By Oliver Spence, CEO, CybaVerse

According to a recent report from insurance firm Hiscox, 38 percent of UK organisations have a suffered cyber attack in the last year.

The figure is not hugely surprising. Cyber crime is widely recognised as the number one threat to business today. However, what is concerning is that the rate of attacks is surging even despite organisations increasing their spending on defences.

According to the same study, firms are spending significant money to ward off the threat of hacks, with the average UK firm spending £44,294 on resilience measures.

This raises an important question, why when organisations are boosting their investments in cyber defences are business crippling attacks continuing to surge?

The UK’s outsourced security market

UK organisations spend heavily on outsourced cyber security.

Government analysis recently revealed that the cyber services market, which includes MSSPs, is now worth approximately £8.4 billion annually.

The figure highlights that many organisations in the UK are outsourcing their security, ensuring it is managed by experts.

This is also not surprising.

Cyber security is a full-time, 24/7 position and most organisations don’t have the resources to manage it internally.

However, even despite this migration to managed services, it doesn’t explain why operationally impacting attacks continue to increase?

Could it highlight that traditional managed security models are often too focused on identifying threats, rather than helping organisations actually remove the weaknesses that allow threats to succeed?

Managed Detection and Response

One of the most common activities for organisations to outsource is their security operations.

Organisations will rely on experts to monitor their digital assets for malicious activity, ensuring incidents are stopped and contained before they escalate into full scale attacks.

However, one of the key issues with Managed Detection and Response is that it only focuses on containment, not remediation.

Security analysts will continually triage alerts coming into the SOC, investigating them to identify malicious activity. If malicious activity occurs, they will then work to understand the incident, investigate it and contain it.

However, this model only contains the incident, it doesn’t remediate the cause behind it.

Take the exploitation of an unpatched vulnerability. A SOC may detect the malicious activity, isolate the affected device, remove malicious files and restore the environment to its previous state.

The incident has been contained, but has the problem actually been remediated? Not if the vulnerability remains unpatched.

The same applies if an attacker gained access because of a misconfiguration, weak Microsoft 365 control or another security gap. Restoring the environment to the state it was in before the attack simply restores the weakness too.

This is where we need to make a much clearer distinction between containment and remediation.

Containment stops the immediate threat. Remediation addresses the weakness that allowed it to happen in the first place.

Without the final step, organisations risk operating in permanent firefighting mode. The flames are extinguished, but nobody is addressing what keeps starting the fires.

Introducing MDR+R

When organisations are selecting an MDR provider, they first must understand the genuine improvements to security being offered.

Simply acting on incidents is not enough. The partner must also make tangible improvements to the overall security of the business.

One of the best ways to achieve this is by partnering with providers that don’t just respond to threats, but also take actions to remediate the root cause of incidents.

These providers don’t simply triage alerts and contain incidents, they work to understand how an attack happened and then provide support to organisations to remediate the issue at its very root.

The overall goal is to close the loop on incidents, not leave them open to be exploited again.

The three-year test

This brings us to a question every organisation outsourcing its security should ask.

If you have been working with a SOC provider for three years, are you more secure today than you were when the relationship started?

Your attack surface may have expanded. Threat activity may have increased. Attackers may have become more sophisticated. These factors obviously won’t be within your SOC provider’s control, but there should still be tangible evidence that security is improving.

Known weaknesses should be getting closed. Previously identified attack paths should be disappearing. Misconfigurations should be addressed. Vulnerabilities should be remediated. The number of exploitable gaps sitting within the environment should be reducing.

If, after three years, and significant investment, the same security gaps remain open, organisations have every right to ask what they are paying for.

Containment keeps an organisation running. Remediation makes it more secure.

Organisations must demand both.

The post Closing the loop: Why an effective SOC focuses on remediation, not just containment appeared first on IT Security Guru.

By Marc de Beaucorps, Co-founder and CEO of Finovox

The UK’s rollout of new digital IDs is being pitched as a straightforward upgrade involving safer age checks, smoother access, and fewer fakes. But from a fraud perspective, “simpler” can be a dangerous word. Identity fraud rarely disappears; it mutates. And when you digitize identity, you don’t just change the interface. You change the attack surface.

Across England and Wales, pubs, bars and retailers have now been given the green light to accept digital IDs for age verification. The hope for this system is that if verification becomes faster, more consistent and more tamper-resistant, then the traditional fake ID, printed, photoshopped, or passed off with a bit of confidence, may finally be tossed aside. Yet there’s a very real chance that thanks to AI, this new system won’t fix these problems at all. It’ll simply change the way fraudsters operate.

Latest research from fraud-detection specialist Finovox suggests the challenge is already evolving. Eleven per cent of Britons admit to having committed document fraud at least once, and 67% point to AI as a key factor making document fraud easier. Add to that the increasingly accessible tools people can use to manufacture convincing paperwork in minutes rather than days, and you start to see the problem. When fraud becomes more automated, scalability stops being a barrier for criminals, and it starts becoming a burden for businesses trying to keep up.

What’s more, the statistics around success tell you a lot about the current reality. Eighty-two per cent of those who committed document fraud succeeded, and 37% say they’d be willing to do it again. That’s not just alarming; it shows how effective it is. And the most falsified documents- proof of residence, medical documents and driving licenses, aren’t edge cases. They’re everyday essentials that many systems and services rely on.

If digital IDs are introduced without equally strong anti-fraud controls, robust verification standards, and a clear understanding of how AI-enabled manipulation works, then the likely outcome may be fewer fake cards but more digital impersonation.

How AI is changing the threat

Digital ID systems are often sold as a way to streamline verification, but they also need to be built to actively defend against the way fraud is evolving. The real challenge is that artificial intelligence doesn’t just make fraud easier, it makes it more scalable and much harder to spot, because attackers can automate document forgery, create synthetic identities, and even generate deepfake biometrics designed to slip past traditional checks.

With automated tools, criminals can produce hyper-realistic digital identity documents at scale, which can sail through basic onboarding validations if those checks are too shallow. AI can also blend fragments of real personal data with entirely fabricated details, allowing criminals to manufacture believable synthetic personas that look “clean” across standard screening. And when biometric checks are involved, machine learning can generate fake selfie videos and manipulated voices, potentially undermining facial recognition and liveness detection during what should be the most secure moment of verification.

Just as importantly, the attack doesn’t have to stop after opening the account. AI-driven fraud can extend into account recovery takeovers and unauthorized high-value payments, turning a one-time deception into an ongoing crime pipeline. That’s why verifying the authenticity of documents at the very start of the digital identity journey matters more than ever, and the next step is looking at how digital ID systems can fight back against these specific AI-enabled threats.

How Digital ID Systems Fight Back

Digital ID systems can fight back, but they have to do more than ask for proof; they must actively assess whether that proof is believable. One of the most effective defenses is advanced liveness detection, where AI is used to spot micro-expressions and subtle signs of tampering at the pixel level, making it harder for criminals to bypass checks with synthetic video injection.

That same principle applies to behavioural biometrics, where platforms don’t just look at what a person shows on screen, but how they interact, tracking typing cadence, swipe patterns, and device handling routines to identify unusual behaviour that doesn’t match the expected profile, triggering stepped-up security when risk rises.

Finally, strong systems should use layered adaptive authentication, adjusting the strength of verification in real time based on the risk score of the specific request. In practice, routine actions can move quickly with minimal friction, while sensitive tasks, those most likely to be targeted by fraudsters, demand deeper proof, creating a moving barrier that attackers can’t easily plan around.

Digital ID could be a genuine step forward for age checks and day-to-day access, but from a fraud perspective, the picture is clear. Identity crime doesn’t stand still, and AI will only make it evolve faster. If the UK’s digital rollout focuses mainly on convenience, without stronger verification, liveness assurance, behavioural signals, and layered, risk-based authentication, then the outcome may not be fewer fakes. It may simply be the same fraud, delivered in a more convincing, more scalable, and harder-to-detect form. The real test, then, isn’t whether digital IDs can verify identity, but whether they can reliably defend it when attackers start using AI to impersonate, manipulate and take over.

The post Digital IDs and the AI threat: verification must evolve, not just digitise appeared first on IT Security Guru.

By Alex Laurie, GTM CTO, Ping Identity

Generative AI has made content creation effortless, but establishing where content originates – and whether it can be trusted – remains a critical security challenge. While AI vendors are introducing digital watermarking to improve visibility, provenance and trust are not the same thing. Knowing an image or document was generated by AI reveals its origin, but it tells us nothing about its accuracy, intent, or authorisation.

Watermarking alone is an incomplete defense. Digital watermarks have existed for decades, and bad actors have consistently found ways to strip, alter, or spoof them. As AI safeguards evolve, so will the techniques designed to bypass them. Maintaining digital trust requires adaptable controls rather than static markers.

The limits of watermarking AI content

The fundamental flaw in relying solely on watermarking is treating origin as verification. A watermark cannot confirm that content is accurate, approved, or compliant.

In an enterprise environment, basic cyber hygiene principles must extend to synthetic content. Just as security teams train employees to scrutinise suspicious links and emails, AI outputs must be systematically validated. Where automated tasks involve critical risk, automated execution must escalate to human oversight.

Why clear standards matter in the fight against misinformation

This doesn’t mean watermarking is pointless – it is simply insufficient on its own. AI companies are right to experiment with ways of making AI-generated content more identifiable, but there are measures that can make these approaches more effective.

For example, attaching tamper-evident metadata to AI content effectively provides a record of who or what created it, when and using what system. That origin story automatically improves AI provenance, particularly when combined with clear policies and organisational standards that establish how AI-generated content should be handled and verified.

However, vendor-specific labeling is only a baseline. To build resilient defenses against AI-driven misinformation and deepfakes, organisations must combine content origin signals with continuous identity assurance. This requires enforcing contextual verification, treating synthetic assets and autonomous AI agents as managed identities with explicitly defined boundaries and runtime behavioural monitoring. Crucially, maintaining human-in-the-loop safeguards ensures that human accountability is retained for verifying high-stakes data and authorising sensitive actions.

Why transparency alone won’t be enough

The introduction of watermarking is an important development in how the technology industry is responding to the challenges created by AI-generated misinformation. Some AI companies are already taking the lead, with others likely to follow as they look for practical and responsible ways to give users greater visibility into AI-generated content. However, watermarking should be viewed as one part of a broader approach rather than a definitive solution.

As watermarking techniques become more sophisticated, so too will the methods used to circumvent them. Organisations need to be able to combine information about a piece of content’s origin and creation with other methods for identifying and validating AI-generated content. This will become increasingly important as synthetic content becomes harder to distinguish from material created by people. For example, every time I present my work, I now take the time to let the audience know which parts of my presentation were AI-generated and which parts human-generated. By being so up-front about my use of AI content, I get an improved level of engagement and trust.

The longer-term challenge is establishing the conditions in which people can make informed decisions about what they see and share. This requires clear standards for identifying AI-generated material and safeguards that can adapt as new methods of circumvention emerge.

Ultimately, provenance can provide valuable context, but it should not be treated as proof. Building confidence in AI-generated content will depend on technology working alongside human oversight, with people retaining responsibility for verifying information and deciding whether it can be trusted. As AI becomes more embedded in how content is produced and distributed, that combination of transparency, evolving safeguards and human accountability will be essential to maintaining trust over the long term.

The post The trust gap that AI watermarking can’t close appeared first on IT Security Guru.

By Ansgar Dodt, VP Product Management for Software Monetization at Thales

Not every piece of software is worth attacking.

Traditionally, that has offered software vendors a degree of protection. Reverse engineering takes time, specialist expertise and persistence, forcing attackers to weigh the potential reward against the effort involved. However, AI is beginning to change that trade-off.

Recent AI-powered security incidents, including cases disclosed by OpenAI and Anthropic, suggest this is not a one-off development but part of a wider trend. While much of the cybersecurity debate has focused on how AI is making attacks faster or more sophisticated, the bigger shift for software security may be an economic one. Reducing the time and human effort needed to identify and exploit potential flaws opens up more opportunities.

When attackers can afford to be less selective

Software that would never previously justified days of an expert’s time to reverse engineer may become worth investigating when AI can perform much of the initial work. Attackers no longer need to concentrate their time and resources solely on a handful of obvious, high-value targets when they can now seek a wider range of choices.

AI agents can increasingly interact with decompilers, debuggers and other security tools, interpret unfamiliar code and test different approaches. If one avenue proves unsuccessful, another can be explored with less continuous human involvement.

This doesn’t mean specialist expertise becomes irrelevant, or that an AI agent can instantly compromise any application. But it does allow attackers to investigate more potential targets with the same resources, making software they might previously have ignored worth a closer look.

When software leaves your control

Once software leaves a vendor’s environment, attackers have more opportunity to analyse it. Cloud-native applications can largely remain within environments controlled by their providers, but desktop applications, on-premise deployments, industrial equipment, connected devices and edge software create a different problem: executable code is placed directly into an environment the developer may no longer control.

From the moment someone obtains that binary, time is on their side. It can be examined privately and repeatedly for vulnerabilities, proprietary algorithms, cryptographic routines, privileged functionality or other valuable information. The consequences can extend well beyond the security team: exposing proprietary code or vulnerabilities can lead to intellectual property theft, operational disruption, regulatory consequences and loss of customer trust.

As automated analysis becomes more capable, vendors should increasingly assume that valuable software distributed outside their environment will eventually be subjected to AI-assisted analysis.

Security approaches therefore need to account not only for preventing unauthorised access to software, but also for what an attacker can learn once they have it.

Patching only works once you know the problem

The fundamentals of security hygiene endure, with secure development, vulnerability testing and rapid patching remaining fundamental. But a vulnerability cannot be fixed until it has been identified, and no development process can guarantee that every weakness will be discovered before software reaches customers.

As AI makes it easier to continuously probe deployed applications, defenders face increasing pressure to find and remediate weaknesses before an attacker does. Patching and application protection therefore need to work together: patching fixes known vulnerabilities, while application protection makes any weaknesses that remain harder for attackers to discover and exploit.

Making software harder to attack

The aim isn’t to make reverse engineering impossible. It is to make software harder and more time-consuming for an attacker to understand and take apart.

Different layers of protection can disguise how software works and make it harder to analyse, alter or copy. These include techniques that obscure code and data, detect attempts to tamper with an application, or protect it while it is running. Together, these measures create additional barriers an attacker must overcome.

In combination, their value is cumulative: each additional barrier forces an attacker to spend more time and computational resources analysing the software.

Thales recently tested this in practice. An autonomous AI reverse-engineering agent analysed two versions of the same application, each containing ten deliberately planted vulnerabilities. Against the unprotected binary, it identified eight in approximately three minutes. Against the protected version, it continued for more than six hours, consumed around 970 times as many tokens and stopped without identifying an actionable vulnerability.

Making vulnerabilities harder to discover can buy vendors time to identify weaknesses themselves, develop and validate patches and deploy updates before an issue can be weaponised at scale.

Changing the attacker’s calculation

AI will continue to reduce some of the constraints that have historically shaped software attacks. Organisations cannot control how quickly those capabilities improve or who gains access to them.

Nor can they stop AI from lowering the cost of analysing software. But they can change the economics of attacking their own applications by making them more difficult and resource-intensive to analyse. Eliminating vulnerabilities remains the priority, but so does increasing the time, compute and effort required to find and exploit those that inevitably remain.

If attackers increasingly have the resources to look everywhere, making your software a costly place to look may become a defence in itself.

The post AI Is Making Software Cheaper to Attack. Defenders Need to Change the Price appeared first on IT Security Guru.

James Gillies, Head of Cyber Security at Logicalis UKI

There is no escaping the fact that AI is creating significant opportunities for cybersecurity teams, from analysing security data and identifying suspicious activity to accelerating detection, response and remediation. However, the same capabilities are also changing the threat landscape.

This comes at a time when security teams are already under considerable pressure, with recent research showing that 77% of organisations experienced a cybersecurity incident in the past 12 months.

With AI models becoming increasingly capable, they could increase the speed at which vulnerabilities are discovered and exploited. For organisations already struggling with gaps across their security environments, the window between identifying a vulnerability and needing to remediate it could become considerably smaller.

Preparing for AI-driven threats therefore isn’t simply about investing in more technology. It starts with addressing the weaknesses organisations already have. Five areas in particular should be a priority, spanning visibility and identity through to how quickly organisations can detect, respond to and remediate threats.

Do you know what you’re trying to protect?

If you can’t see an asset, you can’t protect it, so visibility is fundamental to cybersecurity.

Maintaining that visibility is becoming increasingly difficult as cloud services, applications, endpoints, infrastructure and third-party systems continually change. Without a complete view across the environment, vulnerabilities can emerge that security teams may not know are there.

AI could make those blind spots more significant. Recent research found that 34% of CIOs say AI has already created new security blind spots. Attackers understand the importance of visibility too. Reconnaissance is typically one of the first stages of an attack, as threat actors build an understanding of the environment they are targeting.

Organisations need that same understanding of their own estate, including where critical services and data reside and which vulnerabilities present the greatest business risk.

Can you trust the identities accessing your systems?

Cybersecurity has traditionally focused heavily on protecting the network perimeter. But cloud services, hybrid working and distributed infrastructure have changed where that perimeter sits. Increasingly, identity is the control point.

Attackers are targeting users through phishing and social engineering, as well as obtaining legitimate credentials exposed through previous compromises. In those circumstances, they don’t necessarily need to hack into an organisation. They can simply log in.

This makes strong identity and access controls essential. Zero Trust principles such as verifying explicitly, applying least-privilege access and assuming breach can help limit what compromised identities are able to reach.

Organisations also need visibility into how identities behave after authentication. Identifying unusual activity and quickly revoking access can prevent one compromised account from becoming a much wider incident.

Are your security tools actually making you more secure?

The response to growing cyber risk has often been to invest in more security technology. That has left some organisations managing dozens of different tools across their estates.

The problem isn’t necessarily the capability of those products. It’s whether they work together.

When security technologies operate independently, telemetry becomes fragmented, alerts are spread across multiple platforms and teams can struggle to establish a consistent view of what is happening.

The priority should be getting more from existing investments. Better integration and correlation of security telemetry, including through technologies such as XDR, can provide broader visibility and help teams move from detection to response more quickly.

More tools do not automatically create better security. Making existing tools work together effectively can often deliver greater value.

What happens when attackers can move faster than you can respond?

Here is where AI could fundamentally change the equation; for example, Frontier AI models are demonstrating the potential to discover exploitable vulnerabilities significantly faster than traditional human-led research. If that capability continues to develop, the time organisations have to patch vulnerabilities before attackers can exploit them is likely to shrink.

That puts greater emphasis on time to detect and time to respond, areas where organisations are already feeling pressure. New research shows that 41% of CIOs say incident response times have worsened.

Organisations should understand how quickly they can identify an incident, prioritise a vulnerability and contain an attacker that has gained access. Automation will form part of that response, however, so will effective processes, appropriate logging and access to the right expertise.

Is technical debt becoming security debt?

Legacy infrastructure and long-standing vulnerabilities have always created challenges for IT teams. As remediation windows shrink, they increasingly create cybersecurity risk too.

Older systems can be difficult to patch, particularly where applications have reached end of life or operational dependencies make remediation difficult. That doesn’t remove the risk; it makes understanding and managing the exposure more important.

Where patching isn’t immediately possible, organisations need to consider compensating controls, exposure management and approaches such as virtual patching to reduce the opportunity for exploitation.

No longer just an IT modernisation challenge, technical debt is a cybersecurity risk. Organisations need to identify where ageing and legacy technology leaves them most exposed, understand the potential impact on the business and prioritise remediation where the risk is greatest.

Strengthen the foundations first

AI will undoubtedly play a growing role in cybersecurity, but it cannot compensate for weaknesses that already exist. Poor asset visibility, weak identity controls, disconnected security tools and exposed legacy systems will remain vulnerabilities – and AI could enable attackers to identify and exploit them faster.

Preparing for that shift means getting the fundamentals right: understanding the environment, controlling access, making existing security investments work together and improving the ability to detect and contain threats quickly.

As AI accelerates the pace of attack, those foundations will matter more, not less. The organisations best placed to respond will be those that address the gaps before attackers find them.

The post Why AI won’t fix your cybersecurity problem appeared first on IT Security Guru.

By Matthew Brady, Senior Security Engineering Manager, Black Duck

As of September 11, 2026, Article 14 of the EU Cyber Resilience Act (CRA) is in force. Manufacturers, importers, and distributors of products with digital elements sold into the EU must notify ENISA or their national CSIRT within 24 hours of learning that a vulnerability is being actively exploited, with a mitigation report due in 72 hours and a full analysis due within two weeks. This is the first CRA milestone, not the last: broader secure development obligations arrive in December 2027. Organisations that prepared deserve credit, but this deadline is a starting point, and several parts of the requirement are more nuanced than they appear. 

Who and What Is in Scope

The CRA applies to products with digital elements that connect to a device or network: operating systems, IoT devices, browsers, routers, and similar technology. These fall into four criticality tiers, from a broad “default” category up through important and critical classifications, each with different obligations. The highest tier requires third-party assessment; default-tier products can be self-certified, though manufacturers must still retain evidence of certification.

Some categories are excluded outright, including pure open source software and purely hosted services, unless a service connects to a product with digital elements such as a companion app. Products regulated under other frameworks, including automotive and medical devices, are excluded too, though narrowly: an infotainment system inside a car, for example, likely remains in scope even though the vehicle’s driving systems do not. 

Defining “Actively Exploited”

A key clarification from ENISA concerns what triggers a report. Earlier guidance implied that all actively exploited vulnerabilities found anywhere in a supply chain might need reporting, a standard that would have buried regulators given how many vulnerabilities surface daily. ENISA has since clarified that the obligation applies only to vulnerabilities actively exploited within a manufacturer’s own product, which eases the burden but raises the bar on diligence: it requires knowing what is in your supply chain, monitoring it continuously, and evaluating incoming data against your deployment.

A decision not to report still has to be documented; for example, if a known exploited vulnerability in the supply chain subsequently becomes exploited with the specific product, then this would be a clear derogation of duty for vulnerability management and secure-by-design mandates which are part of the wider CRA requirements. Lack of process here could result in penalties which could reach 2.5 percent of global turnover or 15 million euros, whichever is greater. 

Public Data Has Limits, So Automate

Anyone building a reporting process on public vulnerability data alone will hit a messy landscape. Monthly disclosures have grown roughly twelvefold in a few years, NIST’s National Vulnerability Database has stopped scoring most new CVEs, and the EU Vulnerability Database largely mirrors the NVD and inherits its inconsistencies. Organisations need a scoring approach that goes beyond any single feed, ideally grounded in CVSS version 4, currently the only standard that accounts for exploit maturity, including whether exploitation has been observed in the wild.

Manual, periodic scanning also cannot keep pace with a 24-hour reporting clock. Our own research found that organisations with continuous, automated monitoring fixed critical issues in under a day at two to four times the rate of less automated peers, and that regulatory pressure, including the CRA, is now the second-largest driver of investment in automated testing, trailing only direct experience with an incident. Frameworks like SLSA or NIST’s Secure Software Development Framework force the dependency visibility and SBOM validation that make faster remediation possible. 

Everyone Is Both Supplier and Customer

Primary reporting responsibility sits with the manufacturer, vendor, or distributor placing a product on the EU market, but that entity must maintain an aggregated SBOM covering its entire supply chain. Suppliers of paid components may themselves count as manufacturers, with obligations often passed downstream by contract; open source is the exception, folded into the composite SBOM by the vendor assembling the final product. Many organisations sit on both sides of this relationship, receiving SBOMs upstream while producing their own downstream, and validating incoming SBOMs against actual delivered artifacts, rather than accepting them at face value, is becoming standard practice. 

What Comes Next

December 2027 brings broader secure development lifecycle requirements, from secure-by-default configuration to structured vulnerability handling and coordinated disclosure. It is also worth understanding how the CRA connects to the revised EU Product Liability Directive, which reclassifies software as a product for liability purposes, takes effect by December 2026, and introduces no-fault liability with a lower burden of proof for claimants. In practice, the CRA defines what a reasonable manufacturer looks like, and the directive determines the consequences for those who cannot demonstrate they met that standard. Documentation built for CRA conformity may end up as evidence in a liability claim.

AI matters here in two ways. It is expanding both the attack surface and the volume of vulnerabilities to manage, so every organisation should plan for its applications to be targeted, likely repeatedly. AI tools also have a role in vulnerability assessment, but CRA compliance depends on processes that are documented, repeatable, and deterministic. Code run through a large language model may surface useful findings, but if it produces different results on a different day with no record of what was assessed, that does not meet the bar the CRA sets. AI can support the work; it cannot substitute for the evidence trail the regulation requires. 

A Team Effort

CRA conformity is not a problem any single function can solve alone. Security needs visibility only engineering can provide, engineering needs risk context security is best positioned to deliver, and GRC needs both to oversee compliance. Building security testing and compliance checks into existing development workflows tends to produce better results with less friction, since conformity becomes a natural output of how software already gets built.

The reporting requirement that took effect this week is demanding, but it is also a useful forcing function toward the supply chain visibility, automated monitoring, and cross-functional coordination that will matter for December 2027, and for the liability and competitive differentiation that come with proving you can secure what you ship.

The post CRA Reporting Is Live: What Manufacturers, Vendors, and Distributors Need to Know appeared first on IT Security Guru.

By James Mackay, CEO, MetaCompliance

When security teams think about their organisation’s attack surface, they’re usually focused on technology. Where could an attacker get in? What’s exposed? What hasn’t been updated or configured correctly? An attack surface refers to all the possible ways a cyber attacker can gain access to an organisation, including unpatched security software, misconfigured cloud storage, open system connections, and traditional phishing emails containing fraudulent links.

However, organisations also have an invisible attack surface sitting behind the everyday behaviours of their employees. Our latest research found that more than two thirds of CISOs see their employees as their organisation’s biggest cyber security risk. Not because employees are careless or malicious, but because routine workplace habits can unintentionally create opportunities for attackers.

Unlike a misconfigured server or unpatched system, these behaviours don’t always look like vulnerabilities, they’re simply part of the everyday ways people work.

Small Details Can Give Attackers a Much Bigger Picture

The clearest example is the out-of-office (OOO) reply. An automated message that goes out to anyone who emails a colleague on leave, no matter who they are, can give an attacker the information they need to build a bigger picture of an organisation and its employees before making a move.

Standard OOO replies confirm that the email address an attacker is contacting is correct and usually tells them how long the person won’t be monitoring that inbox for. It potentially names another employee to get in contact with, along with their role and their direct email address. Sometimes it even explains where the person has gone. In just four or five lines, an attacker receives a verified target, a defined window in which that person can’t be easily reached to check anything, and a partial map of the organisational chart.

OOO replies are only one example. Other routine workplace practices can reveal similarly valuable information. Email signatures or automated messages that supply names, titles and direct contact numbers can make an impersonation attempt incredibly convincing. Calendars shared to show full meeting details reveal who is meeting who, and often what about. In isolation, these actions can seem harmless but combined, they can provide a surprisingly detailed picture of an organisation.

Access is Only as Secure as the Habits Around It

Shared drives are another example of how everyday working practices can quietly expand an organisation’s attack surface. While they’re designed to make collaboration easier, they often accumulate broad access permissions over time. Employees move roles, projects end, teams change, yet access rights frequently remain in place. Old project folders, expired contracts, meeting notes and spreadsheets can also all sit there long after anyone needs them.

The content in these drives tends to be exactly what an attacker is hoping to find – customer records, supplier contracts, financial reports, HR documents, organisational charts. Leaving a folder shared with the entire department may not have been viewed as a security decision at the time, but it becomes a big one the moment someone’s password is compromised. What starts as access to a single user can quickly provide visibility into far more of the business than intended.

When an Employee Leaves, their Access Shouldn’t Stay Behind

Employee offboarding has a part to play here too. Over several years, an employee builds access to dozens of systems: shared folders, cloud platforms, and third-party applications.

When people leave, these accounts need to be disabled, and permissions removed. Otherwise, access that was once legitimate can become an overlooked route into the organisation.

Credentials that have been stolen or compromised are among the most common ways attackers get into organisations, and a dormant account belonging to an employee who has left may take longer to be noticed.

The Wider Human Attack Surface

Security awareness training often concentrates on key security topics like phishing and strong password practices. These are essential foundations of any cyber security programme, helping employees recognise common threats and protect access to systems and data. However, the human attack surface extends beyond fraudulent emails and compromised credentials to include the everyday habits and decisions that can unintentionally expose information, create unnecessary access or provide attackers with valuable context about how an organisation operates.

If employees don’t understand how an OOO reply reads to a threat actor, or the risk created by a forgotten third-party login belonging to an ex-employee, they may continue behaviours that increase the organisation’s exposure to risk. This is why security awareness needs to move beyond teaching people to identify individual threats. Employees need to understand how their everyday actions can affect the organisation’s wider security posture.

Upgrading security awareness starts with building a culture where people understand why their behaviour matters, and how they can apply that judgement to situations that aren’t explicitly covered by a policy or training module.

Building that culture takes sustained backing, and this is where many organisations struggle. Our research found that nearly four in five CISOs say leadership support for security education initiatives fades over time. The initial push happens, the training is rolled out, and attention moves elsewhere.

A culture of security awareness has to start at the top. If senior decision-makers don’t fully understand the cyber risk posed by employees, it becomes very hard to secure the sustained attention these habits require. None of the issues here are failures of technology – they’re habits that can be changed with the right behaviours built into the culture of the business.

The post When Everyday Habits Become an Invisible Security Risk appeared first on IT Security Guru.

By Myles Bray, CEO of CyberSentriq.

When it comes to cybersecurity, discussions often centre on technical capabilities, tooling and attacker tactics, but often overlooks the employees and security teams the strategy is intended to protect.

The reality is that most critical business functions from staff payroll to procurement and more have now moved online across digital applications, cloud environments and CRMs. With this comes the intense responsibility of ensuring they work as intended and that they are secure from outside threats.

That raises fundamental questions for business leaders and security teams: what is your attitude to a successful attack, and how do your teams learn from internal mistakes?

If the answer is to simply fire or punish the employee, then that risks overlooking the issue entirely.

When employees fear embarrassment or punishment for making a mistake, they’re less likely to raise their hand when something goes wrong. As cyberattacks increase in number and sophistication, an employee’s ability to identify and report incidents quickly is now a defining characteristic of resilient businesses.

A complete cybersecurity strategy supports employees

With employees generating and managing more data than ever before, it’s essential that they are being provided with adequate support to escalate threats. This doesn’t mean that they need to be cybersecurity experts overnight, but they should be able to identify a threat and know how to escalate it internally.

IBM reported that human error accounts for 95% of all data breaches, other industry research found that 74% CISOs cited human error as their top cybersecurity risk, which is a 60% increase from the previous year. As cybersecurity is an ongoing discipline that demands consistency and constant vigilance, even one unpatched vulnerability or lapse in judgement can allow attackers to slip through defences.

There is also a practical case for developing a people-focused strategy. If an employee delays reporting an incident, it tips the scales in favour of the attacker. The longer an incident goes unreported, the more time attackers gain to access sensitive data and move laterally across networks.

That makes containment harder or worse; it could force security teams to shut systems down while they investigate.

Designing processes that work

When employees delay or don’t report on threats, that doesn’t make them malicious or lazy. Often, it’s a sign to businesses that current security protocols are not working for them. To ensure threats are escalated properly, businesses need to replace complex and fragmented reporting procedures with streamlined processes.

Simplifying the reporting process: If reporting a threat requires employees to fill out a form or submit a lengthy ticket, they’re less likely to follow through. Instead, businesses can replace these barriers with centralised communication channels and automated triage pools to bypass email exchanges. This allows security teams to quickly filter out the noise and prioritise more serious threats.

Train employees to focus on behaviour: Employees do not need to be technical experts to spot risk, but they can become experts in context and operational procedures. This means training employees to identify MFA spamming, urgent requests for credentials or data transfers and sudden changes in communication patterns. Aligning training with how employees work instead of technical exploits means security becomes part of daily work rather than an occasional afterthought.

Automate where you can: Security stacks can be configured to automatically log contextual information like an employee’s email address, device ID, network status and session logs the moment they report an incident. Here, automation can reduce administrative burden while allowing security teams to focus on the root cause and containment.

These examples illustrate that when security is embedded into business and daily habits, escalating threats becomes more efficient and crucially, it’s more likely to be embraced by employees.

Hybrid and remote working have expanded the attack surface

It’s estimated that less than half (43%) of employees work exclusively from an office; this makes safeguarding security perimeters a much more complex task.

Given that a vast majority of UK workforces are now working across different devices, networks and locations, threat escalation strategies need to reflect these new workforce trends because many employees often do not have the means to physically verify suspicious activity with another colleague.

That means a truly effective security strategy must give businesses confidence that their employees can identify and flag potential security threats no matter where they are working or what device they are using.

Don’t fall into the blame culture trap

Suppose an attacker is able to slip through defences and manipulate financial transactions. Rather than blaming the employee, businesses should focus on the how and instead ask themselves: How did our email filters let this through, and why do our financial processes allow an invoice to be paid based on a single email link?

When threats are reported and contained quickly, employees feel involved and valued in a business’ security efforts. This reduces the likelihood of containable threats escalating into more serious ones while removing the fear of punishment. It also creates an ongoing feedback loop, exposing security gaps and whilst giving teams actionable insights to improve processes.

While tooling is an essential part of a cybersecurity strategy, business leaders should not overlook the human layer. Security is also about culture, processes and employee behaviour, which even the most advanced tools alone cannot compensate for. By removing the fear of judgement, businesses can reduce dwell time and foster a proactive security culture.

Modern cybersecurity is not about creating perfect employees; it is about building environments where individuals feel safe to speak up when something goes wrong.

The post Could blame culture be cybersecurity’s next Achilles heel? appeared first on IT Security Guru.

Christopher Clark, Cyber Security Incident Response Team Director, Thrive 

Geopolitical escalation can become a cyber security problem for businesses far more quickly than many boards expect.

The National Cyber Security Council (NCSC) has warned that UK critical infrastructure faced more than 200 cyber incidents over the past year, with around three-quarters believed to be linked to state actors. Analysis of the conflict involving Iran has also found cyber retaliation following military escalation within hours, bringing events overseas much closer to the day-to-day reality of UK organisations.

That risk has already been demonstrated on UK soil. In July, a cyber-attack reportedly linked to Iranian hackers forced a small UK power generator offline for four days. The government said there was no risk to the wider energy system, but the incident shows how quickly geopolitical cyber activity can translate into operational disruption.

Energy, healthcare, water and telecoms remain obvious targets because disruption can affect essential services. Yet, hostile state activity does not stop at the boundary of critical infrastructure.

Hostile state risk extends beyond critical infrastructure

A business does not have to be an obvious target to become one. It may be connected to a larger customer, supplier, regulator or public body that an attacker ultimately wants to reach. In other words, you do not have to be the objective. You just have to be the way in.

There is also the risk of spillover. Targeting can follow politics rather than the size of a company or its balance sheet. If an organisation has operations or suppliers connected to a live conflict, it can become collateral even when nobody set out specifically to target it.

Businesses also need to reconsider what hostile state activity is likely to look like inside their own environments. The most significant intrusions are not necessarily the noisiest.

Security teams may be watching for malware, failed logins or a sudden increase in DDoS activity. Capable attackers increasingly use valid credentials and legitimate administration tools, allowing malicious behaviour to resemble normal activity.

There may also be no obvious warning to investigate. If the plan is to wait for one, the organisation may already be too late by the time it appears.

A better working assumption is that a capable actor could already be inside, or could get in without immediately triggering an alert. The question then becomes what they can actually do once they have that foothold.

Trusted technology can create the same problem. Management platforms and legitimate system tools can be repurposed by attackers, while compromised software packages can provide access to many organisations at once. Activity entering through a tool or supplier that the business already trusts may attract less scrutiny because it appears legitimate.

The same principle applies to suppliers. If a connected partner has been compromised, one of the first questions should be what has been done to separate that organisation from your own environment. Continuing normal access without understanding what happened risks transferring their exposure into your network.

Organisations should know how they would isolate an affected supplier and what evidence would be required before connectivity resumed. They may need confirmation of how the attacker entered and which systems were affected, alongside assurance that the access has been removed. Shared applications or other connections may have to remain unavailable until that information is clear.

That can be uncomfortable for the business, but restoring connectivity too quickly can create a much bigger problem later.

The time available to make these decisions is shrinking. Threat actors can analyse newly disclosed vulnerabilities and move to exploitation quickly, with AI making parts of that process faster. In some cases, organisations can be exposed within hours of a vulnerability becoming known.

Patch management therefore cannot always wait for the normal maintenance cycle. Teams need to know which vulnerable systems create the greatest risk and be ready to prioritise them when a new vulnerability emerges.

Geopolitical risk can also outlast the immediate conflict.  A ceasefire does not automatically remove access established during a period of heightened activity, nor does it mean proxy groups will stop operating. Attackers have good reason to preserve a foothold that may be useful later. I have seen access remain available inside an environment for three years or more.

That is why an easing of geopolitical tension should not automatically be treated as a reduction in cyber risk.

Containment depends on preparation and experience

Preparation has to focus on containing an attacker as well as keeping them out. Standing privileges should be kept to a minimum, networks should be segmented so an attacker cannot move freely towards critical systems or backups, and offline backups need to be regularly tested.

Organisations also need a clear view of their external attack surface and where their greatest points of exposure lie. Regular tabletop exercises should use realistic scenarios informed by current threat intelligence.

If an attacker gained access through a VPN or compromised supplier, what could they reach next? How far could the incident spread? And who has the authority to cut them off?

That authority needs to be clear before an incident. Time can be lost when technical teams know what needs to happen but must wait for decisions on whether systems can be disconnected or business processes interrupted.

Experience is equally important. Frameworks provide structure, but serious incidents rarely follow a script. Responders who have handled repeated compromises understand where investigations can stall, which decisions cannot wait and what needs to be secured before systems are safely returned to service.

For many organisations, maintaining that level of incident response experience entirely in-house is difficult. What matters is having access to people who have dealt with incidents under real operational pressure and can apply that experience quickly when normal assumptions no longer hold.

Hostile state cyber activity should now be treated as a routine business risk rather than something considered only when international tensions make the headlines.

Organisations should be asking a more immediate question: if something gets through today, how far can it spread before we stop it?

Answering that question before an attack happens can make the difference between a contained security incident and a prolonged operational crisis.

The post Why hostile state cyber activity is now a day-to-day business risk appeared first on IT Security Guru.

Artificial intelligence is changing vulnerability discovery. At OpenSSL, we are seeing that change first-hand. A year ago, our security address received around nine separate reports and enquiries a month. It now receives around 70. AI tools can examine source code and identify potential security issues at a scale that would previously have required significant human effort.

In many ways, that’s positive. Finding vulnerabilities is an essential part of making software more secure. But there is another side to this that deserves much more attention. Every vulnerability report has to go somewhere.

Someone needs to assess whether the issue is genuine. If it is, engineers need to understand its severity, develop a fix, test that fix and manage disclosure appropriately. AI can increase the speed at which potential problems are discovered. It does not automatically increase the number of experienced engineers available to deal with them. That imbalance could become a serious issue for open-source security.

Finding a vulnerability is only the beginning

There is an understandable tendency to treat vulnerability discovery as the success story. An AI system finds something humans missed. That makes a compelling headline. But identifying a potential weakness and resolving it are very different tasks.

A report might represent a serious vulnerability. It might be something already understood. It might be technically correct but have limited real-world security impact. It might simply be wrong. Working out which of those is true requires expertise. Then, if there is a genuine vulnerability, somebody has to fix it.

Over the past 12 months we received a little over 400 vulnerability reports. 43 resulted in a published CVE. Roughly one in ten. The other nine still had to be read, understood, reproduced where we could, and answered. A report that turns out not to be a vulnerability consumes much the same expert attention as one that is — sometimes more, because establishing that something cannot be exploited is often harder than confirming that it can.

For a commercial software company with large security teams, increasing the number of reports may be manageable. For an open-source project with limited resources, a sudden increase can create a very different problem. The technology for finding possible vulnerabilities is becoming cheaper and more accessible. However, the expertise required to investigate them is not.

Businesses depend on projects they may barely know exist

This connects to a much older problem with open-source. Most technology companies know they use open-source software. What is less clear is whether they understand exactly which projects their products and services depend upon. That distinction matters.

Open-source components can sit deep inside software stacks. They work quietly, so organisations may have little reason to think about the people maintaining them. Then something goes wrong.

Heartbleed was an important moment for OpenSSL because it exposed the gap between the importance of open-source infrastructure and the resources available to support it. The industry responded. Investment increased and organisations began paying much more attention to the sustainability of critical open-source projects.

My concern is that some of those lessons are beginning to fade, and AI could make the consequences of that particularly visible.

AI changes the economics of vulnerability discovery

There is an asymmetry developing. The cost of searching code for potential security weaknesses is falling. The volume of reports can therefore rise significantly. But the other side of the process remains stubbornly human. Experienced engineers still need to understand the code. They need to judge whether the finding matters and decide how it should be fixed without creating another problem somewhere else.

Those people are a scarce resource. This means the question organisations should be asking about AI and cybersecurity isn’t only: “What can AI find?” It should also be: “Who is going to deal with everything it finds?”

For open-source projects, that leads directly to questions about sustainable funding. If businesses depend on a project as part of their critical infrastructure, supporting the health of that project should be viewed as part of resilience, not philanthropy.

Regulation only gets us part of the way

Governments are understandably looking at how regulation can improve cyber resilience. That matters, but regulation cannot maintain software. Europe provides some interesting examples of a different approach. OpenSSL Foundation has received support from Germany’s Sovereign Tech Agency, which invests directly in open digital infrastructure.

That recognises something important: if technology is critical to the functioning of the digital economy, somebody needs to invest in the people maintaining it. I’d like to see more of that conversation in the UK. Cyber resilience isn’t only about telling organisations what standards they should meet. We also need to consider the health of the technology underneath the services we’re trying to protect.

Organisations need to know what they depend on

There is something businesses can do immediately. Understand your open-source dependencies. If a critical vulnerability appeared tomorrow in a project your organisation relies on, could you identify where that software was being used?

Would you know which products and services were affected? Would you know who maintains the project? And would you have any relationship with the community responsible for fixing it? If the answer is no that is a resilience gap.

Organisations don’t necessarily need to contribute code themselves. There are other ways to support projects, including funding, engineering resources and participation in the communities maintaining the technology they depend upon. The important shift is recognising open source as infrastructure rather than free software that simply appears.

We need to talk about the people behind the code

AI will continue getting better at analysing software. That’s exciting, and it has the potential to make technology significantly more secure. But more findings do not automatically produce more security. The benefit comes when we have the expertise and resources to act on what those tools discover. That makes this a human question as much as a technology question.

How do we sustain the communities maintaining critical open-source infrastructure? How should businesses support the projects they depend on? What happens when vulnerability discovery accelerates faster than our ability to respond?

The post AI is finding vulnerabilities faster. Who is funding the people expected to fix them? appeared first on IT Security Guru.

By Aimee Steele, threat intelligence analyst at Talion Cyber Security

Last month, the UK’s National Cyber Security Centre (NCSC) issued an advisory around a new phishing campaign targeting organisations in the West that was being carried out by the Russian state-sponsored threat actor known as Laundry Bear.

The campaign, saw the threat actors exploiting a zero-day vulnerability in Zimbra Collaboration Suite in order to compromise networks, before gaining persistence, accessing emails, stealing sensitive data and conducting espionage against organisations using vulnerable Zimbra Mailservers.

The advisory from the NCSC was issued in conjunction with advisories from 15 other countries, including the US, Finland, Australia, Denmark and France, and it advised that the threat actors were targeting critical industries in order to steal sensitive information with Russian government backing.

Phishing is nothing new and is regularly cited as the most prevalent method used within cyberattacks. However, what made this attack stand out and warrant such a coordinated international response, was its deviation from conventional phishing techniques, amounting to a markedly sophisticated zero-click campaign.

Successful exploitation did not rely on users clicking a link or opening an attachment; victims simply needed to open an email.

Typical phishing attacks rely on user interaction. The victim might click on a malicious link or open an attachment. The threat actor might leverage phishing techniques to deploy malware, infiltrate systems or networks and establish backdoors for persistent access. Even at the most basic level, attackers might simply use stolen credentials to access private user accounts, such as a bank account, to commit financial fraud.

In this instance, successful exploitation did not depend on outright deception; there were no features that might typically raise a user’s suspicion. The victim didn’t need to do anything at all.

So, how did the attackers get in?

The campaign

The threat group was able to exploit a zero-day XSS vulnerability in the Zimbra Collaboration Suite (CVE-2025-66376), the exploit having been embedded in the HTML body of the message and triggered upon opening or previewing. Emails were issued from either Proton Mail accounts or previously compromised email addresses.

Successful exploitation gave attackers access to the webmail server, allowing them to establish persistence, access users’ mailboxes and steal sensitive emails and authentication data.

From there, the stolen information could be used to conduct cyber espionage, gather intelligence on government and critical infrastructure organisations, and potentially facilitate further compromise of connected systems. Attackers were also able to leverage their access to target specific victims in spearphishing attempts. In instances such as this, having access to contextual information can add an additional layer of legitimacy to communications.

Protecting against Zero-Click attacks

Following the discovery of the vulnerability, Zimbra released security updates to address the flaw, and any organisation using affected versions of Zimbra Collaboration Suite should ensure these patches have been applied as a priority. If this is not immediately actionable, it is advisable for organisations to implement another suitable mail client in the meantime.

However, patching alone should not be considered sufficient. Organisations should also review logs, monitor for indicators of compromise, investigate unusual authentication activity and assess whether attackers may have gained access before the vulnerability was remediated. Multi-factor authentication, network segmentation and continuous monitoring can also help limit the impact if a compromise does occur.

Attacks like these also reinforce the importance of detection and response, which can help spot malicious access quickly, before attackers have an opportunity to compromise networks and access data.

Zero-click exploits present a greater challenge to the individual user than typical phishing attempts. However, they can still play an important role in limiting the impact of such attacks by remaining vigilant for unusual login alerts, unexpected password reset notifications or signs that an account has been accessed without permission.

Users should also ensure multi-factor authentication is enabled wherever possible, use strong and unique passwords, and be alert for any follow-on phishing attempts, as attackers will often use information stolen during an initial compromise to target victims further.

Lessons for organisations

Zero-click attacks are particularly deceptive because they present without the typical warning signs users are trained to look out for in social engineering and phishing scams.

This recent zero-click campaign by Laundry Bear begs the question as to whether current user awareness training is particularly affective in the prevention of successful phishing attacks, which are becoming increasingly sophisticated.

In general, rapid patching supports robust remediation strategy and is fundamental if organisations wish to prevent exploitation, rather than react to it. In addition, continuous monitoring and effective detection and response capabilities are fundamental when reacting efficiently to zero-clicks.

Considering the severity of the attack, any organisation using Zimbra Collaboration Suite should ensure they have applied the latest security updates as a priority.

Organisations should also assume patching alone is insufficient, and review logs, authentication activity and other indicators of compromise to determine whether they were breached before the vulnerability was remediated.

Overall, attacks like these require a layered approach to security, helping identify attackers and potential threats before organisations are compromised further.

The post Protecting Against Zero-Click Attacks appeared first on IT Security Guru.

Cybersecurity has become one of the most defining business challenges of recent times. Organisations have invested heavily in protecting their networks, securing cloud environments and strengthening identity and access management. At the same time, organisations are under increasing pressure to prove they are handling sensitive information securely, not just storing it safely but protecting it throughout its journey.

Yet despite this progress, one area continues to receive far less attention than it deserves: how data is shared.

Most organisations have become very good at protecting data while it is stored. Files are encrypted, key handling is properly managed, access is restricted and systems are monitored around the clock. However, once that information needs to leave the organisation, whether it’s being sent to a customer, supplier, auditor or business partner, the controls often become less robust.

Every day, organisations exchange contracts, financial information, employee records, legal documents and commercially sensitive files. More often than not, this happens via email attachments or cloud-based file-sharing services because they are familiar and convenient. The problem is that convenience does not always equal security.

Email remains one of the most common routes for cyber attacks. Phishing, spoofed domains, malicious attachments and business email compromise continue to account for a significant proportion of successful breaches. However, most incidents do not involve a sophisticated bad actor. The official UK annual Cyber Security Breaches Survey continues to show the majority of incidents stem from everyday mistakes.  An email sent to the wrong recipient, an attachment forwarded outside the organisation or a file shared with overly broad permissions can expose sensitive information in seconds.

Human error remains one of the biggest cyber risks organisations face, particularly as businesses become increasingly connected. Information now flows constantly between employees, customers, suppliers, consultants and regulators. Every transfer creates another opportunity for something to go wrong.

What is often overlooked is that securing data is not just about protecting where it is stored. It is also about understanding the journey it takes.

Many organisations assume that because they operate in the UK, their sensitive information remains within UK borders. In reality, emails and attachments may be routed through multiple countries and cloud infrastructures before arriving at their destination. While this is often an invisible part of modern digital communications, it raises important questions around governance, compliance and data sovereignty.

For organisations operating in regulated sectors, this matters. Financial services firms, local authorities, healthcare providers and legal organisations are increasingly expected to demonstrate not only that data is protected, but also that it is managed responsibly throughout its entire lifecycle. Knowing where information is stored is only part of the picture. Understanding where it travels, who has access to it and how it is controlled has become equally important.

This is why conversations around geofencing and data sovereignty are gaining momentum. Rather than simply encrypting information and hoping for the best, organisations are beginning to ask whether they should have greater control over where sensitive data is permitted to travel. If businesses routinely place restrictions on the movement of physical assets, it seems only logical that they should apply similar thinking to digital information.

At the same time, regulators and auditors are asking more searching questions about how organisations exchange information with third parties. They want to understand how access is controlled, whether there is a complete audit trail and what safeguards exist once information leaves the organisation. These are no longer technical questions reserved for IT teams. They are governance issues that increasingly involve compliance, procurement, risk and senior leadership.

There is also a growing disconnect between the way organisations work and the security controls they have in place. Hybrid working, cloud collaboration and increasingly complex supply chains mean information rarely stays within a single organisation. Yet many businesses continue to rely on processes that were designed for a very different way of working.

This is where a change in mindset is needed.

Cybersecurity should not end when a document is saved securely on a server or in the cloud. Information is often at its most vulnerable when it is moving between people, organisations and systems. Protecting data in transit should therefore be considered just as important as protecting data at rest.

That does not mean making it harder for employees to do their jobs. Quite the opposite. Security should support the way people work, allowing information to be shared safely without creating unnecessary barriers or encouraging workarounds that introduce even greater risk.

Organisations need to take a more holistic view of information security. Protecting sensitive data means understanding its entire lifecycle, from creation and storage through to sharing, collaboration and eventual deletion. It means knowing not only who can access information, but where that information is travelling and whether that journey aligns with the organisation’s security, compliance and governance obligations.

Threats aren’t standing still, and neither are regulators. Focusing only on data that’s sitting in storage means missing one of the biggest holes in your security. It’s not enough to just lock data away; it needs to stay safe wherever it travels.

*DOQEX provides a secure data exchange and email gateway platform that helps businesses protect confidential information.

The post The Hidden Risk in Data Transfer appeared first on IT Security Guru.

By Simon Phillips, CTO, CybaVerse

Alert fatigue is an issue that has plagued Security Operations Centres for years.

As organisations’ digital estates grow, there is more architecture to secure and more architecture for threat actors to attack, which has ultimately led to more alerts.

Today, on average a SOC will face thousands of alerts every day, each of which could indicate a potential threat. Each alert must therefore be analysed and investigated before appropriate action can be taken.

However, ask any SOC analyst and they will tell you the majority of these alerts are benign or false positives.

Yet, analysts will still spend hours investigating activity that ultimately poses little or no risk, hoping to identify the small number of genuine threats hidden amongst the noise.

Given the volume they face, and the possibility of missing something before it’s too late, it’s a noisy, high-stress environment that often leads to burnout and fatigue.

To tackle these issues, many SOCs today are turning to Artificial Intelligence (AI) to support the management of alerts.

In this scenario, the first-line analyst is replaced by an agent that reviews the incident to determine whether it’s malicious and if further action is required. The analyst must then review the conclusion reached by the agent to ensure it is accurate, but they don’t conduct the initial investigations themselves, which reduces the volume of alerts they have to investigate every day.

However, even despite these improvements, is there another way that could reduce the noise even further?

If organisations are still generating huge numbers of unnecessary alerts, have they actually solved the underlying problem, or simply moved it further downstream?

Moving AI upstream

Instead of asking AI to investigate incidents after they have been created, some organisations are using the technology much earlier in the detection process.

Rather than having AI decide whether an alert is malicious, in this scenario it’s used to help build better detection logic and more effective workflows before alerts ever reach an analyst.

For instance, in a phishing attack when an employee reports an email as suspicious, many security platforms immediately generate an incident that someone must investigate.

Traditionally, either a human analyst or an AI assistant would then collect additional context, checking whether links have been clicked, whether anyone else received the email, or whether similar activity appeared elsewhere in the environment.

If these types of checks are incorporated into the detection process, and the answers to the questions are no, then an incident would never need to be created in the first place.

The AI would determine that there was no wider threat, meaning the alert could be filtered out before it ended up in the SOC ticket queue.

The result is a faster, more efficient SOC, with far fewer unnecessary alerts reaching analysts.

From a customer perspective, this can also reduce the costs of working with an outsourced SOC partner.

Many AI-powered investigation platforms price their services according to the number of alerts they process, so reducing unnecessary alerts before they reach the investigation stage can improve efficiency while also helping organisations control operational costs.

Improving security through engineering

Another benefit of moving AI further upstream is that it limits access to sensitive customer data.

Many AI-driven investigation platforms analyse real customer logs and incident data to determine whether activity is malicious. While providers implement safeguards, some organisations are uncomfortable with sensitive operational data being processed by external AI systems, particularly where regulatory or contractual obligations apply.

Using AI during detection engineering changes this process. The AI is used to create the logic that identifies threats, not to inspect live customer data.

Once the detection rules have been verified, they can be applied consistently across customer environments without repeatedly sending operational data through AI models.

Solving the cause, not the symptom

The cyber security industry has become very good at handling alert fatigue, but not so good at preventing it. Is it time a different approach was adopted?

If security teams continue generating thousands of low-value alerts every day, replacing analysts with AI may improve efficiency, but it won’t address why the alerts exist in the first place.

As AI becomes more deeply embedded within security operations, organisations should consider where it delivers the greatest value. In many cases, the answer may not be at the point where analysts investigate incidents, but much earlier, where better detection engineering prevents unnecessary incidents from being created at all.

By reducing false positives at the source, this allows analysts to spend more time on genuine threats, while improving consistency, cutting costs and helping organisations make better use of both their technology and their people.

The post Is AI entering the SOC at the right stage? appeared first on IT Security Guru.

2026 is touted as the year AI moves from speculation and interest to real-world deployment and value. Yet one global analyst firm predicts 40% of agentic AI projects will be canceled by the end of 2027, due to escalating costs, unclear business value or inadequate risk controls.

It suggests more and better advice and an ecosystem of support are needed to make agentic projects a success, which must include addressing new security considerations.

There are early signs that the rise of agentic AI is transforming how organisations operate. In retail, AI agents are already managing inventory, optimising pricing, assisting customers, forecasting demand, and automating supply chain decisions.

At the same time, logistics organisations are deploying autonomous agents to coordinate warehouse operations, route shipments, manage fleet utilisation, track inventory movement, and resolve operational exceptions in real time.

These systems are no longer simple chatbots or assistants—they are becoming autonomous digital operators capable of making decisions and executing actions across business-critical systems.

New Security Considerations in 2026
While the business benefits are significant, the security implications are equally profound. As AI agents gain access to enterprise applications, APIs, devices, customer information, and operational systems, organisations must address a critical question: How do we secure AI agents that increasingly operate like employees but at machine speed and scale?

Traditional AI security concerns such as prompt injection, data leakage, and model vulnerabilities remain important. However, security leaders are now confronting a broader challenge – governing autonomous agents that can access tools, execute workflows, interact with physical devices, and influence business outcomes without constant human oversight. The conversation is shifting from securing AI models to securing AI-powered digital workforces. So, what are the new security considerations and methods to address them in 2026?

Treat AI Agents as Digital Identities
Every AI agent should be managed as a non-human identity rather than merely an application. Just as organisations govern employee access through identity and access management systems, AI agents require unique credentials, role-based permissions, lifecycle management, and continuous auditing.

In retail, an inventory optimisation agent should not automatically gain access to customer payment systems. In logistics, a route-planning agent should not be able to modify warehouse management configurations without authorisation. Applying least-privilege principles ensures that agents can perform their intended tasks while minimising security exposure. Without proper governance, an unmanaged AI agent can quickly become a highly privileged insider capable of accessing sensitive systems and data.

Govern MCP and Tool Access
The Model Context Protocol (MCP) is emerging as a key mechanism for connecting AI agents with enterprise tools, databases, applications, and external services. While this connectivity enables powerful automation, it also expands the attack surface.

Organisations should establish strong governance around MCP servers and tool integrations. This includes validating trusted MCP endpoints, implementing allowlists for approved tools, inspecting contextual information passed to models, and continuously monitoring tool usage.

For retailers, this could mean restricting access to pricing engines, loyalty systems, or inventory platforms. For logistics providers, it may involve controlling access to transportation management systems, warehouse automation platforms, carrier networks, and shipment tracking services. A compromised tool connection can provide attackers with a direct path into critical operational workflows.

Secure Runtime Operations
Security cannot stop once an AI agent is deployed. Autonomous systems must be monitored continuously throughout their operational lifecycle.

Runtime security controls should include policy enforcement, behavioral monitoring, approval checkpoints for high-risk actions, anomaly detection, and emergency kill switches. These controls help identify and contain risky behavior before it impacts business operations.

For example, a retail agent that suddenly attempts to modify thousands of product prices should trigger investigation. Similarly, a logistics agent that begins rerouting large volumes of shipments or altering delivery schedules outside established policies should be flagged immediately.

Continuous runtime visibility is essential because even well-trained agents can drift from expected behavior due to changing inputs, evolving objectives, or malicious manipulation.

Don’t Forget the Devices
Agentic AI increasingly interacts with physical infrastructure. In retail environments, agents may access point-of-sale systems, kiosks, handheld scanners, smart shelves, and IoT devices. In logistics operations, agents often interact with warehouse scanners, robotics systems, automated storage equipment, vehicle telematics, fleet management platforms, and industrial IoT sensors.

A compromised endpoint can influence the decisions made by an AI agent, creating downstream business risks. Device trust, posture validation, endpoint security, and continuous compliance monitoring should therefore be integrated into any Agentic AI security strategy.

Build Security Across Every Layer
Organisations should adopt a layered security approach spanning agent identities, MCP and tool governance, runtime protection, endpoint trust, API security, and data protection. Strong authentication, least-privilege access, token management, behavioral analytics, and continuous monitoring should work together to provide defense in depth.

Continuously Red Team Your Agents
Traditional penetration testing is no longer sufficient. Agentic AI systems must be continuously evaluated against threats such as prompt injection, goal hijacking, privilege escalation, tool abuse, workflow manipulation, and business logic attacks.

Retail and logistics organisations should regularly test complete agent workflows rather than individual components. The objective is to understand how autonomous systems behave under real-world adversarial conditions and identify weaknesses before attackers do.

Getting the Balance Right
Retail and logistics organisations are rapidly deploying AI agents to automate increasingly critical business processes. The leaders in this new era are not those who deploy the most intelligent agents, but those that also establish the strongest foundations of trust, governance, and security.

As AI agents gain access to inventory systems, pricing engines, warehouse platforms, transportation networks, customer data, and operational devices, the key question will be getting the balance right between securing AI agents like software and governing them as digital identities.

The post Building Trustworthy Agentic AI: How Security Concerns Have Changed in 2026 appeared first on IT Security Guru.

Smart buildings promise greater efficiency, improved sustainability and enhanced operational oversight. However, as building management systems, security platforms and energy infrastructure become increasingly interconnected, they also create new pathways for cyber threats that can disrupt physical operations as readily as digital services. Here, Peter Schwartz, senior technology consultant at cybersecurity expert OryxAlign, explains why organisations need to rethink how they manage cyber-physical risk in connected buildings. 

As organisations continue to integrate building management systems, access control, CCTV, environmental monitoring and energy infrastructure, the benefits of connectivity are clear. Shared networks provide greater operational visibility, support remote management and help organisations optimise energy use and building performance.

Yet this growing connectivity also expands the attack surface. Smart buildings should be viewed as operational environments where cybersecurity has a direct impact on business continuity, not just technology platforms that improve efficiency.

Connected systems, connected consequences

The conversation around smart buildings often focuses on energy savings, occupancy analytics and automation. These capabilities undoubtedly deliver value, but they can also overshadow a fundamental consideration in resilience. As building systems become more connected, organisations must consider what happens if those systems are unavailable or deliberately manipulated.

Unlike traditional cyber incidents, the impact is not always measured by stolen data. A cyber-attack against a building management system can have immediate and physical and operational consequences. Consider a modern office where the building management system controls heating, ventilation and air condition (HVAC), access control and environmental monitoring. If an attacker gains access through poorly secured connected devices and moves into the building management network, they may choose not to steal information at all.

Instead, they could alter HVAC schedules and disable environmental alerts. Temperatures begin rising in communications rooms and equipment spaces, critical systems experience outages and facilities teams lose visibility of alarms and system status. The result is operational disruption and potential equipment damage rather than a conventional data breach.

This is why smart buildings should be viewed as operational environments rather than collections of connected technologies. Cybersecurity is now about maintaining operational continuity as well as protecting information.

Overlooked security gaps

Many of the systems that present the greatest cyber-physical risk are not traditionally managed as IT assets. Environmental sensors, smart cameras, access control devices, energy management systems and legacy building management controllers are frequently considered operational technology, meaning they can fall outside conventional cybersecurity reviews.

During procurement, organisations understandably focus on functionality, performance and integration. However, security requirements, patching responsibilities and lifecycle management often receive far less attention. As more connected systems are introduced, these gaps become increasingly significant because vulnerabilities with operational technology can create an entry point into wider business operations.

The technology itself is only part of the challenge. Third-party vendors and systems integrators often retain privileged remote access for maintenance and support, making supplier security practices an equally important consideration. The UK Government’s Cyber Security Breaches Survey 2025 highlights the wider governance challenge, reporting that only 14 per cent of businesses formally review the cybersecurity risks associated with their immediate suppliers, while just seven per cent assess risks across their wider supply chain.

Although these figures are not specific to smart buildings, they demonstrate that third-party risk remains an area where many organisations have more work to do. Strong governance, clear contractual accountability and regular security assessments should therefore apply equally to both connected technologies and the organisations responsible for supporting them.  

Resilience through visibility

Reducing cyber-physical risk does not require organisations to sacrifice the benefits of integration. Instead, the priority should be integrating systems in a way that improves visibility while maintaining appropriate separation between them.

Effective integration is about ensuring systems can share information securely through appropriate network segmentation, clearly defined trust boundaries, robust identity controls and centralised monitoring. The objective is greater operational awareness and faster incident response rather than creating a larger interconnected environment.

This approach is reflected in guidance from the National Institute of Standards and Technology (NIST). Its Guide to Operational Technology (OT) Security identifies building automation and physical access control systems as operational technology requiring dedicated cybersecurity controls, recommending measures such as network segmentation, strong identity management and continuous monitoring to reduce operational risk.

Monitoring also plays a critical role because most cyber-physical incidents begin as relatively small anomalies. Unexpected device behaviour, unusual network communications, failed authentication attempts, unauthorised configuration changes or equipment unexpectedly going offline can all indicate an emerging issue. Combining asset visibility, operational telemetry and cybersecurity insights enables organisations to identify problems before they affect building operations. Simply, organisations cannot protect systems they cannot see.

Shared ownership matters

As building systems IT infrastructure and physical security increasingly overlap, organisations also need to rethink how responsibility is managed. Traditional siloed ownership models are becoming increasingly difficult to sustain because operational resilience now depends on multiple disciplines working together.

Facilities teams, IT departments and physical security specialists each bring different expertise, but connected buildings require a shared governance framework that applies cybersecurity policies, risk assessments and incident management processes consistently across both IT and operational technology environments. Shared accountability is essential for protecting connected buildings against increasingly complex operational risks.

For organisations looking to strengthen resilience, the most effective starting point is often the simplest. Establish a complete inventory of connected building systems and devices. Many organisations still do not have a comprehensive understanding of everything connected to their environment. Once that visibility exists, unsupported systems can be identified, unnecessary connectivity removed, vulnerabilities assessed and appropriate monitoring introduced. Improving visibility remains one of the fastest and most cost-effective ways to reduce cyber-physical risk.

As organisations continue investing in smarter buildings, cyber-physical risk should no longer be considered a specialist concern for facilities or IT teams in isolation. Connected environments deliver significant operational benefits, but they also require a shared approach to governance, monitoring and resilience. Organisations that understand what is connected, establish clear ownership across facilities, security and IT teams, and build visibility into their operational environments will be far better placed to maintain business continuity as smart buildings continue to evolve.

To learn more about strengthening the resilience of connected buildings, visit the OryxAlign website.

The post Managing cyber-physical risk in smart buildings appeared first on IT Security Guru.

Recent government data shows the scale of cyber threats facing security teams. According to the Cyber Security Breaches Survey 2025/2026, it’s estimated that UK businesses experienced 5.19million cyber crimes in the last 12 months. This means an average of over 14,000 incidents per day.

The volume and frequency of threats show little sign of slowing. IT Security Guru recently reported a 34% increase in cyber attacks in June, compared with the same month last year. Every day seems to bring new vulnerabilities, new alerts and new attacks, compounding a mounting challenge for teams operating with stretched resources and budgets. Threats are intensifying, while security teams are tracking thousands of vulnerabilities across on-premises infrastructure, cloud environments and increasingly complex supply chains.

While organisations continue to invest in cyber defences, the reality is that security teams cannot patch every vulnerability or investigate and act on every threat. Adversaries understand this imbalance and are increasingly exploiting it. Rather than relying solely on sophisticated attach techniques, many threat actors are attempting to hit businesses from every direction by increasing the volume, speed and frequency of attacks. The aim is to overwhelm security teams and misdirect their attention through a constant stream of alerts, vulnerabilities and incidents. Attackers can then, in theory, concentrate on a successful breach that flies under the radar.

Artificial Intelligence (AI) is being leveraged by cyber criminals to evolve this form of attack. LLMs can be used to accelerate reconnaissance of targets, amplify deception and social engineering, and significantly cut the time between vulnerability disclosure and working exploit. The expansion of cybercrime-as-a-service ecosystems are also lowering the barriers to entry for less-skilled adversaries and further contributing to a trend of faster, smaller, harder-to-disrupt attacks.

Faced with a relentless avalanche of cyber attacks, security teams must accept the uncomfortable truth that not every vulnerability matters equally. A key step for achieving this is building an intelligence led approach to vulnerability prioritisation, shifting beyond an over-reliance on Common Vulnerability Scoring System (CVSS) scores to manage risk.

Many businesses rely heavily on CVSS ratings to organise patching and remediation priorities. And, although CVSS remains a useful measure of technical severity, it doesn’t tell security teams whether a vulnerability is actually being targeted by threat actors. There may be instances, for example, where a vulnerability receives a critical score, but it isn’t being actively being exploited or lined up in a threat actor’s crosshairs. The consequence of this can be that fixes are made to what’s deemed a critical threat, whilst an adversary is weaponising a lower-rated vulnerability that’s not high up the list of priorities for remediation.

Rather than focusing solely on severity ratings, organisations need to assess vulnerabilities according to real-world risk. This means having the ability to combine exploitation signals, threat actor activity, ransomware group associations and specific tech stacks to effectively surface the CVEs that actually require attention. Essentially, security teams can utilise cyber threat intelligence to build an understanding of whether adversaries are actively discussing or weaponising vulnerabilities to prioritise where they direct their resources and mitigation efforts.

The businesses getting ahead of attackers are those breaking a reactive cycle of vulnerability patching. They are increasingly adopting intelligence-led strategies to effectively determine where a vulnerability sits in the exploitation lifecycle to take action before attackers can take advantage.

Threat intelligence also enables automation and the foundations for embracing AI to prioritise vulnerability remediation at machine-speed. By continuously ingesting exploitation signals, monitoring threat actor activity and correlating insights against an organisation’s tech stack, teams can significantly reduce the manual effort for triaging vulnerabilities. This can prove beneficial for evolving from reactive patching to proactive risk reduction.

Ultimately, cyber resilience is no longer about trying to fix everything. It’s about fixing what matters most in a timely way, before attack intent becomes a breach. Vulnerability prioritisation is crucial to this and can enable security teams to consistently identify and address the highest-risk cyber threats.

By Alexander Leslie, Senior Advisor at Recorded Future 

The post Securing What Matters: Why Cyber Resilience Needs Prioritisation appeared first on IT Security Guru.