Zero trust has become one of the most overused terms in security marketing, often applied to products that simply add another layer of network segmentation. This piece looks at what zero trust actually specifies according to its foundational standard, the implementation order that works in practice, and why identity is the dependency most organizations underestimate.

What Does Zero Trust Actually Specify, Beyond the Marketing Language?

Zero trust gets used loosely enough that it has largely lost precision as a term, applied to everything from a VPN replacement to a full architectural rebuild. That imprecision is a real problem for organizations trying to evaluate vendor claims, since two products both marketed as zero trust solutions can address entirely different parts of the actual model.

Organizations working through this evaluation often look at established regional providers as part of their planning. Among them, cybersecurity solutions in Dubai offer a starting point for comparing how different providers translate the zero trust framework into an actual implementation roadmap, which varies considerably depending on an organization’s existing infrastructure.

At its core, the specification requires continuous verification of every access request, whether it originates inside or outside the traditional network perimeter, and it removes the assumption that anything on the internal network is inherently trustworthy simply by virtue of its location.

That table names the components. The harder part, and the part most vendor pitches skip, is the order in which an organization actually implements them.

What Implementation Order Actually Works, and What Stalls?

Organizations that attempt zero trust as a single, comprehensive rollout tend to stall, since the scope quickly exceeds what any team can execute without disrupting normal operations. Organizations that succeed tend to sequence the work, starting with identity infrastructure before touching network segmentation.

That sequencing is not arbitrary. Identity is the hard dependency underneath every other component of the model. Microsegmentation without solid identity verification just creates smaller trusted zones rather than removing the underlying trust assumption. Continuous monitoring without reliable identity data produces noise rather than usable signal. Getting identity right first is what makes everything built on top of it actually function as intended.

IT Security Guru’s coverage of automated tools in SaaS penetration testing touches a related sequencing question from a different angle: the growing reliance on automation to keep pace with continuous verification demands, which is exactly the kind of tooling that becomes necessary once an organization’s zero trust model matures past the identity foundation stage.

Organizations that skip the identity-first ordering often end up with what looks like a zero trust deployment on paper but functions as a rebranded VLAN structure underneath, technically segmented but still relying on implicit trust once a user or device gets past the initial checkpoint.

Where Does the NIST Standard Actually Draw the Line?

Rather than relying on vendor definitions, it helps to work from the actual specification. NIST Special Publication 800-207 lays out the zero trust architecture in detail, defining the core logical components and the tenets that distinguish a genuine implementation from marketing language attached to conventional network security.

The standard makes it clear that zero trust is a set of principles guiding architecture decisions, not a single product or technology you can buy and deploy wholesale. That framing alone rules out a large share of what gets marketed under the term, since a genuine implementation touches identity management, policy enforcement, and monitoring together rather than any one of them in isolation.

How Can an Organization Tell Real Progress From a Rebranded VLAN?

A few honest checks separate genuine progress toward zero trust from a relabeled version of existing network security. Evaluate access decisions per request based on current context, not grant broad access once a user authenticates at the start of a session. Policy enforcement should apply consistently, whether a request originates inside or outside the traditional network boundary. Monitoring should also detect anomalous access patterns after the fact, not just block unauthorized access at the point of entry.

An organization that cannot clearly explain how it makes access decisions on a per-request basis is likely still operating on the old trust model, whatever the marketing materials on its security stack claim.

FAQ

What is zero trust, in the simplest accurate terms?

It is a security model that requires continuous verification of every access request, regardless of whether it originates inside or outside the traditional network perimeter, removing the assumption that internal network location implies trustworthiness.

Why does identity have to come before network segmentation in implementation?

Identity verification is the dependency the rest of the model relies on. Segmentation and monitoring without reliable identity data produce smaller trusted zones or noisy alerts, rather than genuinely removing implicit trust.

How can an organization tell if its zero trust deployment is genuine?

Access decisions should be evaluated per request based on current context, not granted broadly after initial login, and policy enforcement should apply consistently regardless of where a request originates.

Is zero trust a product an organization can simply buy?

No. NIST’s foundational specification describes it as a set of architectural principles, not a single purchasable technology. A genuine implementation brings together identity, policy enforcement, and monitoring rather than relying on any one component alone.

The post Zero Trust in Practice: Moving Beyond the Buzzword appeared first on IT Security Guru.

Vega, the pioneer of Agentic Cyber Defense, today announced the appointment of Scott Simkin as Chief Marketing Officer. Simkin joins as Vega II unleashes the best model trained for cyber defense to transform every alert, across all data sources, into a conclusive verdict at the speed of the attack. The platform keeps every lesson and gets faster with every fight, so defenders can finally outpace adversarial AI.

“Once a generation, a company changes how security gets done. For Cyber Defense in the age of AI, that company is Vega,” said Shay Sandler, co-founder and CEO of Vega. “Scott built the stories and execution engine behind the two biggest names in security operations. Now he will help Vega define the post-SIEM era. There is no one I would rather have leading this charge.”

Simkin is one of the industry’s best-known storytellers, having twice helped define a category and drive growth at massive scale. At Palo Alto Networks, he served as Vice President of Marketing for the end-to-end Cortex platform, one of the fastest-growing portfolios spanning security operations, cloud security, and Unit 42 services, with annual revenue approaching $2 billion. Earlier, he helped pioneer the XDR category, which has since replaced EDR as the standard for modern endpoint security. At CrowdStrike, he led product marketing, technical marketing, portfolio positioning, and campaigns across the full Falcon platform. He also launched Falcon Next-Gen SIEM, which CrowdStrike says now exceeds $600 million in annual recurring revenue. Two years after founding, Vega already defends some of the world’s largest banks, healthcare providers, and Fortune 200 enterprises, and Simkin joins to turn that momentum into dominant market leadership.

“For three years, CISOs have asked me the same question about AI in their SOC: isn’t this just an iteration on the SIEM? They were right, and Vega is the answer,” said Simkin. “AI across all your data, in place, without moving or ingesting it. Better outcomes, faster, at a lower total cost. That’s Vega, and no one else comes close. I’m grateful for a career at the companies that built this market, and I’ve never been more certain about where Cyber Defense is going. Vega has the technology and the people this moment demands. There was only one choice.”

Experience Vega II at Cyber Defense at the Frontier on Oct. 21, 2026, at 8 a.m. PT / 11 a.m. ET / 4 p.m. BST.

Read the blog · Register for the virtual summit · Get a demo today

The post Vega Appoints Category Builder Scott Simkin as Chief Marketing Officer to Define the Post-SIEM Era appeared first on IT Security Guru.

By Louise John, Head of IT Service Delivery at Virgin Active

For IT managers, unexpected projects and changing business priorities are normal part of the job.

You might have spent months planning your team’s workload, but only to be told with little warning that a new software solution needs to be implemented within six weeks.

Whatever the circumstances, the responsibility for delivering these projects often falls on IT teams, even when they have had little involvement in the decisions behind them.

As a manager, this can be particularly challenging because you are expected to deliver results within tight deadlines, while also managing your team’s existing workload, keeping up staff morale while also protecting them from burnout.

So, how can you support your team when unexpected projects land on their desks?

Prioritise and manage expectations

The first thing I would recommend is establishing what actually needs to be delivered and by when.

If a new software implementation has been given a six-week deadline, what are the absolute essentials that need to be completed within that timeframe?

Rather than attempting to deliver everything at once, identify what is achievable and communicate this to senior leadership. Managing expectations upwards is just as important as managing the team responsible for delivery.

It’s also important to involve your team in these conversations. Be honest about what is expected, explain the priorities and ask what they realistically believe can be achieved.

Protect your team’s wellbeing

Unexpected projects inevitably create pressure, particularly when teams are already managing demanding workloads.

As a manager, you need to recognise this and consider what additional support might be required.

Could working hours be more flexible? Can existing projects be paused or reassigned? Do you need additional resources? If employees are required to work extra hours, can they take time back once the project is completed?

It’s also important to establish boundaries and make sure your team isn’t expected to deliver everything simultaneously.

When workloads become overwhelming, it helps to focus on one task at a time rather than worrying about the hundred things still to do.

Finally, don’t underestimate the importance of keeping morale high. Even during the busiest periods, celebrating small wins, recognising people’s efforts and maintaining a sense of humour can make a big difference.

Ultimately, IT managers cannot always control the projects or deadlines handed to them, but they can control how they support their teams through them.

Louise is speaking at DTX + UCX London 2026, taking place at ExCeL London on 14 and 15 October.

Join Louise on Wednesday 14 October, from 12:10pm to 12:50pm, on the Design & Delivery Stage, for a panel discussion titled Caught in the middle: Leading digital change when nobody prepared you for it.

She will be joined by Rebecca d’Orazi Flavoni, Digital Growth and Training Consultant at RDF Training & Consulting; Greg Ferrari, Executive Director of Performance and Transformation at AAT; and Roger Kirby, Senior Enterprise Architect at AstraZeneca.

Together, they will explore how managers can balance pressure from senior leadership, protect their teams from burnout and successfully deliver digital change, even when they haven’t been given the tools or context to do so.

The post Leading digital change when nobody prepared you for it appeared first on IT Security Guru.

Ahead of their participation at DTX + UCX London 2026, Lee Robson, AWS Greenfield Practice Lead at Ingram Micro shares what the company will be showcasing at the event and explains what trends will impact the channel in the year ahead.

1. How is Ingram Micro participating in DTX + UCX 2026?

Ingram Micro will be showcasing how organisations can accelerate innovation with AWS. Our team will be demonstrating practical AI, cloud and security solutions, including AWS Quick, Claude via Amazon Bedrock, FinOps-led cloud optimisation and AWS security assessments. We’ll be connecting customers with specialist partners that can help turn strategy into measurable business outcomes. 

2. What are the key messages you will be promoting to delegates of the show?

Our message is simple: unlock the value of AI and cloud while maintaining control of cost, security and governance. We’ll be highlighting how AWS enables organisations to innovate faster, connect apps, data, and teams so answers turn into action instantly with AWS Quick, adopt generative AI through Claude via Bedrock, optimise cloud spend through FinOps, and strengthen their security posture.

3. What are the biggest challenges organisations face when purchasing technology through the channel?

Many organisations are overwhelmed by the pace of technology change, particularly around AI and cloud. Common challenges include understanding where to start, selecting the right solutions, managing cloud costs, ensuring security and compliance, and finding the skills required to implement and support new technologies successfully.

4. How can dedicated, experienced partners solve these challenges?

Experienced partners help customers move from technology discussions to business outcomes. With Ingram Micro, they remove the barrier to entry for a lot of businesses and provide strategic guidance, technical expertise and proven delivery frameworks that reduce risk and accelerate adoption. Partners can also help organisations optimise AWS investments, implement AI responsibly, improve security and create clear roadmaps for long-term success.

5. What trends do you believe will impact the channel in the year ahead?

Generative AI adoption will continue to accelerate, but organisations will increasingly focus on governance, security and achieving measurable ROI. We also expect greater emphasis on FinOps as cloud estates mature, alongside growing demand for cybersecurity services. Partners that combine AI expertise, cloud optimisation and security capabilities will be best positioned for growth.

The post DTX + UCX 2026: Ingram Micro on Unlocking AI and Cloud Without Losing Control appeared first on IT Security Guru.

Security awareness has long relied on teaching people to spot the obvious warning signs. Steve Povolny, Vice President of AI Strategy & Security Research at Exabeam, says attackers have been studying the same lessons. “The security industry has spent years teaching people what suspicious looks like: bad grammar, strange links, logins from impossible locations. Attackers have been adapting to those lessons, too.”

The result is a growing class of intrusions that look entirely legitimate on the surface. “A stolen session token can authenticate normally. A compromised employee can use applications they’re supposed to use. A North Korean IT worker can enter through the hiring process rather than an exploit chain,” Povolny explains. “An AI agent can take authorized actions and still produce an outcome nobody intended.”

At the same time, security operations centers are hardly short of data. “The modern SOC doesn’t have an information problem. It has a decision problem,” says Nick Tausek, Lead Security Automation Architect at Swimlane. “Analysts already have alerts, threat intelligence, identity data and endpoint telemetry. The slowdown happens when someone has to figure out which signal deserves attention, what context is missing and what should happen next.”

Behavior over time

Povolny argues that detection must shift from single events to patterns. “That’s why individual events are less meaningful in isolation. Modern detection has to understand behavior over time,” he says. “What does this identity normally access? Which systems and applications does it use? How does today’s sequence compare with its behavior over the past several months?”

That has implications for what organizations can reasonably expect of their staff. “The signal may not be one dramatic action. It may be a series of legitimate actions that have never occurred together before,” Povolny says. “Employees can and should report an unusual request or interaction, but we can’t expect them to recognize a valid login, an approved tool or a sequence of routine actions that only becomes concerning in context.”

Which one gets fixed first?

Piyush Sharrma, co-founder and CEO at Tuskira, sees the same problem in vulnerability management, and poses a thought experiment. “Picture two vulnerabilities. One carries a critical severity score but sits on an isolated system with strong controls around it. The other looks far less dramatic. It happens to connect an exposed application to a privileged identity and then to production.”

“Which one gets fixed first?” he asks.

“For years, vulnerability management has made it too easy to answer that question with severity alone,” Sharrma says. “Attackers aren’t working from a sorted CVE list. They’re looking for combinations of weaknesses that get them somewhere useful.”

AI, he believes, can help defenders see the environment the way an attacker does. “AI-assisted attack-path analysis can trace those combinations across identity, cloud, network and application environments. It can show which weaknesses are actually reachable. It can also identify whether an existing control cuts off the path before an attacker reaches something valuable.”

Matching intelligence to the problem

Tausek cautions that AI in the SOC must justify its place, and that not every case warrants the same treatment. “The AI SOC needs to earn its keep. Not every incident needs the same level of intelligence,” he says. “Routine cases can move through deterministic automation. More ambiguous activity may need AI-assisted investigation. A smaller group of complex threats can justify fully agentic analysis. Human judgment stays focused on the decisions where experience matters most.”

Sharrma says the goal should be clarity rather than ever-larger numbers. “Organizations don’t need more awareness of how many vulnerabilities they have. Most already know the number is uncomfortable. They need a better understanding of which ones can become a breach.”

Tausek agrees that speed alone will not solve the problem. “Cybersecurity Awareness Month is a useful reminder that faster detection alone isn’t enough,” he says. “Security operations need a way to turn what they know into action without forcing analysts to manually rebuild context every time something goes wrong.”

For Povolny, that is the core lesson for this year’s campaign. “Security programs and detection need to account for that ambiguity. Sometimes the credentials are valid, the tools are approved, and each action looks normal,” he concludes. “Behavioral context is what gives security teams a chance to see when those normal-looking pieces stop adding up.”

The post When everything looks normal: why context, not more alerts, is the next frontier for security operations appeared first on IT Security Guru.

By Alex Laurie, GTM CTO, Ping Identity

Generative AI has made content creation effortless, but establishing where content originates – and whether it can be trusted – remains a critical security challenge. While AI vendors are introducing digital watermarking to improve visibility, provenance and trust are not the same thing. Knowing an image or document was generated by AI reveals its origin, but it tells us nothing about its accuracy, intent, or authorisation.

Watermarking alone is an incomplete defense. Digital watermarks have existed for decades, and bad actors have consistently found ways to strip, alter, or spoof them. As AI safeguards evolve, so will the techniques designed to bypass them. Maintaining digital trust requires adaptable controls rather than static markers.

The limits of watermarking AI content

The fundamental flaw in relying solely on watermarking is treating origin as verification. A watermark cannot confirm that content is accurate, approved, or compliant.

In an enterprise environment, basic cyber hygiene principles must extend to synthetic content. Just as security teams train employees to scrutinise suspicious links and emails, AI outputs must be systematically validated. Where automated tasks involve critical risk, automated execution must escalate to human oversight.

Why clear standards matter in the fight against misinformation

This doesn’t mean watermarking is pointless – it is simply insufficient on its own. AI companies are right to experiment with ways of making AI-generated content more identifiable, but there are measures that can make these approaches more effective.

For example, attaching tamper-evident metadata to AI content effectively provides a record of who or what created it, when and using what system. That origin story automatically improves AI provenance, particularly when combined with clear policies and organisational standards that establish how AI-generated content should be handled and verified.

However, vendor-specific labeling is only a baseline. To build resilient defenses against AI-driven misinformation and deepfakes, organisations must combine content origin signals with continuous identity assurance. This requires enforcing contextual verification, treating synthetic assets and autonomous AI agents as managed identities with explicitly defined boundaries and runtime behavioural monitoring. Crucially, maintaining human-in-the-loop safeguards ensures that human accountability is retained for verifying high-stakes data and authorising sensitive actions.

Why transparency alone won’t be enough

The introduction of watermarking is an important development in how the technology industry is responding to the challenges created by AI-generated misinformation. Some AI companies are already taking the lead, with others likely to follow as they look for practical and responsible ways to give users greater visibility into AI-generated content. However, watermarking should be viewed as one part of a broader approach rather than a definitive solution.

As watermarking techniques become more sophisticated, so too will the methods used to circumvent them. Organisations need to be able to combine information about a piece of content’s origin and creation with other methods for identifying and validating AI-generated content. This will become increasingly important as synthetic content becomes harder to distinguish from material created by people. For example, every time I present my work, I now take the time to let the audience know which parts of my presentation were AI-generated and which parts human-generated. By being so up-front about my use of AI content, I get an improved level of engagement and trust.

The longer-term challenge is establishing the conditions in which people can make informed decisions about what they see and share. This requires clear standards for identifying AI-generated material and safeguards that can adapt as new methods of circumvention emerge.

Ultimately, provenance can provide valuable context, but it should not be treated as proof. Building confidence in AI-generated content will depend on technology working alongside human oversight, with people retaining responsibility for verifying information and deciding whether it can be trusted. As AI becomes more embedded in how content is produced and distributed, that combination of transparency, evolving safeguards and human accountability will be essential to maintaining trust over the long term.

The post The trust gap that AI watermarking can’t close appeared first on IT Security Guru.

Executives may be more relaxed about handing IT decisions to AI than the managers who answer to them, according to new research from TeamViewer.

The study found that 46% of middle managers want a human involved when AI resolves IT issues that could affect security, data or business operations. Among executive leaders, the figure falls to 24%.

The gap suggests that those closest to day-to-day AI-driven work want more oversight than the leaders setting AI strategy. It comes as security, privacy and risk concerns remain the most commonly cited barrier to AI adoption, named by 45% of IT decision-makers surveyed.

Unauthorised access tops the list of worries

Caution grows as AI systems are given more autonomy. Almost a third (30%) of workers named security risks or unauthorised access among their biggest concerns about AI acting without human involvement. That rose to 33% among both middle and senior managers, compared with 23% of executives.

Restricting what AI can access appears to ease some of that anxiety. Forty-two percent of senior managers said access limits would make them more comfortable with AI fixing problems on its own, compared with 37% of middle managers and 32% of executives.

Jan Bee, CISO at TeamViewer, said security had to be built in from the outset. “Security cannot be added after autonomy is introduced. The more authority an AI system has, the more important it is that its actions are transparent and that clear boundaries define when human approval is required,” he said.

He added that leaders “should also not assume that their own comfort with autonomy is shared across the organisation.”

Energy sector most cautious

Attitudes varied sharply by industry. In energy, utilities, and oil and gas, 49% of workers want a human in the loop for security-sensitive AI decisions. In marketing, media and communications, the figure was 28%.

Transparency builds trust

Across the workforce, 39% said strong security and privacy protections would make them more comfortable with autonomous AI. Again, managers were more concerned than executives: 46% of senior managers and 43% of middle managers cited protections, against 34% of executive leaders.

Visibility also matters. Nearly three-quarters (73%) of workers said they are more likely to trust AI when it shows what it is doing and why, while 70% are comfortable with AI taking action as long as they can step in when needed. Just over a third (36%) want limits on what AI can access before it acts independently.

However, many workers are unsure where the line sits. Over half (51%) said they do not always know when to trust AI output and when to verify it.

Who is to blame when AI gets it wrong?

Accountability is another grey area. Fewer than half (49%) of respondents said it is clear who is responsible when an autonomous system makes a mistake.

Opinions on where responsibility should lie were split. A quarter (26%) said it should fall to IT, while 25% said it rests with themselves. A further 17% said no one should be held responsible because a system made the error.

The findings indicate that organisations rolling out autonomous AI may need to set clearer rules on when AI can act alone, when oversight is required, and who owns the outcome when things go wrong.

The post Middle managers want tighter human oversight of AI than their bosses, TeamViewer research finds appeared first on IT Security Guru.

This year’s Cybersecurity Awareness Month theme, “Don’t Make It Easy for Them”, is usually read as advice for individuals. Cynthia Overby, director of strategic security solutions, ZCOE, at Rocket Software, says it should be read just as closely in the boardroom. “As Cybersecurity Awareness Month commences, the theme, ‘Don’t make it easy for them’ must apply to organizations just as much as individuals,” she says. “The past few months have shown no shortage of evidence as to why building cyber resilience is more crucial than ever before, and we will no doubt see this evolve further over the coming year.”

She is clear about what has changed. “The most significant shift over the past year is not that attackers are using entirely new techniques, but that AI has dramatically increased the speed, scale and sophistication with which existing methods can be executed.”

Victoria Dimmick, CEO of Titania, makes a similar point about where attacks begin. “Cybersecurity Awareness Month’s theme, ‘Don’t make it easy for them,’ is a useful reminder that many successful attacks don’t start with a highly sophisticated technique. They start with an opportunity we’ve left open,” she says. “Attackers rarely need to innovate when basic network infrastructure remains neglected and exposed.”

“That could be an unpatched vulnerability, an unnecessary route to the internet, an overly permissive access rule or a temporary exception that was never removed,” Dimmick continues. “Individually, these can seem like small issues. But attackers increasingly have automation and AI to help them find and exploit weaknesses faster, making the basics more important, not less.”

The speed gap

Mark Kuhr, CTO and co-founder of Synack, says speed is the defining story of the year. “Cybersecurity Awareness Month invites the usual reminders about passwords and phishing, but the more urgent story this year is speed,” he says. Synack’s 2026 State of Vulnerabilities Report, Kuhr explains, was “built on more than 11,000 exploitable vulnerabilities our Synack Red Team researchers validated across live customer environments,” and “showed that remote code execution findings rose 39 percent in 2025, brute force findings rose 17 percent, and content injection rose 8 percent. Those three categories share a purpose, moving an attacker past the perimeter and toward the systems that matter most.”

“Attackers have also picked up speed,” he continues. “The window between a vulnerability’s disclosure and its exploitation has fallen from months to hours, and in some cases, our researchers are seeing exploitation before a vulnerability is even publicly disclosed. AI-enabled adversaries can now automate reconnaissance and scanning continuously across thousands of assets at once, with no scope limitations.”

Meanwhile, much of the attack surface goes untested. Synack’s research alongside Omdia, Kuhr says, “found that the average enterprise only tests 32 percent of its exposed attack surface. The other 68 percent becomes a target, as attackers routinely find infrastructure that security teams never knew existed.”

The assumption trap

Overby believes many organizations are taking false comfort from the controls they have deployed. “One of the biggest mistakes organizations are making amidst the current threat climate is assuming that security controls are working just because they have been implemented,” she warns. “In an environment shaped by AI-driven threats, cloud services, third-party dependencies, and hybrid infrastructure, security measures can quickly become outdated, and organizations simply cannot afford to stay still.”

Dimmick sees the same pattern at the network level. “The challenge is that organizations often assume the controls they have put in place are still working as intended. Networks change constantly. Devices are added, firewall rules are updated, permissions change and configurations drift,” she says. “A policy that was correct six months ago does not tell you whether your network is secure today.”

Andrew Costis, Engineering Manager of the Adversary Research Team at AttackIQ, is blunter still. “A security control that has never been tested against the behavior it’s supposed to stop is still an assumption,” he says. “Cybersecurity Awareness Month should encourage organizations to challenge more of those assumptions.”

He offers a set of questions every security team should be able to answer. “Would an endpoint control catch the lateral movement technique your threat model says you’re worried about? Would an identity control interrupt privilege escalation? If one defense failed, would another detect or stop the attack before sensitive data was reached? These questions can, and should, be tested before an incident.”

From compliance to continuous assurance

Regulation is pushing in the right direction, Overby says, but cannot do the job alone. “In line with this rising threat landscape, regulations such as the Cyber Resilience Act (CRA) are now increasingly demanding secure-by-design development, vulnerability management, incident reporting, software supply chain transparency and operational resilience,” she says. “While this is a positive first step, regulation simply cannot keep pace with every change in the threat landscape, meaning that businesses must look beyond check-box compliance and prioritize continuous assurance and predictive defense measures.”

“This means a transition from asking ‘Do we have security controls?’ to ‘Can we prove they are working today?’” Overby adds. “Ultimately, the organizations best placed to manage this new era of risk will be those that make continuous assurance a core part of how they operate, not just a periodic exercise.”

Costis points to continuous threat exposure management (CTEM) and validation as the way to turn that ambition into evidence. “CTEM gives organizations a continuous way to identify and prioritize exposure. Adversarial exposure validation adds evidence by testing defenses against real-world attacker tactics and techniques,” he says. “The result goes beyond a theoretical risk score. Teams can see where tested protections work, where they fail and whether remediation closed the gap.”

Kuhr agrees that cadence is now the deciding factor. “Cybersecurity Awareness Month should be a reminder that speed now favors whoever tests continuously, not whoever tests hardest once a year,” he says. “Pairing AI that can watch an attack surface around the clock with researchers who can apply human judgment is how security teams will close that distance before attackers do.”

Fewer places to go

For Dimmick, making life harder for attackers comes down to disciplined basics, checked regularly. “Making life harder for attackers means reducing the opportunities available to them. Harden your infrastructure. Segment your network. Remove access that isn’t needed. Apply least privilege, and, importantly, regularly validate that those controls are actually being enforced.”

“Good cybersecurity isn’t just about responding quickly when something goes wrong. It’s about making sure attackers have fewer places to go in the first place,” she concludes. “Verify it. Don’t assume it.”

Costis sums up the distinction: “Awareness helps you understand what attackers might do. Validation shows how your defenses respond when those behaviors are tested.”

The post Verify it, don’t assume it: why untested security controls are making life easy for attackers appeared first on IT Security Guru.

Every October, security teams roll out refreshed training, posters and phishing simulations. But according to Rob Gregory, CISO at Optiv, organizations that treat the month as the centerpiece of their awareness efforts are missing the point. “I believe Cyber Awareness Month (CAM) is a valuable amplifier and another reminder about the importance we all play in an organization’s cybersecurity risk management program. However, it cannot be the strategy,” he says. “If companies use CAM as another training module, then it’s just another compliance exercise.”

Rafael Narezzi, co-founder and CEO of Centrii, argues that the very definition of awareness needs to broaden. “For years, cybersecurity awareness has largely been framed around what employees should do differently – recognize phishing attempts, strengthen passwords and avoid suspicious links,” he says. “Those habits still matter, but today’s threat environment requires a much broader definition of awareness.”

Sandhya Arun, Chief Technology Officer at Wipro, reads this year’s theme in the same spirit. “This theme of this year’s Cybersecurity Awareness Month, ‘Don’t Make It Easy for Them,’ is not just a call for greater awareness, but a call to build consistent, day-to-day habits that make life difficult for cyber criminals. This applies to both individuals in their personal lives and to organizations.”

From completion rates to behavior change

For Gregory, the metric that matters is not how many people finished a course. “Security awareness is a 24/7, 365-day-a-year operation. The goal for a CISO should be behavior change and reinforcement, not training completion,” he says. “CISOs should use this month as an opportunity to reinforce the behaviors that employees should be practicing throughout all 12 months of the year.”

“They can do this by creating visibility and encouraging engagement as well as ensuring employees understand they are the front lines in cybersecurity,” Gregory adds. “The strongest cyber cultures exist when employees see themselves as part of the security team. This month should reinforce that culture, not be a substitute for it.”

Narezzi agrees that people should be treated as an asset rather than a liability. “This Cybersecurity Awareness Month, we should move beyond treating awareness as an annual training exercise. True cyber resilience requires continuous asset visibility, carefully controlled access, clear supply-chain accountability and incident-response plans that are regularly tested,” he says. “People should not simply be labeled the weakest link; they should be equipped to become an active layer of defense.”

When cyber risk is operational risk

Narezzi’s perspective is shaped by critical infrastructure, where the consequences of an attack look very different from a typical data breach. “In critical infrastructure, cyber risk is operational risk. A compromised battery storage system, renewable energy site or remote-access connection may not produce the warning signs of a conventional data breach,” he explains. “Instead, the consequences can appear as lost generation, unstable operations, reduced availability and direct financial loss.”

That means awareness has to extend beyond an organisation’s own walls. “As energy infrastructure becomes more distributed and interconnected, organizations need visibility not only into their own environments, but also into the vendors and technologies on which their operations depend,” he says.

It also means helping leaders focus on what matters. “Organizations have too many alerts and too little context,” Narezzi warns. “Leaders must be able to determine which exposures could disrupt operations, how much capacity or revenue is at risk and which action will reduce that risk first.”

Cyber agility as an organizational capability

Arun notes that AI is reshaping both sides of the contest. “As AI becomes more widely adopted, attackers and defenders alike are gaining access to new capabilities. AI-enabled techniques can automate reconnaissance, generate convincing content, and increase the scale at which cyber operations are conducted,” she says. “For organizations, this raises the imperative to strengthen detection and response, reducing the time between identifying a threat and acting on it.”

Crucially, she cautions that AI is not a silver bullet. “At the same time, no one can safely assume that every attack can be prevented. AI will strengthen cyber defense, but it will not make organizations breach-proof,” Arun says. “‘Don’t Make It Easy for Them’ therefore requires organization-wide systems to focus on both prevention and resilience. The defining capability is cyber agility: the ability to detect compromise early, contain its spread, recover quickly, and adapt from the event.”

Achieving that, she argues, depends on getting the balance between automation and people right. “The strongest cyber defense combines machine speed with human judgment. Organizations need clear policies that define the role of automation, establish decision rights, and preserve accountability,” she says. “Cyber awareness must be embedded into the organizational operating model, linking workforce behavior, technology, and response. Ultimately, cyber agility is not just a security objective; it is an organizational responsibility spanning architecture, operating models, and governance.”

Everyone has a role

Narezzi believes awareness only becomes meaningful when it reaches every level of an organization. “Cybersecurity becomes meaningful when everyone – from operators and engineers to executives and boards – understands both their role and the real-world consequences of inaction.”

Arun leaves leaders with a clear call to action. “The imperative for leaders is clear: make cyber agility an organizational capability,” she says. “Cybersecurity Awareness Month shines a spotlight on cyber risk and demands attention, but it does not create resilience. Resilience is built every day and will be tested when an organization can least afford to fail.”

The post Cybersecurity Awareness Month “cannot be the strategy”: why awareness must become a year-round capability appeared first on IT Security Guru.

AI tools have moved from novelty to daily habit with remarkable speed, and for many people they are now as much a part of the working day as email. For Corey Nachreiner, CSO at WatchGuard Technologies, that makes a few simple questions more urgent than ever. “People are already using AI for everyday questions, work tasks, and highly personal conversations. Before you type, stop and ask: What am I sharing? Who might see it? What is this tool allowed to do for me? Those questions matter more as AI moves beyond chat and starts taking actions on our behalf.”

Jack Cherkas, Global Chief Information Security Officer at Syntax, believes this year’s campaign is well timed to prompt that reflection. “Cybersecurity Awareness Month is usually a reminder to get the fundamentals right and that is still absolutely critical,” he says. “This year, however, the National Cybersecurity Alliance has adopted the theme, ‘Don’t Make It Easy for Them,’ and that message should also prompt organizations to look at a growing source of risk: artificial intelligence (AI).”

“As organizations and individuals adopt AI, we need to remember that AI is not just another technology. It has the potential to be transformational,” Cherkas continues. “It can hold accounts and permissions, see whatever you give it access to and take actions on your behalf. Many organizations and individuals have never considered the implications of these actions.”

Handing over your privilege

Nachreiner warns that the convenience of connecting AI assistants to personal and corporate accounts comes with a significant trade-off. “When we give an AI agent access to our email, files, calendars, financial information, or other accounts, we are giving it our privilege,” he says. “If someone gets access to that AI account or its credentials, they may be able to do almost anything we can do. That makes AI accounts an increasingly attractive target for threat actors.”

His advice is to treat those accounts with the seriousness they deserve. “Protect them like your primary email or bank account. Turn on multi-factor authentication, be skeptical of unexpected links and login requests, and pause before you share sensitive information or approve a connection.”

Cherkas frames the same challenge as a simple test that should be applied before any AI tool is switched on. “So, as the world embraces AI, we must determine three things before access is granted: what it can see, what it can do and who is responsible for it.”

The AI nobody chose

For organisations, the picture is complicated by the sheer number of routes through which AI enters the business. “For businesses, the issue is shadow AI,” says Nachreiner. “It is not just the chatbot someone opens in a browser. It’s also the plug-in, extension, or integration that gets added without security knowing.”

Cherkas goes further, pointing out that some AI arrives without anyone actively adding it at all. “And we also must remember that, in many cases, AI appears even when we never chose it. It’s in the tool approved three years ago that quietly shipped an AI-infused update, the browser extension or the application add-in,” he says. “Some AI adoption arrives without a decision, and the things nobody decided on are the things nobody is watching.”

Visibility first

Both experts agree that organisations cannot govern what they cannot see. “Security doesn’t exist without visibility,” says Nachreiner. “Organisations need to know which AI tools are in use, where their data is going, and what permissions those tools have.”

He highlights encrypted traffic as a particular blind spot. “Our latest research found that 95% of malware arrived over encrypted TLS traffic, yet only 20% of deployed devices inspect that traffic. As more workplace activity and more AI integrations operate through encrypted channels, organisations cannot assume that encrypted means safe.”

From there, Nachreiner sets out a clear order of priorities. “It is visibility first, then policy, then enforcement. So, teams can decide what is allowed, what needs to be turned off, and where controls need to be applied,” he says. “Implementing Shadow AI policies and safeguards is critically important, and something that we have done successfully at WatchGuard to protect our own employees, customers and partners.”

For Cherkas, the effort required is modest compared with the risk of doing nothing. “‘Don’t Make It Easy for Them’ is the right tagline for this year. For organizations, that means adopting AI in a pragmatic, secure and responsible manner. For individuals, it means 10 minutes in your settings. Neither is hard. Both are overdue for many.”

The post Shadow AI and the permissions problem: what to check before handing AI the keys appeared first on IT Security Guru.

For more than two decades, Cybersecurity Awareness Month has centered on people: the employee who might click a malicious link, reuse a password or approve a suspicious login. This October, as the campaign runs under the banner “Don’t Make It Easy for Them”, identity specialists say the conversation must widen to include a fast-growing population of users that will never sit through a training module: AI agents.

“Cybersecurity Awareness Month has traditionally focused on human behavior: recognizing phishing, protecting credentials and making better decisions about access to an organization’s network, data and accounts. That conversation now needs to expand,” says Darren Guccione, CEO and co-founder of Keeper Security. “As organizations rapidly deploy AI agents across their environments, they are creating an entirely new class of digital users, often without applying the same identity governance expected for employees, contractors or administrators.”

Guccione is clear that this is no longer an experimental corner of the IT estate. “AI is transforming from intelligence to unremovable enterprise infrastructure. AI agents can now authenticate into systems, retrieve sensitive information, interact with applications, execute workflows and make critical decisions – all at machine speed. If an agent has credentials and permissions, it represents an identity, and every identity creates risk when its access is excessive, persistent or poorly monitored.”

John Cannava, CIO at Ping Identity, agrees that the boundaries of what security teams must protect have shifted. “As technology evolves, so does the definition of who, or what, organizations need to secure,” he says. “AI agents are increasingly accessing applications, data, and critical business systems while taking actions at machine speed, creating a new layer of risk that businesses need to manage every day.”

Scale is the real challenge

What makes agentic AI different from previous waves of automation is the speed at which new identities can appear. “The biggest problem is scale,” Guccione warns. “Organizations can deploy hundreds or thousands of non-human identities far faster than they onboard human employees. If those agents receive standing credentials, broad permissions or long-lived secrets without appropriate governance, the attack surface expands just as quickly. A compromised AI agent with privileged access can give an attacker direct access into critical systems and data.”

That concern resonates with Michael Marino, SVP of strategy, identity security at Keeper Security, who has watched the discipline of privileged access change dramatically. “Cybersecurity Awareness Month is an opportunity to reflect not only on how cyber threats have evolved, but on how our defenses have had to evolve alongside them,” he says. “Over my career in identity security, I’ve seen few areas change as significantly as Privileged Access Management (PAM).”

“PAM was once primarily about putting administrator passwords into a secure vault,” Marino explains. “That made sense when infrastructure was largely on-premises, privileged users were relatively easy to identify and access occurred within clearly defined network boundaries. The objective was straightforward: protect powerful credentials and maintain an audit trail around their use.”

That model has not survived the move to the cloud. “The days of contained network perimeter no longer exist,” he says. “Organizations now operate across cloud, hybrid and remote infrastructure, while employees, contractors, applications, service accounts and automated systems all require different levels of access.” Marino points to Keeper’s 2025 report, Securing Privileged Access: The Key to Modern Enterprise Defense, which “found that 94% of organizations operate in hybrid or cloud-first environments. As access has become more distributed, the traditional concept of privilege has expanded with it.”

As a result, he argues, the scope of PAM has had to grow. “Modern PAM, therefore, has to be about much more than protecting passwords. It must control when privileged access is granted, what someone or something can access and what happens during that session. Principles such as least privilege, just-in-time access and zero standing privilege help organizations replace persistent administrative rights with access that is intentional, temporary and auditable.”

AI is now driving the next phase of that evolution, both as a source of risk and as a defensive tool. “The next stage of this evolution will be driven by automation and AI,” Marino says. “Non-human identities and AI agents are creating privileged access at a scale that security teams cannot manage manually. At the same time, AI can help defenders analyze privileged activity and identify suspicious behavior much faster.”

Familiar principles, new identities

Encouragingly, none of the experts believe organizations need to tear up the rulebook. “The security principles needed to secure these identities are not new,” says Guccione. “Organizations should apply the same zero-trust discipline to AI agents that they apply to people: verify every identity, enforce the principle of least privilege, eliminate unnecessary standing access, continuously monitor privileged activity, and protect and rotate credentials and secrets. Access should be granted only to the resources required for a specific task and only for as long as that access is necessary.”

Cannava makes the same case, stressing that accountability ultimately sits with people. “The same security principles we’ve long applied to human access now need to extend to AI. At the end of the day, the nonhuman identity problem is still a human problem,” he says. “Organizations need to know who authorized an agent, what authority it has, and what it should be allowed to do. That means giving AI agents verifiable identities, clear ownership, and least-privilege access, with continuous authorization and accountability for their actions.”

The key, he adds, is enforcement rather than intent. “Businesses should extend proven identity principles to machines acting on behalf of people and build those principles into controls that can actually be enforced.”

For Marino, that continuity is the real lesson of the month. “The lesson for Cybersecurity Awareness Month is that cybersecurity fundamentals don’t disappear as technology changes – they evolve to meet the occasion. Privileged access will always represent concentrated risk. Effective PAM is about continually adapting how that risk is controlled as the identities, infrastructure and technologies around it change.”

Awareness beyond October

Guccione believes awareness itself has to evolve to keep up. “Cybersecurity awareness must evolve alongside technology. We have spent years teaching organizations that every employee identity requires governance. Now we need to extend that understanding to machines.”

“The next frontier of cybersecurity awareness is recognizing that AI agents are users too,” he concludes. “Organizations that govern them accordingly will be far better positioned to capture the benefits of agentic AI without creating an unmanaged layer of privileged access.”

Cannava, meanwhile, warns against treating the month as a one-off. “Cybersecurity Awareness Month is an important reminder to make security a priority, but it shouldn’t begin and end in October,” he says. “Looking ahead to secure the next 250 years, security cannot be in the spotlight for only one month. Leaders must build a culture of security and maintain visibility and control over every kind of identity year-round.”

The post Cybersecurity Awareness Month: AI agents are users too, and they need governing like it appeared first on IT Security Guru.

An annual penetration test reliably satisfies an audit requirement but tells you comparatively little about your actual exposure for the other eleven months of the year. This piece covers what an annual test does and does not actually evidence, why the compliance framing caps what testing programs aim for, and what changes operationally once an organization moves toward continuous testing instead.

What Does an Annual Penetration Test Actually Evidence, and What Does It Not?

An annual test evidences exactly one thing reliably: that a specific, scoped set of systems, evaluated on a specific date, met a certain security bar at that moment. What it does not evidence is anything about the eleven months before or after that date, despite frequently being treated in compliance documentation as though it stands in for continuous assurance.

Organizations moving away from this model increasingly look toward AI pentesting as a way to close that gap, combining automated coverage with human validation to extend assurance across the periods a single annual snapshot simply cannot reach.

This publication made a related argument back in July, and it is worth picking up directly from that piece rather than treating this as a separate, competing thesis. That earlier argument established why the point-in-time model has structurally stopped matching how environments actually change. What follows here is the operational question that argument leaves open: what specifically changes once an organization accepts it and moves toward something continuous instead.

Why Does the Compliance Frame Cap What Testing Programs Actually Aim For?

Once a testing program’s primary goal becomes satisfying a specific audit requirement, the scope, depth, and cadence of testing tend to calibrate to the minimum that requirement demands rather than to what actually reduces risk most effectively. This is not a failure of any individual security team so much as a predictable consequence of how compliance requirements get structured, as a floor rather than a target.

NIST Special Publication 800-115 actually defines a considerably broader scope for what a genuine security assessment program should cover than most organizations’ compliance-driven annual test actually achieves, which is worth reading directly for any team trying to understand the gap between what a compliance checkbox requires and what the underlying standard the checkbox references actually describes.

That gap between the standard’s actual scope and how narrowly it typically gets implemented is where most of the risk hiding in a “compliant” security posture actually lives.

What Changes About Remediation Cycles Once Testing Becomes Continuous?

The most significant operational shift when moving from annual to continuous testing happens in remediation, not in testing itself. An annual test produces a large batch of findings once a year, which then get triaged and remediated in a concentrated burst before fading from attention until the next cycle. Continuous testing produces a steadier stream of smaller finding batches, which requires a correspondingly steady remediation process rather than a periodic burst.

Organizations making this transition often discover their remediation process was implicitly designed around the annual batch model, and simply running more frequent tests without adjusting how findings are triaged and assigned creates a backlog rather than genuinely improved security. The testing cadence and the remediation cadence have to change together, not one without the other.

What Does Continuous Testing Actually Cost, and Where Is It Overkill?

Continuous testing generally shifts cost structure from a single large annual engagement toward an ongoing relationship, which changes budget planning even when total annual spend lands in a similar range. That shift genuinely suits environments with frequent deployment cycles and meaningful configuration change, where an annual snapshot goes stale quickly.

It is worth being honest that continuous testing is not proportionate for every environment. A genuinely stable system with infrequent changes and a narrow, well-understood attack surface may not need the same cadence as a rapidly evolving cloud native environment shipping code weekly. Matching testing intensity to actual rate of change, rather than adopting continuous testing uniformly because it sounds more rigorous, keeps the investment proportional to the actual risk.

FAQ

What does an annual penetration test actually prove?

It evidences that a specific set of systems met a certain security bar on the date the test was conducted. It does not provide meaningful assurance about the months before or after that date, despite often being treated as though it does in compliance documentation.

Why does compliance-driven testing tend to underdeliver on actual security value?

Compliance requirements function as a minimum floor, and testing programs built primarily to satisfy that floor tend to calibrate scope and depth toward the minimum required rather than toward what would most effectively reduce actual risk.

What actually needs to change when moving from annual to continuous testing?

Remediation processes need to shift from handling one large annual batch of findings to managing a steadier, ongoing stream. Increasing testing frequency without adjusting how findings get triaged tends to create a backlog rather than genuinely improved security.

Does every organization need continuous penetration testing?

No. Environments with frequent deployments and meaningful configuration changes benefit most from continuous testing. A stable environment with infrequent changes and a narrow attack surface may be adequately served by a less intensive cadence.

The post Continuous Penetration Testing: Why Annual Pen Tests Are a Compliance Checkbox, Not a Security Strategy appeared first on IT Security Guru.

By Ansgar Dodt, VP Product Management for Software Monetization at Thales

Not every piece of software is worth attacking.

Traditionally, that has offered software vendors a degree of protection. Reverse engineering takes time, specialist expertise and persistence, forcing attackers to weigh the potential reward against the effort involved. However, AI is beginning to change that trade-off.

Recent AI-powered security incidents, including cases disclosed by OpenAI and Anthropic, suggest this is not a one-off development but part of a wider trend. While much of the cybersecurity debate has focused on how AI is making attacks faster or more sophisticated, the bigger shift for software security may be an economic one. Reducing the time and human effort needed to identify and exploit potential flaws opens up more opportunities.

When attackers can afford to be less selective

Software that would never previously justified days of an expert’s time to reverse engineer may become worth investigating when AI can perform much of the initial work. Attackers no longer need to concentrate their time and resources solely on a handful of obvious, high-value targets when they can now seek a wider range of choices.

AI agents can increasingly interact with decompilers, debuggers and other security tools, interpret unfamiliar code and test different approaches. If one avenue proves unsuccessful, another can be explored with less continuous human involvement.

This doesn’t mean specialist expertise becomes irrelevant, or that an AI agent can instantly compromise any application. But it does allow attackers to investigate more potential targets with the same resources, making software they might previously have ignored worth a closer look.

When software leaves your control

Once software leaves a vendor’s environment, attackers have more opportunity to analyse it. Cloud-native applications can largely remain within environments controlled by their providers, but desktop applications, on-premise deployments, industrial equipment, connected devices and edge software create a different problem: executable code is placed directly into an environment the developer may no longer control.

From the moment someone obtains that binary, time is on their side. It can be examined privately and repeatedly for vulnerabilities, proprietary algorithms, cryptographic routines, privileged functionality or other valuable information. The consequences can extend well beyond the security team: exposing proprietary code or vulnerabilities can lead to intellectual property theft, operational disruption, regulatory consequences and loss of customer trust.

As automated analysis becomes more capable, vendors should increasingly assume that valuable software distributed outside their environment will eventually be subjected to AI-assisted analysis.

Security approaches therefore need to account not only for preventing unauthorised access to software, but also for what an attacker can learn once they have it.

Patching only works once you know the problem

The fundamentals of security hygiene endure, with secure development, vulnerability testing and rapid patching remaining fundamental. But a vulnerability cannot be fixed until it has been identified, and no development process can guarantee that every weakness will be discovered before software reaches customers.

As AI makes it easier to continuously probe deployed applications, defenders face increasing pressure to find and remediate weaknesses before an attacker does. Patching and application protection therefore need to work together: patching fixes known vulnerabilities, while application protection makes any weaknesses that remain harder for attackers to discover and exploit.

Making software harder to attack

The aim isn’t to make reverse engineering impossible. It is to make software harder and more time-consuming for an attacker to understand and take apart.

Different layers of protection can disguise how software works and make it harder to analyse, alter or copy. These include techniques that obscure code and data, detect attempts to tamper with an application, or protect it while it is running. Together, these measures create additional barriers an attacker must overcome.

In combination, their value is cumulative: each additional barrier forces an attacker to spend more time and computational resources analysing the software.

Thales recently tested this in practice. An autonomous AI reverse-engineering agent analysed two versions of the same application, each containing ten deliberately planted vulnerabilities. Against the unprotected binary, it identified eight in approximately three minutes. Against the protected version, it continued for more than six hours, consumed around 970 times as many tokens and stopped without identifying an actionable vulnerability.

Making vulnerabilities harder to discover can buy vendors time to identify weaknesses themselves, develop and validate patches and deploy updates before an issue can be weaponised at scale.

Changing the attacker’s calculation

AI will continue to reduce some of the constraints that have historically shaped software attacks. Organisations cannot control how quickly those capabilities improve or who gains access to them.

Nor can they stop AI from lowering the cost of analysing software. But they can change the economics of attacking their own applications by making them more difficult and resource-intensive to analyse. Eliminating vulnerabilities remains the priority, but so does increasing the time, compute and effort required to find and exploit those that inevitably remain.

If attackers increasingly have the resources to look everywhere, making your software a costly place to look may become a defence in itself.

The post AI Is Making Software Cheaper to Attack. Defenders Need to Change the Price appeared first on IT Security Guru.

There is no single official figure for what a UK SME spends on cybersecurity today, because the UK Government stopped collecting detailed cybersecurity investment figures after its 2019 survey. 

The last official benchmark found that micro and small businesses spent an average of £3,490 a year, although the median was only £200 and 33% reported spending nothing. This large gap shows how differently SMEs approach security. 

A more useful way to look at the question in 2026 is to consider what an SME needs to protect. Cybersecurity spending can include email security, websites, laptops and mobiles, cloud software, Microsoft 365 or Google Workspace, backups, firewalls, endpoint protection, vulnerability management, staff training, penetration testing, cyber insurance and specialist IT or security services.

How much should a UK SME spend on cybersecurity?

A typical UK SME should consider budgeting around £5,000 to £15,000 a year for cybersecurity, with larger or more digitally dependent businesses potentially needing considerably more.

There is no universal percentage or fixed amount that works for every business. A ten-person consultancy handling limited customer data will have different requirements from a 50-person manufacturer with internet-connected systems, cloud applications and sensitive intellectual property.

The important point is that the budget should cover the whole attack surface rather than simply paying for antivirus software. A business can have excellent endpoint protection but still be vulnerable through a compromised Microsoft 365 account, an unprotected website, an exposed application, weak passwords or an employee falling for a phishing email.

What should that cybersecurity budget cover?

A sensible SME cybersecurity budget should protect people, devices, applications, websites, email and data, rather than focusing on one security product.

For email, this could include strong spam and phishing protection, multi-factor authentication and monitoring for suspicious account activity. For laptops and desktops, businesses should consider endpoint protection, device encryption, patching and secure configuration.

Websites and online applications also need protection. This can include vulnerability scanning, web application security, secure hosting, domain protection, SSL certificates, regular updates and penetration testing where appropriate. Cloud software and business applications should also be reviewed because a security incident affecting a third-party platform can still disrupt the SME.

Backups are another important part of the budget. Businesses should maintain secure, tested backups so that ransomware or accidental deletion does not turn into a major business interruption.

Has UK SME cybersecurity spending increased over the last 5 to 10 years?

UK cybersecurity investment has increased substantially over the last decade, although there is not a continuous official series showing exactly how much the average SME spends each year.

In 2018, the UK Government estimated that micro and small businesses spent an average of around £2,400 a year on cybersecurity. By the 2019 Cyber Security Breaches Survey, the mean annual investment for micro and small businesses had risen to £3,490. However, the Government warned that spending varied considerably between organisations. (GOV.UK)

The wider cybersecurity market has also expanded significantly. UK Government analysis shows that the number of cybersecurity firms increased from 846 in 2017 to 2,091 in 2023, while cybersecurity-related revenue rose from £5.68 billion to £11.86 billion. 

Why are SMEs spending more on cybersecurity?

SMEs are facing a broader and more complicated digital threat landscape than they did five or ten years ago – to the point that constant upgrades make it hard to manage cashflow. Businesses now rely heavily on cloud software, remote working, online payments, websites, customer databases and email, creating more potential routes into the organisation.

The latest Government survey found that 43% of UK businesses experienced a cyber breach or attack in the previous 12 months. Among small businesses, the figure was 50%. 

Budgets are responding to this pressure. The latest Cyber Security Longitudinal Survey found that 37% of businesses had increased their cybersecurity budget, either somewhat or substantially, while a further 18% had increased it in line with inflation. 

What is the right cybersecurity budget for an SME?

The right cybersecurity budget is therefore less about finding one average number and more about making sure the business has enough money to cover its actual exposure.

For many UK SMEs, £5,000 to £15,000 per year is a reasonable starting point, particularly when that budget covers email, endpoints, websites, cloud applications, backups, vulnerability management, employee awareness and external security expertise. 

Businesses holding sensitive personal information, processing payments or operating critical systems may need substantially more.

Cybersecurity should be treated as an ongoing business cost rather than a one-off IT purchase. The question is no longer simply whether an SME can afford to spend money on security, but whether it can afford to leave its website, email, software, data and customers inadequately protected.

The post How much does the average UK SME spend on cybersecurity each year? appeared first on IT Security Guru.

Business owners everywhere are embracing AI and its capabilities more than ever, and for good reason. They can speed up processes, minimize mistakes, and even save money, but is this all it is doing? Not in the slightest. In fact, this is only touching the tip of the iceberg. AI has vastly improved sectors across industries, especially in tech in recent years, and here is how. 

• Network Security and Cybersecurity

Whether a fully-fledged enterprise with thousands of employees and customers or a small startup with three employees and a select few loyal clients, businesses want to know their data is safe, their user accounts and hardware are protected, and a breach won’t tarnish their reputation. It may seem as though the network and cybersecurity sector has perfected its product range, supporting business owners with firewalls, virtual private networks, Intrusion Detection and Prevention Systems (IDS/IPS), and Network Access Control (NAC), but AI has only enhanced it. 

An AI firewall takes all the features of a next-generation firewall and enhances them with AI capabilities, making the most of modern machine learning. The result is a highly sophisticated system that can identify known and unknown threats within network traffic. Since cyber threats have evolved at a similar pace to technology, these advances mean AI Firewalls can now detect patterns and anomalies in network data, so attacks that might have been missed are no longer overlooked. For businesses investing in cybersecurity, this is a major win. 

• Cloud Computing 

For scaling businesses, cloud computing is often the smart choice. It offers flexible resources and enables faster innovation, whether you need servers, storage, databases, or software analytics. The problem is that it can become extremely complex, and quite quickly, especially for someone with only basic knowledge but who is trying to navigate several cloud servers, applications, and user accounts. 

AI developments are changing the game here. AI can now analyze how someone uses their cloud resources and flag excessive dormant accounts, while also highlighting inefficient processes and bottlenecks. Based on this information, businesses save money on resources they actually didn’t need in the first place. AI goes even deeper in this sector. Many cloud computing companies have developed predictive scaling, where AI helps businesses better anticipate demand based on historical patterns. Cloud computing used to mean dedicating a lot of time to repetitive tasks; now AI can reduce the need for manual monitoring, which is usually reserved for IT teams. While experts, mistakes can happen. After all, they are only human, but AI massively reduces this risk, particularly for cloud administration tasks. 

• Software Development

As more businesses come online every day, they need reliable software to support them. The process of inventing, designing, programming, testing, and then maintaining each piece of software to meet a particular business need has become significantly easier with advances in AI. Experts can now make the most of AI coding assistants to handle the repetitive tasks some sections require while they focus on the most complex elements of the software. What this can do is help bring forward the software launch date. 

AI is incredibly nifty at spotting the bugs and vulnerabilities that like to hide in the software. With the ability to analyze large volumes of codebases, AI can detect these before a developer even lays one eye on it. As part of any software development journey, security testing is critical. AI can help here too. With AI assistance, potential weaknesses can be highlighted for the team so they can address the right areas as soon as possible.

The post How Is AI Improving These 3 Tech Sectors? appeared first on IT Security Guru.

James Gillies, Head of Cyber Security at Logicalis UKI

There is no escaping the fact that AI is creating significant opportunities for cybersecurity teams, from analysing security data and identifying suspicious activity to accelerating detection, response and remediation. However, the same capabilities are also changing the threat landscape.

This comes at a time when security teams are already under considerable pressure, with recent research showing that 77% of organisations experienced a cybersecurity incident in the past 12 months.

With AI models becoming increasingly capable, they could increase the speed at which vulnerabilities are discovered and exploited. For organisations already struggling with gaps across their security environments, the window between identifying a vulnerability and needing to remediate it could become considerably smaller.

Preparing for AI-driven threats therefore isn’t simply about investing in more technology. It starts with addressing the weaknesses organisations already have. Five areas in particular should be a priority, spanning visibility and identity through to how quickly organisations can detect, respond to and remediate threats.

Do you know what you’re trying to protect?

If you can’t see an asset, you can’t protect it, so visibility is fundamental to cybersecurity.

Maintaining that visibility is becoming increasingly difficult as cloud services, applications, endpoints, infrastructure and third-party systems continually change. Without a complete view across the environment, vulnerabilities can emerge that security teams may not know are there.

AI could make those blind spots more significant. Recent research found that 34% of CIOs say AI has already created new security blind spots. Attackers understand the importance of visibility too. Reconnaissance is typically one of the first stages of an attack, as threat actors build an understanding of the environment they are targeting.

Organisations need that same understanding of their own estate, including where critical services and data reside and which vulnerabilities present the greatest business risk.

Can you trust the identities accessing your systems?

Cybersecurity has traditionally focused heavily on protecting the network perimeter. But cloud services, hybrid working and distributed infrastructure have changed where that perimeter sits. Increasingly, identity is the control point.

Attackers are targeting users through phishing and social engineering, as well as obtaining legitimate credentials exposed through previous compromises. In those circumstances, they don’t necessarily need to hack into an organisation. They can simply log in.

This makes strong identity and access controls essential. Zero Trust principles such as verifying explicitly, applying least-privilege access and assuming breach can help limit what compromised identities are able to reach.

Organisations also need visibility into how identities behave after authentication. Identifying unusual activity and quickly revoking access can prevent one compromised account from becoming a much wider incident.

Are your security tools actually making you more secure?

The response to growing cyber risk has often been to invest in more security technology. That has left some organisations managing dozens of different tools across their estates.

The problem isn’t necessarily the capability of those products. It’s whether they work together.

When security technologies operate independently, telemetry becomes fragmented, alerts are spread across multiple platforms and teams can struggle to establish a consistent view of what is happening.

The priority should be getting more from existing investments. Better integration and correlation of security telemetry, including through technologies such as XDR, can provide broader visibility and help teams move from detection to response more quickly.

More tools do not automatically create better security. Making existing tools work together effectively can often deliver greater value.

What happens when attackers can move faster than you can respond?

Here is where AI could fundamentally change the equation; for example, Frontier AI models are demonstrating the potential to discover exploitable vulnerabilities significantly faster than traditional human-led research. If that capability continues to develop, the time organisations have to patch vulnerabilities before attackers can exploit them is likely to shrink.

That puts greater emphasis on time to detect and time to respond, areas where organisations are already feeling pressure. New research shows that 41% of CIOs say incident response times have worsened.

Organisations should understand how quickly they can identify an incident, prioritise a vulnerability and contain an attacker that has gained access. Automation will form part of that response, however, so will effective processes, appropriate logging and access to the right expertise.

Is technical debt becoming security debt?

Legacy infrastructure and long-standing vulnerabilities have always created challenges for IT teams. As remediation windows shrink, they increasingly create cybersecurity risk too.

Older systems can be difficult to patch, particularly where applications have reached end of life or operational dependencies make remediation difficult. That doesn’t remove the risk; it makes understanding and managing the exposure more important.

Where patching isn’t immediately possible, organisations need to consider compensating controls, exposure management and approaches such as virtual patching to reduce the opportunity for exploitation.

No longer just an IT modernisation challenge, technical debt is a cybersecurity risk. Organisations need to identify where ageing and legacy technology leaves them most exposed, understand the potential impact on the business and prioritise remediation where the risk is greatest.

Strengthen the foundations first

AI will undoubtedly play a growing role in cybersecurity, but it cannot compensate for weaknesses that already exist. Poor asset visibility, weak identity controls, disconnected security tools and exposed legacy systems will remain vulnerabilities – and AI could enable attackers to identify and exploit them faster.

Preparing for that shift means getting the fundamentals right: understanding the environment, controlling access, making existing security investments work together and improving the ability to detect and contain threats quickly.

As AI accelerates the pace of attack, those foundations will matter more, not less. The organisations best placed to respond will be those that address the gaps before attackers find them.

The post Why AI won’t fix your cybersecurity problem appeared first on IT Security Guru.

By James Mackay, CEO, MetaCompliance

When security teams think about their organisation’s attack surface, they’re usually focused on technology. Where could an attacker get in? What’s exposed? What hasn’t been updated or configured correctly? An attack surface refers to all the possible ways a cyber attacker can gain access to an organisation, including unpatched security software, misconfigured cloud storage, open system connections, and traditional phishing emails containing fraudulent links.

However, organisations also have an invisible attack surface sitting behind the everyday behaviours of their employees. Our latest research found that more than two thirds of CISOs see their employees as their organisation’s biggest cyber security risk. Not because employees are careless or malicious, but because routine workplace habits can unintentionally create opportunities for attackers.

Unlike a misconfigured server or unpatched system, these behaviours don’t always look like vulnerabilities, they’re simply part of the everyday ways people work.

Small Details Can Give Attackers a Much Bigger Picture

The clearest example is the out-of-office (OOO) reply. An automated message that goes out to anyone who emails a colleague on leave, no matter who they are, can give an attacker the information they need to build a bigger picture of an organisation and its employees before making a move.

Standard OOO replies confirm that the email address an attacker is contacting is correct and usually tells them how long the person won’t be monitoring that inbox for. It potentially names another employee to get in contact with, along with their role and their direct email address. Sometimes it even explains where the person has gone. In just four or five lines, an attacker receives a verified target, a defined window in which that person can’t be easily reached to check anything, and a partial map of the organisational chart.

OOO replies are only one example. Other routine workplace practices can reveal similarly valuable information. Email signatures or automated messages that supply names, titles and direct contact numbers can make an impersonation attempt incredibly convincing. Calendars shared to show full meeting details reveal who is meeting who, and often what about. In isolation, these actions can seem harmless but combined, they can provide a surprisingly detailed picture of an organisation.

Access is Only as Secure as the Habits Around It

Shared drives are another example of how everyday working practices can quietly expand an organisation’s attack surface. While they’re designed to make collaboration easier, they often accumulate broad access permissions over time. Employees move roles, projects end, teams change, yet access rights frequently remain in place. Old project folders, expired contracts, meeting notes and spreadsheets can also all sit there long after anyone needs them.

The content in these drives tends to be exactly what an attacker is hoping to find – customer records, supplier contracts, financial reports, HR documents, organisational charts. Leaving a folder shared with the entire department may not have been viewed as a security decision at the time, but it becomes a big one the moment someone’s password is compromised. What starts as access to a single user can quickly provide visibility into far more of the business than intended.

When an Employee Leaves, their Access Shouldn’t Stay Behind

Employee offboarding has a part to play here too. Over several years, an employee builds access to dozens of systems: shared folders, cloud platforms, and third-party applications.

When people leave, these accounts need to be disabled, and permissions removed. Otherwise, access that was once legitimate can become an overlooked route into the organisation.

Credentials that have been stolen or compromised are among the most common ways attackers get into organisations, and a dormant account belonging to an employee who has left may take longer to be noticed.

The Wider Human Attack Surface

Security awareness training often concentrates on key security topics like phishing and strong password practices. These are essential foundations of any cyber security programme, helping employees recognise common threats and protect access to systems and data. However, the human attack surface extends beyond fraudulent emails and compromised credentials to include the everyday habits and decisions that can unintentionally expose information, create unnecessary access or provide attackers with valuable context about how an organisation operates.

If employees don’t understand how an OOO reply reads to a threat actor, or the risk created by a forgotten third-party login belonging to an ex-employee, they may continue behaviours that increase the organisation’s exposure to risk. This is why security awareness needs to move beyond teaching people to identify individual threats. Employees need to understand how their everyday actions can affect the organisation’s wider security posture.

Upgrading security awareness starts with building a culture where people understand why their behaviour matters, and how they can apply that judgement to situations that aren’t explicitly covered by a policy or training module.

Building that culture takes sustained backing, and this is where many organisations struggle. Our research found that nearly four in five CISOs say leadership support for security education initiatives fades over time. The initial push happens, the training is rolled out, and attention moves elsewhere.

A culture of security awareness has to start at the top. If senior decision-makers don’t fully understand the cyber risk posed by employees, it becomes very hard to secure the sustained attention these habits require. None of the issues here are failures of technology – they’re habits that can be changed with the right behaviours built into the culture of the business.

The post When Everyday Habits Become an Invisible Security Risk appeared first on IT Security Guru.

40% of organisations have suffered an AI-related compliance or governance issue in the last 12 months, with legacy and poorly designed business processes identified as the leading cause, according to new research from Camunda.

The study found that process-related issues contributed to 84% of the compliance and governance failures organisations reported. Employees appear acutely aware of the risk: 79% said they fear their own use of AI could trigger a compliance issue at their organization, while 96% expect process-related challenges to fuel future AI compliance problems.

Almost half of organisations (48%) also expressed concern about AI agents “going rogue” if they are allowed to make changes to a process, reflecting broader anxiety about handing autonomous systems control of operational workflows.

A gap between adoption and governance

The findings, published in Camunda’s report The AI Process Gap, point to a widening gulf between the pace of AI adoption and organizations’ ability to govern it. Daniel Meyer, CIO at Camunda, said the more pressing danger isn’t runaway AI agents but organizations failing to adapt their own operations quickly enough.

“There is a lot of debate about rogue AI agents and whether innovation is moving too fast. But the more immediate risk is that many organisations are not changing the way they work fast enough to keep pace with AI,” Meyer said. He warned that bolting AI onto processes “designed for a pre-AI world” has created a dangerous gap between adoption speed and governance strength, leaving organizations more exposed to compliance failures, regulatory scrutiny and costly penalties.

The cost of broken processes

The report quantifies the fallout: 72% of organisations say process-related challenges have already caused AI initiatives to fail outright, at an average cost of $1.55 million per business. A further 72% believe AI costs will spiral unless organisations gain tighter control over their business processes, and 82% think their AI investments will ultimately be a bust without heavier investment in process redesign.

Despite this, most organisations are taking the path of least resistance. Rather than rebuilding processes from the ground up around AI, 79% say simply layering AI onto existing workflows generates less internal pushback, even though 82% acknowledge that adapting all their critical processes for AI could take up to five years.

Kurt Petersen, SVP Customer Success at Camunda, said the pattern is a predictable source of disappointing returns. “Organisations are rapidly adopting AI. But they are applying it to processes designed for a world before AI, then wondering why the return on investment falls short,” Petersen said. He noted that 61% of respondents say business process redesign simply cannot keep pace with the speed at which they need to move on AI, pushing many teams toward “the quick fix of bolting AI onto processes that were never built for it.” Processes designed before the AI era, he added, “cannot support the technology effectively without being re-engineered, no matter how much is spent on agents and models.”

The post Two in Five Organisations Hit by AI-Related Compliance Failures in Past Year, Research Finds appeared first on IT Security Guru.

By Myles Bray, CEO of CyberSentriq.

When it comes to cybersecurity, discussions often centre on technical capabilities, tooling and attacker tactics, but often overlooks the employees and security teams the strategy is intended to protect.

The reality is that most critical business functions from staff payroll to procurement and more have now moved online across digital applications, cloud environments and CRMs. With this comes the intense responsibility of ensuring they work as intended and that they are secure from outside threats.

That raises fundamental questions for business leaders and security teams: what is your attitude to a successful attack, and how do your teams learn from internal mistakes?

If the answer is to simply fire or punish the employee, then that risks overlooking the issue entirely.

When employees fear embarrassment or punishment for making a mistake, they’re less likely to raise their hand when something goes wrong. As cyberattacks increase in number and sophistication, an employee’s ability to identify and report incidents quickly is now a defining characteristic of resilient businesses.

A complete cybersecurity strategy supports employees

With employees generating and managing more data than ever before, it’s essential that they are being provided with adequate support to escalate threats. This doesn’t mean that they need to be cybersecurity experts overnight, but they should be able to identify a threat and know how to escalate it internally.

IBM reported that human error accounts for 95% of all data breaches, other industry research found that 74% CISOs cited human error as their top cybersecurity risk, which is a 60% increase from the previous year. As cybersecurity is an ongoing discipline that demands consistency and constant vigilance, even one unpatched vulnerability or lapse in judgement can allow attackers to slip through defences.

There is also a practical case for developing a people-focused strategy. If an employee delays reporting an incident, it tips the scales in favour of the attacker. The longer an incident goes unreported, the more time attackers gain to access sensitive data and move laterally across networks.

That makes containment harder or worse; it could force security teams to shut systems down while they investigate.

Designing processes that work

When employees delay or don’t report on threats, that doesn’t make them malicious or lazy. Often, it’s a sign to businesses that current security protocols are not working for them. To ensure threats are escalated properly, businesses need to replace complex and fragmented reporting procedures with streamlined processes.

Simplifying the reporting process: If reporting a threat requires employees to fill out a form or submit a lengthy ticket, they’re less likely to follow through. Instead, businesses can replace these barriers with centralised communication channels and automated triage pools to bypass email exchanges. This allows security teams to quickly filter out the noise and prioritise more serious threats.

Train employees to focus on behaviour: Employees do not need to be technical experts to spot risk, but they can become experts in context and operational procedures. This means training employees to identify MFA spamming, urgent requests for credentials or data transfers and sudden changes in communication patterns. Aligning training with how employees work instead of technical exploits means security becomes part of daily work rather than an occasional afterthought.

Automate where you can: Security stacks can be configured to automatically log contextual information like an employee’s email address, device ID, network status and session logs the moment they report an incident. Here, automation can reduce administrative burden while allowing security teams to focus on the root cause and containment.

These examples illustrate that when security is embedded into business and daily habits, escalating threats becomes more efficient and crucially, it’s more likely to be embraced by employees.

Hybrid and remote working have expanded the attack surface

It’s estimated that less than half (43%) of employees work exclusively from an office; this makes safeguarding security perimeters a much more complex task.

Given that a vast majority of UK workforces are now working across different devices, networks and locations, threat escalation strategies need to reflect these new workforce trends because many employees often do not have the means to physically verify suspicious activity with another colleague.

That means a truly effective security strategy must give businesses confidence that their employees can identify and flag potential security threats no matter where they are working or what device they are using.

Don’t fall into the blame culture trap

Suppose an attacker is able to slip through defences and manipulate financial transactions. Rather than blaming the employee, businesses should focus on the how and instead ask themselves: How did our email filters let this through, and why do our financial processes allow an invoice to be paid based on a single email link?

When threats are reported and contained quickly, employees feel involved and valued in a business’ security efforts. This reduces the likelihood of containable threats escalating into more serious ones while removing the fear of punishment. It also creates an ongoing feedback loop, exposing security gaps and whilst giving teams actionable insights to improve processes.

While tooling is an essential part of a cybersecurity strategy, business leaders should not overlook the human layer. Security is also about culture, processes and employee behaviour, which even the most advanced tools alone cannot compensate for. By removing the fear of judgement, businesses can reduce dwell time and foster a proactive security culture.

Modern cybersecurity is not about creating perfect employees; it is about building environments where individuals feel safe to speak up when something goes wrong.

The post Could blame culture be cybersecurity’s next Achilles heel? appeared first on IT Security Guru.

NeuroCyber, the organisation dedicated to improving opportunities and career outcomes for neurodivergent individuals across the cybersecurity profession, has been granted charity status by the Charity Commission for England and Wales. This is a major milestone for NeuroCyber, enabling it to expand its work to create a more inclusive cybersecurity profession where neurodivergent people can access opportunities, thrive and progress throughout their careers.

Charitable status will enable NeuroCyber to significantly expand its programmes, partnerships and community initiatives, helping more neurodivergent people build successful careers in cybersecurity while supporting employers to create more inclusive workplaces.

To support this next phase of growth, NeuroCyber is launching a UK-wide appeal for corporate partners, strategic partners and volunteers. Support from partners and volunteers will help fund an expanding programme of events, research, awareness campaigns, educational resources and practical initiatives designed to reduce barriers to employment and career progression for neurodivergent professionals.

Over the coming months, NeuroCyber will also launch the NeuroCyber Charter, giving organisations the opportunity to publicly demonstrate their commitment to creating workplaces where neurodivergent employees are welcomed, understood, supported and empowered. The Charter encourages organisations to embed neuro-inclusive practices across recruitment, onboarding, career development and workplace culture, recognising that neuro-inclusion is an ongoing commitment rather than a one-off initiative.

Allie Andrews, founding trustee at NeuroCyber CIO, said: “Achieving charity status is recognition of the vital role neurodiversity has to play in the future of cybersecurity. Our focus has always been on helping neurodivergent people access rewarding careers, realise their potential and thrive within the cybersecurity profession. Too many talented individuals still encounter unnecessary barriers to entering and progressing within the industry, despite the unique skills and perspectives they can bring.

“The wider opportunity is also clear. The UK Government reports that 49% of UK businesses have a basic cybersecurity skills gap, while latest ISC2 research found that 12% of cybersecurity professionals surveyed globally identify as neurodivergent. Neurodivergent talent is already an important part of the cybersecurity workforce but there is enormous potential to unlock more of that talent by creating workplaces where everyone has the opportunity to succeed.

“This new chapter gives us the platform to scale our impact but we can’t do it alone. We’re calling on organisations and individuals who share our vision to help us build a cybersecurity profession where talent is recognised for its strengths, not limited by outdated ways of thinking. Whether through sponsorship, volunteering or signing our forthcoming NeuroCyber Charter, everyone has a role to play in creating lasting change.”

NeuroCyber is inviting organisations of all sizes to become partners, with opportunities designed to help businesses demonstrate their commitment to diversity while supporting meaningful industry change. Partners can contribute to NeuroCyber’s work through thought leadership, event participation, networking, research and other industry initiatives, with every pound directly funding the charity’s work.

NeuroCyber also welcomes organisations able to provide non-financial support, including mentoring, design, event support and specialist expertise.

NeuroCyber is also calling on volunteers from across the cybersecurity community to share their skills and experience by supporting mentoring, research, events, outreach and community engagement activities.

The post NeuroCyber granted charity status to expand support for neurodivergent talent in cybersecurity appeared first on IT Security Guru.