dei sistemi dual-use ad alta capacità. Queste capacità sono direttamente a beneficio della difesa: Anthropic documenta l’impiego dei modelli Mythos per supportare i cyberdefender nella messa in sicurezza del software critico. Contemporaneamente, la concentrazione dell’intero confine di sicurezza su un singolo strato di classificatori identifica il rischio in un punto preciso del sistema, la cui tenuta diventa la variabile decisiva. Per chi opera nel settore della cyber defence, ci sono alcune criticità che meritano attenzione. La prima riguarda la natura agentica della minaccia: l’analisi MITRE ATT&CK suggerisce che il segnale da monitorare non è più soltanto il repertorio di tecniche di un attore, ma il grado di autonomia con cui queste tecniche vengono orchestrate. La seconda riguarda l’inadeguatezza parziale dei framework esistenti nel rappresentare i comportamenti agentici che, secondo Anthropic, dovrebbero essere affrontati in collaborazione con MITRE. La terza riguarda la dipendenza della sicurezza complessiva da meccanismi di rilevamento probabilistici che, come ammesso, sono soggetti a falsi positivi e a un margine residuo di aggirabilità. Resta infine il dato di trasparenza. Le valutazioni di robustezza, le metriche sui falsi positivi e i risultati di alignment sono riportati nella scheda del sistema del modello e nel relativo report di rischio, che costituiscono il riferimento principale per chiunque debba condurre una valutazione del rischio indipendente. [1] Anthropic, Claude Fable 5 and Claude Mythos 5, annuncio, 9 giugno 2026. Dettagli tecnici nel relativo system card e nel risk report. [2] M. Sharma et al., Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming, arXiv:2501.18837, 2025. arxiv.org/abs/2501.18837. [3] Anthropic, Next-generation Constitutional Classifiers (Constitutional Classifiers++), arXiv:2601.04603, 2026.. [4] Anthropic Frontier Red Team, What we learned mapping a year’s worth of AI-enabled cyber threats, 3 giugno 2026. anthropic.com/news/AI-enabled-cyber-threats-mitre-attack. Risultati in parte ripresi nel Verizon 2026 Data Breach Investigations Report. [5] MITRE, ATT&CK (framework dei TTP, versione 18). attack.mitre.org. [6] Anthropic, Project Glasswing. anthropic.com/glasswing.

Every year, the Verizon Data Breach Investigations Report serves as a ground-truth benchmark for the industry. Its value comes not just from the headline numbers but from the convergence signals: when multiple independent data sources point to the same structural shift in how attackers operate, that convergence is worth paying attention to. This year, as a contributor to the Verizon 2026 DBIR, the Keep Aware team had early visibility into that convergence. This post breaks down the specific areas where the 2026 DBIR data and Keep Aware's own browser telemetry align — and where browser-layer data reveals what network and endpoint tools miss entirely. Shadow AI Has Become a Mainstream Enterprise Risk Shadow AI was identified in the Verizon DBIR as the third most common non-malicious insider action observed in Data Loss Prevention (DLP) datasets, representing a fourfold increase from the previous year. Employees are not typically trying to exfiltrate data; rather, they are using the fastest available tool for a task, which increasingly means pasting internal documents or source code into a personal ChatGPT session before their organization has had time to approve and provision a governed alternative. The scale of unauthorized AI usage in enterprise environments is one of the report’s most significant findings: 67% of users are accessing AI services on corporate devices through personal, non-corporate accounts, and 45% of employees are now considered regular AI users. Keep Aware’s browser telemetry further provides insight into how these AI services are being used. Over half of AI prompt inputs are sent to personal accounts, and 23% of sensitive prompt uploads involve data transiting through personal or unverified accounts (i.e., outside the reach of any corporate DLP policy or logging infrastructure), conveying the real risks of AI usage. Employees are pasting and uploading confidential data into ChatGPT, Gemini, and dozens of other AI tools every day. Keep Aware’s free AI audit shows you exactly what's leaving, and from which apps, before it becomes a breach. Get your free AI audit Credential Abuse and the Browser's Detection Gap The 2026 DBIR found that 39% of breaches involved credential abuse. Keep Aware's attack data from 2025 puts browser-based credential theft as the number one browser-based attack, accounting for approximately 41% of observed threat activity, implying that credential theft in the browser will later contribute to successful future breaches. Compounding this attack vector is the fact that the vast majority of these attacks are invisible to traditional tooling, as our data illustrates. In Keep Aware's analysis, 63% of Microsoft-themed phishing sites were not flagged by any VirusTotal vendor at the time of employee exposure, showing a glaring detection gap in intelligence feeds and endpoint tools. More pointedly, 100% of the credential theft attempts Keep Aware observed passed through existing non-browser security controls unblocked — network proxies, DNS filters, and endpoint agents alike. None of them caught it. The only reliable detection point is inside the browser itself, where the page is rendered and the user interaction actually occurs. Browser Extensions: Privileged, Ungoverned, and Expanding Add-ons can read, modify, and interact with any page’s content, and exfiltrate data from within the browser context, enabling extensions to operate with a level of browser privilege that should dictate regular scrutiny—yet data tells a different story. The 2026 DBIR flagged that the average enterprise had more than 15% of users with unauthorized AI extensions installed. However, the extension problem is broader than AI tooling alone. Keep Aware's extension telemetry additionally shows that 13% of unique browser extensions observed across our customer base were classified as high or critical risk. The more operationally significant finding: 93% of poor-reputation extensions were labeled as "productivity" tools by browser marketplaces — the exact category most allowlisting policies treat as safe. For this threat class, that makes category-based allowlisting functionally useless. ClickFix and Browser-Native Social Engineering Both the 2026 DBIR and Keep Aware's State of Browser Security Report call out ClickFix as an emerging technique worth tracking. The Verizon DBIR found ClickFix accounted for 2.7% of browser-detected attacks—a small share that nonetheless signals an evolution in browser-based social engineering. ClickFix is a deceptive social engineering tactic used to get a user to unknowingly execute malicious code from the browser and on the host machine. This threat begins in the browser—often by encountering compromised websites and sometimes through LLM chat responses—but quickly continues on the endpoint, compromising the machine with info stealers and remote access to attackers. The endpoint bears the impact, but the browser is the social engineering medium—and the first line of defense. The Human Element Continues to be a (Browser) Problem The 2026 DBIR found that 62% of breaches involved the human element, with phishing initiating 16% of incidents. Keep Aware's browser-layer data shows phishing and social engineering accounted for 46% of browser attacks observed across 2025. The human element finding is often framed as a training and awareness problem. But attackers are constantly evolving browser-based social engineering tactics—phishing links to benign intermediary sites, redirect chains, pages that render differently for automated scanners, hosting content on legitimate websites, and silent clipboard injections. Browser-level visibility does not solve the human element problem, but it shifts the detection point to where the human interaction is actually occurring, rather than looking for downstream artifacts after the interaction has already been exploited. What This Means for Security Teams. Shadow AI, credential theft, malicious extensions, and browser-native social engineering techniques like ClickFix share a common characteristic: they all execute inside the browser, and they all produce artifacts that are most visible, if not only visible, at the browser layer. Security programs that rely exclusively on network, endpoint, and identity telemetry will continue to have blind spots in exactly the places attackers have learned to operate. The browser is no longer just an application. For most enterprise users, it is the work environment. Securing it is no longer optional. If your security stack lacks visibility into what's happening inside browser sessions, that gap is worth understanding before attackers exploit it. Request a demo of Keep Aware to see what your current tools are missing Keep Aware contributed data to the Verizon 2026 Data Breach Investigations Report. Keep Aware’s 2026 State of Browser Security Report is available here. Sponsored and written by Keep Aware.

L’orizzonte della sicurezza informatica è storicamente caratterizzato da una narrazione incentrata sulla novità e sull’escalation tecnologica. Oggi, commentando il Data Breach Investigations Report (DBIR) 2026 di Verizon, uscito pochi giorni fa, ecco le risultanze emerse e una prospettiva empirica che va un po’ controcorrente rispetto ai soliti toni allarmistici. Indice degli argomenti tradurre i dati in lezioni apprese Attraverso l’analisi quantitativa di oltre 31.000 incidenti globali, di cui ben 22.000 si sono concretizzati in violazioni di dati confermate, il report si configura come una mappa fondamentale per un’analisi global ed in ottica di lesson learned. L’assunto, da cui muove l’analisi di quest’anno, si riallaccia all’aforisma eracliteo sul mutamento perenne, applicandolo tuttavia non per giustificare una rivoluzione negli approcci difensivi, ma per validare la tesi opposta: la necessità di un affinamento metodologico basato sul consolidamento delle competenze “base” della sicurezza. L’obiettivo del presente contributo è decodificare le evidenze emerse nell’anno trascorso, mappare le peculiarità che investono il contesto europeo e strutturare un modello interpretativo capace di tradurre i dati in lezioni apprese (lessons learned), immediatamente azionabili per l’innalzamento della postura di sicurezza delle organizzazioni contemporanee. L’evidenza statistica più dirompente dell’ultimo anno risiede nel mutamento strutturale dei vettori di accesso iniziale. Per la prima volta nella storia recente della fenomenologia dei data breach, lo sfruttamento delle vulnerabilità del software (exploitation of vulnerabilities) ha superato l’abuso di credenziali, attestandosi al 31% del totale dei casi censiti. Questa inversione di tendenza riflette una saturazione dei sistemi difensivi perimetrali e una crescente capacità degli attori di minaccia di industrializzare la ricerca delle falle applicative. Di contro, l’utilizzo malevolo di credenziali legittime, pur registrando una flessione come punto di primo ingresso a causa di sovrapposizioni tassonomiche con le tecniche di pretexting, continua a rappresentare l’architrave delle catene di attacco successive, presenziando nel 39% dei casi totali. Il panorama europeo, analizzato all’interno della macro-regione EMEA, manifesta deviazioni macroscopiche rispetto alle medie globali, deviazioni che i board in Italia e nel continente non possono ignorare. L’Europa si posiziona come l’area geografica con la più alta incidenza globale di compromissioni avviate tramite lo sfruttamento di vulnerabilità, raggiungendo la quota del 47%. Questo dato, combinato con un tasso di phishing che satura l’84% delle azioni di ingegneria sociale, evidenzia una vulnerabilità sistemica dei sistemi esposti sulla rete e una marcata esposizione della componente umana. Ciò che tuttavia caratterizza in modo profondo il quadrante europeo è la matrice geopolitica degli attacchi. Mentre il Nord America sperimenta una minaccia quasi esclusivamente orientata al ritorno finanziario estorsivo, l’Europa si trova immersa in dinamiche di cyber spionaggio. Gli attacchi perpetrati da attori statali o para-statali (state-affiliated) rappresentano il 23% delle violazioni totali in EMEA, determinando un tasso di breach motivati da spionaggio pari al 27%, contro il misero 3% registrato nel contesto nordamericano. La sicurezza delle organizzazioni europee deve pertanto riflettere questa duplice natura del rischio, dove alla criminalità opportunistica tesa alla monetizzazione si affiancano minacce persistenti avanzate il cui fine ultimo è la persistenza silente e la cattura di proprietà intellettuale e dati strategici. Come già stigmatizzato in passato da chi vi scrive, la retorica aziendale (e non solo) tende spesso a giustificare le violazioni informatiche evocando attacchi di sofisticazione “inaudita”, algoritmi quantistici o minacce precedentemente sconosciute. I dati del DBIR 2026 smantellano questa narrazione difensiva, dimostrando che le operazioni di natura puramente complessa rappresentano una frazione percentuale minima della telemetria globale. La collaborazione di ricerca avviata con Anthropic sull’uso dell’intelligenza artificiale generativa da parte degli attaccanti offre in tal senso un chiarimento fondamentale. Sebbene la GenAI sia ormai integrata stabilmente nelle routine offensive, il suo impatto è di natura prettamente operativa e di scala, non strategica o qualitativa. Gli attori di minaccia utilizzano i modelli linguistici per automatizzare l’offuscamento del codice, generare varianti di malware esistenti o eliminare i difetti formali nelle campagne di ingegneria sociale, ma l’azione si sviluppa lungo percorsi ampiamente documentati all’interno della tassonomia MITRE ATT&CK. Il valore mediano indica che le tecniche supportate da intelligenza artificiale presentano già decine di strumenti e firme difensive note sul mercato, riducendo a meno del 2,5% la quota di codice realmente innovativo o raro. La vera criticità non risiede dunque nella capacità dell’avversario di inventare nuove strategie d’attacco, quanto nell’incapacità strutturale delle organizzazioni di eseguire i compiti basilari della difesa. Il report evidenzia una grave crisi nella capacità di gestione delle patch (patching capacity issue). Solo il 26% delle vulnerabilità note e attivamente sfruttate (CISA KEV) è stato integralmente sanato dalle aziende nel corso dell’ultimo anno, con un tempo medio di risoluzione che è scivolato a 43 giorni. Come purtroppo commentiamo da tempo, gli attaccanti non hanno bisogno di scoprire zero-day complessi quando l’aumento del volume delle vulnerabilità espone i team di sicurezza a un sovraccarico informativo che paralizza i processi di remediation. Analogamente, l’analisi delle violazioni degli ambienti cloud gestiti da terze parti dimostra che i vettori d’ingresso più frequenti rimangono l’assenza di autenticazione a più fattori sulle utenze amministrative e la mancata applicazione del principio del minimo privilegio, configurazioni errate che richiedono mediamente fino a otto mesi per essere rilevate e corrette. La statistica ci dice chiaramente che la quasi totalità dei breach si consuma sfruttando l’ordinaria trascuratezza organizzativa e non la straordinaria abilità tecnologica dell’attaccante. Il primo passo indispensabile per tradurre queste evidenze in una strategia difensiva efficace consiste nella riconfigurazione radicale del processo di Vulnerability Management, muovendosi verso un modello predittivo guidato dal principio del recency bias organizzativo. Poiché i dati dimostrano l’impossibilità matematica di sanare la totalità delle falle, a causa dell’asimmetria tra il volume dei rilasci e la capacità di patching dei team interni, i criteri di prioritizzazione devono essere aggiornati. Le organizzazioni devono focalizzare le proprie risorse esclusive sulle vulnerabilità che presentano evidenze disfruttamento attivo nel corso degli ultimi trenta giorni, tralasciando momentaneamente i back-log storici non attivi. La probabilità di resurgence di una vecchia vulnerabilità decade infatti del 50% dopo il primo mese di inattività, permettendo così di ottimizzare gli sforzi di mitigazione sulle minacce che presentano un rischio reale e immediato di penetrazione. La seconda azione strutturale riguarda la gestione dell’identità e la revisione delle architetture cloud, con particolare riferimento ai rapporti di fornitura e alle terze parti. Data l’impennata del 60% dei breach originati dalla catena di fornitura, non è più ammissibile considerare il perimetro aziendale come un’entità isolata. Risulta mandatorio estendere l’adozione di protocolli di autenticazione a più fattori (MFA) resistenti al phishing a ogni singola connessione remota, eliminando categoricamente le deroghe per gli account di servizio e le utenze amministrative, le cui credenziali sono scambiate sul mercato dei broker d’accesso per poche centinaia di dollari. Tale misura deve essere integrata da verifiche periodiche e automatizzate sulle configurazioni dei tenant cloud dei fornitori critici, riducendo i tempi di permanenza delle configurazioni errate che rappresentano oggi il punto debole della supply chain europea. Come terza direttrice, le organizzazioni devono implementare un programma di Data Governance specificamente orientato al rischio della Shadow AI. L’evidenza che quasi la metà della forza lavoro utilizzi correntemente strumenti di intelligenza artificiale attraverso canali non aziendali impone il passaggio da una logica di mero divieto a una logica di controllo granulare dei flussi informativi. È necessario implementare soluzioni di Data Loss Prevention (DLP) capaci di intercettare e bloccare il caricamento di stringhe di codice sorgente, documentazione tecnica e dati strutturati verso endpoint non autorizzati, definendo al contempo policy chiare di utilizzo e mettendo a disposizione sandbox aziendali protette che scongiurino l’esposizione accidentale della proprietà intellettuale. La quarta azione richiede una profonda revisione dei programmi di sensibilizzazione e formazione del personale, i quali devono evolvere dalla simulazione standardizzata del phishing basato su posta elettronica verso la gestione dei vettori sincroni e multicanale. Gli attacchi basati su pretexting, che sfruttano comunicazioni vocali (vishing), messaggistica istantanea su piattaforme di collaborazione e scenari complessi di impersonificazione del supporto tecnico, registrano tassi di successo del 40% superiori rispetto alle tradizionali campagne email. La formazione deve pertanto focalizzarsi sulla definizione di rigide procedure organizzative di verifica dell’identità per ogni richiesta di reset di credenziali o di condivisione dello schermo, addestrando specificamente il personale degli help desk informatici e delle risorse umane a riconoscere le pressioni psicologiche esercitate dagli attaccanti. Infine, il quinto e ultimo pilastro risiede nello spostamento del focus strategico dalla pura prevenzione alla resilienza operativa e alla pianificazione del ripristino (Cyber Resilience). Preso atto che il ransomware colpisce ormai in modo sistematico e trasversale, determinando interruzioni di business prolungate il cui impatto economico supera di ordini di grandezza il valore del riscatto stesso, le organizzazioni devono strutturare piani di disaster recovery costantemente testati. Questo approccio si traduce nella cifratura e nell’isolamento logico e fisico dei backup, nell’adozione di architetture di segmentazione della rete che limitino i movimenti laterali dell’attaccante e nella definizione di canali di comunicazione di emergenza. Il successo della difesa moderna non si misura più soltanto sulla capacità di evitare l’intrusione, ma sulla velocità mediana di riattivazione dei servizi critici a seguito di un evento avverso, minimizzando l’impatto sulla catena del valore e sull’ecosistema dei partner economici. Come più volte evidenziato negli ultimi anni, il consiglio è quello di non innamorarsi troppo delle “minacce del futuro”, inseguendo l’ultima e complessa tecnologia speculativa, bensì applicare conrigore metodologico una verità che accomuna ogni disciplina, dallo sport alla scienza. La vera maestria, così come la massima resilienza, si costruisce solo dominando alla perfezione l’esecuzione dei fondamentali.

Lessons for organizations from the Verizon 2026 Data Breach Investigations Report This is my favourite time of the year, not just because spring is here and the promise of summer is on the way. But also, because one of my must reads each year gets published. There are a few must read reports that I have on my reading list for each year and the Verizon Data Breach Investigations Report is on top of that list. The latest Verizon 2026 Data Breach Investigations Report (DBIR) once again provides a fascinating insight into how the cyber threat landscape continues to evolve. Based on the analysis of more than 31,000 security incidents and over 22,000 confirmed data breaches across 145 countries reported by various organizations ranging from police forces, cybersecurity companies, and CSIRTS, this vendor neutral report is one of the most comprehensive pieces of cybersecurity research published each year and why I have it on my must read list. I am often dismayed by the tendency in cybersecurity for many to focus on the newest threats, latest attack techniques, or emerging technologies, while many organizations are still struggling with the basics of cyber security. This year’s DBIR reinforces this viewpoint and highlights how attackers don’t need sophisticated techniques but are increasingly exploiting those gaps in the cybersecurity fundamentals. Vulnerability exploitation One of the standout findings for me from this year’s report is that vulnerability exploitation has now overtaken stolen credentials as the most common initial access vector in breaches. Exploitation of vulnerabilities accounted for 31% of breaches, while abuse of user credentials dropped to 13%. To me this is an important shift for several reasons. Firstly, it demonstrates that criminals will always use the most effective ways to compromise an organization. For years, much of the cybersecurity conversation centred around phishing emails and password theft, because that was how criminals were compromising organizations. Those threats have not gone away, but attackers are increasingly taking advantage of organizations failing to patch internet-facing systems and applications quickly enough. Secondly, it reinforces a lot of the concerns around AI, Anthropic’s Mythos being the one to grab recent headlines, being used to identify more vulnerabilities which may result in many organizations not being able to patch or remediate these vulnerabilities in a timely manner. The DBIR goes on to highlight that only 26% of critical vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalogue were fully remediated during 2025, down from 38% the previous year. While the median time to fully remediate vulnerabilities also increased to 43 days. With the time taken to remediate vulnerabilities growing yet the volume of new vulnerabilities increasing, we are looking at challenging times ahead for defenders. For many organizations this should be a major concern. Many businesses are operating with limited IT and security resources while simultaneously trying to deal with increasing regulatory obligations such as the EU GDPR, the EU NIS2, and the EU DORA. However, the pace of attackers identifying and exploiting vulnerabilities is not slowing down while organizations are struggling to catch up. My reading of the DBIR report suggests the issue is no longer simply about organizations failing to patch. The sheer volume of vulnerabilities now being discovered is overwhelming many organizations’ ability to respond effectively. In other words, patch management is rapidly becoming a capacity problem as much as a technical one. There is probably no short term solution to this problem but we need to refocus on other vulnerability management controls such as understanding what assets we need to protect, reducing the attack surface, hardening systems, isolating and segmenting key assets, enhanced monitoring, implementing robust incident response, and building cyber resilience into our businesses. Ransomware and third party risk It was no surprise to read that ransomware continues to dominate the threat landscape. According to the DBIR report, ransomware was involved in 48% of all the breaches analysed this year, which is up from 44% last year. There is, however, a small piece of good news buried within the statistics. The report found that 69% of ransomware victims did not pay the ransom demand. That suggests organizations are becoming more resilient, with better backup strategies, improved recovery capabilities, and perhaps a growing recognition that paying criminals does not guarantee a positive outcome. That said, ransomware remains one of the most disruptive risks facing organizations, particularly SMEs. For many smaller businesses, the operational disruption caused by ransomware can be far more damaging than the ransom demand itself. Another area that deserves close attention is third-party risk. The report found that breaches involving an organization’s supply chain increased by 60% and third-party breaches now feature in 48% of breaches. This reflects the reality of modern business. Organizations increasingly rely on cloud providers, managed service providers, SaaS platforms, outsourced payroll systems, and external IT partners. While these services deliver enormous business benefits, they also create additional attack paths and cybersecurity risk into organizations which those organizations need to manage. Cybercrime and AI No cybersecurity report today can go without mentioning the role of AI in cybercrime and the Verizon DBIR is no exception. According to the report, criminals are now using generative AI to assist with target selection, malware development, vulnerability research, and social engineering attacks. While there has been a huge amount of discussion about how organizations can use AI productively, there has perhaps been less focus on how cybercriminals are using the same technology to scale and improve their attacks. One area that should concern many organizations is the growth of “Shadow AI”. Verizon found that 67% of users accessing AI services on corporate devices were using non-corporate accounts. More strikingly, the report found that 45% of employees are now regular users of AI tools in the workplace, up from just 15% the previous year. The risk here is not theoretical, as we experienced in the past with the wave of Bring Your Own Device (BYOD). The DBIR identified source code, internal documents, structured data, and technical documentation being uploaded into unauthorised AI platforms. For organizations handling sensitive personal data, confidential business information, or intellectual property, this creates obvious security, privacy, and compliance concerns. As with the BYOD wave and the rush of corporate data onto personal devices, organizations need to develop policies, tools, and controls to embrace the use of AI rather than take the King Canute approach of trying to stop the rising AI tide. The human factor The human factor also continues to feature heavily throughout the report. Verizon found that the human element was involved in 62% of breaches. Social engineering attacks continue to evolve, particularly through mobile-centric attacks such as voice phishing and SMS scams. In fact, the report notes that engagement rates for mobile-based phishing simulations were 40% higher than traditional email phishing simulations. That finding alone should prompt organizations to rethink how they approach security awareness training. Employees are no longer sitting at desks processing suspicious emails in isolation. They are working remotely, travelling, multitasking, and increasingly interacting with business systems through mobile devices where people are naturally more distracted and more trusting. Criminals are also using other messaging channels other than corporate email to reach employees, such as WhatsApp, social media, and personal email accounts. All platforms where most corporate cybersecurity solutions do not provide coverage. Focus on the security fundamentals The items that stood out to me in the report is that many breaches were linked to fundamental security failures such as missing multi-factor authentication, weak credential management, and excessive user privileges in cloud environments. If there is one clear message from this year’s DBIR, it is that organizations do not necessarily need revolutionary new security strategies. What they need is to develop a comprehensive roadmap to achieve operational discipline. Asset management, patching, MFA, least privilege, incident response planning, supplier assurance, and user awareness training are not glamorous topics, but they remain among the most effective security controls organizations can implement. Cybersecurity is often portrayed as a technology problem. It is increasingly a business resilience issue. The organizations that will cope best with the evolving threat landscape are not necessarily those spending the most money on security tools, but those consistently executing the fundamentals well.

Ransomware and vendor breaches persist. The "2026 Data Breach Investigations Report" (DBIR) highlights how evolving social engineering tactics make the sector more vulnerable.

Keepnet contributes voice and SMS phishing data to the 2026 Verizon DBIR Keepnet, an Extended Human Risk Management (xHRM) platform, today announced that its voice and SMS phishing simulation data contributed to the 2026 Verizon Data Breach Investigations Report (DBIR). The 2026 edition is the first to include voice and SMS phishing simulation data at this scale. The DBIR records this as “an increase of 40% in the median click rate” between phone-centric and email-based simulations (Verizon 2026 DBIR, p. 50). According to the report, phone-centric phishing simulations show a median click rate of 2%, compared to 1.4% for email simulations (Verizon 2026 DBIR, p. 50). On the same page, the DBIR team writes that they “struggled to find companies doing simulations of voice- and text message-based campaigns”. That gap between attacker behaviour and industry measurement is widening, and it’s the story underneath this year’s report. Keepnet’s name appears in the contributing organisations list on page 118. Why phone-centric phishing has outpaced measurement Phishing has expanded beyond email. Attackers now combine voice, SMS, and email in coordinated campaigns that email-only awareness programmes weren’t built to detect. A few things shifted since 2022. Voice cloning got cheap. Voice cloning removed most of the realism problem once it became easy to access. Real-time conversations now happen in dozens of languages, with cloned executive voices that are getting harder to distinguish from the real person. MGM moved voice phishing from personal to corporate. The MGM Resorts breach in September 2023, which started with a 10-minute phone call to the help desk, cost the company an estimated $100 million. It broke the long-held assumption that voice phishing was an individual problem rather than a corporate one. Pretexting went mainstream. The live manipulation of a person on a call or chat has gone from fringe tactic to mainstream attack pattern. AI now writes the scripts and voices the calls. It adapts mid-conversation. A lot of awareness training still focuses mainly on the email side, not this. Attackers stopped relying on email-only inboxes. They now lead with voice and SMS, often in the same campaign. Email phishing is asynchronous. A target can pause, reread, ask a colleague. Voice and SMS attacks are synchronous. The target has seconds, not minutes. Attackers have already shifted channels. Most awareness programmes haven’t. What the data points to The phone is the corporate attack surface most awareness programmes are still measuring the least Pretexting, real-time manipulation on a call or chat, requires different countermeasures from email anti-phishing Recent high-profile incidents show attackers are already exploiting this surface while most companies are still figuring out how to measure it The more important question is no longer who clicked. It’s how far the conversation progressed before verification happened What this means for security teams The cost of getting this wrong is no longer theoretical. The 2024 Hong Kong deepfake call cost a multinational $25 million. The FBI’s 2025 IC3 report puts smishing and vishing losses from government impersonation alone at $798 million in 2025, and adds a new AI-related cybercrime category at $893 million in the same year (source: FBI IC3 2025 Annual Report). The 2026 DBIR reports a median ransom paid of $139,875, with the economics of breaches continuing to favour attackers (Verizon 2026 DBIR, p. 11). For most security teams, the gap between what’s measured and what’s being exploited is now where the real money is being lost. Help desks are now part of the attack surface Verification procedures matter more than awareness alone Repetition under realistic conditions is what holds up under pressure, not annual training Email-only simulations leave major attack channels untested What comes next: AI agents that run the whole attack Gartner forecasts that by 2027, AI agents will reduce the time it takes to exploit account exposures by 50%, with explicit attention to “social engineering based on deepfake voices” and “end-to-end automation of user credential abuses” (source: Gartner, March 2025 press release). In practice, much of this can already be automated. One system gathers background information before the call, another runs the conversation itself, and follow-up SMS or email can be triggered seconds later, with no human operator in the loop except to collect the credentials at the end. As automation cuts attacker cost toward zero and pushes volume up, the economics of who gets targeted change. Today, mostly enterprises with high-value help desks face this risk consistently. In 24 months, almost every organisation will. The economics changed fast. AI lowered the cost of running these attacks at scale while making them much harder to detect. Why Keepnet Keepnet has been running voice and SMS phishing simulations since 2022. Customers include global banks, Fortune 500 companies, and smaller mid-market organisations. Phone number coverage runs across the US, UK, EU and parts of Asia. Keepnet operates in line with ISO/IEC 42001:2023 and EU AI Act requirements. Beyond the automated simulations, Keepnet also runs live voice-based social engineering assessments against help desks and high-risk employee groups, with a real social engineering team on the call. Historically, phishing benchmarking has focused primarily on email-based simulations, while voice and SMS scenarios remained under-measured. Keepnet’s contribution to the 2026 DBIR captures the channels attackers are now using to bypass email-only defences, with anonymised, campaign-level data from customer simulations between October 2024 and October 2025. Across the simulations Keepnet runs at scale, the same playbook keeps working for attackers. Usually the email lands first to set context. Then comes the SMS. The phone call is often the final push. In many cases the help desk senses something is off, but the attacker keeps the call moving fast enough that verification never starts. That’s the gap security and risk leaders should plan around in their 2026 awareness budgets. “We’ve spent years measuring email click rates because email data was easy to collect. The phone channel is harder to measure, but the DBIR data shows the risk is higher there. Most awareness programmes are still grading on email alone. The next step for security leaders is building verification habits into the phone channel too,” said Ozan Ucar, Founder & CEO of Keepnet. How security teams can benchmark voice and SMS phishing exposure Keepnet invites CISOs, security and risk leaders, and SOC managers to request a personalised voice and SMS phishing assessment to: Measure baseline click and conversation-continuation rates on phone-centric simulations Benchmark against the 2026 DBIR phone-centric click rate finding Test help desk and VIP employee resilience with the Keepnet social engineering team See how prepared employees are across voice and SMS phishing scenarios

Verizon DBIR: Vulnerability exploitation is the dominant initial access vector Vulnerability exploitation has overtaken stolen credentials as the most common way attackers gain initial access to target networks, according to the 2026 Verizon Data Breach Investigations Report. This is the first time credential theft has been knocked off the top spot in the report’s 19-year history, the company noted. Known initial access vectors over time (Source: Verizon 2026 DBIR) What is Verizon DBIR? Published annually, Verizon’s DBIR is based on the analysis of real-world data breaches and security incidents from the previous year. For the 2026 edition, that means incidents that happened between November 2024 and October 2025. Verizon aggregates this data from many contributing organizations: law enforcement agencies, incident response firms, information sharing and analysis centers (ISACs), and computer emergency response teams (CERTs) worldwide. This latest DBIR surfaced many crucial findings and confirmed already observed trends, such as the rise of third-party involvement in breaches. Verizon 2026 DBIR findings The rise of AI-assisted vulnerability research performed by threat actors might sound like the most likely explanation, but the analyzed data predates this “explosion”. The problem is that organizations aren’t patching known vulnerabilities quickly (and sometimes not thoroughly) enough. Only 26% of the CISA “known exploited” vulnerabilities – arguably the most critical-to-address flaws, since they are actually leveraged by attackers – had been fully remediated by the 13,000 polled organizations. In the year before, that percentage reached 38, so this is a considerable drop, Verizon analysts noted. “There is also a worse result for the median time elapsed for a vulnerability to be fully patched by detection,” they added. “Our new median time is 43 days, almost two weeks longer than last year’s 32 days.” What was the reason for this deterioration? Verizon blames it on the drastic increase of the number of vulnerabilities, including those in CISA’s Known Exploited Vulnerabilities catalog, making patching prioritization a bigger problem than before. Unfortunately, the use AI for vulnerability discovery – whether by researchers or attackers – is expected to add to the burden. Verizon also noted more worrying statistics. Despite third-party involvement in breaches jumping 60% year-on-year and now accounting for nearly half of all breaches, remediation is slow. MFA gaps in third-party cloud accounts are typically resolved within a month, but only 23% of third-party organizations fully remediated their MFA issues at all. Weak passwords and permission misconfigurations take close to eight months to fix for half of all findings. Social engineering, ransomware and extortion Verizon found that phishers, in general, are having more success in targeting users via voice and text messaging than email. Pretexting, which is a social engineering technique where an attacker fabricates a scenario to manipulate a target into handing over information or access, has also become a more common initial access vector to ransomware and extortion attacks. This approach has been popularized by attack groups like Lapsus$ and Shiny Hunters, who often perform the attack via phone call. (And there are now phishing kits out there that are turbocharging vishing attacks.) “Ransomware grew again to 48% of all breaches, up from 44% from the previous year. However, ransom payments have continued to decline among our dataset, as 69% of ransomware victims didn’t pay,” Verizon noted. Infostealers are serving as a pipeline to ransomware attacks: half of ransomware victims who had a prior credential leak experienced it within 95 days of the attack, and stolen credentials are being packaged and sold by initial access brokers, allowing ransomware operators to simply buy their way in and concentrate their efforts on lateral movement, privilege escalation, deploying the ransomware, and extorting organizations. The AI threat Aside from AI-assisted vulnerability discovery, AI adds to organizations’ risk in other ways. “Shadow AI is now the third most common non-malicious insider action detected in our data loss prevention (DLP) dataset in 2025, a fourfold increase in percentage from the previous year,” the researchers noted. But LLMs and AI agents are also helping attackers every step of the way: they are using them to create exploits and malware, execute well-documented techniques and scale them more efficiently, get help with phishing, and more. Advice for CISOs “The 2026 DBIR makes clear that attackers continue to prioritize the most reliable paths to compromise, such as exploiting unpatched vulnerabilities, leveraging compromised or weak credentials, and scaling social engineering with speed and efficiency,” said Phyllis Lee, Vice President of CIS Security Best Practices Content Development. “Organizations that focus on proven, prioritized security controls and timely remediation are better positioned to reduce risk and disrupt these common attack patterns.” Verizon also pointed out the urgent need to prioritize fundamental security and risk management practices. CISOs and cybersecurity progessionals are advised to prepare for the onslaught of patches, integrate AI into “secure by design” frameworks, and use AI themselves for their defense-in-depth strategies. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Vulnerability exploitation has overtaken compromised credentials for the first time in nearly two decades as the most common initial access vector for data breaches, according to Verizon. The tech giant’s Data Breach investigations Report (DBIR) has been providing threat landscape insight to industry professionals for 19 years, based as it is on a variety of Verizon, incident response, law enforcement and industry data on real breaches and incidents. The latest edition revealed that nearly a third (31%) of data breaches over the past year started with vulnerability exploitation. This is up from 20% in last year’s report. That made it the top initial access vector, with credential abuse down from 22% to 13%. Verizon suggested the figures could indicate that AI is already being used by threat actors to find and exploit more vulnerabilities. However, it’s not just zero-days that are at issue. The report revealed that firms aren’t patching known bugs quickly enough. Only 26% of critical vulnerabilities listed in the Cybersecurity Infrastructure and Security Agency Known Exploited Vulnerabilities (CISA KEV) catalog were fully remediated by organizations in 2025, a drop from 38% the previous year. That could be due to the increased patch load. Organizations had 50% more critical vulnerabilities to patch in this year’s reporting dataset versus 2025, Verizon said. Jon Baker, VP of threat-informed defense at AttackIQ, said organizations are struggling to prioritize patches. “Security teams are being asked to fix more critical issues, but they still need to know which ones actually create a path to compromise,” he argued. “A vulnerability on paper is one thing, but a vulnerability that can be chained into lateral movement, ransomware deployment, or data theft is something else entirely.” Patrick Münch, CSO at vulnerability management services firm Mondoo, said manual remediation is letting firms down. “You don't close the gap with another scanner,” he added. “You close it with transparent agentic AI: humans in the loop on decisions, AI automation on remediation and mitigation execution, and a clear audit trail from identifying the issue to verifying it's fixed.” AI Threats to the Fore of the Verizon DBIR AI is more obviously growing as a threat in other parts of the report. “The median threat actor researched or used AI assistance in 15 different documented techniques, with some actors leveraging as many as 40 or 50,” it noted. Shadow AI is also a growing enterprise threat: it’s now the third most common “non-malicious insider action” detected in Verizon’s data loss prevention (DLP) dataset, a fourfold percentage increase from last year. Some 45% of employees are now regular users of managed and unmanaged AI on their corporate devices, up from 15% last year. Supply Chains and Social Engineering Elsewhere in the report, mobile users were targeted more frequently by social engineering attacks over the past year, as individuals got better at spotting phishing attempts via other channels. In phishing simulations, the median rate of successful “click” rates in mobile vectors like voice and text is 40% higher than via email, Verizon claimed. The “human element” was present in 62% of breaches, up slightly from 60% last year. Supply chain-related breaches also surged, by 60% annually, to account for nearly half (48%) of all data breaches recorded in the report. Just 23% of third-party organizations fully remediated missing or improperly secured multifactor authentication (MFA) on their cloud accounts. For weak passwords and permission misconfigurations, time to resolve 50% of all findings reached almost eight months. As a share of breaches, ransomware nudged up from 44% last year to 48% this, but 69% of victims elected not to pay, squeezing threat actor margins.

Vulnerability exploitation was the most common access vector for data breaches in 2025, the latest installment of Verizon’s annual Data Breach Investigations Report (DBIR) shows. The number of analyzed security incidents has increased to 31,000. Of these, more than 22,000 were confirmed breaches, nearly double compared to last year’s 12,195 confirmed breaches. Approximately 31% of the breaches were the result of unpatched vulnerabilities being exploited. Credential abuse, which was the top entry point in last year’s DBIR, accounted for 13% of the breaches. According to Verizon’s researchers, threat actors are leveraging AI to accelerate vulnerability exploitation, and the window for defense has decreased from months to hours. “The rapid weaponization of known vulnerabilities by AI can create a capacity crisis for security teams, underscoring the urgent need to prioritize fundamental security and risk management practices,” Verizon says. The Verizon 2026 DBIR (PDF) also shows that organizations continue to struggle with vulnerability remediation. The median time for full patching increased to 43 days in 2025, up from 32 days in the previous year. According to the report, organizations patched only 26% of the security defects in CISA’s Known Exploited Vulnerabilities (KEV) catalog last year, a drop from 38% in 2024. The number of critical flaws (defined in the report as bugs included in the KEV list) that organizations had to patch was 50% higher in the median case compared to the previous year’s dataset. “The findings in Verizon’s 2026 DBIR are striking because it reinforces something we have been saying for years: exploitation is now the leading breach vector, and organizations are still simply not fixing flaws fast enough,” said Veracode co-founder and chief security evangelist Chris Wysopal. Per Verizon’s new report, ransomware was involved in 48% of the confirmed breaches in 2025, up from 44% in the previous year, while ransom payments decreased, with the median amount paid dropping below $140,000. Only 31% of ransomware victims paid, the report shows. An increased reliance on third-party software and services has expanded organizations’ attack surface and led to a 60% increase in breaches with third-party involvement last year, reaching 48% of the total. “Looking at remediation over time in third-party cloud exposure, only 23% of third-party organizations fully remediated missing or improperly secured multifactor authentication (MFA) on their cloud accounts, with 50% of all findings being resolved within a month,” the DBIR reads. Verizon’s report also shows that threat actors are increasingly relying on gen-AI for targeting, initial access, and malware and tool development. “The median threat actor researched or used AI assistance in 15 different documented techniques, with some actors leveraging as many as 40 or 50. Most AI-assisted development of malware and tooling was associated with well-known and defined attack techniques, with a median of 55 existing known malware examples performing the same functions,” the report reads. Per the Verizon 2026 DBIR, 62% of breaches involved a human element, social engineering accounted for 16% of breaches, and the median rate of success was 40% higher in mobile-centric phishing attacks than via email. Shadow AI, or the unauthorized use of gen-AI services, the report also shows, continues to plague enterprises, as 67% of users are accessing AI services from corporate devices using non-corporate accounts. Overall, 45% of employees are regular AI users, up from 15% last year. “While the datapoints are clear, the takeaway for the industry is resounding. Security teams can’t rely solely on downstream remediation. As attackers increasingly target common coding weaknesses, organizations need to prioritize finding and fixing vulnerabilities during development—not months, or even a year, down the line when the burden of time, cost, and risk is multiplied. This is even more important as GenAI continues to change the code vulnerability calculus,” Wysopal said. Related: Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks Related: Unpatched ChromaDB Vulnerability Can Lead to Server Takeover Related: Cyber Resilience Is the New Business Continuity Plan Related: PoC Released for DirtyDecrypt Linux Kernel Vulnerability

Verizon's "2026 Data Breach Investigations Report" ("DBIR") finds that exploits are now involved in 31% of initial access for breaches, while patching lags too far behind the bad guys.

2025�N11��26���J�ẤuITmedia Security Week 2025 �H�v�ŁA�p�����S ����� �� �ō��Z�p�ӔC�� �ђB�玁���u�[���g���X�g�̐^�̈Ӌ�Ƃ��̊� ��[���g���X�g���ۂ��Ƃ̌��ʁ�v�Ƒ肵�ču�������B ���̋L���͉������ł��B����o�^�i�����j����ƑS�Ă������������܂��B �@�ю��́A����܂ő����̊�ƁE�g�D�̃Z�L�����e�B��ɁA�F�E�F��A�C�f���e�B�e�B�[�iID�j�Ǘ��𒆐S�Ɋւ���Ă����B�o�ώY�Ə� �������� ���v���W�F�N�g���i2020�2022�N�j�ɂ��ݐЂ��A���݂̓f�W�^���� �A�C�f���e�B�e�B�A�[�L�e�N�g�^�A�C�f���e�B�e�B���j�b�g ���j�b�g�������߂Ă���B�c����m��w ��w�@ ���f�B�A�f�U�C�������ȁiKMD�j������m�ے��ŁA����w��KMD������ �����ł�����B �@�u���g�D�̃V�X�e���͍��A�N������Ă��Ȃ��B�����f�����āA���S���Ė���Ă��܂����H�v�Ƃ����₢����n�܂����{�u���ŗю��́A���{�̑����̊�ƁE�g�D���ׂ��Ă���u�[���g���X�g�������v�ɑ��錵����������w�E�B�{������ׂ��Ɉڂ邽�߂ɁA�Z�p�ɉ����ċZ�p�ҁA�o�c�҂��ǂ̂悤�Ɏ����ϗe������K�v�����邩����������B�{�e�ł́A�u�����e��v��B �@�ю��́u�����͊��ɐN������Ă���v�Ƃ����O��ɗ��ׂ����Ǝ咣����B���̗����������A�[���g���X�g�Z�L�����e�B�ւ̑����Ȃ̂��Ƃ����B�ю��́A�{���I�ȉ��v�ɂ́u�g�D�̏d�v�T�[�o���C���^�[�l�b�g�ɒ��ځA���Œu���܂����H�v�Ƃ����₢�ɓ������邩�ɂ���Ƒ�����B���A�����Ȃ��Ă��Ȃ����R�͗��j��������Ă���B �@�u�[���g���X�g�v�Ƃ����l�������K�v�ɂȂ����w�i�ɂ́A�]���́u���E�h��v�^���f�������{���畢�����A���X�̏d��ȃZ�L�����e�B�C���V�f���g�����݂���B�ю��́A���j�Ɏc��悤�ȍU����������n��ŕ��͂��A���ꂼ�ꂪ����̃Z�L�����e�B�A�[�L�e�N����ɂǂ̂悤�ȋ��P�������炵�������������B �@2009�N�AGoogle���͂��߂Ƃ��鑽���̃e�b�N��Ƃ��W�I�ɂȂ����uOperation Aurora�v�́A��x�����l�b�g���[�N�ւ̐N�����������U���҂��u�M�����ꂽ���K�]�ƈ��v�Ƃ��ĐU�镑���A���������R�Ɉړ��i���e�������[�u�����g�j�ł��������𔒓��̉��ɂ��炵���B���̎������˂��t�������P�͋��E�h��̎��ł���A�u�ǂ̓����́A�����Ĉ��S�ł͂Ȃ��v���Ƃ�\�����̂������B �@���ɐ��E��k���������̂́A�U���҂�MSP�i�}�l�[�W�h�T�[�r�X�v���o�C�_�[�j�Ƃ̐M���W�����p���A�����e�i���X�pVPN�iVirtual Private Network�j�ڑ��Ƃ����u�����v����ڋq�l�b�g���[�N�ɐN�������uOperation Cloud Hopper�v���B�uA�Ђ�B�Ђ�M�����Ă��邩��Ƃ����āAB�Ђ���̃p�P�b�g�����ɐM�p���Ă͂Ȃ�Ȃ��v�Ƃ����T�v���C��F�[���U���ɂ�����d�v�ȋ��P�u�M���͐��ڂ��Ȃ��v���m�����ꂽ�B �@���ݐi�s��ő����uVolt Typhoon�v�́A�}���E�F�A���g�킸�AOS�W���c�[���݂̂𗘗p����uLiving off the Land�v�i���ALotL�j��p�ƁA��������SOHO���[�^�[�Q�ݑ�ɂ��邱�ƂŁu��ʉƒ납��̃A�N�Z�X�v�ɋU������I���Ȏ����g�ݍ��킹��B �@�]���̌��m��@�����͉������Volt Typhoon�ɑ��A�ю��́u�Ȃ����̃��[�U�[���A�[��ɉƒ�p���[�^�[�o�R��PowerShell�����s���Ă���̂��H�v�Ƃ������A�R���e�L�X�g�ُ̈�𗝉����邱�Ƃ̏d�v������������B �@Salt Typhoon�����ݐi�s��̋��Ђ��BAT&T��Verizon�ALumen�Ƃ�����ISP�i�C���^�[�l�b�g�T�[�r�X�v���o�C�_�[�j�̃R�A�l�b�g���[�N�A�����Cisco Systems�����[�^�[���^�[�Q�b�g�ɁA�Ǝ�i�������Ⴍ�j����˂����ƂŃ��[�^�[���x���Ńg���t�B�b�N���~���[�����O���A�U���҂̃T�[�o�ɓ]��������B �@�u�G���h�|�C���g��T�[�o�ł͂Ȃ��A�������Ȃ��y�ǁi�l�b�g���[�N�j���̂��̂��������ꂽ�B�o�b�N�h�A�i���@�I�T��j���̂��U���҂̃o�b�N�h�A�Ƃ��ċ@�\�����ň��̃P�[�X�BISP��l�b�g���[�N�@�킷��M�p�ł��Ȃ��B�A�v���P�[�V�����w�iL7�j�ł̃G���h�c�[�G���h�Í����iALTS�FApplication Layer Transport Security�j�Ƒ��ݔF�imTLS�FMutual Transport Layer Security�j�ȊO�ɖh���͂Ȃ��v�i�ю��j �@�ߔN�A�U���̎����ID��Ղ��̂��̂Ɉڂ��Ă���B�uStorm-0558�v�ł�Microsoft�̏��������ގ悳��A�uMidnight Blizzard�v�ł�MFA�i���v�f�F�FMulti-Factor Authentication�j���ݒ�̃e�X�g�����N�_�ɁA�{�Ԋ��́uMicrosoft 365�v�ւ̃t���A�N�Z�X�����������ӂ���OAuth�A�v�����쐬���ꂽ�B����ꂪ�ˑ�����IDaaS�iIdentity as a Service�j���̂��P���Q�_�ɂȂ蓾��Ƃ��������́A�uIDaaS�Ȃ���S�v�Ƃ�������̏I���������Ă���Ɨю��͎w�E����B �@�����̎����͑Ί݂̉Ύ��ł͂Ȃ��B�u���J�Î��i2025�N11���j�ł��V�X�e���ɉe�����c���Ă����A�T�q�O���[�v�z�[���f�B���O�X�iHD�j�̃C���V�f���g�ł́A�N��������s�܂łɖ�17�J�����̒����Ԑ�������Ă����\�����w�E����Ă���B����͌��݂̓��{�ɂ����鋫�E�h��̎��Ԃ̈�[���B�ю��͌x���������炷�B �@�u�U���҂�1�N�ȏ�A���Ȃ��̏]�ƈ��ׂ̗ő�����߂Đ������Ă��邩������Ȃ��v �@�����̗��j�I�C���V�f���g�́A�����̃Z�L�����e�B���f���������Ɍ��E�ɒB���Ă��邩�������Ă���B�ǂɎ��ꂽ�u�����v�͂��͂⑶�݂��Ȃ��B���̌����F���������A�[���g���X�g�̐^�̒��𗝉�����o���_�ƂȂ�B �@���E�h��̍\���I�s�k��Ɋ�����Google�́AOperation Aurora���@�ɁuBeyondCorp�v�Ƃ����V���ȃZ�L�����e�B���f���̍\�z�ɒ��肵���B�ю��ɂ��A�����Google�ɂƂ��Ắu���������v�ł���A�P�Ȃ鐻�i�����ł͂Ȃ��A�Z�L�����e�B�N�w�̍��{�I�ȕϊv�������Ƃ����B �@�����ł́uCorp�v�͈�ʖ����ł͂Ȃ��BGoogle�Г��ɑ��݂��������C���g���l�b�g�ucorp.google.com�v�Ƃ����ŗL�������w���B���āA���̃l�b�g���[�N�̓����ɂ���ΎГ��̂�����Ɩ��A�v���ɃA�N�Z�X�ł��鐹�悾�����BGoogle�����������f�́A���̐���̊��S�Ȕp�~���B �@Google�͎Г�LAN���A�J�t�F�̌��OWi-Fi�ȂǂƓ����́A��ؐM���ł��Ȃ��l�b�g���[�N�ɒu���������B����ɂ��A�A�N�Z�X����̊�_�́u�ꏊ�v�iIP�A�h���X�j����uID�ƃf�o�C�X�̏�ԁv�i�R���e�L�X�g�j�ւƊ��S�Ɉڍs���ꂽ�B���̌��ʁAVPN�͑S�p����A�S�Ẵ��N�G�X�g���ʂɌ�����Identity-Aware Proxy�iIAP�j���A�v���P�[�V�����̎�O�ɔz�u���ꂽ�B �@�u�����̏��݂��w�l�b�g���[�N�x����wID�x�Ɉړ]������A�[�L�e�N����̍\�����v�������[���g���X�g�̖{�����v �@�[���g���X�g�Ƃ������t�����{�ŕ��y���Ă���10�N�B�������A�ю��͂��̎����̑������{�����猜�����ꂽ�u�[���g���X�g�������v�ɂƂǂ܂��Ă���ƌ������w�E����B �@�����̓��{��Ƃ���������ZTNA�i�[���g���X�g�l�b�g���[�N�A�N�Z�X�j���i�̎��Ԃ́A�C���o�E���h�|�[�g����������́uVPN 2.0�v�ɉ߂��Ȃ��P�[�X���U�������Ɨю��B�g���l���Z�p�ŎГ��l�b�g���[�N���������Ă��邾���ł���A��x�N�����������e�������[�u�����g�̃��X�N�͑S����������Ă��Ȃ��B �@�u�|���V�[���w10.0.0.0/8 Permit�x�Ȃ�A����̓N���E�h�o�R�̋����LAN�ł����Ȃ��v�i�ю��j �@�����������P�[�X�ł́A���[����肪��������Ă���B�uIDaaS����ꂽ������S�v�uSWG�iSecure Web Gateway�j��CASB�iCloud Access Security Broker�j�����Ă����Α��v�v�Ƃ������A���i�����ɂ��v�l��~���B �@�uID�����͑O�i�����A�f�o�C�X�̏�Ԃ����Ă��Ȃ��B�R���e�L�X�g���l�����Ȃ���Ζ��͂ȕ������c��B�o����͂��Ă��A�����ʐM�����@�n�т̂܂܂ł́A���������U���҂̊����������Ă��܂��B�����͋Z�p�I���̌p�����v �@�ł́A�Ȃ������̑g�D�́A�A�[�L�e�N����̕ϊv�ł͂Ȃ��A���Ղȃt�@�C�A�E�H�[���ɓ�������ł����̂��낤���B�ю��́A�u������̖₢�u�g�D�̏d�v�T�[�o���C���^�[�l�b�g�ɒ��ځA���Œu���܂����H�v�ɐG��A���̗��j�I�w�i���l�@����B �@���āASELinux��Network Access Control�AHost-based IPS�iIntrusion Prevention System�j�Ƃ������z�X�g���S�i����낤�j���Z�p�͑��݂������A���̕��G���Ɖ^�p���ׂ̍������猻��Ō�[�����Ă������B���̉ߋ��̎��s���A���E�h��^�Ƃ���������₷���Z�L�����e�B���f���ւ̐[�������I�ˑ��݁A�����̋Z�p�I�����i�������Ă���B �@����E�p���A�����I�Ȉ���ݏo���ɂ́A���z�_�ł͂Ȃ���̓I�Ȑ헪�����߂���B �@�S�]�ƈ��ɍ����ȃ��C�Z���X��t�^�������S�Ǘ��[����z�z����\�\Google���u�k�ɐ��v�ƕ\������悤�ȗ��z�I�ȃ[���g���X�g�́A�����̓��{��ƂɂƂ��Ĕ��I���B�������A�ю��́u���߂�K�v�͂Ȃ��v�ƌ��A�R�X�g�ƕ����̕ǂ��z���邽�߂̌����I�ȃA�v���[������B �@�܂��������ׂ��́A�R�X�g���ABYOD�iBring Your Own Device�j�ɂ�����v���C�o�V�[�ւ̒�R���A������MDM�iMobile Device Management�j��EDR�iEndpoint Detection and Response�j�̖���������3���B �@���ɁuEDR����ꂽ����MDM�͕s�v�v�Ƃ����uEDR�_�b�v�́u�v���I�Ȍ�����v�Ɨю��BMDM�́u�˒��܂�v�i�\�h�j�ł���AEDR�́u�Ď��J�����v�i����Ή��j���B�Ď��J�����������Ă��˒��܂肪�Ȃ���ΓD�_�͓������ł���AEDR�����ł͐�q��LotL�U���ɂ͖��͂��B�����āATPM�iTrusted Platform Module�j�Ƃ������n�[�h�E�F�A�ł̖h����K�v�ɂȂ�B �@�R�X�g��v���C�o�V�[�AEDR�_�b�̖����������邽�߂ɗю��������̂��A�u�M���̊K�w���v�Ƃ��������I�Ȑ����헪���B����́AGoogle�́uTrust Tiers�v���f�����Q�l�ɁA�f�o�C�X�̊Ǘ����x���ɉ����ăA�N�Z�X����������A�v���[����B �@�[���g���X�g�̊T�O�́A���͂�]�ƈ��̃A�N�Z�X�iBeyondCorp�j�����ɂƂǂ܂�Ȃ��B�u�k�ɐ��͈ړ������v�Ɨю��͌��A�h�q�����N���E�h�l�C�e�B�u���ɂ�����T�[�r�X�ԒʐM�Ɋg�����ꂽ�uBeyondProd�v�̐��E����������B �@BeyondProd�Ƃ́A�f�[�^�Z���^�[�����ł���M�������A�}�C�N���T�[�r�X�Ԃ̒ʐM�i���[�N���[�hID�j�������郂�f�����BIP�A�h���X���Ӗ��𐬂��Ȃ��Ȃ����R���e�i���ŏd�v�Ȃ̂́u�ǂ�IP���v�ł͂Ȃ��u�ǂ̃��[�N���[�h���v�u�ǂ̃R�[�h���v����肷�邱�Ƃ��B �@���̎����W���Ƃ��āA�ю���Cloud Native Computing Foundation�iCNCF�j�̃v���W�F�N�g�uSPIFFE/SPIRE�v�iSecure Production Identity Framework for Everyone/SPIFFE Runtime Environment�j���Љ���B�v���b�g�t�H�[���Ɉˑ������A�����郏�[�N���[�h�Ɍ��؉\��ID�I�ɕt�^����I�[�v���Ȏd�g�݂��B �@����ɖ����ɖڂ�������ƁA���U����ID�Ǘ��@�\��A�g������uIdentity Fabric�v�Ƃ����T�O��A�����I�Ƀ^�X�N�����s����AI�i�l�H�m�\�j�G�[�W�F���g���̂�ID��t�^����l�����ANIST�i�č����W���Z�p�������j���f������̉�����OpenID Foundation�ɂ��AuthZEN�iAuthorization Exchange�j��SSF�iShared Signals Framework�j�Ƃ������W���d�l�ȂǁAID�Ǘ��͂�蓮�I�����ݐڑ����ꂽ���E�Ɍ������Ă���B �@�u���̍Ō�ɁA�ю��̓[���g���X�g���f���ւ̈ڍs�ɂ�����A����ׂ��p���Ƃ��āA�G���W�j�A�����O�̐��E����2�̌��t�����p�����B �@1�ڂ́A�G�N�X�g���[���v���O���~���O�iXP�j�̒҃P���g�E�x�b�N���́uEmbrace Change�v�i�ω�����i����j���B���Ђ�����₦���ω����钆�ŁA�Œ�I�ȁu�ǁv�ɌŎ�����̂ł͂Ȃ��AID�ƃR�[�h���j�Ƃ��āA�ω��ɂ��Ȃ₩�ɑΉ��ł���\���ւƎ����ϗe�����Ă����K�v������B �@2�ڂ́A�\�t�g�E�F�A�J���҂̃W���G���E�X�|���X�L�[���́uFire and Motion�v�i�ˌ����O�i�j�B���z�͉�����������Ȃ����A�͍��̒��ŗ����~�܂��Ă�������ꌂ����Ă��܂��B�����Ȍv���҂̂ł͂Ȃ��A�����̃Z�L�����e�B��Ŏ��Ԃ��҂��Ȃ���A���̗��ŏ������ł��Z�p�I����ԍς��A�A�[�L�e�N����̖{���I�ȉ��P��i�߂�ׂ����B �@�Ō�ɁA�ю��́u�w�[���g���X�g���ۂ��x���瑲�Ƃ��A�wBeyondCorp�x�Ɋw�сA�C���^�[�l�b�g�ɐ������Ȃ���x�o��������Ăق����v�ƌĂъ|����B���̐�ɂ����A�u������̖₢�ɑ���^�̓����A���Ȃ킿�u�{���Ɉ��S���Ė����v��Ԃ��҂��Ă���̂��B �@�ю��́A����܂ł�ITmedia Security Week�Łu�F�v���e�[�}�ɉ��x���u�����Ă���B����ҏW���ł́A���̔F�̏d�v����ʊp�x����œ_�Ă�ׂ��A�[���g���X�g���e�[�}�ɂ����u�����˗������B���͂�[���g���X�g�ƔF�E�F�͂قړ��`�ł���A���m�E�Ή������ł͂Ȃ��h��̎��_�ł��d�v�������܂��Ă���B�������AIDaaS�̗��p���S�[���ł͂Ȃ��B�ю��ɂ́A���̎����J�ɉ�����Ă����������B �@���i�̓������Z�L�����e�B����̒��S�ł͂Ȃ��Ȃ������A�܂��͍�����ꂽ�悤�ȍl�����ւƈӎ������߂邱�Ƃ������A��ƁE�g�D���ł���u�ˌ����O�i�v�̑����ɂȂ�g�s���h�Ȃ̂ł͂Ȃ����낤���B Copyright © ITmedia, Inc. All Rights Reserved.

Your security stack looks fine from the dashboard and that’s the problem One in five enterprise endpoints is operating outside a protected and enforceable state on any given day, according to device telemetry collected across tens of millions of corporate PCs. That figure, drawn from Absolute Security’s 2026 Resilience Risk Index, has barely moved in a year, even as organizations continue to add security tools and increase spending. The report, which draws on multi-year endpoint telemetry alongside external research, finds that the gap between security deployment and security enforcement is widening. Controls are installed. Dashboards report coverage. The underlying devices are frequently in a different condition. Control drift is constant, not episodic The share of endpoints operating in a protected state increased from 78% in 2025 to 79% in 2026 among devices tracked without active resilience enforcement. That one-point gain means the average enterprise device spends approximately 76 days per year outside a state where its security controls are reliably enforceable. The data covers three major control categories: Endpoint Vulnerability Management, Endpoint Protection Platforms (EPP/EDR/XDR), and Security Service Edge. Vulnerability management showed the steepest deterioration, with the out-of-compliance rate rising from 20% to 24% year over year. EPP and EDR controls held flat at 23% out of compliance. SSE controls moved from 13% to 14%. The platforms analyzed dominate analyst quadrants and anchor enterprise security budgets across endpoint management, protection, and network security categories. Vendor identities are anonymized in the performance charts, but the dataset represents the largest names in the industry by deployment and spending share. Across the endpoint management category, vendor-level performance ranged from protected-state integrity near 99% at the top to 55% at the bottom. One vendor in the endpoint management tier saw its protected-state rate drop from 64% to 55% year over year, leaving nearly half of devices outside an enforceable state. The cost of being down The financial context behind these numbers is substantial. Splunk research estimates that companies lose an average of $49 million in annual revenue due to downtime. Across the Global 2000, the aggregate figure exceeds $400 billion per year, roughly 9% of total corporate profits. High-impact outages affecting core systems carry a median hourly loss of approximately $2 million, with recovery times frequently extending to two weeks or longer. Researchers draw a distinction between security coverage and operational continuity. An organization can have licenses active, dashboards green, and agents installed on every device, and still be unable to remotely restore those devices at scale when disruption occurs. In one case study, a large global enterprise with extensive security platform coverage found fewer than 40% of its devices were remotely recoverable during an incident. Mean time to recover stretched between five and ten days. Estimated annual downtime exposure ran from $28 million to $40 million. After implementing persistence-based resilience capabilities, remote recovery reached over 95% of endpoints, mean recovery time fell below 24 hours, and annual downtime exposure dropped below $5 million. Vendor consolidation creates concentration exposure Enterprise security architecture is consolidating around fewer platforms. A 2025 Gartner survey found that 62% of organizations are actively reducing their vendor count, and 36% plan to continue consolidation over the next three years. Fewer vendors mean fewer integrations and lower coordination overhead, which is the operational logic driving consolidation. The structural consequence is that a single configuration error, update failure, or service disruption can propagate across an entire device fleet simultaneously. The 2025 Verizon Data Breach Investigations Report found that 30% of breaches now involve a third party, roughly double the prior-year figure, pointing to the degree of ecosystem dependency in enterprise environments. The 2024 global endpoint outage affecting millions of systems within hours is cited as an example of how architectural concentration can convert a single vendor-layer failure into a synchronized enterprise-wide disruption. Patch cycles are slipping, including on newer systems Windows 10 patch age more than doubled year over year across every sector analyzed. That increase is largely attributable to Microsoft ending general security updates for Windows 10 in October 2025. By early 2026, patch age for Windows 10 endpoints largely reflects the number of days since that final update, approximately 150 days. The more significant signal is that approximately 10% of enterprise endpoints in the dataset continue to run Windows 10, placing them permanently outside the security update cycle with no path to remediation short of OS migration. Windows 11 patch age also increased across every vertical in the dataset. In Media and Telecom, Windows 11 patch age reached 78 days. In Education, it reached 81 days. Finance showed the smallest increase, with Windows 11 patch age at 32 days in 2026. The increases indicate that patch discipline is weakening on current-generation systems, not only on legacy hardware being wound down. Generative AI usage grows 2.5x on enterprise devices Visits to generative AI platforms from enterprise PCs grew from approximately 150 million to over 350 million year over year, a 2.5x increase. ChatGPT continues to account for the largest share of traffic, with 97.8% of observed visits in 2025 declining to 78.3% in 2026. Google’s Gemini went from no measurable presence in 2025 to 16.1% of enterprise AI visits in 2026. Claude, OpenAI developer services, and DeepSeek also registered enterprise activity in 2026. Over 99% of this AI usage occurs through web browsers, not locally installed applications. That delivery method bypasses many application control policies, allowing AI access to expand outside formal IT oversight channels. Employees can transmit sensitive prompts, internal data, and intellectual property through browser-based AI tools without triggering traditional endpoint controls. DeepSeek traffic declined significantly year over year, yet the platform continued to appear in enterprise networks despite restrictions from multiple governments and security agencies. Enterprise hardware is becoming an AI execution platform Enterprise PC hardware has shifted significantly toward AI-capable configurations. In 2025, 57% of enterprise devices had at least 16GB of RAM, the baseline for AI-assisted local workloads. By 2026, that figure reached 75%. Devices with 32GB or more, sufficient for more intensive local AI workloads, grew from 11% to 21%. Chip manufacturers are shipping processors with dedicated AI accelerators, and operating systems are integrating AI functionality into the desktop environment. Gartner forecasts that AI-capable PCs will represent more than half of global PC shipments by 2026. The practical consequence is that endpoint stability is now a prerequisite for automated workflows, not just for individual user productivity. An endpoint that drifts out of an enforceable state, or falls beyond management visibility, becomes a potential failure point for AI-driven processes running on or through that device. The emergence of what the report calls “fully entitled digital agents,” AI systems that operate with user-level permissions, access enterprise applications, and persist across workflows, adds an additional governance layer. Organizations must now account for autonomous software operating with the same access rights as the employees who deployed it. Sector-level risk is uneven The financial services sector showed a sharp increase in sensitive data exposure, rising from 23% to 40% of endpoints year over year. Encryption and dark device metrics improved in the sector, which means the risk concentration came from data accumulating faster on individual endpoints than controls tightened. Healthcare showed a similar pattern. Dark device rates declined slightly, and encryption gaps widened, even as regulated data per device continued to grow. Retail showed improvement across all three risk metrics, with reductions in unencrypted devices, dark devices, and sensitive data exposure. Manufacturing remained stable in data density and made incremental gains in control coverage, with distributed dark device risk persisting in operational environments. Measuring resilience as a business metric The researchers propose four metrics for quantifying resilience in financial terms: mean time to recover, the percentage of endpoints recoverable remotely, downtime cost per hour of disruption, and labor plus incident response costs required for recovery. An enterprise generating $500,000 per hour in operational revenue would preserve approximately $4 million in value by reducing downtime by just eight hours per year.

The traditional concept of a "secure perimeter" has effectively evaporated. As the workforce has transitioned from centralized offices to a hybrid model spanning kitchen tables, coffee shops, and co-working spaces, the old way of defending the network has become obsolete. Organizations can no longer rely on the assumption that anything inside the corporate network is "safe" and everything outside is "hostile." The move to Zero Trust isn’t just a passing trend, it’s a necessary evolution in security architecture. However, many organizations are finding that their current implementations are missing a critical component: the connection between identifying a user and authorizing their session. Understanding Zero Trust At its core, Zero Trust is a security framework built on the mantra: "Never trust, always verify." It assumes that a breach is either imminent or has already occurred. Therefore, no user, device, or application is granted implicit trust based on its physical or network location. Unlike legacy models that functioned like a castle moat, where once you crossed the drawbridge, you had free reign of the grounds, Zero Trust operates like a high-security facility where every single door requires a fresh badge swipe and a biometric scan. This granular level of verification is the only way to defend against modern, sophisticated cyber threats that specialize in lateral movement. Where traditional authentication models fall-short While most organizations have strengthened identity security by adopting multi-factor authentication (MFA) and conditional access policies, these measures alone are no longer enough. Despite best efforts, breaches involving valid credentials continue to rise. The problem lies in a fundamental misunderstanding of what MFA does. While authentication verifies who a user is, it does not determine whether their access should be trusted at that specific moment. Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches. Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles! The identity-device gap The "where" and "how" of access today are just as important as the "who." Consider these common scenarios: A remote employee logging in from a personal, unpatched laptop. A third-party contractor using an endpoint that lacks up-to-date antivirus software. A user connecting via an unmanaged, public Wi-Fi network without using a VPN. In these cases, the user might pass an MFA prompt perfectly. They are who they say they are. However, if that device is infected with malware, the "authenticated" session is now a direct pipeline for an attacker to enter your environment. Token theft and session hijacking are invisible threats Attackers know where MFA falls short, and they’ve adapted. They use infostealers, token theft, and session hijacking to steal the session cookie or token created after a successful MFA login. By loading that token into their own browser, they can bypass identity checks. They don’t need to break in because the system already sees them as a legitimate, already authenticated user. If your security policy checks identity only at login and doesn’t verify device health, attackers can more easily expand their access and reach sensitive data. The Role of Device Trust Device trust is now crucial to securing the complete access journey. When access decisions depend on both identity and device health, authentication becomes contextual rather than static. A successful MFA prompt is no longer treated as the end of the security conversation. It is one signal among several. Solutions such as Specops Device Trust embeds posture checks directly into the authentication workflow, allowing access to reflect the current state of the device, not just the user’s credentials. If the device drifts out of compliance, access can be restricted or re-evaluated without relying on a separate security tool to detect the issue later. For organizations deploying Zero Trust, this adjustment corrects a structural gap. Identity confirms who is connecting, and device trust helps determine whether that connection should proceed. Without both elements working together, Zero Trust remains only partially implemented. Continuous monitoring is key Zero Trust is an ongoing effort. Real-time monitoring and analytics help security teams spot unusual activity and respond quickly to threats. With tools that show device health and compliance, organizations can keep strong protections in place, even as devices and conditions change. For instance, if a user’s laptop becomes compromised mid-session or if a security feature is disabled to bypass a local restriction, the system must be capable of recognizing that change instantly. Automating the validation of device posture means security teams can ensure that the "verify" part of "never trust, always verify" is happening in real-time. This level of oversight is essential for matching the speed and agility of current attack techniques. Achieving True Zero Trust Securing a hybrid workforce requires binding identity to a trusted device and continuously validating that trust throughout every session. Specops’ Zero Trust access solution Specops Device Trust is built around that principle. It uses identity binding to ensure that access is tied not just to a user account, but to a specific, verified device. It evaluates device posture in real time and can enforce policy dynamically if risk changes during a session. When issues are detected, built-in one-click remediation allows users to resolve compliance gaps without overwhelming IT teams. Grace periods and automated posture checks reduce friction while maintaining enforcement, so security does not come at the cost of productivity. By combining phishing-resistant authentication with continuous device validation, organizations can make access decisions based on both who is connecting and the current state of the device they are using. Zero Trust is not achieved through more authentication prompts. It’s achieved when identity and device trust work together to ensure that access is granted only when both remain secure. Interested in seeing how continuously evaluated authentication could work in your organization? Contact Specops today and learn how our Zero Trust access solution Specops Device Trust can help your organization secure your authentication lifecycle. Sponsored and written by Specops Software.

While IT teams invest heavily in login security, many don’t apply the same scrutiny to password resets. If the reset path is weaker than the authentication path, it becomes the logical target. Once an attacker gains a foothold, their next step is resetting credentials tied to more valuable accounts. A poorly protected reset process can allow them to move through a network and assume higher privileges while blending in as a legitimate user. Understanding the risks behind password resets is crucial, so we look at how attackers use password resets to escalate privileges and identify seven practical ways to close those gaps without slowing your team down. How attackers escalate privileges through password resets In many environments, the reset process sits slightly outside the robust controls applied to normal authentication. Rather than trying to break through hardened login defenses, attackers look for reset paths that are easier to manipulate. Common escalation paths include: Compromised standard accounts: An attacker gains access to a low-privilege user, then explores reset options for higher-value accounts. This is especially dangerous where helpdesk tools or loosely scoped admin rights allow lateral movement. Helpdesk social engineering: Attackers impersonate employees, claim they’re locked out, and push for urgent resets. Under pressure, inconsistent identity verification can lead to access being handed over. Reset token interception: If email accounts are compromised, multi-factor authentication (MFA) relies on SMS, or recovery settings are misconfigured, attackers can capture reset links or one-time codes without knowing the original password. Abuse of over-permissioned admins: Users with broad reset rights can, intentionally or otherwise, change credentials for accounts beyond their role, creating an escalation opportunity. Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches. Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles! Seven ways to secure password resets 1. Require MFA MFA is one of the most effective controls against privilege escalation through password resets. Requiring MFA for reset requests should be a baseline safeguard in any reset workflow. However, not all MFA methods offer the same level of protection. MFA solutions like codes sent via email and SMS aren’t infallible. For high-value or administrative accounts, phishing-resistant MFA (such as FIDO2 or hardware-backed authentication) provides stronger protection against token interception. It reduces the effectiveness of token interception, SIM swapping, and credential phishing. 2. Strengthen device security Password resets initiated from unmanaged or unknown devices create unnecessary exposure. Compromised endpoints, personal devices, or sessions originating from unusual locations all increase risk. Where possible, limit reset approvals to trusted, managed devices and apply device posture checks. Block or step up verification for requests coming from new geographies or high-risk IPs. Identity alone isn’t enough. MFA validates the user’s identity, not the security posture of the device. 3. Enforce strong password policies Password resets only improve security if the new password is actually strong. Organizations should enforce clear minimum length requirements, block common or breached passwords, and prevent users from recycling old credentials. Complexity rules can help, but overly rigid requirements lead to predictable patterns and frustrated users. Passphrases alleviate this issue, as they’re harder to crack and easier for employees to remember. Solutions like Specops Password Policy help organizations apply stronger, more granular password requirements than those available through Microsoft’s native policies. It also continuously blocks more than 5.4 billion known compromised passwords through the Breached Password Protection feature, reducing the chance of attackers abusing legitimate credentials. 4. Educate users and support teams Password resets are a frequent phishing target because attackers know urgency lowers caution. Train employees to recognize reset scams, suspicious MFA prompts, and unexpected recovery emails. Helpdesk teams also need consistent identity verification procedures. Even in environments with self-service resets, a rushed approval can quickly become a privilege escalation path. 5. Run regular audits and monitor reset activity Organizations should log and review reset requests, especially privileged accounts. Teams should monitor and have alerts for unusual patterns such as repeated attempts, out-of-hours activity, or resets coming from unexpected locations. It’s also important to regularly audit who has permission to reset passwords for others. Overly broad access can create escalation opportunities that go unnoticed until exploited. 6. Implement least privilege Applying least privilege helps limit escalation by ensuring users, including administrators, only have the permissions required for their role. That includes restricting who can reset passwords for others and separating high-privilege accounts from everyday user activity. Privileged access should be tightly scoped, time-bound where possible, and regularly reviewed. The fewer opportunities attackers have to jump from one account to another, the harder it is for one reset to escalate into full administrative control. 7. Avoid knowledge-based authentication Security questions and other “something you know” checks are no longer a reliable way to protect password resets. Answers are easier to guess as people share more information about themselves on social media. Use possession-based verification instead, such as secure MFA prompts or checks tied to trusted devices. It’s here that Specops’ zero trust access solution Infinipoint helps by binding user identities to trusted devices, ensuring that authentication only succeeds from approved, enrolled devices. How Specops can help Securing password resets means protecting the full account lifecycle, from recovery through to ongoing monitoring. We help organizations reduce privilege escalation risk by strengthening reset workflows through Specops uReset. Remote users can change their password from any location and at any time of day, whether on or off VPN. Multiple authentication options guarantee users can complete resets even if one identity provider is unavailable. Our identity security products are designed to support IT teams with the expertise needed to keep access secure without adding unnecessary friction. If you’d like to see how Specops can help secure your password resets, contact us today or book a demo to see our solutions in action. Sponsored and written by Specops Software.

Blumira enhances EDR and ITDR to speed up threat detection and containment Blumira has announced the release of expanded endpoint detection and response (EDR) and identity threat detection and response (ITDR) capabilities in its platform. Security teams on Blumira Respond and Automate editions can now contain active threats by isolating compromised endpoints, stopping malicious processes, and locking out attackers across Microsoft 365 and Active Directory, without ever leaving the Blumira dashboard. “Ransomware and identity-based attacks including business email compromise are top-of-mind concerns keeping IT teams up at night right now,” said Matt Warner, CEO of Blumira. “Response teams shouldn’t have to jump between multiple dashboards during an active breach, or have to wonder what to do next. These endpoint and identity security improvements help us deliver on our promise of manageable, scalable security for busy teams and partners.” Ransomware attacks continue to increase, rising by 34% since 2024, and are seen in 44% of breaches according to Verizon’s DBIR 2025 report. For IT administrators and MSP technicians managing an active incident, the difference between a contained threat and a full-blown breach often comes down to incident response times and having the right toolkit. By bringing endpoint and identity response into a unified platform where threats are detected and investigated, Blumira cuts down the time between threat detection and mitigation. “We’re stopping breaches in seconds instead of minutes or hours. I don’t have to find a password, log in, get to the user, revoke MFA, and change their password. I can do all of that in one click,” said Matt Timm, Network Operations Center Team Lead at TR Computer Sales. “Efficiency is key, especially in a security monitoring department. For us to have everything in one central location — the information, what’s happening, the ways that we can fix it, and then the feedback of how it was fixed — is huge.” Stop threats fast, wherever you find them The benefits of Blumira ITDR and EDR include: Improved response times: Users can respond directly from a new finding, so teams move from detection to containment with less time and less clicks Enriched threat context: Response teams have the context of an investigation, whether it’s related to a compromised M365 account to shutting down privilege abuse before it escalates Faster containment with a clear response process: IT teams have fewer tools to manage under pressure, and have the insight they need to build team confidence and security expertise Extending security operations across your toolchain Blumira is also announcing enhancements to its Public API, giving partners and power users new capabilities to assign findings, add comments, resolve incidents, and query evidence programmatically. For MSPs managing security across multiple client environments, these additions make it easier to connect Blumira to existing PSA platforms, RMM tools, and custom workflows, keeping security operations inside the tools teams already use every day.

Law enforcement agencies in the U.S. and Europe, along with private partners, have disrupted the SocksEscort cybercrime proxy network that relied solely on edge devices compromised via the AVRecon malware for Linux. According to Lumen’s Black Lotus Labs (BLL), which helped the U.S. Department of Justice take down Socksescort, the proxy network had a constant average of 20,000 infected devices every week for the past few years. SocksEscort was first documented by BLL researchers in 2023 and functioned for more than a decade by offering cybercriminals traffic routing services through residential or small business devices. The service advertised access to “clean” IP addresses from major ISPs - such as Comcast, Spectrum, Spectrum Business, Verizon, and Charter - that could pass multiple blocklists. "Since the summer of 2020, SocksEscort has offered to sell access to about 369,000 different IP addresses," the U.S. Department of Justice says in a press release today. "As of February 2026, the SocksEscort application listed approximately 8,000 infected routers to which its customers could buy access, of those, 2,500 were in the United States." The DOJ says that the SocksEscort service was used in the theft of $1 million worth of cryptocurrency from a user in New York, enabled losses of $700,000 from defrauding a Pennsylvania-based manufacturing business, and caused $100,000 in damages in a fraud impacting current and former United States service members with MILITARY STAR cards. In Europe, authorities in Austria, France, and the Netherlands, took down multiple SocksEscort servers under the coordination of Europol. "During the action day, law enforcement agencies successfully took down and seized 34 domains as well as 23 servers located in seven countries," the European agency informs. The US also froze $3.5 million in cryptocurrency. Currently, all infected devices used in the SocksEscort proxy network have been disconnected from the service. According to the Lumen researchers, SocksEscort was powered by the AVRecon malware, which is believed to have been active since at least May 2021 and infected over 70,000 Linux-based small office/home office (SOHO) routers by mid-2023. Lumen researchers disrupted the AVRecon router botnet in 2023 by null-routing the command-and-control (C2) infrastructure across its network, cutting infected devices off from their operators. This severed communications with the botnet’s proxy servers and control nodes, effectively rendering the network inert within Lumen’s infrastructure. However, this disruption had a limited effect, and over time, the operators of Socksescort returned to regular operations, routing communications through 15 command-and-control nodes (C2s). A Lumen spokesperson told BleepingComputer that SocksEscort used only the AVRecon malware to add new nodes. Since the beginning of 2025, the company has seen 280,000 unique victim IP addresses. The researchers believe that the AVRecon malware was used only for growing SocksEscort, as observed victim IPs were not seen in other botnets or services. Also, despite the significant size of the operation, the operators managed to keep the C2 infrastructure undetected. Over half of the infected devices were located in the United States and the United Kingdom, according to the researchers, which is excellent for routing malicious traffic and evading blocklists. Earlier this week, Black Lotus Labs revealed another proxying botnet called KadNap that targets ASUS routers and other edge networking devices primarily. Since August 2025, the botnet has infected 14,000 devices, using a novel but flawed communication and peer discovery mechanism based on the Kademlia Distributed Hash Table (DHT) protocol. Lumen took limited action against that botnet by blocking all network traffic to and from its C2 infrastructure on the Lumen network, preventing infected devices from communicating with the botnet controllers. To minimize the likelihood of router compromise, replace models that have reached end-of-life, apply the latest available firmware updates, change the default administrator password, and disable remote access panels if not needed. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Telco globali sempre più nel mirino di Salt Typhoon. Le infrastrutture di telecomunicazione globali sono infatti “uno dei principali campi di battaglia della competizione tra grandi potenze“. Salt Typhoon è uno dei gruppi hacker criminali più attivi a livello globale, in particolare contro le Telco e la sua operatività è stata ricondotta anche alla competizione geo-economica in atto. Gli attacchi hanno preso di mira alcune delle più grandi compagnie telefoniche e di Internet del mondo. Sottratti decine di milioni di registrazioni telefoniche, molte delle quali riguardanti alti funzionari governativi. Secondo gli esperti di sicurezza informatica, il gruppo ha rapporti diretti con la Cina. Rientra addirittura nel più ampio ecosistema di hacker che hanno l’obiettivo di preparare “il terreno” a Pechino in vista di un possibile conflitto con Taiwan. Il paradigma, ormai noto, sarebbe quello della guerra cyber che precede le operazioni militari ‘classiche’. Attacchi all’infrastruttura Gran parte delle operazioni di Salt Typhoon si è concentrata sull’infiltrazione delle infrastrutture di rete delle compagnie telefoniche. In particolare, gli hacker criminali hanno sfruttato vulnerabilità nei router che si trovano ai margini delle reti aziendali, utilizzandoli “come punto di accesso iniziale per compromettere i sistemi interni“. Una volta nelle reti, il gruppo ha colpito anche i dispositivi di sorveglianza che le Telco statunitensi sono legalmente obbligate a installare per consentire alle forze dell’ordine di monitorare chiamate e messaggi. Il controllo di questi sistemi avrebbe permesso al gruppo di intercettare comunicazioni sensibili. Gran parte della sua efficacia, sostengono gli analisti deriva dal fatto che Salt Typhoon non operi isolatamente. Farebbe infatti parte di una rete più ampia di gruppi di cyberspionaggio (sempre con legami diretti con la Cina). Tra questi figurano: Volt Typhoon. Secondo gli esperti starebbe predisponendo accessi nelle infrastrutture critiche per possibili attacchi distruttivi capaci di provocare gravi interruzioni dei servizi. Flax Typhoon. Quest’ultimo gestirebbe una vasta botnet composta da dispositivi connessi a Internet compromessi. Il suo impiego serve per nascondere il traffico malevolo e rendere più difficile l’attribuzione degli attacchi. Principali obiettivi Tra le operazioni più sensibili attribuite a Salt Typhoon figurano intrusioni nei sistemi di alcune delle principali compagnie telefoniche statunitensi. Gli attacchi avrebbero permesso agli hacker di ottenere registri delle chiamate, messaggi di testo e persino audio di conversazioni telefoniche appartenenti ad alti funzionari del governo americano. Molti di questi figuravano come “obiettivi di interesse strategico“. La gravità della situazione ha spinto l’Federal Bureau of Investigation (FBI) a raccomandare ai cittadini statunitensi di utilizzare applicazioni di messaggistica con crittografia end-to-end. L’obiettivo è quello di ridurre il rischio che potenze straniere possano intercettare le comunicazioni. Sempre secondo funzionari dell’FBI, il gruppo Salt Typhoon avrebbe compromesso almeno 200 aziende in tutto il mondo. L’elenco dei Paesi colpiti continua ad aumentare con l’avanzare delle indagini. Gli attacchi evidenziano come le operazioni di cyberspionaggio stiano diventando sempre più centrali nelle strategie geopolitiche. Si trasformano così le infrastrutture di telecomunicazione globali “in uno dei principali campi di battaglia della competizione tra grandi potenze“. Lo scenario Usa La CISA e l’FBI avevano nel 2024 rivelato con una nota congiunta le attività di un gruppo di hacker criminali. Quest’ultimo aveva violato le reti di “diverse società di telecomunicazioni” americane (tra cui i sistemi di AT&T e Verizon) “per mesi o più”. Sempre dalle loro indagini è emerso un possibile legame tra Salt Typhoon e il Governo cinese. Da qui la sua particolare attenzione per carpire le comunicazioni sensibili. Non solo. Sembrerebbe infatti che siano state esfiltrate “informazioni oggetto di richieste da parte delle forze dell’ordine statunitensi in base a ordini di tribunale”. L’attività malevola si sarebbe protratta per quasi un anno. Si passava così dal “furto dei dati delle chiamate dei clienti” alla “compromissione delle comunicazioni private di un numero circoscritto di individui”. L’insieme di queste operazioni su vasta scala avrebbe consentito al Governo cinese di “geolocalizzare milioni di individui” e “registrare telefonate a piacimento”. Pechino, ovviamente, ha smentito ogni eventuale responsabilità nel merito. Secondo il senatore Ben Ray Lujan, Democratico del New Mexico, le presunte ingerenze cyber cinesi rappresentano “il più grande attacco hacker alle telecomunicazioni nella storia della nostra nazione“.

Investigators are worried that a recent attack on a critical FBI system was more than just a random hit, and that another nation-state might have been involved. On February 17, the FBI flagged irregular network activity that led straight to its Digital Collection System Network. That system contains sensitive data related to court-authorized wiretaps, pen registers, and FISA warrants, along with personal information on active FBI targets. The bureau claims it has “identified and addressed” the suspicious activity. That’s it. No word on whether this was ransomware, state-sponsored espionage, or something else entirely. Now the White House, DHS, and the NSA have joined the investigation, which isn’t the kind of guest list you’d see for a minor incident. The breach path? Through a vendor’s internet service provider, according to reports. Not a frontal assault on FBI systems, but a side door through their supply chain. The hackers apparently exploited an ISP that served as a vendor to the agency, bypassing direct FBI defenses entirely. The Wall Street Journal reports that US investigators suspect that hackers affiliated with the Chinese government were behind the breach. It wouldn’t be the first time that Chinese state-linked groups have hit a target via a third-party telecommunications system. Hackers tied to Salt Typhoon hit AT&T and Verizon in 2024. The campaign compromised call records and private communications of politicians, exposing anyone involved in government activity, while also going after law enforcement systems. A year earlier, ransomware operators breached the US Marshals Service and walked away with employee information, legal documents, and administrative data. Then Russian hackers targeted federal courts last year. The judiciary described it as an escalation in cyberattacks while scrambling to protect case files that could expose confidential informants. This trend of attacks on government systems suggests that nation-state actors are actively collecting intelligence. Law enforcement systems are attractive targets because they contain large volumes of sensitive information. This latest incident indicates these attacks are getting more sophisticated, not less. How secure are FBI systems? The Digital Collection System Network stores personally identifiable information on FBI investigation subjects, including wiretap returns and other surveillance data. This includes “pen register” data, which reveals metadata about which numbers a monitored phone line called, and which numbers called that line. Lawmakers are calling for action. In December 2024, Sen. Ron Wyden (D-Ore) proposed legislation to tighten up security of the nation’s phone networks. In 1994, Congress passed lawful access legislation designed to allow government access to telcos’ systems. That law also enabled the FCC to issue regulations that would force telecom providers to secure their systems against unauthorized access by third parties, but Wyden said that was never done. Introducing the Secure American Communications Act, he said: “It was inevitable that foreign hackers would burrow deep into the American communications system the moment the FCC decided to let phone companies write their own cybersecurity rules.” The draft legislation didn’t go any further, though. February’s breach raises an uncomfortable question. If attackers can slip through vendor ISPs into the FBI’s wiretapping infrastructure, what else sits exposed? The bureau says it “identified and addressed” the suspicious activity. Beyond that, little detail has been released. What is clear is that federal law enforcement systems face sustained and sophisticated attacks, and the pressure on those defenses is growing.

Password audits are a standard part of most security programs. They help organizations demonstrate compliance, reduce obvious risk, and confirm that basic controls are in place. However, in many cases the accounts that show up in an audit report aren’t always the accounts attackers target. Most password audits focus on signals like complexity and expiry policies. While important, those audits miss potential risks like over-privileged users, forgotten access, service accounts, or credentials that have already been exposed in a breach. To understand the risks, it’s important to look at where password audits typically fall short, and what security teams can do to make them more effective without losing sight of regulatory requirements. Strength without context doesn’t stop attacks Password audits often start with strength rules: minimum length, complexity requirements, rotation policies, and checks against common weak choices. But if that’s where they end, those audits miss critical vulnerabilities that attackers look for: Reused passwords Credentials exposed in previous breaches Predictable patterns tied to the organization or industry A password can meet every compliance requirement and still be easily guessable in context. For example, an employee at a hospital using something like Healthcare123! may technically satisfy complexity rules, but attackers can easily crack it using a targeted wordlist. Even worse, a password can appear “strong” while already being compromised. If it’s been leaked in a breach elsewhere, attackers can simply log in with it. One study highlights this risk, where 83% of 800 million known compromised passwords otherwise satisfied regulatory requirements. Without breached password screening, audits create a gap where accounts look secure on paper but remain easy to compromise. This is especially true for high-value accounts, where one successful login can open the door to far wider access. What to do instead: Modern audits should include breached-password screening and risk-based prioritization, so the focus stays on the accounts attackers are most likely to target. Tools like Specops Password Policy help by continuously checking credentials against a database of more than 5.4 billion compromised passwords. Alongside allowing organizations to create unlimited custom block lists of terms unique to their environment, Specops Password Policy reduces the likelihood of attackers successfully using exposed or predictable credentials. Orphaned accounts aren’t audited Typically, password audits assume that the accounts that matter are those on the current employee list. However, in many environments, not every active account belongs to an active employee. Attackers know this, which is why “orphaned” accounts are such an attractive target. Accounts belonging to former employees, contractors, test accounts or shadow IT accounts operating outside normal identity processes are all-too common in enterprise environments. Orphaned accounts can sit quietly for months or years without anyone paying attention. They also tend to have weaker controls, such as outdated passwords or missing multi-factor authentication (MFA) enforcement. If an attacker finds valid credentials for an old contractor account, they may gain access without triggering the same alerts that a privileged login would. What to do instead: Password audits should extend beyond “active users” and include dormant, external, and non-HR-linked accounts. Pairing password checks with regular access reviews and automated deprovisioning helps close one of the most overlooked gaps in account security. Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches. Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles! Audits miss high-value service accounts Service accounts are frequently overlooked in user-focused password audits, which is an issue as these accounts often have excessive permissions alongside passwords that never expire. From an attacker’s point of view, compromising a service account can provide long-term access without the visibility or scrutiny that comes with a privileged user login. The result is that organizations may pass a password audit while some of riskiest accounts remain effectively unmanaged. What to do instead: Password audits should explicitly include service accounts, especially those with elevated permissions. Moving credentials into a vault, enforcing rotation, and applying least-privilege access can significantly reduce the risk of service accounts becoming an attacker’s easiest route into critical infrastructure. Point-in-time audits can’t keep up with continuous threats An audit delivers a snapshot of password hygiene at the moment the audit ran. But credential-based attacks are continuous, and the risk can change overnight. One of the most common examples is credential stuffing. Attackers take usernames and passwords exposed in one breach and try them across other services, betting on password reuse. That means an account can be perfectly compliant today and compromised tomorrow, simply because the same credentials were leaked elsewhere. This is especially relevant for larger organizations or those with external-facing login portals. Attackers don’t need to break password rules if they can just reuse credentials that already exist in criminal marketplaces. What to do instead: Strong password auditing needs an element of continuous monitoring. That includes regularly checking credentials against updated breach data, watching for suspicious login patterns, and treating password security as an ongoing control. How to carry out secure password audits If the goal is to reduce the likelihood of compromise, not just pass an assessment, audits need to reflect how attackers actually operate. At a minimum, password audits should: Check passwords against known breach data, not just complexity rules Prioritize highvalue and privileged accounts, rather than treating all users equally Include orphaned and dormant accounts, not just active employees Explicitly cover service accounts, especially those with elevated permissions Incorporate continuous monitoring, rather than relying on periodic snapshots Consider MFA resilience, particularly for sensitive systems Solutions like Specops Password Auditor help organizations assess their password health by running a read-only scan of their Active Directory and flagging vulnerabilities like inactive privileged admin accounts or compromised passwords. To understand more about how these controls can work in your organization, speak to a Specops expert or request a live demonstration. Sponsored and written by Specops Software.

The U.S. Federal Bureau of Investigation (FBI) confirmed on Thursday that it's investigating a breach that affected systems used to manage surveillance and wiretap warrants. While the federal law enforcement agency declined to share more details regarding the incident's scope and overall impact, it said that the incident has already been addressed. "The FBI identified and addressed suspicious activities on FBI networks, and we have leveraged all technical capabilities to respond," the law enforcement agency told BleepingComputer, but declined to provide additional information. On Thursday, CNN, which first reported the incident, cited an anonymous source saying the breach affected FBI systems used to manage wiretapping and foreign intelligence surveillance warrants. While it's unclear at the moment whether this incident is also connected, Chinese hackers part of a state-backed threat group tracked as Salt Typhoon have also compromised U.S. federal government systems used for court-authorized network wiretapping requests in 2024. The incident came to light after Salt Typhoon breached the networks of telecommunications providers in the U.S. (AT&T, Verizon, Lumen, Charter Communications, Consolidated Communications, Comcast, Digital Realty, and Windstream), as well as dozens of other countries. While inside the U.S. telecom firms' networks, the hackers also gained access to the "private communications" of some U.S. government officials. In November 2021, the FBI's email servers were also hacked to distribute spam emails impersonating the bureau that warned recipients about fake cyberattacks. The FBI also revealed in February 2023 that it was investigating malicious cyber activity involving an FBI New York Field Office computer system that was used to investigate child sexual exploitation. Update March 06, 07:39 EST: Added FBI statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cloudflare tracked 230 billion daily threats and here is what it found Cloudflare’s network blocks over 230 billion threats per day. The volume indicates how routine and automated the attack cycle has become, and the patterns behind that volume point to a shift in how breaches begin and progress. Cloudflare’s threat research unit, Cloudforce One, published its inaugural cyber threat report 2026, covering activity observed through 2025 and projecting into the year ahead. The report draws on telemetry from Cloudflare’s network, which handles roughly 20% of global web traffic. “Threat actors are constantly changing tactics, finding new vulnerabilities to exploit and ways to overwhelm their victims. To avoid being caught off guard, organizations must shift from a reactive posture to one fueled by real-time, actionable intelligence,” said Blake Darché, head of threat intelligence, Cloudforce One at Cloudflare. Stolen sessions are replacing credential guessing Infostealers such as LummaC2 extract live session tokens from infected machines rather than stored passwords. Those tokens give attackers access to already-authenticated sessions, bypassing MFA entirely. According to the report, 54% of ransomware attacks in 2025 traced back to infostealer-enabled credential theft, citing Verizon’s 2025 Data Breach Investigations Report. Cloudforce One participated in a coordinated global operation in May 2025 to disrupt LummaC2 infrastructure, deploying warning pages across malicious command-and-control domains. The unit is already tracking successor variants expected to automate the time between infection and ransomware deployment down to hours. Bots account for 94% of all login attempts observed on Cloudflare’s network. Of human login attempts, 46% involve credentials that have already been compromised in prior breaches. These figures reflect the scale at which automated credential testing operates across the web. Cloud platforms are being used as attack infrastructure Threat actors across multiple nation-state categories are routing malicious activity through legitimate cloud services including AWS, Google Cloud, Azure, and SaaS platforms like Google Calendar and Dropbox. This approach blends attack traffic with normal enterprise usage, making detection harder for network security teams. Cloudforce One tracks this tactic under the label “Living off the XaaS,” or LotX. Chinese-affiliated groups identified in the report use Google Calendar event descriptions to pass encrypted commands to infected hosts, and exploit F5 and VMware infrastructure for long-term persistence. Iranian-linked groups host command-and-control pages on Azure Web Apps. Salt Typhoon and Linen Typhoon, both linked to China, continued targeting North American telecommunications providers, government networks, and IT services through 2025. The report attributes breaches at AT&T, Verizon, and Lumen to this activity, along with a July 2025 Microsoft SharePoint compromise. The targeting pattern indicates a focus on persistent access to critical infrastructure for potential future disruption. Email authentication gaps are enabling phishing at scale An analysis of 450 million emails found that 43% failed SPF checks, over 44% lacked valid DKIM signatures, and 46% failed DMARC. These gaps allow Phishing-as-a-Service bots to exploit incomplete authentication chains and deliver spoofed messages that appear to come from trusted internal or branded sources. The top impersonated brands in phishing campaigns were Windows, SANS, Microsoft, Stripe, and Facebook. Researchers also intercepted over $123 million in BEC financial theft attempts in 2025. The average attempt sat at approximately $49,225, a figure the report attributes to deliberate calibration by fraudsters targeting amounts below executive approval thresholds. DDoS volumes reached new records in 2025 The total number of DDoS attacks observed by Cloudflare more than doubled in 2025 to 47.1 million. Network-layer attacks more than tripled year over year. Cloudforce One recorded 19 new world-record attacks during the year. The largest, a 31.4 Tbps UDP flood launched by the Aisuru botnet in November 2025, was nearly six times the peak volume of the largest attack recorded in 2024. Most attacks in 2025 lasted under 10 minutes, closing the practical window for human-led mitigation. The Aisuru botnet and its successor Kimwolf collectively control an estimated one to four million infected hosts. The report notes that Kimwolf saw over 550 command-and-control nodes null-routed in early 2026. North Korean operatives are embedding in remote workforces State-sponsored operatives linked to North Korea are obtaining employment at Western organizations using AI-generated deepfake profiles and U.S.-based laptop farms that create the appearance of domestic residency. Once hired, these workers funnel salary revenue back to the regime and can introduce malicious access to internal systems. The report identifies detection indicators including impossible travel login alerts, mouse-jiggling software, and video metadata artifacts consistent with real-time deepfake rendering. Manufacturing and critical infrastructure accounted for over 50% of ransomware-targeted attacks in 2025, driven by the high cost of operational downtime in those sectors.

Josys centralizes identity data to replace manual IT oversight with automated governance Josys has transitioned into an autonomous identity governance platform, expanding beyond traditional SaaS management. The enhanced platform empowers IT leaders and managed service providers (MSPs) to scale governance and compliance efforts by centralizing identity data within a single, AI-driven system. With Verizon reporting that 80% of hacking breaches stem from compromised credentials, identity is the ultimate attack surface. As threats and costly non-compliance penalties surge, organizations can no longer rely on manual IT oversight. Autonomous Identity Governance replaces this human latency with instant, systemwide enforcement. Josys delivers an automation-first approach to governance that eliminates the manual IT burden of access and compliance oversight. The platform seamlessly automates access reviews and lifecycle updates while actively flagging over-permissioned users, revoking unauthorized access, and surfacing missing MFA accounts. With Josys, organizations have the insights needed to eliminate blind spots across their entire identity perimeter. “High-integrity data is the primary driver of organizational agility and compliance,” said Mahabaleshwar Bhat, chief product officer at Josys. “By evolving into an Autonomous Identity Governance platform, we are giving IT teams the tools to break down integration barriers and build a seamless source of truth. From there, Josys takes the wheel and automates complex lifecycle changes, proactively mitigates risks, and transforms disjointed IT environments into scalable operations.” Breaking down integration barriers Josys has engineered a new standard for connectivity that ingests identity and access data from virtually any source. By merging disjointed data into a unified system of record, organizations can transform raw information into actionable security intelligence by leveraging: AI integration builder: This self-serve, no-code tool achieves total application and access visibility of custom and niche web apps within 30 minutes, effectively bypassing traditional development cycles and API limitations. By recording their browser actions, IT admins “train” the builder, which learns specific workflows and intelligently extracts user, access, and permission data directly from the application’s interface, ensuring continuous identity integrity. Josys app script: Utilizing a proprietary framework to rapidly build and deploy custom integration scripts, Josys enables organizations to unify external identity data into a single source of truth in a matter of days. This accelerated delivery model is significantly faster than the traditional models of supporting a new integration within Josys. Multi-source identity enrichment: This architecture allows IT to construct comprehensive identity profiles by drawing attributes from multiple sources to drive smarter access governance. Merging core identities from systems like Microsoft Entra ID with rich attribute data from secondary HR sources, Josys facilitates a zero-touch security model where an HR update triggers immediate, systemwide enforcement. “The Josys AI Integration Builder has allowed us to easily integrate and monitor any app, even if it is not supported on Microsoft Entra ID, which is an absolute game-changer for closing the gaps where visibility and offboarding risks usually slip through,” said Billy Whiting, system administrator at Francom Group.

N-able’s Anomaly Detection feature identifies credential-based threats N-able expanded its Anomaly Detection capabilities in Cove Data Protection to combat the surge in identity-driven cyberattacks targeting backup environments. The new functionality delivers real-time alerts when suspicious or unauthorized changes to backup policies are detected, giving customers an early warning system against the credential-based tactics attackers use to disable or corrupt backups before deploying ransomware. Identity-based attacks have become a major driver of successful cyberattacks, with AI making these schemes even more convincing. With stolen or phished credentials, attackers can gain access to backup software and weaken backup policies. The 2025 Verizon Data Breach Investigations Report found that roughly 88% of basic web application breaches involved stolen credentials, making it clear how widespread this tactic has become. Once inside, attackers – and sometimes well-intentioned employees – can alter retention policies, exclude critical data from backups, and delete protected devices. These are subtle changes that can go unnoticed for weeks or even months before the attacker triggers the final ransomware event. To give IT teams real-time visibility, Anomaly Detection introduces a vital layer of protection through event-based notifications that highlight these indicators of compromise. This capability notifies users of potential cyberattack signals or misconfigurations before they escalate, allowing organizations to take just-in-time action to safeguard their recovery posture and maintain data resilience. This new capability builds on last year’s Anomaly Detection feature, Honeypots, an always-on defense mechanism designed to detect brute-force attacks on backup infrastructure. “It’s no longer just active systems under attack – backups are firmly in the crosshairs. If attackers gain access to the backup platform, they don’t always strike immediately. They can quietly manipulate backups, alter retention policies, or delete servers, then sit undetected for weeks or even months. When they finally launch their attack, recovery can be impossible,” said Neil Douglas, CIO at Network ROI, a UK-based managed IT services provider. “In the past, we had no visibility into those subtle changes happening behind the scenes. Now, with real-time, event-based alerts for even the smallest alteration, we know the moment something suspicious occurs. That not only protects us from malicious actors but also guards against accidental misconfigurations. It’s a powerful step forward in strengthening our overall data resilience,” added Douglas. “A new wave of threats is targeting businesses through stolen identities,” said Chris Groot, GM of Cove Data Protection. “Real-time alerts to backup policy changes give customers peace of mind by protecting them from risky changes that could affect recovery, whether that change was caused by attackers or employees. By catching these changes as they happen, organizations can stop identity-driven attacks and misconfigurations before recovery is compromised.”

For years, identity has been treated as the foundation of workforce security. If an organization could reliably confirm who a user was, the assumption followed that access could be granted with confidence. That logic worked when employees accessed corporate networks from corporate devices under predictable conditions. Today, that no longer reflects how access is actually used or abused. The modern workforce operates across multiple locations, networks, and time zones. Employees routinely switch between corporate laptops, personal devices, and third-party endpoints. Access is no longer anchored to a single environment or device, yet security teams are expected to support this flexibility without increasing exposure or disrupting productivity, even as the signals used to make access decisions become noisier, more fragmented, and harder to trust on their own. As a result, identity is being asked to carry responsibility it was never designed to hold alone. Authentication can confirm who a user claims to be, but it does not provide sufficient insight into how risky that access may be once device condition and context are taken into account. In modern environments, the core issue is not identity failure, but the over-reliance on identity as a proxy for trust. Identity tells us who, not how risky the access is A legitimate user accessing systems from a secure, compliant device represents a fundamentally different risk from the same user connecting from an outdated, unmanaged, or compromised endpoint. Yet many access models continue to treat these scenarios as equivalent, granting access primarily on identity while device condition remains secondary or static. This approach fails to account for how quickly device risk changes after authentication. Endpoints regularly shift state as configurations drift, security controls are disabled, or updates are delayed, often long after access has already been granted. When access decisions remain tied to the conditions present at login, trust persists even as the underlying risk profile degrades. These gaps are most visible across access paths that fall outside modern conditional access coverage, including legacy protocols, remote access tools, and non-browser-based workflows. In these cases, access decisions are often made with limited context, and trust is extended beyond the point where it is justified. Attackers are increasingly exploiting these blind spots by reusing misplaced trust rather than breaking authentication, stealing session tokens, abusing compromised endpoints, or working around multi-factor authentication. After all, it’s easier to log in than break in. A valid identity presented from the wrong device remains one of the most reliable ways to bypass modern controls and fly under the radar. Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches. Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles! Why Zero Trust often falls short Zero Trust is widely accepted as a security principle, but far less consistently applied across workforce access. While identity controls have matured, progress frequently stalls at the device layer, particularly across access paths outside browser-based or modern conditional access frameworks that inherit trust by default. Establishing device trust introduces complexity that identity alone cannot address. Unmanaged and personal devices are difficult to assess consistently, compliance checks are often static rather than continuous, and enforcement varies depending on how access is initiated. These challenges are compounded when identity and endpoint signals are handled by separate tools that were never designed to work together. The result is fragmented visibility and inconsistent decisions. Over time, access policies can harden and become static, creating more opportunities for identity abuse. When access is granted without ongoing checks, traditional controls are slow to detect and respond to malicious behavior. From identity checks to continuous access verification Addressing static, identity-centric access controls requires mechanisms that remain effective after authentication and adapt as conditions change. Solutions such as Infinipoint operationalize this model by extending trust decisions beyond identity and maintaining enforcement as conditions evolve. The following measures focus on closing the most common access failure points without disrupting how people work. Verify both user and device continuously: This approach reduces the effectiveness of stolen credentials, session tokens, and multi-factor authentication bypass techniques by ensuring access is tied to a trusted endpoint rather than granted on identity alone. Apply device-based access controls: Device-based access controls make it possible to enroll approved hardware, limit the number and type of devices per user, and differentiate between corporate, personal, and third-party endpoints. This prevents attackers from reusing valid credentials from untrusted devices. Enforce security without defaulting to disruption: Proportionate enforcement allows organizations to respond to risk without unnecessarily interrupting legitimate work. This includes conditional restrictions and grace periods that give users time to resolve issues while maintaining security controls. Enable self-service remediation to restore trust: Self-guided, one-click remediation for actions such as enabling encryption or updating operating systems allows trust to be restored efficiently, reducing support tickets and demand on IT teams while keeping security standards intact. Specops, the Identity and Access Management division of Outpost24, delivers these controls through Infinipoint, enabling zero trust workforce access that verifies both users and devices at every access point and continuously throughout each session across Windows, macOS, Linux, and mobile platforms. Talk to a Specops expert about enforcing device-based Zero Trust access beyond identity. Sponsored and written by Specops Software.

Modern infostealers have expanded credential theft far beyond usernames and passwords. Over the past year, campaigns have accelerated, targeting users with little distinction between corporate employees and individuals on personal devices. These infections routinely harvest credentials alongside broader session data and user activity. The resulting datasets are aggregated and sold by initial access brokers, then reused across attacks targeting both personal and enterprise environments. To better understand the scope and implications of this activity, Specops researchers analyzed more than 90,000 leaked infostealer dumps, comprising over 800 million rows of data collected during active infections. The datasets included credentials, browser cookies, browsing history, and system-level files stored locally on compromised machines. What emerges is a clear picture of how infostealer dumps allow attackers to associate technical data with real users, organizations, and behavioral patterns, making a single infection valuable long after the initial compromise. When stolen credentials become identity data The biggest risk is how easily infostealer data ties multiple accounts and behaviors back to one real person. These dumps routinely expose reused account names across services, Windows usernames, files stored in user directories, active session data, and detailed records of activity across environments. Combined, these signals let attackers move from a single compromised credential to identifying an individual, their employer, and potentially their role within an organization. This convergence collapses the boundary between personal and professional identity that many security models still assume exists. What may start as a compromise on a personal device can quickly escalate into enterprise-level risk. Specops Password Policy helps organizations break this link by continuously scanning Active Directory against a database of more than 5.4 billion known-compromised credentials, rather than only checking passwords at creation or reset. Credentials that have already been exposed are blocked from being set or reused, even if they technically comply with policy, reducing the risk of compromised passwords being reused across personal and corporate accounts. Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches. Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles! Where infostealers get your data and how they abuse it The dataset contained credentials and session data associated with a wide range of services, illustrating how infostealer data exposes both identity and access. Professional and enterprise-linked services LinkedIn, GitHub, Microsoft Teams, Outlook, and corporate domains appeared frequently in the dataset. LinkedIn alone accounted for nearly 900,000 records, providing a direct path from stolen data to real names, job titles, and organizational affiliations. For threat actors, this information enables targeted phishing, social engineering, and prioritization of access that may lead deeper into enterprise environments, especially where password reuse exists. Personal identity and social platforms YouTube, Facebook, and similar social media platforms also made high-volume appearances. These services often contain real names, photos, and social connections, making it easier to validate the identity of a compromised user and link them to other accounts. This correlation makes targeted exploitation far easier. Sensitive and high-risk services The dataset also included credentials and cookies associated with sensitive services, including government and tax-related domains such as the IRS and the Canada Revenue Agency, as well as adult content platforms. Access to these services introduces risks beyond traditional account takeover. In previous incidents, threat actors have used data from adult platforms as leverage for extortion and blackmail. When that activity can be linked back to an individual’s real identity and employer, the potential impact escalates quickly. Security-aware yet still exposed Domains such as Shodan and even mil.gov appeared within the dataset, reinforcing an uncomfortable reality: technical awareness does not equal immunity. Secure practices followed in corporate environments do not always extend to personal systems, yet exposure on those systems can still create enterprise risk. Why infostealers remain so effective Infostealer exposure isn’t driven by a single failure, but by a combination of common behaviors repeated at scale. Users install applications from illicit sources, reuse passwords across personal and corporate accounts, and rely on browser-based credential storage for convenience. Browser-stored credentials and payment data are especially valuable to attackers. When an infostealer compromises a system, these stores provide attackers with immediate access to high-value information, significantly increasing the impact of a single infection. Reducing impact after credential theft Once infostealer data has been collected and circulated, prevention is no longer the only challenge. The real question is how quickly defenders can neutralize it before it’s reused for lateral movement, account takeover, or ransomware deployment. Because infostealer dumps often circulate for weeks or months before detection, effective mitigation must assume that some credentials are already exposed. Password reuse remains one of the most reliable ways attackers operationalize infostealer data. Credentials harvested from personal devices are routinely tested against corporate environments, cloud services, and remote access systems, often with success even when those passwords meet standard complexity requirements. Disrupting reuse directly reduces the operational value of infostealer datasets and shortens their window of exploitation. Combined with stronger password policies that support longer passphrases and continuous enforcement, these controls shift password security from a static configuration exercise to an active containment measure. Identity exposure increasingly begins outside the corporate perimeter, so reducing the reuse and downstream impact of stolen credentials remains one of the most effective ways to break infostealer-driven attack chains. To see how Specops Password Policy helps block compromised passwords and reduce credential reuse in Active Directory, request a live demo from a Specops expert. Sponsored and written by Specops Software.

BloodHound Scentry helps organizations reduce identity risk and close attack paths SpecterOps has announced BloodHound Scentry, a new service designed to help customers accelerate their APM practice and reduce identity risk. BloodHound Scentry combines the power of BloodHound Enterprise with SpecterOps tradecraft experts and practitioners to provide customers with tailored guidance for attack path remediation, advanced analysis for emerging threats, and privilege zone design to protect critical assets. The 2024 Verizon Data Breach Investigations Report found that around 80% of breaches involve compromised identity credentials, highlighting that many incidents begin with valid logins rather than novel malware or zero‑day exploits. Reflecting this shift, a 2025 SpecterOps survey of cybersecurity decision-makers found that 59% of organizations are actively researching or have already implemented an identity‑based attack path management solution. “The risks associated with identity security continue to grow with each new provider and technology adopted, creating unseen critical risk that can only be resolved through identity APM efforts,” said Robby Winchester, Chief Services Officer at SpecterOps. With BloodHound Scentry, organizations with little or no identity Attack Path Management can build and scale their practice from Level 0 (nonexistent) to Level 3 (well-defined) maturity or higher in as little as six months, strengthening security posture and reducing risk. Attack path remediation: Every environment has unique requirements, constraints, and tech debt. Scentry experts assess your environment, identify priority actions and high‑value targets, and deliver tailored remediation guidance specific to your identity model. Expert analysis: Scentry experts provide monthly analysis of attack paths and trends, share clear findings and recommended actions, and investigate emerging threats where your environment or industry faces elevated risk. Privilege zone design: BloodHound Enterprise lets you create privilege zones around your most critical assets. Scentry experts identify and prioritize those assets, configure effective privilege zones, and track ongoing governance and certification. BloodHound OpenGraph support: BloodHound OpenGraph expands attack path coverage across any platform, repository, or application. Scentry experts help you design and build OpenGraph extensions that meet your coverage needs, including custom applications. Customized reporting: Scentry tracks the progress of your identity APM practice with tailored reporting, including hygiene reports and quarterly executive packages that connect attack path remediation to broader operational and business outcomes. “Building a successful identity APM practice requires a team of experts who understand how identity attacks unfold, how to prioritize remediations, can quickly react to emerging threats, track the right metrics for success, and more,” said Winchester. “For companies wanting a shortcut to gain identity APM expertise and resources, BloodHound Scentry can accelerate an identity APM program to better identify and protect an organization’s most critical assets.”

SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports. Here are this week’s stories: Former Google engineer convicted over theft of AI trade secrets A federal jury in San Francisco convicted former Google software engineer Linwei Ding, also known as Leon Ding, on seven counts of economic espionage and seven counts of theft of trade secrets. The conviction relates to Ding’s theft of confidential information containing Google’s AI trade secrets for China’s benefit. ESET patches high-severity vulnerabilities ESET has announced patches for two high-severity local privilege escalation vulnerabilities affecting Windows products. One of the flaws, CVE-2025-13176, affects ESET Inspect Connector. The second issue, CVE-2025-13818, impacts the ESET Management Agent. The security firm has found no evidence of in-the-wild exploitation. Record-setting DDoS attack hits 31.4 Tbps Cloudflare’s Q4 2025 DDoS threat report details a massive network-layer attack that peaked at 31.4 Tbps and lasted 35 seconds, marking the largest ever recorded. This incident formed part of a broader surge, with total DDoS attacks rising 121% over the year to 47.1 million. Network-layer threats made up 78% of Q4 incidents, while hyper-volumetric attacks grew 40% from the prior quarter. Jeffrey Epstein’s personal hacker A confidential informant told the FBI in 2017 that Jeffrey Epstein had a personal hacker, according to a redacted document released by the Department of Justice. The informant described the hacker as an Italian citizen who specialized in discovering vulnerabilities in iOS, BlackBerry devices, and Firefox, and who developed and sold zero-day exploits and offensive cyber tools. Some in the cybersecurity community have speculated about the hacker’s identity based on the publicly available details in the document, though the name remains redacted and the FBI has not independently verified the claims. AI agents solve web security challenges in evaluation Researchers from Wiz and Irregular tested leading AI models (Claude Sonnet 4.5, GPT-5, and Gemini 2.5 Pro) on 10 lab-based web security challenges modeled after real-world vulnerabilities. The agents successfully completed 9 out of 10 challenges when given clear, directed objectives, often at low cost, but performance declined in broader, less guided scenarios where agents struggled with prioritization and scope management. AI-assisted attack gains AWS admin privileges in under 10 minutes Sysdig’s Threat Research Team recently observed a cloud intrusion where a threat actor used stolen credentials from public AWS S3 buckets to gain initial access to an AWS environment. The attacker, assisted by LLMs for tasks like reconnaissance, code generation, and decision-making, escalated privileges and achieved administrative access in about 8 minutes. The attacker compromised multiple AWS resources, created backdoor accounts, abused Bedrock models, and attempted to launch GPU instances before access was terminated. Canada Computers data breach Canada Computers & Electronics reported becoming aware of unauthorized access to its retail website system on January 22, 2026. The data breach affected customers who checked out as guests between December 29, 2025, and January 22, 2026, potentially exposing personal information including credit card details. In-store purchases and logged-in member accounts remained unaffected. Senator urges hearing with AT&T and Verizon CEOs over Salt Typhoon breach response On February 3, 2026, Senator Maria Cantwell (D-WA), ranking member of the Senate Commerce, Science, and Transportation Committee, sent a letter to Chairman Ted Cruz requesting a public oversight hearing with the CEOs of AT&T and Verizon. She cited months of unsuccessful efforts to obtain key documentation, including network security assessments from Mandiant, on the companies’ remediation of the Chinese Salt Typhoon attacks. Forescout report highlights surge in OT protocol attacks Forescout released its 2025 Threat Roundup, analyzing over 900 million global cyberattacks observed last year. Key trends include an 84% increase in attacks using OT protocols, greater distribution of attacks across more countries, rising exploitation of cloud services, vulnerable web applications, and emerging AI platforms. The report notes escalated targeting of critical sectors such as healthcare, manufacturing, government, energy, and financial services. Polish police arrest 20-year-old for DDoS attacks Law enforcement in Poland detained a 20-year-old man suspected of launching DDoS attacks that targeted numerous websites worldwide. The suspect faces six criminal charges. During the arrest at his apartment, officers seized computer equipment used to host and distribute the attack tools. The man admitted to most of the allegations before being released on bail. 1.4 million records compromised in Betterment data breach The recent data breach at automated investment platform Betterment resulted in the exposure of approximately 1.4 million unique email addresses along with names and geographic locations for affected accounts. A subset of records also included dates of birth, phone numbers, physical addresses, device information, employers, and job titles. The breach, which did not involve access to customer accounts or login credentials, has been added to Have I Been Pwned.

Veracode’s platform enhancements help prevent software supply chain attacks Veracode announced significant platform innovations introduced through the second half of 2025. Headlining the release is Package Firewall, a preventive control for software supply chains, advancing the company’s mission to help organizations run secure software from code to cloud. With supply chain-related third-party breaches doubling year over year— from 15 to 30 percent according to the Verizon 2025 Data Breach Investigations Report— the need to strengthen security across the software ecosystem has never been greater. “The growing attack surface has created an unprecedented level of complexity for security and development teams,” said Tim Jarrett, VP of Product at Veracode. “The latest enhancements to our platform empower organizations to stop third-party risk from ever entering their software code, providing them with a prevention-first approach.” Package Firewall enhancement: Preventing supply chain attacks at the source Package Firewall, originally launched in June 2025, provides organizations with preventive control over their software supply chains by blocking malicious and risky packages before they enter the development environment. While traditional Software Composition Analysis (SCA) tools identify vulnerabilities in packages that are already in use, Veracode Package Firewall stops threats at the point of ingestion. The solution integrates with Azure Artifacts and deploys in seconds with integrations into package managers and repositories, like NPM, PyPI, Maven, Nexus, and Artifactory. It also supports custom policies that enable organizations to enforce security standards while maintaining developer productivity. Organizations can configure policies based on package risk profiles, vulnerability thresholds, and specific security requirements. Expanded platform capabilities and developer experience Veracode continued to expand and enhance its platform capabilities and developer experience throughout the year, with each release improving detection accuracy. Dynamic Application Security Testing (DAST) Essentials gained manual application linking, enabling policy evaluation and consolidated reporting. Software Composition Analysis (SCA) was upgraded with intelligent policies that only fail builds when fixes are available for vulnerable components, reducing developer friction. Static Analysis support was added for frameworks, including .NET Semantic Kernel, Python frameworks like AWS Glue and FastAPI, Java JDK 25 (LTS), and Node.js 22.x. The platform also saw significant updates to developer integrations for Visual Studio, JetBrains, Azure DevOps, and GitHub, alongside expansions to Veracode Security Labs, with training modules in container security content and the latest OWASP Top 10. Enterprise-grade authentication for developer tools The most recent platform update saw Veracode introduce the advanced enterprise-grade security required by organizations. The company added more thorough platform integration and deeper role-based access control to Veracode Risk Manager (VRM), and OAuth-based single sign-on (SSO) authentication across its entire Integrated Development Environment (IDE) plugin portfolio, including Visual Studio Code, Visual Studio, Eclipse, and JetBrains platforms. The integration eliminates Application Programming Interface (API) key management and delivers secure, enterprise-grade authentication with centralized access control. Jarrett closed, “Our mission is to empower organizations to enhance their security posture, bridge critical skills gaps, and accelerate remediation, all within a unified, integrated platform. By listening closely to our customers, we continuously evolved Veracode’s platform in 2025 to meet their needs, enabling them to drive faster, more secure DevSecOps practices.”

Back when everyone worked in the office, password resets were annoying but manageable. If someone forgot their credentials, they walked down the hall to IT and got back to work within minutes. The interaction was quick, the fix was immediate, and life went on. But hybrid work changed that. Now, when employees can't access their accounts, they're sitting at home or in a coffee shop, unable to work until IT gets around to their ticket. The helpdesk can't just walk over to troubleshoot; they're fielding calls from people scattered across cities, time zones, and home networks with varying levels of connectivity. What used to be a minor interruption has become a productivity drain that costs organizations far more than most realize. How hybrid work increased Active Directory Password Reset Issues The shift to distributed work isn't a temporary trend waiting to reverse itself. Since 2022, work location patterns have remained remarkably stable. Today, 51% of remote-capable US employees work in a hybrid model, with hybrid workers spending an average of 2.3 days per week in the office. This is the new normal, and the operational challenges that came with this shift caught many IT teams off guard. Password resets, which Gartner found already accounted for 40% of helpdesk calls, have gotten worse in distributed work environments. The reason isn't that people suddenly became more forgetful. It's that the technical landscape has changed. Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches. Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles! Cached credentials and remote connectivity drive account lockouts Remote employees experience more lockouts because credentials cached on their laptops become outdated when they aren’t consistently connected to the corporate network. For example, an employee may change their password while connected via a virtual private network (VPN), then try to log in the next morning using cached credentials on their local machine. The result is a lockout that requires a helpdesk call. Employees working across multiple locations and devices are also more likely to forget which password goes with which account, especially when they aren’t in their usual work environment with familiar login routines. Security policies increase password reset frequency for remote users Security concerns have also forced IT teams to mandate more frequent password changes for remote access. Nearly half of CISOs cite hybrid and remote employees as a top security risk, and many respond by increasing password rotation requirements. But every mandatory change creates another opportunity for someone to forget their new credentials or fail to update them across all their devices. The real cost of password resets for IT helpdesks Forrester estimates that each password reset costs $70 in IT time and resources. And for organizations still handling these manually, that adds up fast. Recent data from over 700 organizations using Specops’ self-service password reset tools shows the average company processes 923 password resets per year. At $70 each, that's roughly $65,000 in annual reset costs. But the help desk cost is only the visible part of the problem. The hidden expenses fall on employees who can't work while they wait for IT to respond. Consider what happens when someone gets locked out at 9AM on a Tuesday: they submit a ticket and wait. If they’re lucky, IT might respond in 20 minutes. Or if the helpdesk is backed up, it may take two hours. During that time, the employee can’t attend meetings, can’t access files, and may be holding up colleagues who need their input. That lost productivity doesn't show up on any IT budget report, but it's real money walking out the door. The math gets worse when you factor in employees who constantly reset their passwords. Specops’ analysis of password reset data found ten individuals responsible for 5,703 resets in a single year. These outliers, who either face chronic technical issues or have developed terrible password habits, can each cost an organization thousands of dollars annually if every reset goes through the helpdesk. Even though no study has quantified the exact increase in resets per remote worker, we see hybrid work stabilizing as the dominant model, CISOs identifying remote workers as security risks, and IT teams reporting being "bombarded" with VPN and password-related tickets. The pattern suggests the connection. Why self-service password reset is essential for hybrid Active Directory environments The solution isn't building a time machine to go back to 2019; hybrid work isn't going away, and neither are the technical challenges that come with it. The fix is removing the helpdesk from the equation for routine password issues. Self-service password reset tools let employees securely reset their own credentials and unlock their accounts without waiting for IT intervention. The technology verifies identity through methods like SMS codes, authenticator apps, or security questions. Once verified, users can create a new password that immediately syncs across their devices, including updating cached credentials on local machines. For hybrid organizations, this eliminates the biggest frustration: employees getting locked out while working remotely and losing hours of productivity waiting for help. It also frees helpdesk staff to focus on problems that actually require their expertise rather than spending time on password resets. The organizations that have deployed these solutions see measurable results. Data shows companies save an average of $65,000 annually on resets alone, plus another $48,000 on account unlocks. More importantly, employees return to work in minutes rather than hours. What to look for in a self-service Active Directory password reset tool Not every self-service solution handles the hybrid work challenge equally well. Look for tools that specifically address cached credential updates for remote users and integrate with your existing Active Directory infrastructure. A solution like Specops uReset is designed for this exact problem, allowing secure self-service while ensuring password changes propagate properly across all devices, whether employees are on the corporate network or working from anywhere. The explosion in password reset incidents isn't slowing down. The question is whether your organization will keep treating it as an inevitable cost of hybrid work or start treating it as a solvable problem. Sponsored and written by Specops Software.

Verizon has begun sending text messages with instructions on how to redeem a $20 account credit for last week's nationwide wireless outage. The message states that the $20 credit is intended to cover multiple days of service and apologizes for the outage. "Valued Verizon Customer - We let you down this week. For that we are truly sorry. We would like to extend you a $20 account credit that can be easily redeemed via the link below," reads the Verizon text message. "On average, this covers multiple days of service. This credit isn't meant to make up for what happened. But it's a way of acknowledging your time and showing that this matters to us." The text message also tells customers who are still experiencing connectivity issues to restart their devices and includes a link to access the credit. To apply the credit, customers must complete the following steps: Log in to their Verizon.com account. Click the "Take action" button under "Mobile", which should display a red notification indicator. Click the "Redeem Now" button to apply the credit to your account. Verizon is issuing one $20 credit per account, regardless of the number of lines associated with the account. Customers say the text message is being sent only to the primary account holder's phone number. The outage occurred on January 14, when Verizon customers across the United States reported loss of cellular service around 12 PM ET. Many of the affected users had their phones stuck in SOS mode for the duration of the outage, preventing normal voice calls and data access. Verizon acknowledged the incident and said engineers were working to identify and resolve the issue. At 10:20 PM ET that night, the company confirmed the outage had been resolved and advised customers to restart their devices to reconnect to the network. Verizon previously said the outage was caused by a software issue and stated that there is no indication it was the result of a cybersecurity incident. However, the company has not provided further technical details or explained what systems were affected. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Verizon has confirmed that yesterday's nationwide wireless outage was caused by a software issue, though the company has not shared additional details about what went wrong. "This was a software issue and we are conducting a full review of what happened," Verizon shared in a statement to BleepingComputer. The company also said there is no indication that a cybersecurity incident caused the outage. The outage began around 12 PM ET on January 14, when Verizon customers across the United States started reporting a loss of cellular service. Many affected users reported that their phones were stuck in SOS mode, preventing them from making calls. SOS mode should normally allow customers to call 911. However, during the outage, New York City Emergency Management warned that some Verizon Wireless customers may be unable to reach 911 and advised residents to use another carrier or landline. According to customer reports and outage site DownDetector, the disruption was not limited to a specific region or state and impacted users nationwide. While not all Verizon customers were affected, attempts to call affected numbers returned a message stating that the "called party is temporarily unavailable." During the incident, Verizon confirmed the service disruption in posts on X, stating that engineers were working to identify and resolve the issue. At 10:20 PM ET, the company announced that the outage had been resolved and advised customers to restart their devices to reconnect to the network. Today, Verizon apologized to customers and announced it would provide a $20 account credit to those impacted. The credit will be available in the myVerizon app, and customers will receive a text message when it is available. "This credit isn't meant to make up for what happened. No credit really can," Verizon said. "But it's a way of acknowledging your time and showing that this matters to us." Verizon has not provided any further information about the software issue, including what systems were involved. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Updates added to the end of the article. Verizon Wireless is suffering a massive outage in the US, with customers reporting their phones stuck in SOS mode with no cellular service. "We are aware of an issue impacting wireless voice and data services for some customers. Our engineers are engaged and are working to identify and solve the issue quickly. We understand how important reliable connectivity is and apologize for the inconvenience," Verizon confirmed on X. "Verizon engineering teams are continuing to address today's service interruptions. Our teams remain fully deployed and are focused on the issue. We understand the impact this has on your day and remain committed to resolving this as quickly as possible," shared a later post. According to DownDetector, customers began reporting the outage around 12 PM ET today, and service remains disrupted for those affected. Verizon customers affected by the outage will see a SOS symbol on their phones, indicating that only emergency calls can be made. From customer reports, the outage is impacting people throughout the US and is not set to a particular region or state. While the outage is not affecting all customers, attempting to call a phone number impacted by the Verizon outage will result in a recording stating that the "called party is temporarily unavailable." Cybersecurity researcher vxdb noted that others mobile carriers, such as AT&T, T-Mobile, and US Cellular, are also showing outages during the same timeframes. BleepingComputer also contacted Verizon about the outage and will update the story if we receive a response. Update 1/14/26 03:19 PM ET: T-Mobile told BleepingComputer that they are not impacted by an outage and their network is operating normally. "T-Mobile’s network is keeping our customers connected, and we’ve confirmed that our network is operating normally and as expected. However, due to Verizon’s reported outage, our customers may not be able to reach someone with Verizon service at this time," T-Mobile told BleepingComputer. Update 1/14:26 10:45 PM ET: At 10:20 PM ET, the Verizon X account posted that the outage has been resolved, advising customers to restart their devices to reconnect to the network. "The outage has been resolved. If customers are still having an issue, we encourage them to restart their devices to reconnect to the network," explains Verizon. "For those affected, we will provide account credits. Details will be shared directly with customers. We sincerely apologize for the disruption." At this time, it is still unclear what caused the outage and Verizon has not shared any details with customers. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

For the latest discoveries in cyber research for the week of 24th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The notorious “Scattered LAPSUS$ Hunters” group claimed responsibility for a supply-chain attack involving the Salesforce-integrated platform Gainsight. The group stated that data from 300 organizations was compromised, including Verizon, GitLab and Atlassian. Salesforce has confirmed unusual activity related to Gainsight integrations and has revoked all active access tokens as a precaution, emphasizing there is no vulnerability in the Salesforce’s core platform. Eurofiber France SAS, the French unit of Dutch telecommunications provider Eurofiber Group N.V., has been a victim of a data breach. The attack resulted in an unauthorized access to its French ticket management system and exfiltration of customer information from its cloud division and regional sub-brands. A threat actor “ByteToBreach” claimed responsibility for the attack. Italian IT provider Almaviva has confirmed a cyberattack, with stolen data including information from Ferrovie dello Stato Italiane, Italy’s national railway operator. Nearly 2.3 TB of sensitive files were leaked, including passenger passport data, employee records across FS subsidiaries, defense-related contracts, and financial documents. Almaviva says critical services remain operational. South Korean giant battery maker LG Energy Solution has experienced a ransomware attack at a single overseas facility, which the company says has been restored, with headquarters unaffected. The Akira gang claimed to have stolen 1.7 terabytes of data. Check Point Threat Emulation and Harmony Endpoint provide protection against this threat (Ransomware.Wins.Akira.ta.*; Ransomware.Wins.Akira; Trojan.Win.Akira) Microsoft’s Azure cloud was hit by a massive 15.72 Tbps distributed denial-of-service (DDoS) attack (3.64 billion packets per second) against a public IP address in Australia, sourced from over 500,000 IPs. The high-rate UDP flood is attributed to the Aisuru Turbo Mirai-class IoT botnet, which abuses compromised home routers, cameras, and other internet-connected devices. Check Point Threat Emulation and Harmony Endpoint provide protection against this threat (Trojan.Wins.Mirai) French social security service provider, Pajemploi, has suffered a data breach that resulted in the theft of personal data linked to up to 1.2 million of private employers using its childcare services. Exposed information reportedly includes full names, places of birth, postal addresses, Social Security numbers, Pajemploi and accreditation numbers, and banking institution names. AIPAC, a US political advocacy organization, has encountered a data breach tied to an external third-party system, with notification filed to the Maine attorney general on November 14th. Unauthorized access occurred between October 2024 and February 2025, impacting 810 individuals and exposing personal identifiers. No threat actor claimed responsibility. VULNERABILITIES AND PATCHES Fortinet warned of CVE-2025-58034, a FortiWeb command injection flaw actively exploited in the wild. The bug lets authenticated attackers run unauthorized code via crafted requests, with updates available for multiple 7.x and 8.x releases. Check Point IPS provides protection against this threat (Fortinet FortiWeb Command Injection (CVE-2025-58034)) Google fixed CVE-2025-13223, a high-severity type confusion flaw in Chrome’s V8 engine. The bug is being actively exploited to run malicious code via crafted web pages. Google has issued fixes in Chrome 142.0.7444.175 and later. Researchers warns of active exploitation and a public proof of concept of CVE-2025-11001, a 7-Zip Windows vulnerability that lets attackers run code by abusing ZIP symbolic link handling. The flaw carries a CVSS 7.0 score and was fixed in 7-Zip version 25.00. THREAT INTELLIGENCE REPORTS Check Point Research uncovered a surge in fraudulent Black Friday domains and brand impersonation. Roughly 1 in 11 new Black Friday domains are malicious, and 1 in 25 domains referencing Amazon, AliExpress, or Alibaba pose active threats, with fake storefronts stealing credentials and payment data. Recent examples also mimic HOKA and AliExpress. Check Point researchers detailed a Europe-wide scam in which criminal networks use generative AI to impersonate health regulators and sell fake GLP-1 weight-loss products. The criminals clone logos and endorsements from the official health services, then localize persuasive ads to exploit drug shortages and public trust. Akamai discovered a RAT that disguises its C2 traffic as LLM chat completions API requests, sending Base64- and XOR-encoded payloads without standard headers. The malware steals data from remote access tools and browsers and deploys a .NET proxy toolkit with persistence. Researchers analyzed a Howling Scorpius campaign that used fake CAPTCHA prompts to install SectopRAT on a global data storage and infrastructure company, enabling remote control and lateral movement. Over 42 days, the attackers stole nearly 1 TB of data, deleted cloud backups, and deployed Akira ransomware across three networks, halting operations. Google analyzed a nearly three-year APT24 cyber-espionage campaign centered on the BadAudio C++ downloader, which uses AES-encrypted C2 traffic, cookie-embedded host profiling, and control-flow flattening to deploy payloads such as Cobalt Strike Beacon in memory. The research details how APT24 shifted from strategic web compromises to large-scale supply-chain and spear-phishing operations that weaponize FingerprintJS-based browser fingerprinting, DLL search-order hijacking, and repeatedly re-compromised Taiwanese marketing infrastructure to deliver BADAUDIO across more than 1,000 domains.

Kerberoasting attacks remain an enduring headache for IT professionals, allowing hackers to escalate privileges and reach the highest levels of your Active Directory (AD) environment. But by enforcing robust passwords, encryption, and cybersecurity policies, you can disrupt the criminals before they even begin. The term Kerberoasting refers to ‘Kerberos’, the authentication protocol that Microsoft’s AD uses to verify the identity of computers or users requesting access to specific resources. The attack’s power lies in its escalatory nature. A cybercriminal can begin by exploiting any standard Windows user account in AD, accessed through the usual roster of criminal techniques: malware, phishing, etc. However, the attacker’s real goal is to target ‘service accounts’, identifiable by their Service Principal Name (SPN). These are the types of accounts that run Windows services and aren’t typically used by regular users. Service accounts are attractive for hackers because they often contain high-level permissions across services, and in some cases, even domain administrator access. How Kerberoasting works in Active Directory So how does an attacker jump from a normal user account to a service account? The danger lies in the system’s ticket-granting mechanism within Kerberos. The Kerberos protocol conveys user authentication state in a message called a ‘service ticket’. Any user with an AD account can request tickets to any service account in AD from the ticket-granting service (TGS). This means that, using the normal user account under their control, an attacker can request a service ticket tied to an SPN. Hackers can identify such accounts quite easily by using free, open-source tools like SecureAuth Corporation’s GetUserSPNs.py or Ghost Pack’s Rubeus. These tools can also automatically request a valid ticket associated with these service accounts. Each ticket is encrypted with the hash of the target account’s password: the password tied to the SPN. The attacker takes the ticket offline and uses brute force techniques to crack the password hash at their leisure, enabling them to take over the service account and all its associated access, with the ability to scale from there. Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches. Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles! Password priorities for stronger security None of this would be possible if accounts were properly protected: even if the hacker got their hands on a ticket and took it offline, the highest levels of encryption and password complexity would frustrate their efforts to crack the ticket hash. An obvious first step, then, is to audit the passwords you use, ensuring they’re fit for purpose in a world of Kerberoasting. Tools like Specops Password Auditor can play a key role here, scanning your AD for password-related vulnerabilities. This works on three key levels: Audit AD accounts: Check user accounts against 1 billion vulnerable passwords, scan for weak passwords that could be targeted by attackers and audit your domain for stale or inactive privileged accounts. Analyze risk with password reports: Ensure that your policies drive users to create secure passwords. Identify accounts with expired, identical or blank passwords, and measure the effectiveness of your policies against brute force attacks. Align password policies with compliance standards: Benchmark your password policies against the best standards and check you comply with cybersecurity and privacy regulations. Why Kerberoasting is hard to detect We’ve seen how simple it is for clever criminals to escalate their privileges by exploiting the architecture of AD. But there’s another problem: Kerberoasting can be hard to detect even when it’s underway. First, the hackers’ efforts to crack the ticket occur offline, making them undetectable. But it gets worse: these attacks don’t need malware to operate, so they can’t be detected by traditional solutions like antivirus tools. And because the attacker begins by taking control of a legitimate account, they can avoid cybersecurity detection solutions, because these usually aren’t designed to monitor the behavior of approved users. So, what can be done to defend your accounts against Kerberoasting? There are lots of options to reduce risk, but here are some key priorities. Audit all domain account passwords regularly As we’ve seen, passwords are the weakest links. Each SPN-enabled account should be protected with non-reusable, random, and lengthy passwords of at least 25 characters. You should also ensure that these passwords are rotated regularly. Use Group Managed Service Accounts (gMSAs) This is a type of AD account that enables multiple services or servers to use the same account, providing simplified SPN handling and automatic password management. As Microsoft notes, passwords for gMSAs are “120 characters long, complex, and randomly generated, making them highly resistant to brute force cyberattacks using currently known methods”. Opt for AES encryption Not all service accounts are equal in their potential risk to hackers. The weakest targets are those that use flimsy encryption algorithms, with RC4 a particular concern. Accounts using AES encryption are far harder for criminals to crack. Next steps to protect service accounts Kerberoasting is a significant threat, but the dangers can be addressed. The first step is to conduct an audit of all user accounts with SPNs. If you find that some accounts don’t need SPNs, simply remove them. If you want to run a read-only scan of your Active Directory today, download our free auditing tool: Specops Password Auditor. At a wider level, enforce robust password policies and cybersecurity hygiene across your organization. Remember that Kerberoasting begins by attacking a normal user account, so ensure everyone uses long, complex passwords that are regularly rotated. Even better, pursue a policy of multi-factor authentication, and ensure employees are aware of the dangers from malware and phishing. Cybercriminals exploit easily accessible tools to pursue their attacks. However, technology is also on your side. For instance, Specops Password Policy is designed to continuously block more than 4 billion unique compromised passwords, scanning for these potential problems and discovering breached passwords daily. With such defenses, you can ensure Kerberoasting fails from the outset and protect your vital service accounts from exploitation. Sponsored and written by Specops Software.

Verizon ha rilasciato il Mobile Security Index 2025, il report sulla sicurezza Mobile giunto all’ottava edizione. “Il rapporto 2025 di Verizon evidenzia come l’intreccio tra intelligenza artificiale ed errore umano stia ridefinendo la sicurezza mobile”, commenta Pierluigi Paganini, analista di cyber security e Ceo Cybhorus. Dunque “è fondamentale mantenere il controllo del fattore umano attraverso investimenti ponderati, misurati e raggiungibili”, aggiunge Stefano Gazzella, Dpo e Consulente Privacy & ICT Law. Indice degli argomenti La principale minaccia alla sicurezza delle aziende si trova nel palmo della mano dei loro dipendenti. Secondo il report di Verizon, l’85% delle organizzazioni denuncia un incremento delle minacce a questi dispositivi mobili. “L’uso crescente di strumenti di genAI e la diffusione del Byod”, infatti, conferma Paganini, “ampliano la superficie d’attacco, mentre le difese restano spesso inadeguate”. I timori giungono da un uso superficiale, se non sconsiderato dell’AI generativa. Infatti, il 34% delle organizzazioni teme un aumento rilevante del rischio cyber a causa di intrusioni AI-driven, più sofisticate e su ampio raggio. Invece il 38% punta il dito contro il ransomware che rischia di aumentare la propria pericolosità se alimentato dall’intelligenza artificiale. Appena il 17% delle realtà si avvale di controlli di sicurezza specifici contro gli attacchi via AI. Si tratta di un fattore di fragilità, poiché i cyber criminali stanno usando la GenAI per aumentare il volume e rendere più sofisticate le loro offensive. Dal report emerge che “solo una minoranza di organizzazioni adotta controlli specifici contro deepfake o exploit zero-day“, mette in guardia Paganini: “Sebbene tre aziende su quattro abbiano aumentato la spesa per la sicurezza mobile e la formazione, persistono ampie lacune operative, soprattutto tra le Pmi”. Quasi tutte le organizzazioni (93%) riferiscono che i propri collaboratori sfruttano la GenAI sui dispositivi mobile durante il lavoro quotidiano e il 64% teme la compromissione dei dati – via AI generativa – il principale rischio per questi device. Fra le imprese che hanno sperimentato test di smishing sui propri dipendenti (l’80% del totale), il 39% ha scoperto che la metà del personale ha abboccato al link malevolo. L’intreccio fra comportamento umano, soluzioni mobile e attacchi basati sull’AI è dunque il nuovo epicentro del terremoto cyber per le organizzazioni. “Stiamo assistendo a un vero e proprio uragano di categoria 5 nella protezione dei device mobili, dove l’AI è il vento e l’errore umano la finestra aperta – ha affermato in una nota Chris Novak, VP Global Cybersecurity Solutions di Verizon Business. La rapida adozione della GenAI è un punto di svolta; le aziende di ogni dimensione, devono ripensare le strategie di protezione contro gli attacchi assistiti dall’intelligenza artificiale e aiutare i professionisti a utilizzare la tecnologia in modo responsabile”. Le aziende sono impegnate a risolvere le vulnerabilità di sicurezza. Il 75% delle organizzazione ha alzato gli investimenti per la sicurezza mobile negli ultimi dodici mesi. Tuttavia, l’impiego crescente della GenAI in ambito professionale da parte degli utenti sta espandendo il perimetro d’attacco. “Investire per investire non è una soluzione. Occorre un approccio strategico a riguardo, con sinergia delle funzioni coinvolte nella data maturity dell’organizzazione”, conferma Stefano Gazzella: “Questo richiede un impegno costante di comunicazione interna, ma anche di convergenza dei modelli di compliance, altrimenti il rischio è non soltanto quello di un punto cieco ma di una vera e propria allucinazione di sicurezza. L’eccesso di confidenza, così come sottostimare ogni rischio o altrimenti sovrastimarlo eccessivamente, sono i fattori che comportano un fallimento critico e sistematico pressoché in ogni scenario di sicurezza cyber”. Per mitigare il rischio, occorre inoltre disporre di controlli di sicurezza specifici contro gli attacchi supportati dall’AI. “Concordo con il punto di vista espresso nel rapporto (Mobile Security Index 2025, ndr)”, conclude Paganini, “che evidenzia come la resilienza non dipenda solo dagli investimenti, ma da strategie integrate di MDM, formazione continua e governance dei dati capaci di anticipare l’evoluzione delle minacce”.

Un gruppo di criminal hacker di uno Stato non identificato ha violato Ribbon Communications, una delle principali aziende statunitensi di telecomunicazioni. L’attacco risale allo scorso anno ma i criminali sono rimasti nei sistemi della società per quasi un anno, senza essere scoperti, almeno sino a questa settimana. Ribbon Communications, azienda del Texas, ha subìto un attacco cyber da parte di un gruppo di hacker criminali. Secondo Reuters i responsabili sarebbero affiliati ad uno Stato ancora non identificato, mentre gli stessi avrebbero operato all’interno dei sistemi dell’azienda per circa un anno. Non è ancora chiara la mole dei danni, né quali quali dati abbiano eventualmente esfiltrato. Nella misura in cui l’azienda statunitense sia una delle più importanti nei servizi delle telecomunicazioni, si evidenzia una vulnerabilità sistemica nel settore. La tecnologia di Ribbon, in effetti, facilita le comunicazioni vocali e dei dati in tempo reale, migliorando la funzionalità delle teleconferenze telematiche. La stessa Ribbon Communications ha comunicato che soggetti “presumibilmente associati a un attore statale” hanno ottenuto l’accesso alla rete IT della società. L’accesso iniziale risalirebbe all’inizio di dicembre 2024. Di protezione delle infrastrutture digitali critiche si parlerà nel corso della 2^ edizione di Space & Underwater, la conferenza internazionale organizzata e promossa da Cybersecurity Italia il prossimo 3 dicembre, che si terrà presso la Caserma “Salvo d’Acquisto” a Roma. Il fulcro della vulnerabilità di Ribbon L’aspetto principale della vicenda è stata proprio la durata dell’attacco hacker criminale, senza segnalazioni per molti mesi. Per altro, operazioni simili in cui si prendono di mira aziende del comparto, sono ormai all’ordine del giorno. Ribbon non ha identificato l’autore dell’attacco né ha rivelato quali dei suoi clienti siano stati colpiti dalla violazione. Tuttavia, ha spiegato a Reuters che le indagini condotte finora hanno rivelato il coinvolgimento di tre “clienti minori”. Un portavoce di Ribbon in una e-mail ha dichiarato: “Al momento non disponiamo di prove che indichino che l’autore della minaccia abbia avuto accesso a informazioni rilevanti. Ciononostante, continuiamo a collaborare con i nostri esperti esterni per confermarlo. Abbiamo anche adottato misure per rafforzare ulteriormente la nostra rete al fine di prevenire eventuali incidenti futuri”. I possibili sospetti Ad oggi non ci sono prove che l’incidente possa consentire agli hacker criminali di accedere ai sistemi dei clienti. Inoltre, l’azienda non è a conoscenza che ci sia stato il coinvolgimento di alcun cliente governativo. La tecnologia di Ribbon potrebbe costituire un importante riferimento per operazioni di hacking di Stato. Secondo alcuni esperti, dietro l’attacco all’azienda del Texas ci sarebbe stata la Cina. Come ha scritto Reuters, “gli hacker legati alla Cina avevano già preso di mira una serie di aziende di telecomunicazioni statunitensi e globali“. Avevano anche attaccato “la rete della Guardia Nazionale dell’esercito di uno Stato americano in una campagna di spionaggio informatico di ampio respiro e durata pluriennale, denominata Salt Typhoon“. La rivelazione di quest’ultima è avvenuta per la prima volta nel settembre 2024. C’è un precedente? Sempre a proposito delle possibili accuse contro Pechino, lo scorso anno il gruppo affiliato al Governo cinese Salt Typhoon ha agito in diverse occasioni contro aziende di Washington. Su tutte, gli attacchi contro AT&T, Verizon e Lumen Technologies di cui Salt Typhoon è stato ritenuto responsabile. Secondo diversi analisti, quella serie di attacchi ha costituito il peggior attacco hacker criminale contro le telecomunicazioni nella storia degli Usa. Lo studio dell’FBI Nel suo annuale 2024 Internet Crime Report dello scorso aprile, l’Internet Crime Complaint Center (IC3) dell’FBI ha analizzato i crimini informatici negli Usa. Lo studio, per il 2024, ha combinato le informazioni provenienti da 859.532 denunce di presunti illeciti cibernetici, riportando perdite per oltre 16 miliardi di dollari, con un aumento del 33% rispetto al 2023. I primi tre reati informatici, in base al numero di denunce del 2024, sono stati: il phishing/spoofing. L’estorsione. La violazione dei dati personali. Le vittime di frodi finanziarie, in particolare quelle che coinvolgono le criptovalute, hanno segnalato le perdite maggiori, per un totale di oltre 6,5 miliardi di dollari. Sempre secondo il rapporto del 2024, la maggior parte delle denunce è arrivata dalla California, dal Texas e dalla Florida. Come gruppo, le persone di età superiore ai 60 anni hanno subito le perdite maggiori, pari a quasi 5 miliardi di dollari e hanno presentato il maggior numero di denunce. Per approfondire Consulta il 2024 Internet Crime Report in PDF.