The security stories enterprise IT leaders actually read.
Volume 341, Issue 3 · 20 articles from 2 issues
Organizations must adopt passwordless authentication such as passkeys to defend against AI-driven identity threats.
The UK's NCSC recommends replacing passwords with passkeys as AI-powered attacks industrialize account compromise at unprecedented scale. Traditional passwords create usability friction while only 9% of enterprises are prepared for AI-driven identity threats.
Passkeys offer cryptographic, phishing-resistant authentication with private keys secured on user devices. As autonomous AI agents proliferate, organizations need machine identities with task-specific permissions rather than shared human credentials.
Modern identity orchestration platforms enable gradual passwordless transitions without disrupting legacy systems or requiring complete rewrites.
Malicious AI 'skills' hit 1.7 million downloads, and reactive patching is losing to AI-speed bug discovery.
Microsoft used Black Hat USA 2026 to argue that reactive patching cannot keep up as AI accelerates vulnerability discovery, pushing instead for memory-safe languages and automated remediation.
Researchers reported more than 1.7 million downloads of malicious AI skills from a marketplace, an emerging supply chain attack vector aimed squarely at AI agents. Another session showed how GitHub event streams and APIs can surface supply chain intrusions through behavioral patterns, supported by an open-source GitHub Threat Detector tool.
A recurring theme was that the most effective AI-driven security research still depends on human expertise setting the methodology, illustrated by PortSwigger's HTTP Terminator finding novel vulnerabilities.
AI is transforming security operations by automating investigation while humans retain consequential decisions.
Black Hat 2026 highlighted how AI is reshaping cybersecurity economics, letting attackers discover vulnerabilities faster while giving defenders tools to accelerate their response cycle.
The industry faces a coordination problem, as alerts, identity data, vulnerability context, and business information remain fragmented across systems and require manual assembly by analysts.
Security leaders should redesign their operating model to use AI for evidence gathering and routine investigations while preserving human judgment for decisions with business consequences.
Success requires architectural changes that make context integral to security systems and clear definitions of which tasks software can safely execute autonomously.
Container security strategy shifts from vulnerability scanning to eliminating unnecessary components before deployment.
Enterprise container security is evolving beyond the traditional scan, patch, repeat model toward architectural approaches that reduce attack surface. With more than 35,000 CVEs reported in the first half of 2026 alone, scanning proves insufficient because it identifies risk only after vulnerable components already exist.
Distro Zero approaches remove unnecessary runtime elements such as shells and libraries to minimize exploitable surface area.
Regulatory requirements including NIST frameworks and the EU Cyber Resilience Act are pushing these architectural decisions directly into software development rather than treating them as post-deployment validation.
Quantifying cyber risk across direct loss, opportunity cost, and reputation aligns security with executive decisions.
Qualys VP Ivan Milenkovic argues that cybersecurity's real impact is financial and hits the balance sheet through three measurable channels: direct financial loss, opportunity cost, and reputational impact.
Direct losses cover forensics, restoration, legal counsel, ransom payments, and regulatory fines, and compound with dwell time, which averages 210 days in UK breaches.
Opportunity cost, often the largest and most overlooked component, is the revenue lost to downtime and diverted resources, quantifiable by modeling hourly revenue from critical systems and contractual penalties.
Reputational damage can now be modeled using survival analysis and churn techniques. Quantifying all three lets CISOs calculate probable maximum loss and compare it directly against the cost of controls.
A reporter's field notes from Black Hat USA 2026 on AI messaging, exploitability, and supply-chain security.
This firsthand field report from Black Hat USA 2026 in Las Vegas covers interviews, keynotes, demonstrations, and show floor observations.
AI appeared in roughly 90% of vendor messaging as an addition to existing products, with about 10% built around AI at their core, and the more compelling implementations served a specific security function rather than acting as another feature.
A second major theme was the move from identifying vulnerabilities to proving whether they can actually be exploited, illustrated by Pentera's automated penetration testing chaining weaknesses into complete attack paths.
Software supply-chain security featured prominently, with Microsoft security VP Aarti Borkar summarizing the shift by noting that scale has fundamentally changed.
July's Taiwan intrusions were the first real-world AI-agent attacks on critical infrastructure.
In July 2026 attackers used open-source AI agents to autonomously breach Taiwanese government systems and energy companies, the first real-world demonstration of AI-driven attacks against critical infrastructure.
Security experts and government officials warn that weaponized autonomous AI could disable safety systems and turn a digital intrusion into a physical disaster. The concern is not limited to frontier models: commodity AI can identify vulnerabilities and misconfigurations that previously required specialized expertise.
That effectively democratizes attacks on industrial control systems, putting capabilities once limited to advanced threat actors within reach of less sophisticated adversaries such as Iran and North Korea.
ARN argues AI, regulation and critical infrastructure rules are changing how Australian providers must deliver services.
ARN examines how AI, regulation and critical infrastructure requirements are transforming the way technology and services must be delivered across the ecosystem. The pressure will increase as the Australian Defence Force rolls out CI Fortify, its guidance for critical infrastructure operators to strengthen cyber posture.
The article argues these requirements will separate providers able to meet them from those that cannot.
It frames compliance capability as a competitive differentiator rather than an overhead. The piece is aimed at channel partners and managed service providers serving regulated Australian customers.
CIO argues attackers have turned ransomware into a business disruption strategy that outruns cyber resilience planning.
CIO examines how ransomware playbooks have evolved into business disruption strategies rather than encryption events. Companies have strengthened cyber defenses over the years, but attackers in 2026 are faster, more targeted and increasingly reliant on AI.
The article covers the rise of AI-enabled attacks and extortion-only campaigns that skip encryption entirely. It argues CISOs who expand their focus beyond cyber resilience to broader business resilience will be best positioned to respond.
The piece is aimed at security leaders whose recovery planning assumes a restore-from-backup scenario.
Decentralized identity brings privacy and efficiency gains alongside governance and auditability challenges.
Decentralized identity uses cryptographically secure, portable credentials instead of centralized providers, enabling improved privacy and ecosystem integration.
It delivers measurable value in partner ecosystems, customer identity and contractor scenarios. Implementation challenges include compliance complexity, immature standards and user key management risk.
CISOs should apply a decision framework assessing business fit, regulatory impact, architecture readiness and vendor ecosystem maturity before piloting in high-value use cases.
An Omdia report finds AI-driven SSD and memory price hikes are pushing storage teams to consolidate layers.
Blocks & Files reports on an Omdia study, commissioned by Verge.io, on how AI-fuelled price increases for SSDs and memory are affecting storage teams. Those teams are bearing the brunt of the increases and are being forced to consolidate storage layers in response.
The report also finds teams confronting the fact that much of their data is beyond their direct control. Software-defined storage is presented as the route to consolidation without buying more hardware at inflated prices.
The piece is aimed at storage practitioners planning refresh cycles under cost pressure.
Almost two-thirds of victims in one ransomware campaign held managerial positions or higher.
Zscaler's ThreatLabz analyzed the early stage of a real ransomware campaign and found 351 victims across 334 organizations over one month, with 62% holding manager-level titles or higher.
Around three-quarters worked in accounting and finance, sales, operations, HR, or marketing, and half the organizations were in industrial or IT sectors.
Managers are targeted because they hold higher network and business privileges and handle payments, budgets, and contracts, so a compromised account reaches many business units.
ThreatLabz recommends limiting external collaboration-tool contact, training staff to spot IT impersonation, deploying AI-powered detection, watching for signs of compromise, adopting least-privilege access, and segmenting under zero trust.
The CIS Cyber Threat Intelligence team assesses voice phishing will pose an increased risk to US state and local government.
The Center for Internet Security's Cyber Threat Intelligence team published an assessment that voice phishing will likely pose an increased threat to United States State, Local, Tribal and Territorial organizations.
The analysis covers how vishing techniques have evolved and why SLTT entities are attractive targets. It examines the specific characteristics that make these organizations vulnerable, including help desk processes and limited security staffing.
The assessment is written for public sector defenders rather than a general audience. It includes CIS recommendations for reducing exposure.
CIS draws three security lessons from protecting the 39-day, three-country, 16-city FIFA World Cup 2026.
The Center for Internet Security published lessons learned from securing FIFA World Cup 2026, a 39-day tournament spanning three countries and 16 host cities.
The event drew millions of fans, spectators and athletes from around the world. CIS distils the experience into three lessons applicable to other large-scale events.
The analysis covers coordination across many jurisdictions and organizations with different security maturity. It is written for public sector and event security teams planning comparable undertakings.
Authentication is only a snapshot in time, so trust must be continuously verified through behavioral signals.
Tata Communications cybersecurity VP Vaibhav Dutta argues that the most damaging breaches now involve attackers entering through the front door with valid credentials, as seen in recent attacks on the UK Foreign Office and local councils.
Phishing, infostealer malware, session hijacking, and credential harvesting have made legitimate account access easy to acquire, and the UK's Cyber Security Breaches Survey 2025 found phishing affected 85% of organizations that experienced a breach.
Authentication only confirms that correct credentials were presented at one moment, so continuous trust models should reassess risk as behavior changes. Machine learning can flag deviations from an established baseline, catching attackers who blend into normal operations rather than breaking in.
eSecurity Planet compares JumpCloud, Okta, OneLogin, ManageEngine, CyberArk and Microsoft Entra ID on features and tradeoffs.
eSecurity Planet publishes a comparison of six identity and access management platforms for 2026. The products covered are JumpCloud, Okta, OneLogin, ManageEngine, CyberArk and Microsoft Entra ID. Each is assessed on features, strengths and weaknesses rather than ranked on a single score.
The review is written by Ken Underhill and runs to roughly 21 minutes of reading. eSecurity Planet states its content and product recommendations are editorially independent.
CIO contrasts CIO enthusiasm for agent democratization with CISO alarm over non-human identity governance.
The author describes sitting in on a CIO conversation about the democratization of agents, putting large language models directly in employees' hands connected to business logic so people could build on top of them. The mood was bullish, with CIOs sketching what their teams could do with agents they trained and managed themselves.
Soon after, the author was in a room full of CISOs discussing non-human identity, and the contrast was stark.
The article argues AI agents fit neither the human nor the machine identity model cleanly. It concludes security teams need governance that can adapt as agents act rather than static entitlement reviews.
Katie Moussouris of Luta Security argues enterprises must now monitor risks posed by their own agents.
Katie Moussouris of Luta Security speaks with the Dark Reading News Desk about how agentic AI changes the insider threat model.
Her argument is that enterprises will now need to monitor risks posed by their own agents, not only by their own people. Agents operate with granted permissions and act continuously, which makes them behave structurally like insiders.
The discussion covers what monitoring that population requires in practice. The segment is aimed at security teams whose insider threat programmes were designed exclusively around humans.
Three tracked groups used AI across reconnaissance, credential harvesting, and infrastructure upkeep.
A Gambit Security investigation identified three threat actor groups actively integrating AI into attack operations across multiple stages of intrusion.
They used tools including Claude Code for reconnaissance, high-value target identification, credential harvesting at scale, and maintaining attack infrastructure.
The campaigns collected nearly 3,000 validated credentials from more than 1,700 compromised systems, with AI acting as a force multiplier that compressed intrusion timelines. Recommended defenses are unglamorous and specific: strengthen identity controls, segment networks, rotate credentials regularly, and actually test incident response plans.
eSecurity Planet's weekly roundup covers the critical patches, AI-driven attacks and data theft incidents of the week.
eSecurity Planet publishes its weekly summary of Cybersecurity Insider newsletter coverage for the week in August 2026.
The roundup is organized around three themes that dominated the period. Critical patches covers the vendor advisories defenders needed to act on. AI-driven attacks covers incidents where attackers used AI to accelerate or scale their operations.
Data theft covers the week's disclosed breaches and their scope.