The security stories enterprise IT leaders actually read.
Volume 343, Issue 1 · 20 articles from 4 issues
CISOs should replace annual check-box training with a continuous, risk-based human risk management program that measures behavior.
TechTarget argues that many cybersecurity awareness programs fail with dull, outdated content that checks compliance boxes but doesn't change behavior.
The real problem is unmanaged human-related cyber risk rather than insufficient knowledge, since employees face social engineering continuously, not once a year, and generic content ignores the organization's actual threat profile.
CISOs should treat awareness as a human risk management capability by starting with a risk assessment, prioritizing business needs, running training continuously and measuring outcomes rather than completion rates.
Security Weekly News #623 covers Windows support cutoffs, TP-Link fraud suits, the AgentCorruption AWS flaw and shadow AI.
Episode 623 of Security Weekly News, with Josh Marpet, runs through the week's security headlines, including airline Zoom calls and school picture day.
Stories include shadow AI framed as a governance and leadership problem, Microsoft warning that outdated Windows devices will stop getting security updates, and four states alleging TP-Link defrauded customers.
The show also covers 'AgentCorruption,' which puts AWS environments at risk with a single prompt, an open source scanner, and a billing dispute between Microsoft and Anthropic over a startup's Claude invoice.
The AI race is about chips and data centers, but workforce AI literacy, including in rural communities, is the real competitive edge.
In a TechTarget opinion piece, Vasileios Maroulas of the University of Tennessee, Knoxville, argues that chips, data centers and models alone won't ensure ethical AI literacy and adoption, and that the greatest advantage will belong to workforces able to use that computing power.
AI is already helping law enforcement, attorneys, manufacturers, healthcare providers and farmers spend more time on judgment rather than replacing them, much as electricity and the internet transformed rather than eliminated work.
The biggest risk, he says, is failing to give rural and underserved communities AI literacy resources.
A CNCF ambassador argues agents should change systems through immutable, reviewable state proposals, not root access.
CNCF ambassador Mauro Morales argues that giving AI agents root on production machines and relying on an AGENTS.md file to prevent disaster is self-deception, since agents are nondeterministic and the real issue is reproducibility.
Containers and immutable operating systems have already narrowed the host's role to booting reliably and running the platform.
Agents should therefore work through source control, review, CI, signed images and deployment, proposing the next system state rather than mutating machines, with the same rule against unrestricted root applying to humans.
A Yubico/Okta survey finds 48% of security pros use passwords for personal accounts and few use passkeys at work.
A survey of 2,000 cybersecurity professionals found that 48% rely on usernames and passwords for personal accounts and 43% for work, even though they rate passwords among the least secure methods.
Only 25% use hardware-backed passkeys for work logins, three-quarters say their organizations use fragmented authentication across apps, and 23% don't mandate MFA everywhere.
Researchers attribute the gap to friction and legacy onboarding defaults rather than lack of awareness, since 52% were issued passwords when they started.
Seven low-cost credential controls, ranked by effort, help budget-constrained teams start NIS2 compliance and produce audit evidence.
Help Net Security says budgets rarely cover a full NIS2 program at once, so credential controls are a practical starting point because they make access visible, revocable and reviewable without new infrastructure.
Credentials were among compromised data in 28% of breaches in Verizon's 2026 DBIR, and NIS2's Article 21 links credential security to cyber hygiene, access control, HR security, asset management and control effectiveness reviews.
The article ranks seven credential controls by effort and shows the evidence each produces for leadership, auditors or national oversight bodies.
AI is compressing time-to-exploit to hours, forcing security teams to rethink patch prioritization and defense.
In a Dark Reading reader poll on Black Hat themes, half of respondents named AI-driven attacks versus AI-powered SOC defenses as their top concern.
Experts from SOCRadar, watchTowr and Coalition describe exploitation beginning within hours of disclosure, partly because LLMs help attackers analyze patches, including silent ones.
With record CVE volumes, organizations need risk-based prioritization instead of treating Patch Tuesday as deploy-everything, and security through obscurity is no longer viable.
Google research finds half of likely AI-discovered flaws enable remote code execution and exploited vulnerabilities rose sharply in 2026.
Google Threat Intelligence Group found 50% of vulnerabilities it judged likely AI-discovered led to remote code execution, versus 26% of other CVEs.
Monthly disclosures doubled from about 5,000 in January 2026 to more than 10,000 by summer, and exploited vulnerabilities rose from 10.5 to 18 a month, though modest zero-day growth suggests most of the increase came from rapid weaponization of n-days, possibly aided by AI patch analysis.
Google calls confirmed exploitation of AI-found flaws an early indicator rather than an established trend.
Attackers increasingly reach executives through spouses, children and home networks, so families need security training too.
Attackers blocked by an executive's MFA often go after family members' devices, social media accounts and home networks instead, using impersonation, compromised household devices and phishing or smishing of less technical relatives, while leaked itineraries can lead to physical threats or extortion.
Ponemon and BlackCloak research found that 51% of organizations reported attacks on their leaders in 2025, up from 43% in 2023, and 39% of newly onboarded executives already had compromised devices.
The article argues that protection programs should cover the people executives live with, including privacy settings and home network hygiene.
ISACA says organizations are adopting AI faster than they build the skills and governance to manage it.
ISACA is preparing an AI governance certification for early 2027 to complete its AI audit, security and risk credentials.
Its research shows only 32% of digital trust professionals think their organizations adequately address AI risks, while 54% of organizations are onboarding AI solutions and 32% provide no AI training to any employees.
Chief global strategy officer Chris Dimitriadis said governance must span cyber, audit and risk teams so that AI is controlled rather than 'on the loose.'
With AI flooding teams with vulnerabilities, CISOs are using continuous pentesting to prove what is actually exploitable.
AI lets adversaries scale, run continuous operations and raise lower-skilled attackers' abilities, while defenders face more discovered vulnerabilities than they can fix.
Experts including CSA's Rich Mogull and Edna Conway say periodic patch cycles no longer fit this threat model, so CISOs are moving offensive security to the center of their programs with continuous penetration testing that proves which flaws are exploitable in production.
The goal is to make hard decisions about what not to fix based on evidence rather than CVSS scores.
IANS research finds CISOs using AI to help existing teams do more rather than shrink headcount, while AI reshapes budgets.
In a Dark Reading video interview, Nick Kakolowski, senior director for CISO research at IANS, discusses new research showing most CISOs are not planning to shrink teams because of AI.
Instead, they aim to automate routine tasks, reskill staff and give senior professionals more time for complex problems, while rethinking how work is split between junior and senior roles.
Security leaders are also using the momentum behind AI initiatives to win funding for tools and staff, even as vendors' added AI features drive up costs on already tight budgets.
AI gave attackers a speed advantage, identity eclipsed malware and AI infrastructure itself became an attack surface in early 2026.
In this SC Media Perspectives column, the author finds most predictions for 2026 came true, some faster than expected, with the biggest change being their convergence: AI helps attackers move faster, identities matter more than malware, and trusted tools and platforms are becoming attack paths.
The Copy Fail Linux kernel flaw spawned more than 140 public exploit variants within weeks, many AI-assisted, while Project Glasswing using Claude Mythos reported over 10,000 high and critical findings.
Most surprising, AI infrastructure such as MCP servers and LLM gateways has itself become an attack surface.
Twelve percent of credential slots in 82,000 public MCP config files contained a hardcoded secret.
Hush Security analyzed roughly 82,000 MCP configuration files in public GitHub repositories and found that 12% of credential slots held a hardcoded credential literal, exposing connected services and systems.
Researchers classified each slot as a hardcoded value, environment-variable reference, client-managed prompt, secret-manager reference, placeholder or empty field, then identified likely secrets using provider-specific patterns and Shannon entropy.
Of the hardcoded secrets, 55% had no vendor-recognizable token format, including 31% classified as opaque bearer tokens for internal MCP servers, and the values were predominantly vendor API keys, bearer tokens and database passwords.
Open source encryption tools protect organizational data at rest and in transit securely and affordably.
Organizations can safeguard sensitive information using free, open source encryption solutions like OpenSSL, Let's Encrypt, LUKS, and WireGuard. The article details protecting data in two states: at rest on storage devices through full-disk encryption and pgcrypto, and in transit via TLS protocols and VPNs.
Proper key management using HashiCorp Vault ensures security, while regulatory frameworks like GDPR mandate encryption.
Implementing these layered approaches enables organizations to meet enterprise-grade protection standards without proprietary software costs.
Arctic Wolf's Kerri Shafer-Page explains why containment, payment, law enforcement and communications decisions should be made in advance.
In this Help Net Security video, Kerri Shafer-Page, VP of Incident Response at Arctic Wolf, walks through a ransomware decision tree covering four areas to settle before an incident.
Containment requires someone who understands what taking systems offline does to client data, production or websites.
For extortion, organizations must decide who can negotiate and set a payment ceiling, which she treats as a business decision that may cost less than insurance retention and higher premiums.
She also recommends including law enforcement in the playbook and preparing communications with legal counsel, a spokesperson and the help desk.
ISC2 shifted from sizing the workforce gap to measuring the capability gap, and 88% report a consequence from it.
ISC2's latest Cybersecurity Workforce Study, covering 16,029 professionals, stopped estimating the size of the global workforce gap and now focuses on the gap between the skills organizations need and the capabilities their teams have.
The consequences are operational, not theoretical: 88% of respondents faced at least one major cybersecurity consequence tied to missing critical skills, and 69% reported more than one.
AI was the most frequently cited skill needed, named by 41%, as teams increasingly need people who can use AI, evaluate its output, secure AI systems and recognize threats using the same technology.
The underlying issue is opportunity cost, since most teams are short on time rather than dedication and security gets bolted on rather than built in.
A vCISO's method for a flat or cut budget: sort every security expense into four buckets instead of trimming across the board.
Cheri Hotman, managing partner of Hotman Group and a vCISO and vGRC leader, addresses what to do when the CFO asks for a flat budget or a 12% cut.
Her core advice is to stop trimming every line by the same percentage. Instead, sort each security expense into four buckets: what works and protects something the business cares about, what could add value but was never operationalized, what duplicates a tool another team already bought, and what exists only for compliance theater.
Waste is common, she says, with companies often running three or four GRC tools that each do part of the job, and cheap choices frequently cost more later. Security leaders who speak in risk and dollars, back estimates with due diligence and tie spending to revenue get a different conversation with finance.
Agents converted 430,000 lines of TypeScript into 800,000 lines of Rust for $120K in tokens plus three weeks of developer time.
The runtime behind GitHub Copilot is now entirely Rust, with AI agents doing most of the porting.
The migration cost roughly $120,000 in token usage plus about three weeks of a developer's time, spanning 135 releases over 14.5 weeks at roughly 1.3 port pull requests per day, though managers had to handle a few dozen regressions that pointed to continuing agent difficulty with Rust.
The team replaced TypeScript modules case by case without restructuring the runtime, leaving optimization for later.
On a benchmark of 1,000 one-turn session lifecycles with 100 concurrent pipelines, TypeScript managed 7.55 per second against 120 per second for in-process Rust, a 15.9x speedup, and a 10-client agent batch dropped from 1,383 MB to 126 MB.
Plugin4Shell breaks SHA pinning in Claude Code, Codex, GitHub Copilot and Gemini CLI, and auto-update makes it zero-click.
Researchers at AIR found that Claude Code, Codex, GitHub Copilot and Gemini CLI all share a plugin SHA-pinning bypass they call Plugin4Shell, giving an attacker the same reach into company systems as the employee running the agent.
SHA pinning is supposed to lock an installed plugin to a specific reviewed commit, but all four agents check out the pinned commit without verifying the checkout actually landed there.
Claude Code, Codex and Copilot share one variant tied to how git handles branch names; Gemini CLI is exposed through a separate fetch-and-checkout mechanism with the same outcome.
Because the same git checkout re-runs on background auto-update, the default in Claude Code and Codex, the swap reaches already-installed plugins with no user action.