Research found 426 mobile apps connecting to servers advertising PHP versions potentially affected by PHP2Shell vulnerabilities, raising concerns…

UK cybersecurity specialist WorkNest Secure has achieved Accredited Organisation status under The Cyber Scheme, providing further independent recognition of the technical expertise and professional standards maintained across its services.

The accreditation recognises organisations that demonstrate professional competence, quality and alignment with established cybersecurity industry standards. It also places particular emphasis on the qualifications and capabilities of the professionals delivering those services.

For WorkNest Secure, the latest recognition builds on its existing technical accreditations and reflects its continued investment in developing and maintaining a highly skilled cybersecurity workforce.

Independent Recognition of Cybersecurity Expertise

The Cyber Scheme is a Licensed Body of the UK Cyber Security Council and works to assess and recognise cybersecurity professionals against established industry standards.

Its Accredited Company Programme is designed to give businesses greater confidence when selecting cybersecurity service providers by linking organisational accreditation to independently verified workforce capabilities.

Unlike certifications focused primarily on processes or technical controls, the programme places significant importance on the people delivering cybersecurity services and their professional competence.

WorkNest Secure already has a number of penetration testing consultants who hold individual accreditations through The Cyber Scheme, making company-wide recognition a natural progression.

Jordan Constantine, Head of Offensive Security at WorkNest Secure, said the accreditation provides customers with independent evidence of the team’s capabilities.

“Becoming accredited under The Cyber Scheme felt like a natural step for WorkNest Secure. It’s one thing to say our team meets a high standard; it’s another to have that verified independently, and many of our penetration testing consultants are accredited under their scheme.”

He added: “Their assessments are respected across government and industry, and that gives our clients real confidence in the people testing their systems. It’s proof, not just a claim.”

Building Trust in Cybersecurity Services

The accreditation comes as organisations increasingly rely on external cybersecurity specialists to help identify vulnerabilities, assess risks and strengthen their defences.

With businesses placing considerable trust in third-party providers, independently verified qualifications and professional standards can provide an important measure of assurance.

Kirsty Fowler, Managing Director of WorkNest Secure, believes the expertise of cybersecurity professionals remains central to delivering effective security services.

“Cybersecurity is a people business. Technology is incredibly important, but customers also need to know that the people testing their systems, advising their teams and helping them respond to risk have the right expertise behind them.”

She added that the accreditation also reflects the company’s commitment to supporting professional development.

“Achieving the Cyber Scheme accreditation gives our customers another level of independent assurance and reflects the investment we continue to make in our people.”

Supporting Continued Growth

WorkNest Secure was formed following the integration of Pentest People and Bulletproof under the WorkNest Group, bringing together expertise across penetration testing, red teaming, attack simulation, information security, data protection and compliance.

The company also provides GuardNest, its proprietary vulnerability management platform, which combines vulnerability visibility, threat intelligence and compliance capabilities.

WorkNest Secure holds CREST and CHECK accreditations for penetration testing and recently achieved CREST STAR-FS accreditation for intelligence-led red teaming within financial services.

The latest accreditation adds to these credentials as the company continues to develop its technical capabilities and strengthen its position in the UK cybersecurity services market.

WorkNest Secure forms part of WorkNest Group, which employs more than 800 people and supports over 50,000 customers across ten countries.

The post WorkNest Secure Gains The Cyber Scheme Accreditation appeared first on IT Security Guru.

Summary Bullets:

• AI is driving up voice traffic while also making voice more vulnerable, so voice security needs urgent attention.

• The building blocks are in place, but solutions are fragmented. Voice security needs to be integrated on the carrier network level and backed by strong verification at the business.

Voice security is of paramount importance today. Advances in AI are affecting voice in two ways. First, AI is improving the voice experience as it becomes more interactive, which is expected to increase overall voice traffic. Second, AI can be used to bypass security barriers, significantly raising the threat level. The threat landscape varies depending on the call type, recipients, and network routing (such as international borders); this blog focuses on voice security within customer engagement (particularly contact centers), predominantly in the US.

Voice security in customer engagement is a multi-layered issue that must be viewed from the perspective of both incoming and outgoing calls:

• For incoming calls, the objective is to protect business systems from threats like telephony denial of service (TDoS), i.e., when business operations are flooded with fake calls to disrupt service or demand a ransom, or scammers posing as customers to access sensitive data.

• For outgoing calls, the goal is to ensure customers do not ignore crucial alerts, such as notifications of fraudulent bank activity or delivery confirmations.

The initial safety net for incoming calls must start on the carrier level, where threats like TDoS can be identified and mitigated at the network stage. A carrier helps determine a call’s legitimacy using Secure Telephony Identity Revisited / Signature-based Handling of Asserted information using toKENs (STIR/SHAKEN), a mandatory US government framework acting as a digital notary. The originating carrier attaches a digitally signed certification to each call:

• Full Attestation (Grade A): The gold standard; the carrier knows the caller and confirms they legitimately own the number.

• Partial Attestation (Grade B): The carrier knows the caller but cannot verify they own the number.

• Gateway Attestation (Grade C): The carrier simply passes the call along from an unverified, unknown source.

Relying solely on networks is not enough; spoofed calls can still slip through. Businesses require extra layers like call identification and authentication. Conversely, for outgoing calls, brands must ensure their outreach isn’t mistaken for spam. This is achieved by displaying a branding logo, verified number, and the reason for the call. Notably, ecosystem requirements are stringent—calls without the highest certification grade (Grade A) cannot utilize call branding.

A robust partner ecosystem in the US brings these pieces together:

• SecureLogix orchestrates the screening of incoming calls.

• TransUnion (via its Neustar division) operates a massive database of legitimate business numbers to match callers accurately.

• Pindrop addresses audio authenticity and caller verification once calls pass the carrier gateway and reach the business phone system.

• Hiya and First Orion provide branded calling for outgoing traffic, displaying logos and call reasons.

• TNS, a carrier network hub, operates the data highways that route cryptographic signatures for both initial screening and outbound branding.

While these building blocks are in place, the broader architecture needs attention. Point solutions remain fragmented and are generally sold as add-ons, leaving gaps and placing a costly, complex configuration burden on enterprises. Partner integration should ideally happen upstream on the carrier network routing level to seal the gap at the origin.

Furthermore, stronger verification is required at the business phone system layer, as AI voice cloning makes it easier than ever to impersonate customers. Implementing multi-factor authentication can reinforce this safety net. Finally, for outgoing calls, while cross-carrier interoperability has improved, branded calling can still experience fragmentation depending on the recipient’s mobile operating system and carrier ecosystem.

The post Voice Security in Customer Engagement Has Missing Pieces appeared first on IT Connection.

WorkNest Secure has achieved CREST Simulated Targeted Attack & Response for Financial Services (STAR-FS) accreditation, recognising its ability to deliver intelligence-led red teaming assessments for organisations operating in high-risk and regulated environments.

The accreditation confirms that WorkNest Secure meets CREST’s standards for conducting threat-led penetration testing, using realistic attack scenarios to assess how effectively organisations can prevent, detect and respond to sophisticated cyber threats.

Developed in collaboration with the Bank of England, Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA), STAR-FS is designed to help financial institutions assess the resilience of their critical business services against realistic cyberattacks.

Moving Beyond Traditional Penetration Testing

While conventional penetration testing focuses on identifying technical vulnerabilities, red teaming takes a broader approach by simulating how a determined attacker might target an organisation’s people, processes and technology.

STAR-FS assessments use commercial threat intelligence to develop scenarios based on the tactics, techniques and procedures used by real-world threat actors. These scenarios are then used to test an organisation’s security controls, detection capabilities and incident response processes.

The aim is to identify not only where weaknesses exist, but how effectively an organisation would respond if an attacker attempted to exploit them.

Kirsty Fowler, Managing Director of WorkNest Secure, said organisations are increasingly looking for more comprehensive ways to assess their cyber resilience.

“There is growing demand for security testing that goes beyond identifying technical vulnerabilities. Red teaming provides organisations with a much clearer understanding of how well their people, processes and technology work together when faced with a determined attacker.”

She added: “Achieving CREST STAR-FS accreditation is an important milestone for WorkNest Secure. It recognises the expertise of our red team and ability to deliver intelligence-led assessments that meet one of the highest standards in the industry.”

Strengthening Offensive Security Expertise

The accreditation follows the launch of WorkNest Secure, which brought together the cybersecurity expertise of Pentest People and Bulletproof under a single brand.

It also reflects the company’s continued investment in offensive security services, particularly as organisations face increasing pressure to demonstrate that their security controls and response capabilities can withstand realistic attacks.

Dominic Mortimer, Head of Red Team at WorkNest Secure, said effective red teaming should challenge assumptions about how well an organisation is protected.

“Red teaming is about understanding what would happen if a skilled attacker genuinely targeted your organisation. It’s designed to replicate realistic attack scenarios, challenge assumptions and provide organisations with valuable insight into how effectively their security controls, detection capabilities and response processes perform under pressure.”

Mortimer added that achieving STAR-FS accreditation demonstrates the company’s commitment to maintaining high technical standards while continuing to develop its offensive security capabilities.

The accreditation expands WorkNest Secure’s existing portfolio of CREST-accredited services and supports its focus on helping organisations adopt a more proactive, intelligence-led approach to managing cyber risk.

The post WorkNest Secure Achieves CREST STAR-FS Accreditation for Red Teaming appeared first on IT Security Guru.

Summary Bullets:

• Technology vendors are investing in forward deployed engineers to adapt AI solutions to meet customer needs.

• Systems integrators are working alongside their technology partners to help enterprises accelerate their AI adoption and ensure business outcomes are met.

It is widely reported that only a small percentage of firms that have conducted AI pilots are moving them into production. Even fewer enterprises have been able to scale their AI initiatives across multiple business functions. Based on GlobalData’s observations and discussions with enterprises, there has been greater success in AI implementations among large enterprises that have engaged a systems integrator or consulting firm to work alongside their technology partners, including hyperscale cloud providers and AI model companies (e.g., Anthropic and OpenAI).

This is not surprising since generative AI (GenAI) and agentic AI are relatively new and rapidly evolving. There are unknowns for enterprises in harnessing the technology, both from the technical and commercial standpoints. Moreover, the use of AI is tied to business objectives, not an IT-led initiative. This suggests a need for a high-touch, consulting-led approach in which technology companies work closely with enterprises to turn AI into solutions that deliver against business outcomes. Systems integrators and consulting firms do not just provide the technical knowhow, but also business consulting capabilities and industry knowledge.

While AI studios and labs are useful in demonstrating the possibilities, actual deployment can be challenging for large-scale enterprises that have complex tech stacks with legacy systems, and messy workflows. Increasingly, technology vendors are embedding forward deployed engineers (FDEs) into client premises to support customer teams with their AI implementations. Technology vendors (e.g., AWS, Databricks, Google Cloud, Microsoft, and Salesforce) have FDEs that are highly skilled in their technology to help customers solve problems and develop custom solutions (e.g., sorting out data pipelines, configuring data models, and setting up guardrails and security controls). However, it is harder for software vendors and to some extent the hyperscalers to maintain large FDE workforces. They are therefore working with service provider partners to develop FDE teams to jointly work with clients.

For systems integrators, the goal is not just to help clients move AI into production: It is also to build long-term relationships with clients, and they are more focused on helping clients through their AI lifecycle. Cognizant is responding to this trend with its Frontier-certified workforce. This comprises two new job categories: Frontier Certified Engineers (FCEs) and Frontier Business Operators (FBOs). FCEs focus on reimagining work processes and identifying where AI can make the most business impact. They work with clients directly to realign business processes for an AI-enabled environment. On the other hand, FBOs take full ownership of the operational results via the realignment of business processes. They manage a workforce of humans, AI agents, and automated software to ensure tasks are assigned to the most efficient resources and expected business outcomes are achieved. The company plans to scale to 5,000 FCEs and 10,000 FBOs by Q4 2026.

Capgemini has introduced its outcome deployed engineer (ODE) model, aimed at supporting the agentification of clients and optimizing the time-to-value. Capgemini’s approach is to embrace technology partners’ FDE model, but focus on delivering the business outcomes clients are aiming for. This helps the company shift its engagement from a talent-driven model to a value/outcome-based model. The company is building its ODE by aligning to key technology partners. It started with Google Cloud; Capgemini’s ODEs work alongside Google Cloud FDEs in dedicated pods within a client’s environment to design, build, and deploy AI agents around workflows while committing to business outcomes. The company is expected to have similar arrangements with more technology partners going forward.

Each systems integrator has or will have a similar FDE-like approach to engage customers in AI projects focusing on business outcomes. The aim is to help customers achieve faster implementation and return on investment (ROI). After having AI in production, enterprises also have to grapple with the rapid advancement of frontier models, the changing pricing mechanism, and an increasing number of use cases. Systems integrators add greater value to customers by supporting their AI lifecycle with continuous enhancements, including providing the AI technology (i.e., the partner ecosystem), the necessary tools (e.g., agentic AI builders and control plane), and the human expertise (technical, business, and industry knowledge).

The post Systems Integrators Adopting the FDE Model with a Focus on Business Outcomes appeared first on IT Connection.

Summary Bullets:

• Agentic orchestration has been dominating vendor narratives as growing complexity in the CX space is driving the need for a sophisticated coordination system.

• CX agentic orchestration remains fragmented as there are still infrastructural gaps, and trust remains a major issue for customers.

Agentic orchestration has been increasingly occupying CX vendor narratives in recent years, so it is time to take a deep dive into what orchestration is and why it is becoming relevant. Simply put, orchestration is bringing people, workflows, and technology together to achieve an outcome. Depending on how far we stretch the concept, orchestration is not new, and even a deterministic call routing can be described as orchestration. The question is, what is new today and why is orchestration increasingly dominating vendor narratives?

There are two factors bringing orchestration to the forefront: connected customer experience and agentic AI. Connected customer experience came into play with the advent of cloud platforms, making it possible to consolidate the CX IT stack and create a unified system. This enabled data to flow seamlessly between applications and systems for contextual insights before, during, and after customer engagement, reducing fragmented customer experiences. The second factor is the rise of agentic AI, which, as the name implies, involves agents that can autonomously perform tasks on behalf of humans. This autonomy stems from the ability to understand, reason, decide, and act. The projection is that agentic AI will proliferate, acting as digital assistants for workers and customers. While interactions today are still between agentic AI and humans, it is predicted that in the future, they will also take place directly between agentic AI.

What we are witnessing is the rise of a complex CX landscape with numerous actors, including AI, people, and applications, making it necessary to have a sophisticated coordination system. This is where orchestration becomes relevant and even critical. What makes orchestration compelling today is its agentic capabilities with a cognitive layer in the backend. It is probabilistic in nature and can understand, reason, decide, and act on its own, unlike the pre-programmed, deterministic models used for reaching a goal. Agentic orchestration is designed to autonomously map the most optimal customer journey depending on customer intent and stage, as well as determine the most suitable resources, insights, and tools to achieve a given goal. The challenge, however, is that the term is broadly used, and the underlying question is: How agentic are the orchestration layers today?

Agentic orchestration as it stands falls under two classifications: routing orchestration and workflow orchestration. Routing orchestration is when AI autonomously routes interactions to the most suitable agent, while workflow orchestration is when AI determines the optimal customer journey to accomplish an outcome. We see some instances where routing orchestration is deployed and some instances where workflow orchestration is deployed, but in most cases, orchestration remains fragmented across bits and pieces of specific, outcome-driven workflows.

In a true agentic era, orchestration will take place end-to-end across all use cases, but there are infrastructural gaps before such a state could be achieved: LLMs are still reasoning and decision tools and cannot really act although tool calling are used for driving actions; data requires more work, including quality improvement, aggregation, and the development of data graphs; and latency/real-time technology needs to be faster. The most critical factor, however, is trust. Today, AI autonomy and trust work in reverse order. It is a journey vendors are taking as they gradually fill the gaps, but there is still some distance to go before we see a pure state of agentic orchestration.

The post Beyond the Hype: The Reality of CX Agentic Orchestration appeared first on IT Connection.

WorkNest Secure has expanded its GuardNest platform with continuous vulnerability scanning, giving organisations ongoing visibility into security weaknesses rather than relying solely on periodic penetration tests.

The new capability is designed to help businesses monitor vulnerabilities across internet-facing systems, web applications, and internal environments, providing continuous oversight of their attack surface as threats and infrastructure evolve.

The launch comes as organisations face increasing pressure from customers, insurers, and regulators to demonstrate continuous vulnerability management and stronger cyber resilience.

Moving beyond annual penetration testing

While penetration testing remains a critical part of any cybersecurity strategy, WorkNest Secure says annual or point-in-time assessments no longer provide a complete picture of an organisation’s security posture.

The enhanced GuardNest platform combines automated vulnerability scanning with expert analysis and remediation support, allowing organisations to identify vulnerabilities as they emerge and prioritise the issues that present the greatest business risk.

Organisations can schedule scans, monitor vulnerabilities in real time, and manage remediation activities through a single dashboard.

The platform now supports external vulnerability scanning, internal vulnerability scanning, web application scanning, and agent-based internal scanning, allowing customers to tailor the service to their environment and compliance requirements.

Simplifying vulnerability management

Alongside continuous scanning, GuardNest introduces new remediation workflows designed to help security and IT teams manage vulnerabilities more effectively.

Organisations can assign remediation tasks, define service level targets based on vulnerability severity, and track progress through to resolution. Automated escalation and SLA tracking are intended to ensure vulnerabilities are actively managed rather than simply recorded in reports.

The platform also includes live dashboards, historical trend reporting, and automated reporting that can support compliance initiatives, cyber insurance renewals, customer due diligence, and certifications including ISO 27001, Cyber Essentials Plus, and PCI DSS.

Helping organizations focus on what matters

Kirsty Fowler, Managing Director of WorkNest Secure, said organisations need greater visibility into their cyber risks as environments continue to change.

“Cyber threats do not operate to an annual schedule, yet many organisations are still relying on point-in-time assessments to understand their security posture,” Fowler said.

“New vulnerabilities emerge every day and infrastructure changes constantly, so businesses need visibility of their risks as they exist today, not six months ago.”

She added that the new functionality is intended to reduce the complexity of vulnerability management by combining automation with expert support.

“By combining automated scanning with expert support and practical remediation guidance, we help organisations cut through the noise, understand what matters most, and know exactly where action is needed,” Fowler said.

Responding to changing security needs

The launch reflects a broader shift in how organisations approach cybersecurity investment, with many moving away from one-off security projects in favour of continuous monitoring and ongoing risk management.

WorkNest Secure said the new functionality is available immediately either as a standalone vulnerability management service or as part of existing GuardNest packages.

The latest release builds on the redesign of the GuardNest platform in 2025, which introduced a more collaborative and user-friendly approach to vulnerability management, penetration testing, and remediation.

The post WorkNest Secure Launches Continuous Vulnerability Scanning with GuardNest appeared first on IT Security Guru.

Summary Bullets:

• Enterprises are deploying AI agents leveraging Google Cloud’s solutions and achieving positive business outcomes.
• Google Cloud offers the full AI stack, and its sovereign cloud and cyber solutions are especially crucial for enterprise customers.

AI agents are no longer an idea. They are now being deployed by enterprises to improve internal workplace productivity and external customer experience. At Google Cloud Summit Sydney (held on June 25, 2026), more examples of agentic AI in operations were presented, moving from deterministic AI chatbots to more autonomous systems. Bunnings, a home improvement, gardening, and hardware products retailer in Australia, upgraded its Buddy AI chatbot that helped customers with product search to an AI agent that takes customers’ descriptions of their projects and fills the shopping carts with the products that they need. Bunnings indicated an uplift of conversion rates and basket sizes when customers engage with Buddy. Similarly, Woolworths supermarket has an agentic AI powered Olive assistant that is able to build shopping baskets from recipe photos and assist with proactive meal planning. These two examples demonstrate how AI agents trained with proprietary knowledge (e.g., Bunnings’s DIY catalog and Woolworths’ recipe catalog) can deliver greater customer outcomes.

Enterprises deploying AI will appreciate the importance of data. To benefit from AI, it is necessary for enterprises to tap into corporate data to impart knowledge to AI agents. Google Cloud has the advantage in this area since enterprises have been adopting its products such as BigQuery to manage their data more effectively. Moreover, the company has other associated products such as Google Maps, Google Search, and Google Workspace that customers can leverage to enhance their AI capabilities. Transurban, an Australian road operations company and toll road operator, works with Google Cloud to transform its interaction with customers. While customer relationships are mainly transactional, Transurban now leverages Google Cloud’s solutions such as Gemini Enterprise, BigQuery, and Google Maps to power its Linkt app with the “Linkt AI” assistant, which proactively suggests optimal travel routes and toll options, dynamically adjusts schedules for prevailing weather, delivers timely account balance notifications, and offers discounted hotel and attraction bookings for upcoming road trips.

Data is the most valuable asset for enterprises particularly in the age of AI. Many companies across jurisdictions are increasingly concerned about security and sovereignty. Google Cloud offers a set of options for enterprises to meet their data and AI sovereignty requirements. It addresses not just the issue of data residency but also operational sovereignty and software sovereignty. Firstly, Google Cloud Data Boundary helps customers to meet data residency requirements through a set of controls, e.g., regions where data is stored, compliance programs, and external customer or partner managed encryption keys. This option allows enterprises to enjoy the benefits of hosting data in the public cloud for operational flexibility and high availability. Google Cloud is also offering support services with personnel meeting specific geographical locations as well as monitoring capabilities with real-time alerts when organization policy changes violate the defined compliance posture.

For customers that have a more stringent requirement on operational sovereignty, Google Cloud Dedicated addresses the need by enabling solutions to be operated by an independent local partner. The solution is hosted in a standalone, local instance of Google Cloud. The local partner maintains exclusive control over security-critical systems, identity management, authentication, etc. as well as controls over communication between Google and the Google Cloud Dedicated environment. For example, S3NS (a joint venture between Thales and Google Cloud that is headquartered in Paris, France) offers PREMI3NS services built on Google Cloud Dedicated for customers in Europe, now generally available in France. S3NS has achieved SecNumCloud 3.2 qualification from the French National Agency for the Security of Information Systems (ANSSI). Google Cloud Dedicated is also available in Germany (in preview).

For clients with the most stringent sovereignty requirements, Google Distributed Cloud (GDC) air-gapped allows complete isolation, without connectivity to an external network. The solution gives customers the flexibility to use general purpose compute and GPUs, and leverage open-source software. Google Cloud has also made its Gemini available in this air-gapped option, giving customers generative AI capabilities including automation, content generation, discovery and summarization. The GDC air-gapped solution is now deployed by many government agencies including those in Australia and Singapore within the Asia-Pacific region.

Besides sovereignty, Google Cloud has been bolstering its capability to offer stronger cyber defense. This includes the acquisition of Mandiant to add threat intelligence and incident response capabilities as well as Wiz for multi-cloud security defense. At the Google Cloud Summit, the company together with Wiz demonstrated how agentic AI can help to improve protection at scale and speed. Wiz is offering three AI agents with distinct roles: the Red Agent helps to uncover vulnerabilities and validate exploitable risks across web applications and APIs; the Blue Agent is the threat investigator that gathers evidence across cloud telemetry, runtime signals, and identity context to assess the severity of a threat and allow threats to be resolved more proactively; and the Green Agent is the investigation and remediation engine, identifying the root cause of a risk and the safest and most effective resolution. Wiz is known to provide security for cloud-native applications across major cloud environments including AWS, Microsoft Azure, Google Cloud, and Oracle. Following the completed acquisition on March 11, 2026, Wiz joins Google Cloud but operates independently to maintain its brand and key value proposition.

Google Cloud offers the full AI stack including applications and agents, AI models, data platforms, and infrastructure. It has also demonstrated strong momentum through broad customer references. However, the ability to drive AI adoption ultimately lies with its partner ecosystem and its willingness to support third-party products (including AI models) and help customers operate within a multi-cloud environment. Consulting partners such as Accenture and Mantel Group were featured at the Google Cloud event, and these partners play a crucial role in helping enterprises develop their business strategy around AI and implement solutions addressing data, security, governance, and other technology challenges.

The post Google Cloud Summit Sydney: Putting Agentic AI into Action appeared first on IT Connection.