Christopher Clark, Cyber Security Incident Response Team Director, Thrive 

Geopolitical escalation can become a cyber security problem for businesses far more quickly than many boards expect.

The National Cyber Security Council (NCSC) has warned that UK critical infrastructure faced more than 200 cyber incidents over the past year, with around three-quarters believed to be linked to state actors. Analysis of the conflict involving Iran has also found cyber retaliation following military escalation within hours, bringing events overseas much closer to the day-to-day reality of UK organisations.

That risk has already been demonstrated on UK soil. In July, a cyber-attack reportedly linked to Iranian hackers forced a small UK power generator offline for four days. The government said there was no risk to the wider energy system, but the incident shows how quickly geopolitical cyber activity can translate into operational disruption.

Energy, healthcare, water and telecoms remain obvious targets because disruption can affect essential services. Yet, hostile state activity does not stop at the boundary of critical infrastructure.

Hostile state risk extends beyond critical infrastructure

A business does not have to be an obvious target to become one. It may be connected to a larger customer, supplier, regulator or public body that an attacker ultimately wants to reach. In other words, you do not have to be the objective. You just have to be the way in.

There is also the risk of spillover. Targeting can follow politics rather than the size of a company or its balance sheet. If an organisation has operations or suppliers connected to a live conflict, it can become collateral even when nobody set out specifically to target it.

Businesses also need to reconsider what hostile state activity is likely to look like inside their own environments. The most significant intrusions are not necessarily the noisiest.

Security teams may be watching for malware, failed logins or a sudden increase in DDoS activity. Capable attackers increasingly use valid credentials and legitimate administration tools, allowing malicious behaviour to resemble normal activity.

There may also be no obvious warning to investigate. If the plan is to wait for one, the organisation may already be too late by the time it appears.

A better working assumption is that a capable actor could already be inside, or could get in without immediately triggering an alert. The question then becomes what they can actually do once they have that foothold.

Trusted technology can create the same problem. Management platforms and legitimate system tools can be repurposed by attackers, while compromised software packages can provide access to many organisations at once. Activity entering through a tool or supplier that the business already trusts may attract less scrutiny because it appears legitimate.

The same principle applies to suppliers. If a connected partner has been compromised, one of the first questions should be what has been done to separate that organisation from your own environment. Continuing normal access without understanding what happened risks transferring their exposure into your network.

Organisations should know how they would isolate an affected supplier and what evidence would be required before connectivity resumed. They may need confirmation of how the attacker entered and which systems were affected, alongside assurance that the access has been removed. Shared applications or other connections may have to remain unavailable until that information is clear.

That can be uncomfortable for the business, but restoring connectivity too quickly can create a much bigger problem later.

The time available to make these decisions is shrinking. Threat actors can analyse newly disclosed vulnerabilities and move to exploitation quickly, with AI making parts of that process faster. In some cases, organisations can be exposed within hours of a vulnerability becoming known.

Patch management therefore cannot always wait for the normal maintenance cycle. Teams need to know which vulnerable systems create the greatest risk and be ready to prioritise them when a new vulnerability emerges.

Geopolitical risk can also outlast the immediate conflict.  A ceasefire does not automatically remove access established during a period of heightened activity, nor does it mean proxy groups will stop operating. Attackers have good reason to preserve a foothold that may be useful later. I have seen access remain available inside an environment for three years or more.

That is why an easing of geopolitical tension should not automatically be treated as a reduction in cyber risk.

Containment depends on preparation and experience

Preparation has to focus on containing an attacker as well as keeping them out. Standing privileges should be kept to a minimum, networks should be segmented so an attacker cannot move freely towards critical systems or backups, and offline backups need to be regularly tested.

Organisations also need a clear view of their external attack surface and where their greatest points of exposure lie. Regular tabletop exercises should use realistic scenarios informed by current threat intelligence.

If an attacker gained access through a VPN or compromised supplier, what could they reach next? How far could the incident spread? And who has the authority to cut them off?

That authority needs to be clear before an incident. Time can be lost when technical teams know what needs to happen but must wait for decisions on whether systems can be disconnected or business processes interrupted.

Experience is equally important. Frameworks provide structure, but serious incidents rarely follow a script. Responders who have handled repeated compromises understand where investigations can stall, which decisions cannot wait and what needs to be secured before systems are safely returned to service.

For many organisations, maintaining that level of incident response experience entirely in-house is difficult. What matters is having access to people who have dealt with incidents under real operational pressure and can apply that experience quickly when normal assumptions no longer hold.

Hostile state cyber activity should now be treated as a routine business risk rather than something considered only when international tensions make the headlines.

Organisations should be asking a more immediate question: if something gets through today, how far can it spread before we stop it?

Answering that question before an attack happens can make the difference between a contained security incident and a prolonged operational crisis.

The post Why hostile state cyber activity is now a day-to-day business risk appeared first on IT Security Guru.

Artificial intelligence is changing vulnerability discovery. At OpenSSL, we are seeing that change first-hand. A year ago, our security address received around nine separate reports and enquiries a month. It now receives around 70. AI tools can examine source code and identify potential security issues at a scale that would previously have required significant human effort.

In many ways, that’s positive. Finding vulnerabilities is an essential part of making software more secure. But there is another side to this that deserves much more attention. Every vulnerability report has to go somewhere.

Someone needs to assess whether the issue is genuine. If it is, engineers need to understand its severity, develop a fix, test that fix and manage disclosure appropriately. AI can increase the speed at which potential problems are discovered. It does not automatically increase the number of experienced engineers available to deal with them. That imbalance could become a serious issue for open-source security.

Finding a vulnerability is only the beginning

There is an understandable tendency to treat vulnerability discovery as the success story. An AI system finds something humans missed. That makes a compelling headline. But identifying a potential weakness and resolving it are very different tasks.

A report might represent a serious vulnerability. It might be something already understood. It might be technically correct but have limited real-world security impact. It might simply be wrong. Working out which of those is true requires expertise. Then, if there is a genuine vulnerability, somebody has to fix it.

Over the past 12 months we received a little over 400 vulnerability reports. 43 resulted in a published CVE. Roughly one in ten. The other nine still had to be read, understood, reproduced where we could, and answered. A report that turns out not to be a vulnerability consumes much the same expert attention as one that is — sometimes more, because establishing that something cannot be exploited is often harder than confirming that it can.

For a commercial software company with large security teams, increasing the number of reports may be manageable. For an open-source project with limited resources, a sudden increase can create a very different problem. The technology for finding possible vulnerabilities is becoming cheaper and more accessible. However, the expertise required to investigate them is not.

Businesses depend on projects they may barely know exist

This connects to a much older problem with open-source. Most technology companies know they use open-source software. What is less clear is whether they understand exactly which projects their products and services depend upon. That distinction matters.

Open-source components can sit deep inside software stacks. They work quietly, so organisations may have little reason to think about the people maintaining them. Then something goes wrong.

Heartbleed was an important moment for OpenSSL because it exposed the gap between the importance of open-source infrastructure and the resources available to support it. The industry responded. Investment increased and organisations began paying much more attention to the sustainability of critical open-source projects.

My concern is that some of those lessons are beginning to fade, and AI could make the consequences of that particularly visible.

AI changes the economics of vulnerability discovery

There is an asymmetry developing. The cost of searching code for potential security weaknesses is falling. The volume of reports can therefore rise significantly. But the other side of the process remains stubbornly human. Experienced engineers still need to understand the code. They need to judge whether the finding matters and decide how it should be fixed without creating another problem somewhere else.

Those people are a scarce resource. This means the question organisations should be asking about AI and cybersecurity isn’t only: “What can AI find?” It should also be: “Who is going to deal with everything it finds?”

For open-source projects, that leads directly to questions about sustainable funding. If businesses depend on a project as part of their critical infrastructure, supporting the health of that project should be viewed as part of resilience, not philanthropy.

Regulation only gets us part of the way

Governments are understandably looking at how regulation can improve cyber resilience. That matters, but regulation cannot maintain software. Europe provides some interesting examples of a different approach. OpenSSL Foundation has received support from Germany’s Sovereign Tech Agency, which invests directly in open digital infrastructure.

That recognises something important: if technology is critical to the functioning of the digital economy, somebody needs to invest in the people maintaining it. I’d like to see more of that conversation in the UK. Cyber resilience isn’t only about telling organisations what standards they should meet. We also need to consider the health of the technology underneath the services we’re trying to protect.

Organisations need to know what they depend on

There is something businesses can do immediately. Understand your open-source dependencies. If a critical vulnerability appeared tomorrow in a project your organisation relies on, could you identify where that software was being used?

Would you know which products and services were affected? Would you know who maintains the project? And would you have any relationship with the community responsible for fixing it? If the answer is no that is a resilience gap.

Organisations don’t necessarily need to contribute code themselves. There are other ways to support projects, including funding, engineering resources and participation in the communities maintaining the technology they depend upon. The important shift is recognising open source as infrastructure rather than free software that simply appears.

We need to talk about the people behind the code

AI will continue getting better at analysing software. That’s exciting, and it has the potential to make technology significantly more secure. But more findings do not automatically produce more security. The benefit comes when we have the expertise and resources to act on what those tools discover. That makes this a human question as much as a technology question.

How do we sustain the communities maintaining critical open-source infrastructure? How should businesses support the projects they depend on? What happens when vulnerability discovery accelerates faster than our ability to respond?

The post AI is finding vulnerabilities faster. Who is funding the people expected to fix them? appeared first on IT Security Guru.

By Aimee Steele, threat intelligence analyst at Talion Cyber Security

Last month, the UK’s National Cyber Security Centre (NCSC) issued an advisory around a new phishing campaign targeting organisations in the West that was being carried out by the Russian state-sponsored threat actor known as Laundry Bear.

The campaign, saw the threat actors exploiting a zero-day vulnerability in Zimbra Collaboration Suite in order to compromise networks, before gaining persistence, accessing emails, stealing sensitive data and conducting espionage against organisations using vulnerable Zimbra Mailservers.

The advisory from the NCSC was issued in conjunction with advisories from 15 other countries, including the US, Finland, Australia, Denmark and France, and it advised that the threat actors were targeting critical industries in order to steal sensitive information with Russian government backing.

Phishing is nothing new and is regularly cited as the most prevalent method used within cyberattacks. However, what made this attack stand out and warrant such a coordinated international response, was its deviation from conventional phishing techniques, amounting to a markedly sophisticated zero-click campaign.

Successful exploitation did not rely on users clicking a link or opening an attachment; victims simply needed to open an email.

Typical phishing attacks rely on user interaction. The victim might click on a malicious link or open an attachment. The threat actor might leverage phishing techniques to deploy malware, infiltrate systems or networks and establish backdoors for persistent access. Even at the most basic level, attackers might simply use stolen credentials to access private user accounts, such as a bank account, to commit financial fraud.

In this instance, successful exploitation did not depend on outright deception; there were no features that might typically raise a user’s suspicion. The victim didn’t need to do anything at all.

So, how did the attackers get in?

The campaign

The threat group was able to exploit a zero-day XSS vulnerability in the Zimbra Collaboration Suite (CVE-2025-66376), the exploit having been embedded in the HTML body of the message and triggered upon opening or previewing. Emails were issued from either Proton Mail accounts or previously compromised email addresses.

Successful exploitation gave attackers access to the webmail server, allowing them to establish persistence, access users’ mailboxes and steal sensitive emails and authentication data.

From there, the stolen information could be used to conduct cyber espionage, gather intelligence on government and critical infrastructure organisations, and potentially facilitate further compromise of connected systems. Attackers were also able to leverage their access to target specific victims in spearphishing attempts. In instances such as this, having access to contextual information can add an additional layer of legitimacy to communications.

Protecting against Zero-Click attacks

Following the discovery of the vulnerability, Zimbra released security updates to address the flaw, and any organisation using affected versions of Zimbra Collaboration Suite should ensure these patches have been applied as a priority. If this is not immediately actionable, it is advisable for organisations to implement another suitable mail client in the meantime.

However, patching alone should not be considered sufficient. Organisations should also review logs, monitor for indicators of compromise, investigate unusual authentication activity and assess whether attackers may have gained access before the vulnerability was remediated. Multi-factor authentication, network segmentation and continuous monitoring can also help limit the impact if a compromise does occur.

Attacks like these also reinforce the importance of detection and response, which can help spot malicious access quickly, before attackers have an opportunity to compromise networks and access data.

Zero-click exploits present a greater challenge to the individual user than typical phishing attempts. However, they can still play an important role in limiting the impact of such attacks by remaining vigilant for unusual login alerts, unexpected password reset notifications or signs that an account has been accessed without permission.

Users should also ensure multi-factor authentication is enabled wherever possible, use strong and unique passwords, and be alert for any follow-on phishing attempts, as attackers will often use information stolen during an initial compromise to target victims further.

Lessons for organisations

Zero-click attacks are particularly deceptive because they present without the typical warning signs users are trained to look out for in social engineering and phishing scams.

This recent zero-click campaign by Laundry Bear begs the question as to whether current user awareness training is particularly affective in the prevention of successful phishing attacks, which are becoming increasingly sophisticated.

In general, rapid patching supports robust remediation strategy and is fundamental if organisations wish to prevent exploitation, rather than react to it. In addition, continuous monitoring and effective detection and response capabilities are fundamental when reacting efficiently to zero-clicks.

Considering the severity of the attack, any organisation using Zimbra Collaboration Suite should ensure they have applied the latest security updates as a priority.

Organisations should also assume patching alone is insufficient, and review logs, authentication activity and other indicators of compromise to determine whether they were breached before the vulnerability was remediated.

Overall, attacks like these require a layered approach to security, helping identify attackers and potential threats before organisations are compromised further.

The post Protecting Against Zero-Click Attacks appeared first on IT Security Guru.

Cybersecurity has become one of the most defining business challenges of recent times. Organisations have invested heavily in protecting their networks, securing cloud environments and strengthening identity and access management. At the same time, organisations are under increasing pressure to prove they are handling sensitive information securely, not just storing it safely but protecting it throughout its journey.

Yet despite this progress, one area continues to receive far less attention than it deserves: how data is shared.

Most organisations have become very good at protecting data while it is stored. Files are encrypted, key handling is properly managed, access is restricted and systems are monitored around the clock. However, once that information needs to leave the organisation, whether it’s being sent to a customer, supplier, auditor or business partner, the controls often become less robust.

Every day, organisations exchange contracts, financial information, employee records, legal documents and commercially sensitive files. More often than not, this happens via email attachments or cloud-based file-sharing services because they are familiar and convenient. The problem is that convenience does not always equal security.

Email remains one of the most common routes for cyber attacks. Phishing, spoofed domains, malicious attachments and business email compromise continue to account for a significant proportion of successful breaches. However, most incidents do not involve a sophisticated bad actor. The official UK annual Cyber Security Breaches Survey continues to show the majority of incidents stem from everyday mistakes.  An email sent to the wrong recipient, an attachment forwarded outside the organisation or a file shared with overly broad permissions can expose sensitive information in seconds.

Human error remains one of the biggest cyber risks organisations face, particularly as businesses become increasingly connected. Information now flows constantly between employees, customers, suppliers, consultants and regulators. Every transfer creates another opportunity for something to go wrong.

What is often overlooked is that securing data is not just about protecting where it is stored. It is also about understanding the journey it takes.

Many organisations assume that because they operate in the UK, their sensitive information remains within UK borders. In reality, emails and attachments may be routed through multiple countries and cloud infrastructures before arriving at their destination. While this is often an invisible part of modern digital communications, it raises important questions around governance, compliance and data sovereignty.

For organisations operating in regulated sectors, this matters. Financial services firms, local authorities, healthcare providers and legal organisations are increasingly expected to demonstrate not only that data is protected, but also that it is managed responsibly throughout its entire lifecycle. Knowing where information is stored is only part of the picture. Understanding where it travels, who has access to it and how it is controlled has become equally important.

This is why conversations around geofencing and data sovereignty are gaining momentum. Rather than simply encrypting information and hoping for the best, organisations are beginning to ask whether they should have greater control over where sensitive data is permitted to travel. If businesses routinely place restrictions on the movement of physical assets, it seems only logical that they should apply similar thinking to digital information.

At the same time, regulators and auditors are asking more searching questions about how organisations exchange information with third parties. They want to understand how access is controlled, whether there is a complete audit trail and what safeguards exist once information leaves the organisation. These are no longer technical questions reserved for IT teams. They are governance issues that increasingly involve compliance, procurement, risk and senior leadership.

There is also a growing disconnect between the way organisations work and the security controls they have in place. Hybrid working, cloud collaboration and increasingly complex supply chains mean information rarely stays within a single organisation. Yet many businesses continue to rely on processes that were designed for a very different way of working.

This is where a change in mindset is needed.

Cybersecurity should not end when a document is saved securely on a server or in the cloud. Information is often at its most vulnerable when it is moving between people, organisations and systems. Protecting data in transit should therefore be considered just as important as protecting data at rest.

That does not mean making it harder for employees to do their jobs. Quite the opposite. Security should support the way people work, allowing information to be shared safely without creating unnecessary barriers or encouraging workarounds that introduce even greater risk.

Organisations need to take a more holistic view of information security. Protecting sensitive data means understanding its entire lifecycle, from creation and storage through to sharing, collaboration and eventual deletion. It means knowing not only who can access information, but where that information is travelling and whether that journey aligns with the organisation’s security, compliance and governance obligations.

Threats aren’t standing still, and neither are regulators. Focusing only on data that’s sitting in storage means missing one of the biggest holes in your security. It’s not enough to just lock data away; it needs to stay safe wherever it travels.

*DOQEX provides a secure data exchange and email gateway platform that helps businesses protect confidential information.

The post The Hidden Risk in Data Transfer appeared first on IT Security Guru.

By Simon Phillips, CTO, CybaVerse

Alert fatigue is an issue that has plagued Security Operations Centres for years.

As organisations’ digital estates grow, there is more architecture to secure and more architecture for threat actors to attack, which has ultimately led to more alerts.

Today, on average a SOC will face thousands of alerts every day, each of which could indicate a potential threat. Each alert must therefore be analysed and investigated before appropriate action can be taken.

However, ask any SOC analyst and they will tell you the majority of these alerts are benign or false positives.

Yet, analysts will still spend hours investigating activity that ultimately poses little or no risk, hoping to identify the small number of genuine threats hidden amongst the noise.

Given the volume they face, and the possibility of missing something before it’s too late, it’s a noisy, high-stress environment that often leads to burnout and fatigue.

To tackle these issues, many SOCs today are turning to Artificial Intelligence (AI) to support the management of alerts.

In this scenario, the first-line analyst is replaced by an agent that reviews the incident to determine whether it’s malicious and if further action is required. The analyst must then review the conclusion reached by the agent to ensure it is accurate, but they don’t conduct the initial investigations themselves, which reduces the volume of alerts they have to investigate every day.

However, even despite these improvements, is there another way that could reduce the noise even further?

If organisations are still generating huge numbers of unnecessary alerts, have they actually solved the underlying problem, or simply moved it further downstream?

Moving AI upstream

Instead of asking AI to investigate incidents after they have been created, some organisations are using the technology much earlier in the detection process.

Rather than having AI decide whether an alert is malicious, in this scenario it’s used to help build better detection logic and more effective workflows before alerts ever reach an analyst.

For instance, in a phishing attack when an employee reports an email as suspicious, many security platforms immediately generate an incident that someone must investigate.

Traditionally, either a human analyst or an AI assistant would then collect additional context, checking whether links have been clicked, whether anyone else received the email, or whether similar activity appeared elsewhere in the environment.

If these types of checks are incorporated into the detection process, and the answers to the questions are no, then an incident would never need to be created in the first place.

The AI would determine that there was no wider threat, meaning the alert could be filtered out before it ended up in the SOC ticket queue.

The result is a faster, more efficient SOC, with far fewer unnecessary alerts reaching analysts.

From a customer perspective, this can also reduce the costs of working with an outsourced SOC partner.

Many AI-powered investigation platforms price their services according to the number of alerts they process, so reducing unnecessary alerts before they reach the investigation stage can improve efficiency while also helping organisations control operational costs.

Improving security through engineering

Another benefit of moving AI further upstream is that it limits access to sensitive customer data.

Many AI-driven investigation platforms analyse real customer logs and incident data to determine whether activity is malicious. While providers implement safeguards, some organisations are uncomfortable with sensitive operational data being processed by external AI systems, particularly where regulatory or contractual obligations apply.

Using AI during detection engineering changes this process. The AI is used to create the logic that identifies threats, not to inspect live customer data.

Once the detection rules have been verified, they can be applied consistently across customer environments without repeatedly sending operational data through AI models.

Solving the cause, not the symptom

The cyber security industry has become very good at handling alert fatigue, but not so good at preventing it. Is it time a different approach was adopted?

If security teams continue generating thousands of low-value alerts every day, replacing analysts with AI may improve efficiency, but it won’t address why the alerts exist in the first place.

As AI becomes more deeply embedded within security operations, organisations should consider where it delivers the greatest value. In many cases, the answer may not be at the point where analysts investigate incidents, but much earlier, where better detection engineering prevents unnecessary incidents from being created at all.

By reducing false positives at the source, this allows analysts to spend more time on genuine threats, while improving consistency, cutting costs and helping organisations make better use of both their technology and their people.

The post Is AI entering the SOC at the right stage? appeared first on IT Security Guru.

2026 is touted as the year AI moves from speculation and interest to real-world deployment and value. Yet one global analyst firm predicts 40% of agentic AI projects will be canceled by the end of 2027, due to escalating costs, unclear business value or inadequate risk controls.

It suggests more and better advice and an ecosystem of support are needed to make agentic projects a success, which must include addressing new security considerations.

There are early signs that the rise of agentic AI is transforming how organisations operate. In retail, AI agents are already managing inventory, optimising pricing, assisting customers, forecasting demand, and automating supply chain decisions.

At the same time, logistics organisations are deploying autonomous agents to coordinate warehouse operations, route shipments, manage fleet utilisation, track inventory movement, and resolve operational exceptions in real time.

These systems are no longer simple chatbots or assistants—they are becoming autonomous digital operators capable of making decisions and executing actions across business-critical systems.

New Security Considerations in 2026
While the business benefits are significant, the security implications are equally profound. As AI agents gain access to enterprise applications, APIs, devices, customer information, and operational systems, organisations must address a critical question: How do we secure AI agents that increasingly operate like employees but at machine speed and scale?

Traditional AI security concerns such as prompt injection, data leakage, and model vulnerabilities remain important. However, security leaders are now confronting a broader challenge – governing autonomous agents that can access tools, execute workflows, interact with physical devices, and influence business outcomes without constant human oversight. The conversation is shifting from securing AI models to securing AI-powered digital workforces. So, what are the new security considerations and methods to address them in 2026?

Treat AI Agents as Digital Identities
Every AI agent should be managed as a non-human identity rather than merely an application. Just as organisations govern employee access through identity and access management systems, AI agents require unique credentials, role-based permissions, lifecycle management, and continuous auditing.

In retail, an inventory optimisation agent should not automatically gain access to customer payment systems. In logistics, a route-planning agent should not be able to modify warehouse management configurations without authorisation. Applying least-privilege principles ensures that agents can perform their intended tasks while minimising security exposure. Without proper governance, an unmanaged AI agent can quickly become a highly privileged insider capable of accessing sensitive systems and data.

Govern MCP and Tool Access
The Model Context Protocol (MCP) is emerging as a key mechanism for connecting AI agents with enterprise tools, databases, applications, and external services. While this connectivity enables powerful automation, it also expands the attack surface.

Organisations should establish strong governance around MCP servers and tool integrations. This includes validating trusted MCP endpoints, implementing allowlists for approved tools, inspecting contextual information passed to models, and continuously monitoring tool usage.

For retailers, this could mean restricting access to pricing engines, loyalty systems, or inventory platforms. For logistics providers, it may involve controlling access to transportation management systems, warehouse automation platforms, carrier networks, and shipment tracking services. A compromised tool connection can provide attackers with a direct path into critical operational workflows.

Secure Runtime Operations
Security cannot stop once an AI agent is deployed. Autonomous systems must be monitored continuously throughout their operational lifecycle.

Runtime security controls should include policy enforcement, behavioral monitoring, approval checkpoints for high-risk actions, anomaly detection, and emergency kill switches. These controls help identify and contain risky behavior before it impacts business operations.

For example, a retail agent that suddenly attempts to modify thousands of product prices should trigger investigation. Similarly, a logistics agent that begins rerouting large volumes of shipments or altering delivery schedules outside established policies should be flagged immediately.

Continuous runtime visibility is essential because even well-trained agents can drift from expected behavior due to changing inputs, evolving objectives, or malicious manipulation.

Don’t Forget the Devices
Agentic AI increasingly interacts with physical infrastructure. In retail environments, agents may access point-of-sale systems, kiosks, handheld scanners, smart shelves, and IoT devices. In logistics operations, agents often interact with warehouse scanners, robotics systems, automated storage equipment, vehicle telematics, fleet management platforms, and industrial IoT sensors.

A compromised endpoint can influence the decisions made by an AI agent, creating downstream business risks. Device trust, posture validation, endpoint security, and continuous compliance monitoring should therefore be integrated into any Agentic AI security strategy.

Build Security Across Every Layer
Organisations should adopt a layered security approach spanning agent identities, MCP and tool governance, runtime protection, endpoint trust, API security, and data protection. Strong authentication, least-privilege access, token management, behavioral analytics, and continuous monitoring should work together to provide defense in depth.

Continuously Red Team Your Agents
Traditional penetration testing is no longer sufficient. Agentic AI systems must be continuously evaluated against threats such as prompt injection, goal hijacking, privilege escalation, tool abuse, workflow manipulation, and business logic attacks.

Retail and logistics organisations should regularly test complete agent workflows rather than individual components. The objective is to understand how autonomous systems behave under real-world adversarial conditions and identify weaknesses before attackers do.

Getting the Balance Right
Retail and logistics organisations are rapidly deploying AI agents to automate increasingly critical business processes. The leaders in this new era are not those who deploy the most intelligent agents, but those that also establish the strongest foundations of trust, governance, and security.

As AI agents gain access to inventory systems, pricing engines, warehouse platforms, transportation networks, customer data, and operational devices, the key question will be getting the balance right between securing AI agents like software and governing them as digital identities.

The post Building Trustworthy Agentic AI: How Security Concerns Have Changed in 2026 appeared first on IT Security Guru.

Smart buildings promise greater efficiency, improved sustainability and enhanced operational oversight. However, as building management systems, security platforms and energy infrastructure become increasingly interconnected, they also create new pathways for cyber threats that can disrupt physical operations as readily as digital services. Here, Peter Schwartz, senior technology consultant at cybersecurity expert OryxAlign, explains why organisations need to rethink how they manage cyber-physical risk in connected buildings. 

As organisations continue to integrate building management systems, access control, CCTV, environmental monitoring and energy infrastructure, the benefits of connectivity are clear. Shared networks provide greater operational visibility, support remote management and help organisations optimise energy use and building performance.

Yet this growing connectivity also expands the attack surface. Smart buildings should be viewed as operational environments where cybersecurity has a direct impact on business continuity, not just technology platforms that improve efficiency.

Connected systems, connected consequences

The conversation around smart buildings often focuses on energy savings, occupancy analytics and automation. These capabilities undoubtedly deliver value, but they can also overshadow a fundamental consideration in resilience. As building systems become more connected, organisations must consider what happens if those systems are unavailable or deliberately manipulated.

Unlike traditional cyber incidents, the impact is not always measured by stolen data. A cyber-attack against a building management system can have immediate and physical and operational consequences. Consider a modern office where the building management system controls heating, ventilation and air condition (HVAC), access control and environmental monitoring. If an attacker gains access through poorly secured connected devices and moves into the building management network, they may choose not to steal information at all.

Instead, they could alter HVAC schedules and disable environmental alerts. Temperatures begin rising in communications rooms and equipment spaces, critical systems experience outages and facilities teams lose visibility of alarms and system status. The result is operational disruption and potential equipment damage rather than a conventional data breach.

This is why smart buildings should be viewed as operational environments rather than collections of connected technologies. Cybersecurity is now about maintaining operational continuity as well as protecting information.

Overlooked security gaps

Many of the systems that present the greatest cyber-physical risk are not traditionally managed as IT assets. Environmental sensors, smart cameras, access control devices, energy management systems and legacy building management controllers are frequently considered operational technology, meaning they can fall outside conventional cybersecurity reviews.

During procurement, organisations understandably focus on functionality, performance and integration. However, security requirements, patching responsibilities and lifecycle management often receive far less attention. As more connected systems are introduced, these gaps become increasingly significant because vulnerabilities with operational technology can create an entry point into wider business operations.

The technology itself is only part of the challenge. Third-party vendors and systems integrators often retain privileged remote access for maintenance and support, making supplier security practices an equally important consideration. The UK Government’s Cyber Security Breaches Survey 2025 highlights the wider governance challenge, reporting that only 14 per cent of businesses formally review the cybersecurity risks associated with their immediate suppliers, while just seven per cent assess risks across their wider supply chain.

Although these figures are not specific to smart buildings, they demonstrate that third-party risk remains an area where many organisations have more work to do. Strong governance, clear contractual accountability and regular security assessments should therefore apply equally to both connected technologies and the organisations responsible for supporting them.  

Resilience through visibility

Reducing cyber-physical risk does not require organisations to sacrifice the benefits of integration. Instead, the priority should be integrating systems in a way that improves visibility while maintaining appropriate separation between them.

Effective integration is about ensuring systems can share information securely through appropriate network segmentation, clearly defined trust boundaries, robust identity controls and centralised monitoring. The objective is greater operational awareness and faster incident response rather than creating a larger interconnected environment.

This approach is reflected in guidance from the National Institute of Standards and Technology (NIST). Its Guide to Operational Technology (OT) Security identifies building automation and physical access control systems as operational technology requiring dedicated cybersecurity controls, recommending measures such as network segmentation, strong identity management and continuous monitoring to reduce operational risk.

Monitoring also plays a critical role because most cyber-physical incidents begin as relatively small anomalies. Unexpected device behaviour, unusual network communications, failed authentication attempts, unauthorised configuration changes or equipment unexpectedly going offline can all indicate an emerging issue. Combining asset visibility, operational telemetry and cybersecurity insights enables organisations to identify problems before they affect building operations. Simply, organisations cannot protect systems they cannot see.

Shared ownership matters

As building systems IT infrastructure and physical security increasingly overlap, organisations also need to rethink how responsibility is managed. Traditional siloed ownership models are becoming increasingly difficult to sustain because operational resilience now depends on multiple disciplines working together.

Facilities teams, IT departments and physical security specialists each bring different expertise, but connected buildings require a shared governance framework that applies cybersecurity policies, risk assessments and incident management processes consistently across both IT and operational technology environments. Shared accountability is essential for protecting connected buildings against increasingly complex operational risks.

For organisations looking to strengthen resilience, the most effective starting point is often the simplest. Establish a complete inventory of connected building systems and devices. Many organisations still do not have a comprehensive understanding of everything connected to their environment. Once that visibility exists, unsupported systems can be identified, unnecessary connectivity removed, vulnerabilities assessed and appropriate monitoring introduced. Improving visibility remains one of the fastest and most cost-effective ways to reduce cyber-physical risk.

As organisations continue investing in smarter buildings, cyber-physical risk should no longer be considered a specialist concern for facilities or IT teams in isolation. Connected environments deliver significant operational benefits, but they also require a shared approach to governance, monitoring and resilience. Organisations that understand what is connected, establish clear ownership across facilities, security and IT teams, and build visibility into their operational environments will be far better placed to maintain business continuity as smart buildings continue to evolve.

To learn more about strengthening the resilience of connected buildings, visit the OryxAlign website.

The post Managing cyber-physical risk in smart buildings appeared first on IT Security Guru.

Recent government data shows the scale of cyber threats facing security teams. According to the Cyber Security Breaches Survey 2025/2026, it’s estimated that UK businesses experienced 5.19million cyber crimes in the last 12 months. This means an average of over 14,000 incidents per day.

The volume and frequency of threats show little sign of slowing. IT Security Guru recently reported a 34% increase in cyber attacks in June, compared with the same month last year. Every day seems to bring new vulnerabilities, new alerts and new attacks, compounding a mounting challenge for teams operating with stretched resources and budgets. Threats are intensifying, while security teams are tracking thousands of vulnerabilities across on-premises infrastructure, cloud environments and increasingly complex supply chains.

While organisations continue to invest in cyber defences, the reality is that security teams cannot patch every vulnerability or investigate and act on every threat. Adversaries understand this imbalance and are increasingly exploiting it. Rather than relying solely on sophisticated attach techniques, many threat actors are attempting to hit businesses from every direction by increasing the volume, speed and frequency of attacks. The aim is to overwhelm security teams and misdirect their attention through a constant stream of alerts, vulnerabilities and incidents. Attackers can then, in theory, concentrate on a successful breach that flies under the radar.

Artificial Intelligence (AI) is being leveraged by cyber criminals to evolve this form of attack. LLMs can be used to accelerate reconnaissance of targets, amplify deception and social engineering, and significantly cut the time between vulnerability disclosure and working exploit. The expansion of cybercrime-as-a-service ecosystems are also lowering the barriers to entry for less-skilled adversaries and further contributing to a trend of faster, smaller, harder-to-disrupt attacks.

Faced with a relentless avalanche of cyber attacks, security teams must accept the uncomfortable truth that not every vulnerability matters equally. A key step for achieving this is building an intelligence led approach to vulnerability prioritisation, shifting beyond an over-reliance on Common Vulnerability Scoring System (CVSS) scores to manage risk.

Many businesses rely heavily on CVSS ratings to organise patching and remediation priorities. And, although CVSS remains a useful measure of technical severity, it doesn’t tell security teams whether a vulnerability is actually being targeted by threat actors. There may be instances, for example, where a vulnerability receives a critical score, but it isn’t being actively being exploited or lined up in a threat actor’s crosshairs. The consequence of this can be that fixes are made to what’s deemed a critical threat, whilst an adversary is weaponising a lower-rated vulnerability that’s not high up the list of priorities for remediation.

Rather than focusing solely on severity ratings, organisations need to assess vulnerabilities according to real-world risk. This means having the ability to combine exploitation signals, threat actor activity, ransomware group associations and specific tech stacks to effectively surface the CVEs that actually require attention. Essentially, security teams can utilise cyber threat intelligence to build an understanding of whether adversaries are actively discussing or weaponising vulnerabilities to prioritise where they direct their resources and mitigation efforts.

The businesses getting ahead of attackers are those breaking a reactive cycle of vulnerability patching. They are increasingly adopting intelligence-led strategies to effectively determine where a vulnerability sits in the exploitation lifecycle to take action before attackers can take advantage.

Threat intelligence also enables automation and the foundations for embracing AI to prioritise vulnerability remediation at machine-speed. By continuously ingesting exploitation signals, monitoring threat actor activity and correlating insights against an organisation’s tech stack, teams can significantly reduce the manual effort for triaging vulnerabilities. This can prove beneficial for evolving from reactive patching to proactive risk reduction.

Ultimately, cyber resilience is no longer about trying to fix everything. It’s about fixing what matters most in a timely way, before attack intent becomes a breach. Vulnerability prioritisation is crucial to this and can enable security teams to consistently identify and address the highest-risk cyber threats.

By Alexander Leslie, Senior Advisor at Recorded Future 

The post Securing What Matters: Why Cyber Resilience Needs Prioritisation appeared first on IT Security Guru.