Sophos Working with OpenAI on security from AI, with AI, and for AI
The Sophos AI Security 2026 report, released last month, just showed us the current state of AI-enhanced cyberattacks: Timelines are...
Last
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys...
Apple Seeks Injunction as OpenAI Blames Tech Giant for Security Lapses
Over the last 48 hours, the partnership between the world’s most valuable smartphone maker and the king of generative AI...
New warnings that Russian operatives are targeting the emails of US nuclear scientists and defense contractors
A group of Russian hackers has spent the last year targeting nuclear scientists, defense contractors, and government employees in a...
When the “attacker” is an AI agent
Last week, Hugging Face disclosed a security incident of a new kind: an intrusion carried out end to end by...
CMMC Assessment Pause Leaves Defense Contractors Facing a New Risk
Defense organizations processed last week’s CMMC Phase II suspension as a scheduling problem. The more useful frame is a governance...
Scammers race to cash in on Venezuelan earthquake disaster
When a devastating earthquake struck north central Venezuela last week, rescue teams were not the only ones who mobilised fast....
“Exploit mitigation” stalled around 2008. The attacks didn’t.
The core of my last post was an asymmetry. An attack can unfold in two steps or 20, but the...
The Future of Cybersecurity: What CISOs Must Do Differently in 2026
Last Updated: 30 May 2026 The Future of Cybersecurity Cybersecurity isn’t about keeping up with trends anymore. It’s about surviving...
Identity for the Machine Age: A CISO’s Framework for Agentic AI Governance (2026 Edition)
Last Updated: 30 April 2026 Identity for the Machine Age: A CISO’s Framework for Agentic AI Governance In 2026, one...
Building a Cyber Incident Response Team: The CISO’s Guide
Last Updated: 16 May 2026 Building a Cyber Incident Response Team: The CISO’s Guide A cyber incident response team (CIRT)...
Inside the Boardroom and Beyond: Reflecting on My Induction into the EC-Council C|CISO Hall of Fame 2025
Last Updated: 16 May 2026 Inside the Boardroom and Beyond: Reflecting on My Induction into the EC-Council C|CISO Hall of...
ICS Security Fundamentals: Protecting Critical Infrastructure
Last Updated: 16 May 2026 ICS Security Fundamentals Industrial Control Systems (ICS) form the backbone of the world’s most critical...
Weekly Update 505
24 May 2026 Well, that didn't last long! Recording this on Saturday morning my time, I observed ShinyHunters having gone...
Indirect Prompt Injection Is Now a Real-World AI Security Threat
Last week, researchers at Google and Forcepoint reported that indirect prompt injection — a category of attack the security community...
