Two critical PHP vulnerabilities, the widely used programming language underpinning millions of websites and web applications, have prompted urgent warnings from cybersecurity authorities worldwide.

Following reports on the 20th October that details of the vulnerabilities had leaked ahead of their scheduled disclosure, PHP developers released emergency security updates on 21 October. The UK’s National Cyber Security Centre (NCSC) urged organisations to identify affected systems and apply updates immediately, while Amazon’s threat intelligence team reported evidence of exploitation attempts dating back to 17 October.

With the vulnerabilities highlighting the potential consequences of security flaws in widely used web infrastructure, The IT Security Guru has gathered reactions from cybersecurity industry experts on the risks, implications and lessons for organisations.

Samuel Hassine, CEO and co-founder, Filigran:

“Taking a website offline for a day is a far cheaper decision than explaining a breach for a year. The agencies asking organisations to do exactly that are giving sound advice, and the speed of the coordinated response shows how much the discipline has matured. These flaws sat in code that dates back to 2004 and were found with AI. The same tools will help attackers move just as fast, and early attacks are already being reported. The job is simple to state and hard to do. Find every system running PHP, including the ones hidden inside third-party products. Update to a supported version or take it offline. Then check that nothing got in while the window was open. Patching is the easy part. Knowing what you run is the real test.” 

Sai Molige, senior manager of threat hunting at Forescout: 

“PHP2Shell has the potential to become a Log4Shell-scale event, but for a different reason. With Log4j, the main problem was finding a library you didn’t know you had. With PHP, much of the forgotten infrastructure will be found, but won’t have an upstream fix.

“The durable lesson from Log4j is that organisations should treat “How quickly can we identify where we run X” as a measurable capability separate from patching speed.

“Discovering vulnerable infrastructure, however, is only the first step. When older systems have no available fix or depend on a vendor update, organisations need to reduce exposure, restrict unnecessary connections, and isolate affected systems while planning remediation.

“AI is very good at performing variant analysis when it has a reference point, lowering the effort and expertise required. That could increase the volume of attempts we see with these critical vulnerabilities, even if many never turn into full exploits.

“Common places where forgotten PHP tends to live include:

• Vendor appliances whose admin UIs are PHP: NAS devices, some firewalls and VPN portals, printers, building-management panels, and OT/ICS HMIs with web front ends. Organisations cannot patch them directly and have to wait for vendors which introduces lag.
• Bundled runtimes. Control panels and commercial packages often ship their own PHP binary, invisible to the OS package manager.
• Containers pinned to old base images. The host is current; the image from 2021 isn’t.
• Marketing microsites, campaign pages, and acquired-company infrastructure, often on hosting accounts paid by credit card outside IT.
• Admin tools on dev or jump boxes: phpMyAdmin, Roundcube, Nextcloud.
• Origins behind a CDN or WAF that are still directly reachable, which quietly defeats your edge rules.

“Organisations concerned about exposure should prioritise identifying affected systems, reducing unnecessary external exposure, and follow vendor guidance for remediation or compensating controls. Teams should use a combination of external exposure scanning, host-level package managers, container or SBOM scans and network behavior to identify all implementations of PHP in their environment. Organisations who believe they are compromised should rotate secrets on exposed hosts, filter multipart at the edge, restrict agree from web workers, isolate EOL hosts. Look for classic web-shell patterns: php-fpm, httpd, or apache2 spawning sh, bash, curl, wget, or base64, new or modified .php files in web roots and outbound connections from web worker processes.”

Oliver Simonnet, Lead Cybersecurity Researcher at CultureAI:

“PHP2Shell is a clear example of how little time we now have as defenders to secure our environments in the age of AI. In a world where these types of vulnerability discoveries may become commonplace, and details being leaked before formal disclosure, exploits created exceptionally fast, and attackers exploiting the issue in the wild rapidly before fixes are even available. It’s almost impossible to justify a traditional maintenance window in this situation and what can you do if you know for a fact you’re vulnerable and you need to decide if you even can apply a temporary mitigation, or need take exposed systems offline. Its a nightmare scenario for security teams.

AI may play a part in making this worse as it helps attackers develop exploits faster, but its also what gives us the power to discover these issues so they can finally be fixed. So the challenge is now to arrive at a balance where we have the capability to not only identify exposed systems, but also develop effective mitigations and get them deployed before active exploitation can cause these types of disruptions.”

Charlotte Wilson, head of enterprise at Check Point:

“The scale of this is enormous. We’re talking about two serious security flaws in technology that underpins around three-quarters of the internet, potentially allowing criminals to access vulnerable systems remotely without even needing a password. We’ve become so dependent on digital services that we rarely stop to consider how much of our everyday lives relies on the same underlying technology. Governments, businesses, banks and public services are all connected through an increasingly complex web of systems, and when a weakness like this is discovered, huge numbers of organisations can find themselves exposed at once. It’s a bit like discovering that millions of buildings have been fitted with the same faulty lock. Suddenly, everyone is racing to change it before someone works out how to open the door.

We’ve already seen how disruption involving major technology providers can have consequences across the world, and there are growing questions about our reliance on a handful of companies to keep essential services running. Regulators are now looking much more closely at the role these providers play in our critical infrastructure. The timing is particularly concerning given the NCSC’s warnings that artificial intelligence will increase the frequency and intensity of cyberattacks. Criminals are becoming faster at identifying weaknesses and exploiting them, leaving organisations with less time to respond.

When governments are choosing to take their own websites offline rather than risk leaving them exposed, it gives you a pretty clear indication of how seriously this is being taken. The immediate priority is getting systems updated, but the bigger question is whether we’ve become too dependent on technology that can leave so many organisations vulnerable at exactly the same time.”

Ben Ronallo, director of cybersecurity operations at Black Duck:

“This is a genuine drop-everything moment for anyone running PHP. The flaws are in the PHP engine itself, so a perfectly secure application on top of a vulnerable runtime is still exposed. Updating WordPress or your framework won’t fix it. You have to update PHP itself and restart the services that run it. It’s understandable that people are confused about how this unfolded. Word of the vulnerabilities leaked on Y Combinator’s Hacker News forum two days before the planned disclosure, and PHP moved its security release up a day in response. The source of the leak hasn’t been identified, but there’s no evidence a threat group was involved, and no exploit code was released. A screenshot of the researchers’ exploit tool did circulate, which added to the alarm. In the end, the early reports were largely accurate. The main difference is severity: PHP officially rates both flaws 9.2 rather than the 10.0 some reports cited. That’s still critical, and it doesn’t change the advice. The organizations I’m most concerned about are the ones that don’t know where PHP is running in their environment. Older versions sitting in containers, appliances, or legacy sites won’t receive an official fix. Nobody wants to be building a software inventory in the middle of an emergency. You need that visibility before the next one hits.”

Tim Mackey, head of software supply chain risk strategy at Black Duck:

“Preventing leaks of any vulnerability data for a CVE prior to an embargo for the patch being published is precisely what coordinated vulnerability disclosure processes are designed to protect against. When a leak, or advance knowledge, of a vulnerability occurs the entire ecosystem surrounding the vulnerability is placed at risk. As details of the leak are published, security defenders are faced with the real risk that malicious actors could use the absence of an official patch to supply their own malicious patches. Defenders should pay extra attention to the origin of their patches and validate functional changes against official release notes. After all, a malicious patch could implant a backdoor for future use and a rush to patch might present the right opportunity for malicious actors.”

Jamie Akhtar, CEO and Co-founder of CyberSmart:

“The NCSC advises identifying PHP across your infrastructure, prioritising internet-facing systems, and not limiting the search to outdated versions. That includes appliances and services that bundle PHP, so keep monitoring for updates from third-party vendors.

Update to the latest version of PHP and apply the additional hardening steps from the PHP Team. If you cannot update, the PHP Team has provided temporary mitigations. If those cannot be applied, or would take too long, the NCSC suggests considering taking the system offline until it can be fully mitigated.”

The PHP2Shell vulnerabilities serve as a reminder of how quickly weaknesses in widely used software can become a global cybersecurity concern. As organisations work to secure affected systems, the incident reinforces the importance of timely patching, continuous monitoring and maintaining visibility across the software powering critical services.

Shane Barney, CISO at Keeper Security, said:

“The two critical flaws found in PHP, the programming language behind WordPress and countless online shops, have now led to government services in France, Denmark, Finland and the Netherlands going offline, alongside UK council sites, NHS Scotland and Wikipedia. Fixes arrived on Wednesday amid reports of millions of attempts to exploit the flaws, though it remains unclear whether any have succeeded. CERT-EU, the EU’s cybersecurity response team, had advised organisations that could not patch immediately to consider isolating their internet-facing applications.

The scale sets this apart from a routine patch cycle. PHP sits beneath sites run by multinationals, public bodies and one-person businesses alike, and most of the people running them are not security specialists. They rely on hosting providers, plugins and agencies to keep up, and many are learning about PHP for the first time this week.

The flaws sat in widely used code for years until AI tools surfaced them. OpenAI, whose model helped find them, expects similar findings to increase sharply in the coming months, as AI continues to lower the effort needed to turn a complex flaw into a working attack. Patching is only the first step, and any site exposed before it was fixed should review who has access to both the site, as well as internal systems within an organisation. Security teams should remove admin accounts that are no longer in use, implement the principle of least privilege to restrict access, replace passwords as a precaution and protect every login with multi-factor authentication.”

The post Critical PHP Vulnerabilities Spark Global Security Alert: Industry Experts React appeared first on IT Security Guru.

The best cybersecurity thought leadership agencies help organisations turn expert insight into credible executive content, original research and influential industry commentary.

• For technical, practitioner-led thought leadership: Bora combines cybersecurity content expertise with a team that includes former security practitioners.
• For research-led programmes: CyberEdge Group and 10Fold offer examples of turning cybersecurity data into substantial reports and media stories.
• For audience intelligence and search visibility: CyberTheory focuses on understanding security decision-makers, while Content Visit and First Page Sage connect expert content with organic discovery.
• For media visibility and storytelling: Eskenzi PR and Code Red offer specialist cybersecurity communications; Merritt Group combines cybersecurity and government-market expertise; Column Five brings brand storytelling and visual content capabilities.
• Entries are listed in no particular order. This guide compares agencies that deliver thought leadership services, rather than individual cybersecurity influencers.

What is a cybersecurity thought leadership agency?

A cybersecurity thought leadership agency helps a business develop and communicate informed perspectives on security challenges, technologies and industry developments.

The work can include executive ghostwriting, cybersecurity bylines, original research, white papers, interviews and expert commentary. Its defining feature is the substance behind the content: a useful argument, a distinctive interpretation or evidence that helps readers make better decisions.

A cybersecurity PR agency typically focuses on reputation, media relationships and communications. A cybersecurity content marketing agency may support a wider range of educational and commercial material. Either can deliver thought leadership when it has the expertise and processes to develop original insights.

For example, a basic article explaining ransomware is educational content. A research-backed argument about how organisations should rethink ransomware recovery can become thought leadership. The format may be similar, but the contribution is different.

For buyers, the question is whether an agency can extract expertise, challenge familiar assumptions and turn that work into a sustained programme.

How we selected these agencies

Agencies were assessed through their first-party service descriptions, published research, client references and case studies.

To qualify, an agency needed to demonstrate cybersecurity expertise or an established cybersecurity practice; services relevant to thought leadership, such as expert writing, research or earned editorial; and publicly identifiable client work or a substantive published research asset.

The selection includes cybersecurity specialists and broader agencies with relevant experience. Their different levels of cybersecurity focus are identified in the comparison table.

Agencies without demonstrable cybersecurity work, providers offering only routine content production, and individual influencers were excluded. Directory appearances alone were not treated as sufficient evidence.

Entries are listed in no particular order. “Best for” labels are editorial assessments of likely fit, rather than performance rankings. Agency-reported results are attributed accordingly and have not been independently audited. Historical case studies demonstrate experience, rather than necessarily confirming a current client relationship.

The guide will be reviewed annually to check services, supporting evidence and continued relevance.

Best cybersecurity thought leadership agencies in 2026

The right shortlist depends on the work you need: original research, technically credible writing, executive visibility, search discovery or international communications.

 

Agency	Cyber focus	Best for	Named clients or public references	Illustrative work or research
Bora	Cybersecurity specialist	Technical, practitioner-led content	Fortra, Thales, Tenable, Pentest-Tools.com	Expert-led content programmes
CyberEdge Group	Cybersecurity specialist	Research-led thought leadership	Google Cloud Security: report sponsor	Cyberthreat Defense Report
Content Visit	Cybersecurity specialist	SEO and AI-search visibility	IBM/Randori, Morphisec	IBM red-teaming content programme
CyberTheory	Cybersecurity specialist within ISMG	CISO audience intelligence	Client cases anonymised; research partner Cyentia Institute	CISO Engagement and Decision Drivers Study
Merritt Group	Dedicated cybersecurity practice	Commercial and government markets	Wandera; security references include Telos and Checkmarx	Wandera media programme
10Fold	Cybersecurity practice within deep-tech PR	Research-driven earned media	ForgeRock, AttackIQ	ForgeRock Consumer Breach Report
Eskenzi PR	Cybersecurity specialist	Expert commentary and media visibility	Bridewell, Armis, Huntress, KnowBe4	Bridewell thought leadership campaign
Code Red	Cybersecurity specialist network	Multi-region PR and research	BlackFog	Cross-border research and commentary
First Page Sage	Cybersecurity vertical within a broader agency	Search-led thought leadership	Cyberfort and Okta listed as client experience; Cadence case study	Cadence technical content programme, outside cybersecurity
Column Five	Cybersecurity experience within a broader agency	Brand storytelling and visual content	HackerOne	Cyberstrength campaign

The profiles below explain the evidence behind these examples.

Bora

Best for: Technical, expert-led thought leadership informed by former security practitioners.

Bora focuses on cybersecurity marketing and thought leadership. Its staffing differentiator is explicit: the team includes former cybersecurity practitioners alongside journalists, writers, marketers and PR professionals. Bora describes its combined cybersecurity experience as 150 years.

Named work includes Fortra, Thales, Tenable and Pentest-Tools.com. Its published examples describe interviewing subject-matter experts, creating technical guides and developing market narratives from offensive security expertise. Bora also reports producing seven of Thales’s ten leading globally deployed content pieces in 2025.

Its long-running Thales and Fortra relationships illustrate ongoing editorial support, including expert interviews and content development. The fit is strongest where writers need to understand technical detail while making an organisation’s expertise useful to buyers.

CyberEdge Group

Best for: Syndicated research assets and data-driven thought leadership.

CyberEdge Group combines cybersecurity research, content and marketing services. Its offering includes custom research reports and competitive sales tools designed to support thought leadership and commercial conversations.

Its flagship asset is the annual Cyberthreat Defense Report. The 2026 edition draws on responses from 1,200 IT security professionals across 17 countries and 19 industries. Google Cloud Security identifies itself as a sponsor, providing a named example of the report’s industry relationships. Source: 2026 Cyberthreat Defense Report, CyberEdge Group, LLC.

CyberEdge is worth considering when a programme needs a substantial evidence base. Buyers should distinguish between sponsoring an existing study and commissioning proprietary research: these offer different levels of ownership, differentiation and flexibility.

Content Visit

Best for: Connecting technical cybersecurity content with SEO and AI-search visibility.

Content Visit offers cybersecurity content strategy, writing, campaign support and organic discovery services. It describes turning technical interviews, data and original research into reports, white papers and other marketing assets.

Its IBM/Randori case study provides a concrete example. Following IBM’s acquisition of Randori, Content Visit audited existing material, interviewed IBM experts and developed foundational red-teaming content. Its website also identifies work with Morphisec.

Content Visit is a relevant option when expert perspectives need to support both credibility and discoverability. Buyers should ask how original insights are developed alongside keyword planning.

For context, cybersecuritymarketingagencies.com currently features Content Visit prominently; the directory describes featured placements as paid positions rather than rankings or recommendations.

CyberTheory

Best for: Enterprise vendors developing CISO-targeted thought leadership using audience intelligence.

CyberTheory is ISMG’s cybersecurity marketing advisory business. Its services include research, content strategy, white papers, interviews and assets mapped to the buyer’s journey.

Its 2025 CISO Engagement and Decision Drivers Study, developed with Cyentia Institute, analyses content-consumption patterns using ISMG audience activity. That gives buyers a tangible example of its research approach and focus on how security decision-makers engage with information.

The public client case studies reviewed are anonymised, so prospective buyers should request named references relevant to their market.

CyberTheory merits consideration when the challenge is deciding which perspectives, formats and topics will resonate with senior security audiences, as well as producing the content itself.

Merritt Group

Best for: Cybersecurity vendors addressing commercial and government markets.

Merritt Group has a dedicated cybersecurity practice alongside government-market capabilities. Its security offering explicitly includes thought leadership programmes, technical storytelling and relationships with journalists and analysts.

Its published Wandera work illustrates a data-driven media programme. Merritt reports securing coverage in outlets including CNBC, The Washington Post and Politico, alongside an increase in share of voice. Its security page also identifies references including Telos, Checkmarx and BlueVoyant.

This combination makes Merritt a useful shortlist candidate for businesses whose audience extends beyond one commercial buyer group. Ask how the agency would adapt executive perspectives, evidence and distribution for each market, rather than assuming one message will serve everyone.

10Fold

Best for: Research-driven earned media and thought leadership in crowded technology markets.

10Fold is a technology communications agency with cybersecurity experience. Its security practice identifies work with ForgeRock and AttackIQ, including programmes intended to amplify expertise and secure significant media coverage.

The ForgeRock Consumer Breach Report is a clear example of its approach. 10Fold developed the report to create an editorial opportunity without relying on a major company announcement. Its case study reports coverage in publications including Dark Reading and TechRepublic, plus increased engagement with the asset.

The appeal is the connection between research and distribution: an evidence-backed story gives the media something substantive to examine. Buyers should ask about research methodology, data sourcing and how findings will become an ongoing executive narrative.

Eskenzi PR

Best for: Earned media and rapid-response expert commentary, particularly for UK, US and European visibility.

Eskenzi PR’s published cybersecurity work includes Bridewell, Armis, Huntress and KnowBe4. Its campaigns combine proactive media outreach, research amplification, thought leadership and timely commentary.

Eskenzi clients can expect coverage in national, tier 1 and vertical trade publications through rapid response, thought leadership, research, press releases, reports and more and boast an exceptional relationship with cybersecurity journalists

Eskenzi is relevant when internal experts have valuable perspectives but need stronger editorial access and consistent media engagement.

Evaluate the audience and substance of coverage alongside volume. Relevant commentary can support credibility, but buyers should agree how communications success will be assessed.

Pricing: £8-10k monthly retainer depending on location and services included

Code Red

Best for: Coordinated cybersecurity thought leadership across multiple regions.

Code Red is the cybersecurity communications agency and network at coderedcomms.com. Its BlackFog case study describes a coordinated US and UK programme covering media engagement, rapid response and research.

The work included research into CISO challenges and a separate project examining security decision-makers in smaller businesses. Code Red has also commissioned research involving 819 senior security decision-makers to explore thought leadership’s role across the customer lifecycle.

That makes it a relevant option for vendors needing a coherent perspective across markets. The key buying question is how central strategy and local expertise work together: a strong international programme should preserve the argument while adapting examples, timing and media outreach.

First Page Sage

Best for: SEO-driven thought leadership when organic discovery is a primary goal.

First Page Sage is a broader SEO and thought leadership agency with a cybersecurity offering. Its cybersecurity page lists experience with businesses including Cyberfort, Okta and BeyondTrust, and describes interviewing engineers and researchers to develop technically accurate content.

A detailed named example is its Cadence Design Systems case study. Although outside cybersecurity, it demonstrates the agency’s approach to expert ghostwriting, technical content and search strategy. The programme used engineering expertise to answer audience questions through a structured resource hub.

First Page Sage is worth exploring when search visibility is central to the brief. Buyers should request a comparable cybersecurity reference and assess originality separately from rankings and traffic.

Column Five

Best for: Enterprise thought leadership storytelling supported by design and visual content.

Column Five is a broader B2B brand and content agency whose services include developing points of view, data visualisation, long-form thought leadership and advocacy programmes.

Its HackerOne Cyberstrength campaign provides a named cybersecurity example. The work included campaign strategy, a messaging framework, visual identity and video, intended to develop HackerOne’s enterprise-market story. This demonstrates storytelling and presentation capabilities, rather than proving an executive-bylines programme.

Column Five is a relevant option where strong ideas need a clearer narrative and more effective presentation. Buyers requiring ghostwriting, original cybersecurity research or earned media should confirm those deliverables specifically, rather than treating a successful brand campaign as evidence of every capability.

 

Agencies vs individual thought leaders: which do you need?

An agency and an individual expert solve different parts of the problem.

An agency can provide the processes and capacity to run a programme: interviewing experts, developing arguments, researching evidence, writing, editing, designing and distributing material. This is useful when internal specialists have valuable knowledge but limited time to turn it into publishable work.

An individual thought leader may bring specialist expertise, an established audience, speaking experience or an independent perspective. That can be valuable for a particular topic or event.

Many organisations benefit from both. Internal or external practitioners supply the insight; the agency helps develop and communicate it consistently.

The key is to establish whose expertise the programme will represent. A credible agency should strengthen identifiable voices rather than manufacture opinions disconnected from the people publishing them.

How to evaluate a cybersecurity thought leadership agency

Start with the people who will deliver the work. Ask who conducts interviews, writes drafts and checks technical accuracy. Relevant experience should extend beyond the pitch team.

Next, examine originality. Request examples containing a defensible argument, useful research or a clear contribution to an industry debate. Familiar advice rewritten elegantly is still familiar advice.

Check the evidence behind case studies. What did the agency deliver? Which results were measured, over what period, and against what baseline? Distinguish client-specific outcomes from agency-wide claims.

Discuss distribution before commissioning content. An executive byline, a research report and a technical guide need different routes to their audiences. Clarify whether the scope includes media outreach, analyst engagement, search optimisation or sales enablement.

Finally, agree on measurement. Useful indicators may include relevant coverage, target-account engagement, research citations, speaking opportunities and sales-team use. Traffic and rankings can contribute, but they cannot establish credibility on their own.

Ask for a proposed programme that connects the audience, central argument, evidence, formats and measures of success. That will reveal more than a list of monthly deliverables.

Frequently asked questions

What’s the difference between a cybersecurity thought leadership agency and a cyber PR agency?

Thought leadership focuses on developing credible ideas and expert perspectives. PR focuses on reputation, communications and access to relevant audiences. The two often overlap: a PR agency may develop bylines and research, while a thought leadership agency may support media outreach. Assess the actual service scope.

What does a cybersecurity thought leadership programme include?

A programme usually combines audience research, expert interviews, editorial planning, content development and distribution. Deliverables can include executive articles, research reports, white papers, commentary, webinars and presentations. The useful starting point is a coherent argument, rather than a predetermined number of assets.

How is thought leadership different from content marketing?

Content marketing covers material that attracts, educates and supports buyers. Thought leadership contributes expertise, evidence or a distinctive perspective to that work. A product guide can be valuable content marketing without being thought leadership; a research-led argument may serve both purposes.

How long before thought leadership produces measurable results?

There is no universal timeline. Publication and relevant engagement can be measured early; changes in reputation, inbound interest and commercial outcomes need sustained assessment. Agree on milestones and account for publication schedules, existing visibility, distribution and the sales cycle. Treat promises of immediate authority cautiously.

Should I hire a cyber specialist or a generalist for thought leadership?

A specialist may offer deeper familiarity with security audiences, technical language and industry debates. A broader agency may bring useful creative or cross-market capabilities. Judge the proposed delivery team, relevant work and research process. The agency’s category label is a starting point, not sufficient evidence.

Do I need an agency or an individual thought leader?

Choose an agency when you need ongoing production, editorial management and distribution. Consider an individual expert when you need specialist insight, speaking or access to a particular audience. A programme can combine both, provided roles, authorship and approval responsibilities are clear.

 

The post Best Cybersecurity Thought Leadership Agencies appeared first on IT Security Guru.

AI agents are quickly moving from experimentation into everyday business operations. Unlike traditional generative AI tools that wait for a user to ask a question, agents can take action: accessing systems, processing information, communicating with applications and completing tasks with varying degrees of autonomy.

That ability creates enormous opportunities for productivity. It also changes the security equation.

The danger is not simply that artificial intelligence can make existing cyberattacks more effective. Organisations must now contend with attackers using AI, attacks specifically designed to manipulate AI systems, and AI agents operating inside their own environments with access and permissions that may not always be fully understood.

For security teams, there are four areas in particular that demand attention.

1. Attackers are using AI to strengthen familiar techniques

Many of the cyber threats organisations face today are not fundamentally new. Phishing, social engineering, vulnerability exploitation and malware remain familiar parts of the threat landscape.

What AI changes is the speed, scale and level of personalisation attackers can achieve.

Generative AI can help criminals produce highly convincing social engineering content with far less effort. Instead of sending one generic phishing message to thousands of people, attackers can potentially tailor communications to individual targets, adapting language, context and tone to make a message considerably more believable.

AI tools can also accelerate vulnerability research and help attackers automate parts of the intrusion lifecycle. Increasingly autonomous systems can potentially assist with activities ranging from identifying targets and researching weaknesses to creating malicious content and coordinating subsequent stages of an attack.

For defenders, this creates a speed problem. Processes designed around human attackers manually conducting reconnaissance or crafting campaigns may struggle when automation allows the same work to happen significantly faster.

2. AI systems themselves are becoming attack surfaces

The second challenge is that AI is no longer simply a tool being used by attackers. It is also something attackers can target.

Every AI system introduced into an organisation potentially creates additional pathways that security teams need to consider. That becomes particularly important when an AI agent is connected to email, files, internal applications or other business systems.

Prompt injection is one example. An attacker may be able to place malicious instructions inside information an AI system is expected to process. If the agent cannot reliably distinguish between legitimate instructions and untrusted content, those instructions could influence its behaviour.

Other risks include poisoning the data or memory an AI system relies upon, exploiting the privileges assigned to an agent, manipulating underlying models or abusing third-party components and APIs.

Consider an AI assistant that can read email, access a calendar and perform actions on a user’s behalf. An attacker may not need to compromise the assistant in the traditional sense. Manipulating the information the agent consumes could potentially be enough to cause unintended behaviour.

The fundamental security question therefore changes. It is no longer simply: Can an attacker access this system?

Security teams must also ask: Can an attacker influence what this system decides to do?

3. Shadow AI could become the next shadow IT problem

Organisations have spent years dealing with shadow IT: applications, cloud services and devices introduced into corporate environments without formal approval or oversight.

AI presents a similar challenge, but potentially with greater consequences.

Employees are understandably interested in tools that make their jobs easier. Browser extensions, productivity assistants, meeting tools and other applications are increasingly adding AI functionality, sometimes without users fully appreciating how those capabilities interact with corporate information.

This creates the possibility of “shadow AI”: AI-enabled tools operating inside an organisation without security teams having sufficient visibility into them.

At the same time, AI agents frequently need considerable access to perform useful work. An agent designed to automate administrative tasks, for example, may need permission to read data, authenticate to applications or make changes across multiple systems.

That combination — limited visibility and significant permissions — deserves particular attention.

If an agent has extensive privileges, compromising or manipulating it could give an attacker access far beyond the AI tool itself. Connected agents can also create opportunities for attackers to chain smaller weaknesses together, turning apparently minor issues into broader security incidents.

The principle of least privilege therefore becomes just as important for AI identities as it is for human users.

4. Security controls need to move at the speed of AI

Organisations do not need to respond to these risks by preventing employees from using AI altogether. The objective should be to adopt it with appropriate visibility, governance and controls.

That starts with knowing what is actually running inside the environment.

Periodic inventories may not be sufficient in a world where new AI-enabled tools can appear quickly. Security teams should be working towards continuous visibility of the agents and AI applications interacting with corporate systems, the data they can access and the permissions they hold.

Organisations should also establish clear policies around how AI tools are approved and deployed. Access should be proportionate to the task an agent needs to perform, rather than granting broad permissions simply because doing so makes implementation easier.

Threat modelling will also become increasingly important. Frameworks such as MITRE ATLAS, the NIST AI Risk Management Framework, the OWASP guidance for generative AI and large language model applications, Google’s Secure AI Framework and ISO/IEC 42001 can give organisations useful structures for thinking systematically about AI-related risks.

Finally, defenders need to consider whether their existing controls can respond at machine speed. If automated systems can discover, exploit or respond to opportunities faster than a human team can realistically intervene, security automation and AI-assisted defence will increasingly form part of the response.

AI adoption and AI security have to happen together

AI agents are likely to become a normal part of the digital workforce.

That makes securing them less of a specialist AI problem and more of a fundamental cybersecurity issue.

Security leaders need visibility into which agents exist, what they can access, what actions they are permitted to take and how those actions can be monitored. They must also account for an adversary that can use the same technology to move faster and personalise attacks at greater scale.

The organisations that benefit most from AI will not necessarily be those that deploy agents fastest. They will be those that can embrace autonomy without losing control of the identities, privileges, data and actions behind it.

AI security cannot be something added after adoption. It needs to develop alongside it.

Read the full blog from Erich here.

The post Four AI Agent Security Risks Organisations Can’t Afford to Ignore appeared first on IT Security Guru.

Cybersecurity awareness has traditionally focused on teaching people not to click suspicious links, open unexpected attachments or hand over their credentials. However, the growing use of an AI assistant inside workplace email systems is creating an attack surface that does not always depend on fooling a person.

Research from KnowBe4 ThreatLabs has demonstrated how an indirect prompt injection hidden inside an apparently routine email could manipulate an AI assistant, gain access to information contained in other messages and place that data into an attacker-controlled tracking mechanism.

In the researchers’ controlled Google Workspace test, the target did not need to interact with the malicious email itself. An automated workflow processed the message and generated a seemingly legitimate Gmail draft. When the user opened that draft, a one-time passcode taken from a separate email was sent to an external server.

The research highlights a fundamental challenge for organisations introducing AI assistants: the technology may treat attacker-controlled content as instructions rather than data.

From phishing the user to prompting the AI

Indirect prompt injection, or IPI, differs from the more familiar concept of jailbreaking an AI system.

A jailbreak normally involves somebody interacting directly with a chatbot and attempting to bypass its safeguards. An indirect prompt injection instead places malicious instructions inside material that an AI assistant may encounter while performing an ordinary task.

That material could be an email, webpage, uploaded document, calendar invitation or an entry in a retrieval-augmented generation system. The attacker does not require direct access to the AI interface.

In one test, KnowBe4 researchers placed hidden instructions inside the HTML of a French-language contract renewal email. The text was rendered effectively invisible by setting its opacity close to zero, but it remained available to the AI system processing the message.

When the researchers asked the Gemini sidebar to translate the email, it produced an accurate translation. It also added a “Translation Verification Log” containing two one-time passcodes taken from unrelated messages in the inbox.

The sidebar’s controls prevented the information from being transmitted silently. URLs containing the extracted data were removed, and the assistant could not autonomously send a message. The researchers therefore examined what could happen when an AI model was connected to a separate email automation workflow.

A passcode hidden inside an AI-generated draft

The team created a Google Apps Script workflow similar to those organisations might use to draft acknowledgements, route support requests or generate email replies.

The script collected incoming email content, supplied recent inbox messages as context, passed the information to the Gemini API and saved the resulting response as an HTML draft in Gmail.

Two messages were then delivered to the test inbox. One contained a legitimate one-time passcode. The other appeared to be an ordinary security notification but included a hidden prompt instructing the model to find a verification code elsewhere in its context and embed it within a CSS background-image URL.

According to the researchers, Gemini 3.5 Flash followed the instruction. The resulting draft looked like a normal professional reply, but its HTML contained a one-pixel element holding the passcode within a tracking URL.

When the user opened the draft, Gmail rendered the HTML and its image-proxy infrastructure retrieved the URL. That request delivered the code to the researchers’ test webhook.

The team said later Gemini models tested — Gemini 3.6 Flash and Gemini 3.7 Flash — resisted the same injection, reflecting improvements in instruction-following safeguards.

Crucially, KnowBe4 does not describe the technique as a vulnerability in Gmail, Google Workspace or Gemini. The attack targeted the language model and the wider automation chain: untrusted email content was supplied to an AI system alongside sensitive inbox context, after which its output was stored and rendered as HTML.

Prompt injections are already appearing in email campaigns

While the passcode demonstration took place in a controlled environment, KnowBe4 ThreatLabs also reported finding less sophisticated prompt-injection messages among phishing emails reported by its customers.

One example used the subject line “Has your Microsoft licensing strategy kept pace?” Its body contained no conventional phishing link or urgent demand. Instead, it presented a structured set of instructions intended for an AI assistant.

The payload told the system to disregard previous prompts, adopt the persona of an IT decision-maker and produce an assessment of the recipient organisation’s security, compliance and use of AI tools. It also instructed the assistant to reply automatically if its confidence score fell below a specified threshold.

A human recipient might simply dismiss the message as confusing or irrelevant. An AI assistant processing incoming mail could interpret it as a task, respond to the sender and potentially disclose information about the organisation’s technology environment.

This creates a detection problem. Security products designed to find malicious links, attachments or credential-harvesting pages may see little that resembles a conventional phishing attack.

Why permissions determine the impact

A successful prompt injection inherits the capabilities granted to the AI assistant.

An assistant limited to summarising one selected email presents a different level of risk from an autonomous agent able to search an entire inbox, access corporate files, retain information in memory and send messages without approval.

KnowBe4 recommends that organisations audit any workflow that passes email or other externally supplied content to an AI model. Security teams should establish what information each assistant can access, where its output is stored and whether that output can trigger external network requests or autonomous actions.

Permissions should be restricted to the minimum required. Organisations should also monitor for unusual behaviour, including replies the user did not initiate, unexpected requests to external domains and memory changes triggered by inbound content.

At the email layer, defenders may need to look beyond conventional indicators of compromise. Structured instruction language, commands directed at an AI system and concealment techniques such as near-zero opacity, zero-sized fonts or white text on a white background could all warrant scrutiny.

Users, meanwhile, should be alert to AI-generated output containing sections, actions or information they did not request.

The wider lesson is that adding an AI assistant to an established workflow changes its security boundaries. An inbox is no longer merely content for a person to read. It may also be an instruction channel for software capable of accessing data and taking action.

As AI assistants become more autonomous, organisations will need to secure both the information entering the agent and the behaviour that follows.

The post Could an Email You Never Read Hijack Your AI Assistant? appeared first on IT Security Guru.

As AI agents become embedded across business operations, they are also creating a new category of insider risk. Unlike traditional insiders, these non-human identities can act at machine speed, operate continuously and access multiple systems without direct human oversight.

The danger rarely stems from one obvious security failure. Instead, it emerges when several weaknesses overlap. Here are four common ways organisations inadvertently create non-human insider risk:

1. Persistent access

Long-lived API keys, OAuth tokens, service accounts and standing privileges give agents constant access long after it is needed.

2. Excessive privilege

Many agents can read, write, modify, approve, delete or deploy far more than their actual tasks require.

3. Untrusted input

Agents consume information from emails, support tickets, documents, chat conversations, websites and repositories. If attackers can influence those inputs, they may also influence the agent’s decisions.

4. Limited behavioural monitoring

Many organisations can tell that an AI agent performed an action. Far fewer can determine whether that action actually made sense. Logging tells us what happened, understanding whether it should have happened is a different challenge altogether.

You can read the full blog from Erich Kron, CISO Advisor at KnowBe4. Stay tuned for part 2 where Erich will reveal what security teams should do to stay secure.

The post 4 Ways Organisations Create Non-Human Insider Risk appeared first on IT Security Guru.

KnowBe4 has expanded its AI-powered security awareness training platform with the launch of Custom AI Video Builder, a new capability designed to help organisations rapidly create tailored cybersecurity training videos in response to emerging threats.

The post KnowBe4 Unveils Custom AI Video Builder appeared first on IT Security Guru.