The CISA and FBI, along with cybersecurity agencies from Australia, Canada, New Zealand and the U.K., have released new guidance on outage communications for service providers dealing with major IT and OT outages. The guide calls for prompt, factual and audience-specific communication during disruptions caused by malicious cyber activity or non-malicious events.

Titled “Communicating Under Pressure: Best Practices for Service Providers,” the guidance says effective communication is critical to limiting operational impact when IT and OT outages affect customers, network defenders, critical infrastructure owners and operators, and the public. It recommends that organizations clearly communicate what is known, what remains unknown and what is still under investigation, while providing frequent updates as circumstances change.

Outage Communications Should Start With Facts

The agencies recommend that service providers establish an outage communications plan before an incident occurs. The plan should define incident thresholds, escalation paths, target audiences and procedures for status pages, customer and partner notices, and regulatory communications. Organizations are also advised to establish cross-functional incident teams involving engineering and operations, communications, legal, risk and compliance, and customer support.

The guidance calls for clearly defined roles, including an incident lead, communications lead and spokesperson. It also recommends parallel workstreams so technical teams can focus on diagnosing and remediating the root cause while communications teams manage external messaging and leadership handles strategy and regulatory requirements.

For organizations responding to cyber incidents, the guidance places particular emphasis on balancing transparency with operational security. If malicious activity is suspected or confirmed, external communications should not compromise investigations, containment efforts or other response activities. Organizations are also advised against making premature conclusions when the root cause remains under investigation.

Service Providers Urged to Tailor Messages

The guidance recommends segmenting communications for technical teams, executives and the public. Audiences can include enterprise IT teams and security operations centers, employees and customers, government partners and regulators, critical infrastructure owners and operators, as well as the media and general public.

During an outage, organizations should lead with a concise summary covering affected systems, user impact, scope and the known cause without speculation. The agencies also advise against vague descriptions such as “service degradation” and recommend messaging that can be understood quickly during high-pressure situations.

Transparency is another central principle. Service providers are advised to state what they know and do not know, use a single source of truth such as a status page, and focus communications on actionable guidance rather than reputation management. Customers should be told what actions they need to take or clearly informed when no action is required.

The guidance also calls for continuous, time-stamped updates that show the incident timeline, actions taken, and recovery milestones. Organizations should maintain a single status page and align external messaging with legal, contractual and sector-specific reporting obligations.

Agencies ultimately frame effective outage communications around five principles: immediate acknowledgement, technical and actionable information, transparency, accountability, and continuous updates. For service providers, the guidance positions communication as an important part of incident response, alongside technical remediation and recovery.

Anthropic warned users over the weekend that a threat actor is using widely available infostealer malware to hijack active Claude login sessions from infected computers, then using those sessions to run up victims' paid usage without ever needing a password or a two-factor code.

The company said it identified six malware families in the campaign: Vidar, LummaC2, StealC, RedLine and Acreed on Windows, and Atomic Stealer, known as AMOS, on a smaller number of macOS machines. None are novel or bespoke. All are commodity stealers sold or rented on criminal dark web marketplaces, and all work the same basic way - harvesting locally stored browser credentials, autofill data and authentication cookies from a compromised machine and shipping them to an operator's server.

Claude Session Cookies Heist

What makes the campaign notable is the target rather than the technique. Session cookies represent an already-authenticated state, so an attacker who replays a stolen Claude session token steps past both the account password and multi-factor authentication entirely. This is textbook session hijacking; the new element is that paid AI assistant subscriptions have become worth stealing as a commodity in their own right, alongside the streaming and gaming accounts that stealer log markets have traded for years.

Anthropic told affected users that the tell sign for them was a usage pattern that made no sense. Limits appearing to refill and then drain while the account owner was not using Claude was the biggest red flag.

Also read: Hacker Used Claude AI to Automate Reconnaissance, Harvest Credentials and Penetrate Networks

The company said it is signing affected users out of their sessions, removing saved payment methods from compromised accounts and refunding unauthorized charges identified during its investigation. It also stressed that the malware is not connected to Claude, was not installed through Claude and did not result from anything users did with the product. Infections trace to the usual vectors — pirated software and other illicit downloads.

A Reddit user going by the moniker "WorriedAssociate7029" received the notification from Anthropic and confirmed that he mistakenly installed an infostealer from "a reputable Russian underground forum" while downloading a pirated game. "I got fooled like a rookie by downloading a cracked game," he said.

Intrestingly though, the user claimed of using Claude's Opus model to detect and remove the malware.

"I use the models exclusively in permission-free mode on my entire computer," the Reddit user said.

"Opus was very efficient. It scanned for active processes, then listed my recent downloads. It found the virus almost instantly. My prompt was very simple: "I think I downloaded a virus recently. My login credentials were stolen. Audit the malware and remove it if you find it. Report on the extent of the damage. He deactivated the virus and created a folder on the desktop containing all the relevant information (including the deactivated virus, lol)."

Anthropic has not disclosed how many accounts were affected.

The security implications reach past the billing line. AI assistant accounts increasingly hold conversation histories, uploaded documents, connected data sources and, in developer configurations, API keys and repository access. A hijacked session inherits whatever the account can reach. Organizations that have rolled out AI tools without folding them into identity and access management now have a class of high-value session token sitting in employee browsers, largely outside the monitoring applied to corporate SaaS.

Anthropic's guidance to compromised users is the standard infostealer playbook. Change credentials across every service used on the affected machine, revoke active sessions, and actually remove the malware, since signing out does not clear an infection that will simply harvest the next session.

There is no formal regulatory hook here yet — no confirmed breach of the provider itself and no disclosure obligation triggered on Anthropic's side. But the episode lands as regulators and standards bodies are working out how AI system security fits existing frameworks, and it illustrates a gap those frameworks have barely addressed - the weakest point in an AI deployment may be an unmanaged endpoint rather than the model or the platform.

New Zealand is moving ahead with a social media ban for under-16s, with the Government introducing the Online Safety (Minimum Age and Child Safety Risk Assessment) Bill to Parliament. The proposed law would require high-risk social media platforms to take reasonable steps to prevent children under 16 from accessing their services and would place greater responsibility on technology companies to address risks to children online. Prime Minister Christopher Luxon said the Government was responding to concerns about the amount of time young people spend on social media and their exposure to harmful content, addictive technology and online pressures. “We simply cannot accept the harm being done to a generation of New Zealand children,” says Prime Minister Christopher Luxon. According to the Government, one in three children aged 13 to 17 spends at least five hours a day on social media.

New Zealand Social Media Ban Introduces Age Verification

Under the proposed social media ban, high-risk platforms including Instagram, TikTok, Snapchat and Facebook would be required to take reasonable steps to establish whether users are over 16. The Bill allows for multiple age-checking methods, including existing account information, facial age estimation, digital ID services and formal identification. The proposed framework would also require platforms used by children to regularly assess the risks they pose and report on how those risks are being identified and reduced. The Government said the framework is designed to evolve alongside technology and would also cover emerging services, including AI companion platforms.

Companies Could Face Significant Penalties

The proposed online safety law would introduce significant penalties for platforms that fail to meet their obligations. Companies could face fines of up to 10 percent of their global revenue. An online safety regulator within the Department of Internal Affairs would independently monitor compliance, investigate platforms and enforce the law. Education Minister Erica Stanford said the Bill would place legal obligations on technology platforms rather than children, parents or caregivers. No penalties are proposed for children, their parents or caregivers under the proposed framework. “The Bill places legal obligations on platforms. No penalties are proposed for children, their parents or caregivers,” Ms Stanford says. “It doesn’t just introduce a minimum age requirement. It creates an enduring framework that can evolve alongside technology and holds platforms responsible for understanding and reducing the risks they create for children,” she says. The Government also plans to strengthen education and public awareness so parents, schools and communities have information and tools to help children navigate online services safely.

New Zealand Joins Growing Push for Child Online Safety

The proposed New Zealand social media ban follows similar moves in other countries seeking to place greater responsibility on technology companies. Earlier this year, Spain announced plans to prohibit social media access for children under 16. Prime Minister Pedro Sanchez described the internet as a “digital Wild West” and said stronger protections were needed to shield young people from online harm. France has also moved toward age-based restrictions. In February, French lawmakers approved legislation banning children under 15 from accessing social media platforms, with the measure expected to take effect at the start of the next school year. French President Emmanuel Macron backed the proposal, arguing that children’s development should not be dictated by algorithms designed to maximize engagement.

Government Says Rules Aim to Change Online Behaviour

Luxon acknowledged that the Government does not expect every child to stop using social media but said early evidence from Australia showed minimum age requirements were already changing behaviour. The Government said the child online safety framework is intended to make a meaningful difference while creating longer-term obligations for technology companies. The Online Safety (Minimum Age and Child Safety Risk Assessment) Bill will now be introduced to Parliament, beginning the legislative process for the proposed under-16 social media restrictions.

Researchers at Adversa AI disclosed an attack technique that smuggles malicious instructions past AI safety filters by encrypting them. They then demonstrated it against production deployments of xAI's Grok and Google's Gemini - including a zero-click chain that could exfiltrate a Grok user's entire chat history.

The technique, which the researchers call Cryptographic Context Injection, inverts the usual assumption behind input filtering. Guardrails inspect prompts and retrieved content as text; an AES-256-GCM ciphertext contains no readable instruction to flag. The model itself performs the decryption inside its own code-execution sandbox, and then treats the recovered plaintext as trusted intermediate output rather than as untrusted external content. Adversa noted that every element a scanner would need is present on the page, but recovering it requires "running PBKDF2 and AES-256-GCM."

That distinction separates the work from earlier cipher-based jailbreaks such as CipherChat and CodeChameleon, which relied on substitution ciphers or Base64 encoding that large language models can decode natively during inference. Strong authenticated encryption forces execution, and execution is what launders the payload's provenance.

The demonstrated impact differed by target. Against Grok, the researchers showed an indirect, zero-click path. Encrypted JSON embedded in a web page is picked up when Grok's agentic browsing analyzes the site, and the decrypted instructions then leak session data like user name, coarse location, subscription tier and full conversation history, to an attacker-controlled URL. No click or warning reached the user.

Also read: French Police Raid X Offices as Grok Investigations Grow

Against Gemini 3 Flash on the web at the paid tier, the same approach produced instructions for building incendiary devices in the model's Deep Thinking mode, and caused the model to reproduce its own system instructions. Adversa said its Gemini success rate had fallen sharply since June and dropped significantly by August, but could not attribute the change to filter updates, model version changes or both.

Vendor engagement was limited. Adversa reported the Grok issue to xAI on June 3, received an initial acknowledgment, and followed up on August 4 and 10 without substantive response. The firm confirmed the attack still reproduced on August 19.

The Gemini finding was never formally reported, because Google's AI vulnerability reward program excludes prompt injection, jailbreaks and alignment issues from scope, directing them instead to in-product feedback channels. Guardrail-bypass research at one of the largest model providers therefore sits outside a coordinated-disclosure track with a reward and a disclosure clock.

The findings land against a body of evidence that prompt injection remains the dominant failure mode in deployed agentic systems, a position reflected in OWASP's guidance and in Microsoft research published in May on remote code execution in AI agent frameworks. The pattern here is narrower and more concerning for defenders. Content-based guardrails, the primary control most enterprises have deployed, are structurally unable to inspect a payload that only exists in plaintext after the model has already decided to trust it.

Whether xAI ships a fix or acknowledges the report, whether Google revises its reward-program scope to cover guardrail bypasses, and whether AI security vendors move detection from input text to sandbox execution monitoring, is something to watch-out for.

The UK Cyber Resilience Pledge gives organizations a 30/60/90-day checklist for NCSC alerts, supplier Cyber Essentials checks and board-level cyber governance.

The post UK Cyber Resilience Pledge Sets 90-Day Test for Security Leaders appeared first on TechRepublic.

The FBI Warns of Malicious Traffic Distribution Systems being increasingly used by cybercriminals to redirect internet users to phishing pages, malware downloads, ransomware attacks, and online financial scams. In a newly released Public Service Announcement (PSA), the Federal Bureau of Investigation cautioned that cybercriminals are leveraging Traffic Distribution Systems (TDS) to gain access to victim networks while evading traditional security controls. According to the FBI, TDS technology is designed to route internet traffic to different destinations after users visit websites, click advertisements, download applications, or engage with online promotions. While the technology itself has legitimate uses, cybercriminals are exploiting it to selectively redirect users to compromised websites and fraudulent login pages.

FBI Warns of Malicious Traffic Distribution Systems Used in Cyber Attacks

As the FBI Warns of Malicious Traffic Distribution Systems, the agency explained that cybercriminals often drive victims to a malicious TDS through various methods, including Social Engineering, phishing emails, malicious advertisements, and compromised websites. One common technique involves Search Engine Optimization (SEO) Poisoning, where fraudulent advertisements are designed to imitate legitimate websites. Users who click these links may unknowingly enter a redirection chain controlled by threat actors. Cybercriminals also compromise legitimate websites by exploiting weak passwords, outdated plugins, and vulnerable website themes. Once administrative access is obtained, attackers can modify website code to automatically redirect visitors to a malicious TDS infrastructure.

How Traffic Distribution Systems Help Evade Detection

According to the FBI, Traffic Distribution Systems (TDS) can bypass traditional firewall protections that would normally block access to malicious websites. The system uses multiple intermediate nodes before directing users to the final destination, making it more difficult for defenders to identify and block malicious activity. In addition to hiding malicious infrastructure, attackers use TDS platforms to gather information about visitors. Data collected may include:

• IP address
• Operating system
• Geographic location
• Device information
• Browser details

The FBI noted that this information allows attackers to determine whether a victim is a suitable target. It also enables cybercriminals to avoid detection by presenting harmless content to users they are not interested in targeting, including security researchers and analysts.

Phishing, Malware, and Ransomware Risks

The FBI warned that users reaching the end of a malicious redirection chain may encounter Phishing Pages, financial fraud schemes, or malware downloads. In some cases, attackers use malware delivered through a TDS to gain access to victim networks. The agency stated that compromised accounts and network access obtained through these methods may later be sold to other criminal groups, including Ransomware operators. The PSA highlights how a single visit to a compromised website or malicious advertisement can ultimately lead to broader cybersecurity incidents.

FBI Shares Protection Measures

To reduce the risk of compromise, the FBI advised individuals to verify website URLs before clicking advertisements or promotional links. The agency also recommended keeping software, website plugins, and themes updated to address known vulnerabilities. Additional recommendations include:

• Using strong passwords
• Enabling Two-Factor Authentication (2FA)
• Installing reputable security plugins and web application firewalls
• Downloading software only from trusted developers

For businesses, the FBI recommended monitoring endpoints for suspicious activity involving JavaScript, PowerShell, and script execution tools. Organizations are also encouraged to strengthen phishing awareness training, regularly audit website administration accounts, and patch content management systems and third-party components.

FBI Urges Victims to Report Incidents

The FBI encouraged individuals and organizations that believe they have been affected by activity linked to malicious TDS infrastructure to report the incident through the Internet Crime Complaint Center (IC3) and contact their local FBI field office. The agency emphasized that cybercriminals continue to evolve their techniques for delivering malware and conducting online fraud, making vigilance and proactive cybersecurity measures essential for both individuals and businesses.

The UK government has announced plans to introduce a UK social media ban for under-16s, preventing children from accessing major platforms such as TikTok, Instagram, Snapchat, Facebook, YouTube and X under a sweeping package of online safety reforms. The measures, expected to be brought before Parliament later this year and enforced from Spring 2027, would make Britain one of the toughest countries in the world when it comes to regulating children's access to social media. The proposal is part of a wider government effort to strengthen online child safety and address growing concerns about the impact of social media algorithms, harmful content and excessive screen time on young users. Prime Minister Keir Starmer described the move as a "line in the sand," arguing that technology companies have failed to do enough to protect children online. "Parents want to keep their kids safe and happy, but the online world has made that harder than ever," Starmer said. "That's why we're going further than any country in the world by banning social media for under-16s and putting wider protections in place to give kids their childhood back."

UK Social Media Ban for Under-16s to Cover Major Platforms

The proposed UK social media ban for under-16s will apply to user-to-user platforms that allow users to interact and share content through algorithm-driven feeds. Platforms expected to fall under the restrictions include TikTok, Instagram, Snapchat, Facebook, YouTube and X. Messaging services such as WhatsApp and Signal are not expected to be included. Alongside the ban, the government plans to introduce new restrictions on features considered particularly risky for young users. These include livestreaming functions and communication between children and strangers across a wider range of digital services, including some gaming platforms. The government is also considering additional safeguards, including overnight access limits and measures designed to interrupt infinite scrolling for users under 18.

AI Chatbots Also Under Scrutiny

The reforms extend beyond social media platforms. Under the proposed rules, AI-powered "romantic companion" chatbots that simulate intimate or sexual relationships will be required to enforce a minimum age of 18. Similar intimate AI functions will also face restrictions for users under the age of 18. Officials say the broader approach reflects how children increasingly encounter online risks across multiple digital services rather than solely through social media platforms.

Global Momentum Builds Behind Social Media Age Restrictions

Britain's announcement comes amid growing international support for tighter social media age restrictions. Earlier this year, Spain announced plans to prohibit social media access for children under 16. Prime Minister Pedro Sanchez described the internet as a "digital Wild West" and said stronger protections were needed to shield young people from online harm. France has also moved in a similar direction. In February, French lawmakers approved legislation banning children under 15 from accessing social media platforms. The measure is expected to take effect at the start of the next school year. French President Emmanuel Macron strongly backed the proposal, stating that children's development should not be dictated by algorithms designed to maximize engagement. The developments have fueled debate over whether age-based restrictions could become a standard approach to child online protection across Europe and beyond.

Australia's Experience Highlights Enforcement Challenges

While support for restrictions is growing, Australia's experience shows that enforcement remains a major challenge. The Australia social media ban, introduced under Prime Minister Anthony Albanese, requires platforms to block users under 16 or face fines of up to AU$32 million. However, recent research suggests many children continue to access restricted platforms despite the rules. A study conducted by the Molly Rose Foundation and YouthInsight found that more than 60% of children aged 12 to 15 who previously used social media still had access to at least one account. The survey of 1,050 young people showed that 53% of former TikTok users, 53% of YouTube users and 52% of Instagram users remained active after the restrictions were introduced. Researchers also found evidence that some children created new accounts after the ban came into effect, raising questions about the effectiveness of current age verification systems.

Age Assurance Measures Key to Enforcement

To improve compliance, the UK government plans to introduce stronger age assurance measures and has tasked Ofcom with conducting a rapid review of age-verification technologies. The regulator will also review its enforcement capabilities, while ministers have pledged additional funding to support implementation of both the proposed regulations and existing provisions under the Online Safety Act. The announcement follows a national consultation that attracted more than 116,000 responses from parents, children and experts. According to government figures, nine in ten parents support a ban on social media access for children under 16. If approved, the reforms will mark one of the most significant changes to Britain's digital safety framework and could further accelerate a global shift toward stricter regulation of children's online experiences.

Ransomware Preparedness must become a strategic priority for organizations as cyberattacks grow more disruptive and difficult to contain, according to Richard Horne, CEO of the UK's NCSC (National Cyber Security Centre). Speaking during the FBI's Ahead of the Threat podcast, Horne urged business leaders to assess whether their organizations could continue operating if critical IT systems were unavailable for four weeks. His remarks come amid growing concerns over ransomware, AI-driven cyber threats, and the increasing speed at which attackers exploit known vulnerabilities.

Ransomware Preparedness Requires Planning Beyond Paying a Ransom

A key message from Horne was that organizations should not view ransom payments as a recovery strategy. Instead, effective Ransomware Preparedness depends on resilience, tested recovery plans, and executive support. According to Horne, ransomware attacks typically involve two forms of extortion. Attackers steal sensitive data and threaten to publish it, while also encrypting systems and demanding payment for decryption keys. He noted that paying criminals does not guarantee data will be deleted or systems fully restored. Referencing lessons learned from Operation Cronos, the international law enforcement operation that disrupted the LockBit ransomware group, Horne said investigators found instances where victim data remained on criminal infrastructure even after ransom payments had been made.

NCSC Warns Organizations About the Coming Patch Wave

The discussion also highlighted concerns about a growing Patch Wave, a term used by the NCSC to describe the anticipated surge in vulnerability disclosures and exploitation attempts fueled by artificial intelligence. FBI Cyber Division Assistant Director Brett Leatherman pointed to recent industry findings showing that attackers are exploiting known vulnerabilities faster than defenders can remediate them. Internet-facing devices and VPNs have become increasingly attractive targets, while the window between disclosure and exploitation continues to shrink. Horne stressed that organizations need long-term planning rather than short-term reactions. He encouraged businesses to develop multi-year cybersecurity roadmaps and ensure security investments remain a priority across budget cycles.

CyberUK Discussions Focused on Executive Accountability

Reflecting on discussions held during CyberUK, the UK's flagship cybersecurity conference hosted by the NCSC, Horne emphasized that cybersecurity cannot remain solely the responsibility of technical teams. He noted that many Chief Information Security Officers face challenges securing organizational support despite having visibility into technology risks. According to Horne, leadership teams must actively participate in managing cyber risk rather than treating it as an isolated IT issue. The conversation also addressed burnout among cybersecurity professionals, with both Horne and FBI officials acknowledging the operational strain placed on defenders during major incidents, including ransomware attacks and large-scale vulnerability disclosures.

Public-Private Cooperation Remains Critical

Beyond technical defenses, Horne highlighted the importance of collaboration between governments, law enforcement agencies, and the private sector. He said threat intelligence sharing creates a continuous cycle in which organizations identify threats, share findings, improve defenses, and generate new intelligence that benefits the wider cybersecurity community. Horne also pointed to growing opportunities to use artificial intelligence to accelerate threat detection and response efforts. As ransomware groups continue targeting businesses worldwide, the message from both the FBI and the NCSC was clear: organizations must invest in Ransomware Preparedness, strengthen resilience plans, and prepare for a future where cyber incidents are not a possibility but an expectation.

For years, security teams have relied on behavioral clues to identify malicious activity. However, the rise of AI-powered bots is making that task far more challenging. Unlike traditional automated tools, these bots can imitate legitimate user behavior with remarkable accuracy, allowing them to blend into normal traffic patterns. A new study examining enterprise security readiness suggests that artificial intelligence is fundamentally changing how bot attacks are carried out. Rather than behaving like traditional automated tools, modern AI-powered bots are now capable of mimicking legitimate users with a level of sophistication that many organizations struggle to detect. The report, based on a survey of 300 enterprise leaders across North America, highlights a growing concern among cybersecurity professionals: attackers are no longer trying to force their way into systems. Instead, they are increasingly blending into normal digital activity.

AI-Powered Bot Threats Are Becoming More Advanced

According to the findings, AI-driven bot threats are reshaping the threat landscape by enabling attackers to automate reconnaissance, optimize targeting, and operate within normal user behavior patterns. Credential-based attacks remain the most common form of bot-related activity, with 74% of respondents identifying them as a major concern. DDoS attacks followed at 51%, while 40% reported dealing with AI-driven scraping campaigns designed to harvest sensitive information from websites and online platforms. What makes these attacks particularly challenging is not just their scale, but their ability to imitate legitimate traffic. Modern bots can browse websites, submit forms, test stolen credentials, and interact with applications in ways that closely resemble human behavior. Security experts warn that this evolution is making traditional bot detection methods less effective.

Many Organizations Still Rely on Slow Defensive Processes

While attackers are increasingly operating at machine speed, many organizations continue to update their defenses at a much slower pace. The survey found that only 25% of enterprises continuously update bot detection rules. In contrast, nearly half of respondents update protections on a weekly basis, creating potential windows of opportunity for attackers. This gap between attack speed and response speed is becoming a growing concern as AI lowers the barriers to launching automated campaigns. Researchers noted that the cost of executing large-scale bot attacks has dropped significantly, allowing threat actors to conduct more reconnaissance, launch more credential attacks, and scale operations faster than ever before.

The Challenge of Distinguishing Good Bots From Bad Bots

One of the most notable findings from the study is the difficulty organizations face when trying to classify bot activity. Nearly one-quarter of respondents said they cannot reliably distinguish malicious bots from legitimate automated traffic. That challenge is becoming increasingly relevant as businesses themselves rely on automation. Organizations commonly use bots for search engine optimization, website monitoring, analytics, and performance testing. As a result, security teams are often managing environments where beneficial and malicious automation can appear remarkably similar. Industry experts warn that threat actors are taking advantage of this overlap. By designing attacks that resemble trusted automated activity, they can reduce the likelihood of detection and remain active for longer periods.

Confidence Does Not Always Reflect Readiness

Despite growing concerns around AI-driven bot threats, many organizations remain confident in their ability to detect malicious activity. The survey found that 79% of enterprise leaders believe they can identify bot traffic. However, only 23% reported having mature, governance-driven programs designed to manage automated threats proactively. Meanwhile, 44% continue to rely primarily on reactive approaches, while many depend on default protections provided by web application firewalls and content delivery networks. This disconnect suggests that confidence may be outpacing actual preparedness. The report also found that only one-third of respondents said their existing tools successfully blocked more than half of AI-generated bot traffic over the past year.

Business Impact Extends Beyond Security Teams

The consequences of AI-driven bot threats are no longer limited to cybersecurity departments. More than half of surveyed organizations expect AI-powered bots to negatively affect customer experience during the next 12 months. Others anticipate increased exposure of sensitive data and growing operational challenges. Bots can create subtle but costly disruptions. Slower website performance, disrupted transactions, account takeover attempts, and unauthorized data collection can all affect customer trust and business performance. For large organizations handling millions of monthly website visits, even small disruptions can translate into significant financial and operational consequences.

A Shift Toward Bot Governance

As AI continues to reshape cyber threats, security leaders are increasingly being encouraged to move beyond traditional bot detection strategies. The report argues that organizations should begin treating bots as identity-bearing actors rather than simply another source of internet traffic. This approach places greater emphasis on understanding intent, verifying identities, and continuously assessing behavior rather than relying solely on signature-based detection methods. The broader message from the research is clear: as automated threats become more intelligent, organizations will need to focus not only on identifying malicious activity but also on understanding and governing it. The challenge is no longer just stopping bots. It is determining which automated actors can be trusted and which are actively working against the organization.

By Sharat Sinha, CEO, Airtel Business The world has entered an era where more than 20 billion connected devices generate continuous digital exhaust. In this hyperconnected environment, AI-native cybersecurity is emerging as a critical foundation for protecting digital ecosystems. Every transaction, sensor read, API call and remote login now feeds a vast digital nervous system supporting economies, governments and critical infrastructure. As adversaries weaponize automation and AI to scale reconnaissance and exploitation, the cyberattack surface has expanded faster than traditional defenses can adapt. To safeguard national and enterprise resilience, security must evolve from fragmented, reactive controls to an AI-powered, human-led, always-on model delivered through a unified security platform.

Why Traditional Security Models Are Failing

Traditional architectures were designed for static networks and stable perimeters. They were never built for cloud-native workloads, edge computing, distributed workforces or API-centric digital ecosystems. Threat actors, however, now operate at machine speed—using AI to craft hyper-targeted phishing, escalate privileges autonomously and exploit misconfigurations in minutes. Meanwhile, breach discovery in many organizations still spans months. This widening gap between attacker speed and defender response highlights the need for continuous, intelligence-driven protection across network, identity, cloud and data layers.

AI-Native Cybersecurity Is Transforming Threat Detection

Within this shift, AI is emerging as a force multiplier—not a replacement—for human expertise. AI-driven analytics reduce false positives by up to 60%, correlate billions of signals across hybrid environments and detect weak anomalies invisible to manual analysis. Predictive models identify the vulnerabilities most likely to be weaponized, shrinking patch backlogs and strengthening overall resilience. Behavioral algorithms reinforce identity security by spotting subtle deviations that precede credential compromise. Even configuration hygiene improves as AI continuously validates cloud and network settings, eliminating exposures before they become incidents.

Unified Security Platforms Are Becoming the New Standard

AI is also enabling entirely new security capabilities. AI assistants for security leaders can summarize incidents, explain posture drift and produce board-ready insights in seconds. Autonomous SOC workflows now triage, enrich and contain threats across identity, endpoint and cloud layers. DevOps and cloud engineering teams use AI copilots to enforce guardrails and detect compliance drift—addressing misconfiguration risks that consistently rank among the top causes of breaches worldwide. These advancements reflect a broader global shift toward unified, AI-first cybersecurity platforms, where intelligence becomes the connective fabric linking telemetry from identity, network, cloud and data. Rather than operating dozens of siloed tools, organizations gain a single operating layer where detection, decision-making and response flow seamlessly. This consolidation accelerates containment, eliminates blind spots and frees security teams to focus on high-impact decisions. AI also strengthens data protection and regulatory alignment, including emerging requirements under India’s DPDP Act. Automated data classification, policy violation monitoring, retention enforcement and real-time breach alerts shift privacy oversight from periodic checks to continuous assurance. As India’s digital economy scales—driven by cloud adoption, fintech innovation and public digital infrastructure—AI-driven governance ensures both compliance and protection without increasing operational burden.

The Future of Cyber Resilience Will Be AI-Driven

The global direction is clear: AI-first, human-centered unified platforms are becoming the foundation of modern cyber resilience. With cyber incidents costing organizations millions of dollars and often causing systemic ripple effects, intelligent consolidation is no longer an efficiency strategy—it is a national and enterprise resilience strategy. Looking ahead, cybersecurity will be defined by how effectively organizations integrate AI across the entire lifecycle—posture management, threat prediction, protection, governance and automated response—while empowering human judgment at every critical decision point. In a world where threats operate at machine speed, always-on, AI-powered end-to-end protection is becoming the new standard. Organizations that embrace unified, AI-driven architectures will be best positioned to safeguard their people, data and services with confidence in an increasingly unpredictable digital landscape.

The UK government has officially licensed SilentGlass, a government-developed cyber security device, for global commercial use, marking a major step in expanding public sector cybersecurity innovation into international markets. Developed by the National Cyber Security Centre, a part of Government Communications Headquarters, SilentGlass was originally designed to protect sensitive government systems from cyber threats linked to smart display connections. The technology is now being commercialized with support from the Government Office for Technology Transfer through a global intellectual property licensing agreement with a UK-based company. The launch highlights growing concerns around hardware-based cyber risks in modern workplaces, especially as organizations increasingly adopt hybrid work environments, shared office spaces, and connected devices.

SilentGlass Designed to Block Video Connection Cyber Threats

According to the NCSC, the cyber security device was created to address risks associated with modern smart monitors and digital video connections. Security experts have warned that video connections between laptops and monitors can potentially be exploited by attackers to compromise connected systems. The threat becomes more serious in environments where devices with different security levels are connected to shared displays. SilentGlass works as a small plug-and-play hardware device positioned between a laptop and monitor. Its primary role is to prevent the physical video connection from being used as a pathway for cyberattacks. By blocking that attack route, the cyber security device helps organizations reduce exposure to hardware-level threats while enabling safer flexible working arrangements, including hot desking and remote work setups. The NCSC stated that the technology was initially developed for internal government operations before demonstrating broader commercial potential across multiple sectors.

UK Government Expands Cyber Security Innovation to Global Market

Following a competitive commercial process, the UK government approved a global intellectual property licensing agreement for SilentGlass with a UK-based company. The agreement allows the cyber security device to be distributed internationally, expanding access to technology that was originally built for high-security government environments. Officials said the move reflects a wider effort to commercialize public sector innovation while ensuring strong governance and protection of government-developed intellectual property. The NCSC noted that SilentGlass could support:

• Government departments
• Public sector organizations
• Critical national infrastructure operators
• Businesses with advanced cybersecurity requirements
• Employers supporting hybrid work environments

The technology is expected to benefit sectors where device trust, network security, and hardware protection are considered critical operational requirements.

GOTT Supported Commercialization of SilentGlass

The Government Office for Technology Transfer played a key role in helping the NCSC bring the cyber security device to market. According to officials, GOTT supported the project by advising on intellectual property licensing strategies, funding commercialization initiatives, and connecting the NCSC with technology transfer and investment experts. The organization also provided mentoring support for knowledge asset management and helped guide the licensing process through market engagement and competitive partner selection. The UK government has increasingly focused on turning public sector-developed technologies into commercially viable products that can deliver broader economic and security benefits.

Growing Focus on Hardware-Level Cybersecurity

The release of SilentGlass comes as cybersecurity experts continue raising concerns about hardware-level attack vectors that are often overlooked in traditional cybersecurity strategies. Modern monitors, docking stations, USB-connected devices, and display interfaces are increasingly viewed as potential entry points for attackers targeting enterprise and government systems. As hybrid work models expand globally, organizations are under pressure to secure not only software environments but also physical device connections used in day-to-day operations. The NCSC said SilentGlass was specifically designed to address these emerging risks without requiring complex deployment or major infrastructure changes.

NCSC Highlights Future Commercialization Plans

Ollie Whitehouse, Chief Technology Officer at the NCSC, described the commercialization of SilentGlass as an example of how government-developed innovation can support both national cybersecurity and economic growth. According to Whitehouse, the partnership demonstrates how UK government departments can derive greater value from intellectual property while making advanced security technologies more widely available. The NCSC also indicated that additional government-developed cybersecurity technologies could be commercialized in the future following the success of the SilentGlass initiative.

Dubai Police has issued a public warning about the growing spread of viral energy drink videos on social media platforms that encourage excessive consumption, particularly among children and teenagers. Authorities said many of these videos are designed solely to attract views and engagement while ignoring the serious health risks linked to overconsumption of energy drinks. The warning was issued by the Cybercrime Department under the General Department of Criminal Investigation at Dubai Police, which urged parents to closely monitor the type of online content their children are exposed to and educate them about the dangers of blindly imitating viral internet trends. According to Dubai Police, the increasing popularity of online challenges and influencer-driven content has made harmful behavior appear entertaining or harmless to young audiences. Officials stressed that some creators prioritize social media reach over public safety, exposing children to risky habits without discussing potential consequences. [caption id="attachment_112092" align="aligncenter" width="1024"] Source: Dubai Police[/caption]

Energy Drink Videos Raise Serious Health Concerns

Dubai Police highlighted that excessive intake of energy drinks can lead to severe medical complications. Authorities warned that consuming high quantities of caffeine and stimulant-based beverages may cause heart rhythm disorders, convulsions, loss of consciousness, and in extreme cases, sudden cardiac arrest. Children and adolescents are considered particularly vulnerable to these effects because their bodies may react more strongly to stimulant ingredients commonly found in energy drinks. The police also noted that overconsumption can trigger a wide range of additional health issues, including poisoning, stomach disorders, anxiety, irritability, poor concentration, memory problems, sleep disturbances, high blood pressure, and rapid heartbeat. Officials said the concern is not limited to physical health alone. Repeated exposure to viral energy drink videos can normalize dangerous behavior among younger audiences who often attempt to replicate online trends without understanding the risks involved.

Dubai Police Urges Parents to Monitor Online Content

As part of the advisory, Dubai Police encouraged parents and guardians to maintain active supervision of the digital content consumed by children. Authorities emphasized the importance of discussing online safety and helping children identify misleading or harmful trends circulating on social media platforms. The force urged families to explain that not all viral content is trustworthy or safe, especially when it promotes unhealthy or dangerous actions for entertainment purposes. Dubai Police also advised the public to rely on verified medical and health sources for information regarding food, beverages, and wellness-related trends instead of depending on influencer content or unverified social media posts. The warning reflects broader concerns among authorities globally about how social media algorithms can rapidly amplify risky trends, especially among younger users who are highly engaged with short-form video platforms.

Public Asked to Report Harmful Online Content

Dubai Police called on community members to report any digital content that promotes dangerous behavior or threatens public safety. Authorities said reports can be submitted through the Dubai Police smart application, the dedicated E-Crime platform, or by contacting the non-emergency helpline at 901. Officials stressed that public reporting plays an important role in limiting the spread of harmful online material and protecting vulnerable groups from unsafe internet trends. The department also reminded social media users to think critically before participating in online challenges or consuming products promoted through viral content.

Dubai Police Expands Cyber Awareness Efforts

Alongside the warning, Dubai Police highlighted its ongoing efforts to improve public awareness around cyber safety and digital risks through its awareness e-platform. The online platform provides educational material in both Arabic and English and covers various topics related to cybercrime prevention, online fraud awareness, digital safety, and safe internet usage. According to Dubai Police, the platform is designed for all sections of society, including parents, children, employees, business owners, and regular internet users. Authorities said the initiative aims to help residents recognize online manipulation tactics, avoid cyber-related threats, and make safer decisions while using social media and digital platforms. The latest advisory on viral energy drink videos adds to growing efforts by law enforcement and public health authorities to address the real-world risks created by harmful social media trends targeting younger audiences.

By Niall Browne, CEO and Founder, AIBound

Shadow AI is accelerating alongside artificial intelligence (AI) adoption at a pace that has outgrown most enterprise governance models. Artificial intelligence (AI) adoption is accelerating at a pace that has outgrown most enterprise governance models. According to the World Economic Forum, 87% of organizations report that AI-related vulnerabilities are now the fastest-growing cyber risk. Part of this surfaces with  employees increasingly deploying autonomous AI agents that connect to MCP servers and external AI that security teams have never assessed, quietly piping sensitive corporate data into systems no one in IT has ever audited — and no one in the C-suite knows exist. This increase in Shadow AI is creating systemic enterprise risk that can lead to unforeseen costs. Compliance frameworks like the Artificial Intelligence Act of the European Union (EU AI Act) take full effect this year introducing penalties up to 7% of global annual revenue for unmanaged AI. As regulatory frameworks begin to align with the realities of increased AI adoption, enterprises need to account for decentralized AI usage that operates outside traditional controls. This requires software that allows greater visibility, organization, and control into how AI is used and tracked across environments.

Shadow AI Is Creating a New Enterprise Attack Surface

The traditional security stack was built for a world that no longer exists — one with known assets, centralized systems, and software that asked permission before it ran. As new tools are introduced independently, usage levels evolve quickly without system checks or visibility into how these tools interact with sensitive data. Research indicates that 75% of CISOs have discovered unsanctioned GenAI tools in their environments, and only 5% feel confident they could contain compromised AI agents. Because of how easy these platforms are to access and require little onboarding, adoption is happening across teams at a rapid rate without IT involvement. Other security issues lie with employees integrating workflows with personal AI agents. These deployments allow sensitive information to be leaked or directly inputted into agents without security knowledge. Without a system in place for organizations to continuously track and evaluate how AI is being used across their enterprise systems, CISOs are left without visibility of their attack surfaces. The result is a slow-motion breach: data leaking, compliance crumbling, and governance reduced to a slide deck nobody enforces. Recurring data leaks and breaches via AI reveal the need for solutions that address this gap. Popular AI agents like ChatGPT for example, revealed a ‘ShadowLeak’ vulnerability that allowed sensitive email data to be breached through a zero-click attack. Other short lived features that rolled out last year allowed conversation sharing, leaving employee info, internal corporate strategies, and other sensitive data to be shared and indexed by search engines. Although this option only was available for a day, it was estimated that over 100,000 private chats were affected and able to be viewed with a simple search, allowing any sensitive information inputted to be publicly accessible. Other recent breaches include a Microsoft 365 Copilot bug allowing AI assistants to summarize emails labeled confidential, bypassing data loss prevention policies set up by organizations. Microsoft confirmed that a code issue allowed confidential emails data to be accessed despite organizational securities put in place. These agents are live and operational with local access to files, systems, commands, and APIs capable of executing tasks and retrieving data without clear oversight control. As AI usage continues to expand at accelerating rates, organizations need a way to better understand how these tools are used across their environments. No CISO has ever defended a perimeter they couldn't see. Shadow AI is the new perimeter — and most security teams are flying blind. Without a comprehensive inventory and control of AI usage, security teams are unable to accurately assess risks and enforce policy to maintain compliance.

Shadow AI Demands Continuous Visibility and Independent AI Control Planes

This is where adoption of independent AI Control Planes becomes vital. Independent AI Control Planes provides a way to continuously identify and assess AI activity giving security teams the visibility needed to manage emerging risks. It enables organization and categorization of AI usage across enterprises without relying on the manual entry and tracking that existing platforms demand — work no security team in a fast-moving environment can realistically keep up with. It’s undeniable: Shadow AI is not a future problem — it is already running inside your enterprise, on assets you don't own, through agents you never approved, touching data you are responsible for protecting. Every day without continuous, autonomous AI discovery is a day your attack surface grows faster than your governance can chase it. Regulators won't wait. Attackers already aren't. The CISOs who win the next 24 months will be the ones who stop pretending policy equals control and start operating on a simple truth: if you can't see it, you can't secure it — and right now, most of AI is invisible.

Disclaimer: The views and opinions expressed in this guest article are solely those of the author and do not necessarily reflect the official policy or position of The Cyber Express. The information shared is intended for industry discussion and awareness purposes only.

As India marks National Technology Day, industry leaders say the country’s technology ambitions are now closely tied to cybersecurity, AI infrastructure, and digital resilience. With businesses rapidly adopting artificial intelligence, cloud platforms, and connected systems, experts believe the next phase of growth will depend on how securely and responsibly these technologies are deployed. Across industries, organisations are moving beyond experimental AI projects and integrating intelligent systems directly into operations, customer engagement, healthcare, infrastructure, and enterprise decision-making. At the same time, cybersecurity leaders are warning that the rise of AI-driven environments is also creating faster and more sophisticated cyber threats.

National Technology Day 2026 Reflects India’s AI-First Push

According to Ritesh Kapadia, Field Chief Technology Officer, iLink Digital, technology discussions are increasingly centred around how AI systems behave and interact within organisations rather than just the tools themselves. Kapadia said AI is evolving from passive software into active systems capable of analysing context, triggering actions, and supporting enterprise decisions. He noted that organisations are gradually building “AI-first enterprises” where intelligence becomes part of daily workflows instead of operating as a separate technology layer. "Technology conversations today are becoming less focused on tools and more focused on behaviour. AI systems are evolving from passive platforms into active collaborators that can analyse context, trigger actions and support enterprise decision making. This shift is laying the foundation for AI first enterprises, where intelligence is embedded into everyday operations, workflows and business decisions rather than functioning as a separate layer of technology." He added that enterprises are focusing on connected systems that can respond intelligently while maintaining governance and operational clarity. The growing use of AI across enterprise environments is also increasing cybersecurity concerns. Security teams are now dealing with automated attacks, deepfakes, AI-assisted vulnerability discovery, and identity-based threats that can move at machine speed.

Cybersecurity, Core Part of Digital Transformation

Sunil Sharma, Managing Director & VP – Sales (India & SAARC) at Sophos, said National Technology Day 2026 is a reminder that innovation and cybersecurity must grow together. According to Sharma, organisations can no longer depend only on traditional or reactive security models. Businesses are now being pushed toward continuous threat monitoring and real-time response frameworks as attackers use AI to scale operations faster than before. He also highlighted identity security as a major challenge for enterprises managing cloud systems, remote access environments, and interconnected digital ecosystems. “The threat landscape is evolving rapidly,” Sharma said, pointing to deepfakes, automated attacks, and AI-driven vulnerability discovery as some of the biggest emerging concerns. Industry leaders believe cyber resilience is becoming equally important as digital transformation, especially as Indian enterprises continue accelerating cloud adoption and AI integration.

AI Infrastructure and Data Centres Gain Importance

Technology executives also stressed the importance of building infrastructure capable of supporting India’s growing AI ecosystem. AS Prasad, Vice President, Product Management, Vertiv, said the future of AI will depend heavily on infrastructure decisions being made today, particularly around power systems, cooling technologies, and data centre architecture. "The next decade of AI will be won in the infrastructure layer, in the power systems, the cooling architecture, and the data center design decisions being made right now. Prasad noted that AI workloads require scalable and reliable infrastructure to operate efficiently at enterprise and national levels. That view was echoed by Narendra Sen, Founder & CEO, RackBank & NeevCloud, who described data centres as critical to India’s digital future. Sen said India’s policy initiatives, including the IndiaAI Mission and data localisation efforts, are creating momentum for sovereign AI infrastructure and homegrown cloud ecosystems. He added that infrastructure readiness will determine how effectively India can scale AI adoption across industries and government systems.

Responsible AI Adoption Expands Across Industries

The life sciences sector is also witnessing increased AI adoption as companies look to improve operational efficiency and decision-making. Duraisamy Rajan Palani (Durai), Founder and CEO of Archimedis Digital, said AI is helping accelerate innovation in drug discovery, clinical trials, and patient engagement. However, he noted that as AI systems move beyond automation and begin supporting expert-level decisions, accuracy, accountability, and regulatory compliance become increasingly important. Industry experts say responsible AI adoption will remain a key focus area as organisations balance innovation with governance requirements. Meanwhile, Vikram Prabakar highlighted how technology is also being used to address sustainability and inclusion challenges. He said AI-powered waste traceability and digital recycling platforms are helping improve transparency and efficiency while supporting India’s broader sustainability goals.

India’s Technology Growth Also Depends on Skilled Talent

While India continues to invest heavily in AI infrastructure and digital transformation, experts say the shortage of specialised talent remains a growing challenge. Milind Shah, Managing Director, Randstad Digital India, said demand for professionals skilled in AI, cybersecurity, cloud computing, and digital infrastructure is increasing rapidly. He added that many of these specialised roles have emerged only recently, making workforce development a critical priority for businesses, academic institutions, and policymakers. "India is on track to become one of the world’s largest digital infrastructure markets within this decade, supported by sustained investments, policy momentum, and accelerating demand. What now requires equal emphasis is the depth, quality, and readiness of the talent pipeline. AI, cloud, and advanced digital infrastructure rely on highly skilled engineers, architects, and operators capable of managing complex, rapidly evolving environments. Many of these roles have emerged only recently, making workforce readiness a strategic priority rather than a secondary consideration. Addressing this gap will require coordinated action across industry, academia, and policy frameworks to build both scale and specialisation." As National Technology Day 2026 highlights India’s progress in AI and digital innovation, industry leaders say long-term success will depend on building secure infrastructure, strengthening cyber resilience, and preparing a workforce capable of managing increasingly complex technology environments.

In the span of four days, the U.S. government announced two parallel sets of agreements with frontier AI companies that together define the two tracks Washington wants to run simultaneously—test AI for national security risks before the public ever sees it, and deploy AI directly on the military's most classified networks.

The Center for AI Standards and Innovation — CAISI, the entity under the Department of Commerce's National Institute of Standards and Technology that inherited the remit of the former AI Safety Institute — announced new agreements with Google DeepMind, Microsoft, and Elon Musk's xAI. These build on renegotiated agreements with Anthropic and OpenAI that date to 2024, updated to reflect directives from Commerce Secretary Howard Lutnick and America's AI Action Plan.

Under the CAISI agreements, the three companies will hand over their frontier AI models to government evaluators before those models are publicly released. The evaluations probe for national security-relevant capabilities and risks.

To conduct a thorough assessment, developers frequently provide CAISI with models that have reduced or removed safety guardrails — a design choice that allows evaluators to probe what a model can do at its ceiling, not what it will do under commercial safety controls. Evaluators from across the federal government participate, coordinated through the CAISI-convened TRAINS Taskforce, an interagency body focused specifically on AI national security concerns.

CAISI said it has completed more than 40 such evaluations to date. The agreements explicitly support testing in classified environments and were drafted with the flexibility to adapt rapidly as AI capabilities continue advancing.

"Independent, rigorous measurement science is essential to understanding frontier AI and its national security implications," said CAISI Director Chris Fall. "These expanded industry collaborations help us scale our work in the public interest at a critical moment."

Listen to: Charting the AI Frontier in Cybersecurity with Ryan Davis

Fall was appointed to lead CAISI after Collin Burns — a former Anthropic researcher — was reportedly removed from the director role after just four days. The personnel transition at CAISI's top reflects a broader institutional pivot. Under the Biden administration, the AI Safety Institute focused on safety standards, definitions, and voluntary guardrails. Under Trump, CAISI has shifted its emphasis toward AI acceleration and national security capability assessment. The substance of what the evaluators do — probe powerful models before release — has not changed. The framing of why they do it has.

The latest announcement comes four days after the Department of War (formerly Department of Defense) announced agreements with eight frontier AI companies to deploy their models directly on the military's classified networks for operational use.

The companies cleared are SpaceX, OpenAI, Google, NVIDIA, Reflection, Microsoft, Amazon Web Services, and Oracle. The networks in question are classified at Impact Level 6, covering secret-level data, and Impact Level 7, which refers to the most highly restricted national-security systems. The stated objectives are data synthesis, situational awareness enhancement, and warfighter decision support.

The Department of War announcement carries one conspicuous absence that dominates coverage of what it actually means. Anthropic is not on the list. The company that first deployed AI models on Pentagon classified systems — via a Palantir integration under the Maven Smart System contract — is excluded after a dispute over the guardrails governing military and surveillance use of its AI.

Also read: Australia Establishes AI Safety Institute to Combat Emerging Threats from Frontier AI Systems

The Pentagon had previously branded Anthropic a "supply chain risk," a designation typically reserved for foreign entities posing national security concerns. A March 2026 federal injunction reversed that designation, but it did not restore Anthropic's position as a Pentagon AI vendor. Palantir has pulled its Claude models from its DoD platforms accordingly.

The exclusion has strategic implications that extend beyond one company's contract status. Anthropic's recently released Mythos model — described by Treasury Secretary Scott Bessent as representing a step change in large language model capability — has generated significant attention from U.S. officials and financial sector executives about its potential to supercharge adversarial cyber operations.

The fact that Mythos is not among the models being assessed for classified military use, while simultaneously being cited by senior officials as a capability milestone that warrants concern, creates a gap in the government's stated AI security posture that is difficult to characterize as anything other than a policy contradiction.

Organisations worldwide are being urged to prepare for a vulnerability patch wave, as security experts warn that advances in artificial intelligence (AI) could rapidly expose long-standing weaknesses across software systems. The warning comes from National Cyber Security Centre (NCSC), which says businesses must act now to strengthen their environments before a surge of critical updates arrives. In a blog, Chief Technology Officer Ollie Whitehouse highlighted that years of accumulated technical debt are now becoming a major cybersecurity risk. Technical debt refers to unresolved flaws and compromises in software that arise when organisations prioritise speed or short-term delivery over long-term resilience. According to Whitehouse, artificial intelligence is accelerating the problem. Skilled attackers are increasingly able to use AI tools to identify and exploit vulnerabilities at scale, forcing what the NCSC describes as a “correction” across the technology ecosystem. This is expected to trigger a vulnerability patch wave, with a high volume of security updates affecting open source, commercial, proprietary, and software-as-a-service platforms.

Prioritising External Attack Surfaces

As part of preparing for the vulnerability patch wave, the NCSC advises organisations to first focus on their external attack surfaces. Internet-facing systems, cloud services, and exposed infrastructure present the highest risk when new vulnerabilities are disclosed. The guidance recommends a perimeter-first approach. Organisations should secure outward-facing technologies before moving deeper into internal systems. This reduces the likelihood that attackers can exploit newly discovered weaknesses during the vulnerability patch wave. Where resources are limited, priority should be given to patching systems that are directly exposed to the internet. Critical security infrastructure should follow next. However, the NCSC cautions that patching alone will not solve every issue. Legacy and end-of-life systems remain a major concern. Many of these technologies no longer receive security updates, leaving organisations vulnerable even during a vulnerability patch wave. In such cases, businesses may need to replace outdated systems or bring them back into supported environments, especially if they are externally accessible.

Preparing for Faster and Large-scale Patching

The expected vulnerability patch wave will require organisations to rethink how they manage updates. The NCSC is urging businesses to prepare for faster, more frequent, and large-scale deployment of security patches, including across supply chains. Several key measures have been recommended:

• Enable automatic updates wherever possible to reduce operational burden
• Adopt secure “hot patching” to apply fixes without service disruption
• Ensure internal processes support rapid and large-scale updates
• Use risk-based prioritisation models such as Stakeholder Specific Vulnerability Categorisation (SSVC)

Whitehouse noted that organisations must be ready to accelerate patching timelines when critical vulnerabilities are actively exploited, particularly those affecting internet-facing systems. At the core of this approach is an “update by default” policy. This means applying software updates as quickly as possible, ideally through automated processes. While this may not always be feasible for safety-critical or operational technology systems, the NCSC says it should form the foundation of modern vulnerability management strategies.

Beyond Vulnerability Patch Wave: Addressing Systemic Risks

The NCSC emphasises that the vulnerability patch wave is only part of a broader cybersecurity challenge. Patching addresses immediate risks, but it does not eliminate the underlying causes of technical debt. Technology vendors are being encouraged to build more secure systems from the outset. This includes adopting memory safety and containment technologies such as CHERI, which can reduce the likelihood of exploitable vulnerabilities. For organisations operating critical services, strengthening cybersecurity fundamentals is equally important. Frameworks such as Cyber Essentials and sector-specific resilience models can help reduce the impact of breaches and improve overall security posture. Additional guidance has also been issued for high-risk environments, covering areas such as privileged access workstations, cross-domain security architecture, and threat detection through observability and proactive hunting.

Organisations Urged to Act Now

The NCSC has made it clear that preparation cannot be delayed. The anticipated vulnerability patch wave is expected to impact organisations of all sizes and sectors. Businesses are advised to review their vulnerability management processes, assess their exposure, and ensure their supply chains are also ready to respond. Larger organisations, in particular, are encouraged to seek assurance from both commercial and open-source partners. As Whitehouse concluded, readiness for the vulnerability patch wave will depend on proactive planning, strong fundamentals, and the ability to respond quickly at scale.

India’s top intelligence agency arrested a suspected key conspirator accused of supplying fraudulently obtained SIM cards to cybercriminal networks, as part of the agency’s ongoing anti-cybercrime initiative, Operation Chakra-V.

According the Central Bureau of Investigation (CBI), the suspect was apprehended in the North Eastern city of Guwahati after allegedly evading authorities since August 2025. Investigators say the accused played a central role in procuring and distributing illegally issued mobile SIM cards that were later used in a range of cyber-enabled fraud schemes.

Also read: CBI Files Chargesheet Against 30 Including Two Chinese Nationals in ₹1,000 Cr Cyber Fraud Network

The law enforcement agencies are now increasingly focusing on the infrastructure that enables digital crime rather than only the individuals carrying out the scams. Fraudulently acquired SIM cards are a valuable tool for cybercriminals because they can be used to create anonymous accounts, bypass identity checks, receive one-time passwords (OTPs), and operate scam call centers with reduced traceability.

The CBI said its broader investigation uncovered a network involving Point of Sale (POS) agents who allegedly issued SIM cards using fake or improperly verified customer identities. These SIM cards were then reportedly supplied to criminals linked to fake “digital arrest” extortion scams, fraudulent loan offers, and investment fraud operations.

Authorities stated that searches were previously conducted at around 45 locations across eight Indian states, resulting in the arrest of 10 accused POS agents. The latest suspect is believed to have acted as an aggregator within the network.

Also read: India Dismantles ‘Phishing SMS Factory’ Infrastructure Sending Lakhs of Fraud Messages Daily

Investigators allege the accused transferred nearly ₹67 lakh through multiple bank accounts to procure approximately 10,000 illegally issued SIM cards. Evidence related to courier shipments used for distributing the cards has also reportedly been recovered, suggesting a structured logistics chain behind the operation.

From a cybersecurity perspective, the case underscores how telecom identity abuse remains a critical threat vector. Even sophisticated fraud campaigns often depend on simple enablers such as fraudulent SIM issuance, mule bank accounts, and compromised identity records.

The CBI said investigations into additional conspirators are ongoing. As cyber fraud grows more industrialized, dismantling support networks like these may prove just as important as arresting the scammers who interact directly with victims.

Also read: 12 Lakh SIM Cards Cancelled, over 3 Lakh IMEI Numbers Blocked as Centre Intensifies Crackdown on Cybercrime

The UAE Cyber Security Council has raised concerns over widespread data exposure, revealing that nearly 25 percent of publicly accessible files contain sensitive personal data. The warning comes as part of its ongoing awareness efforts, urging individuals and organisations to strengthen basic cybersecurity practices. In its latest advisory under the “Cyber Pulse” campaign, the Council highlighted that poor file-sharing habits continue to expose users to avoidable cyber risks. The findings point to a growing gap between the use of cloud platforms and the understanding of how to secure shared data.

Public Files and Sensitive Personal Data at Risk

The Council’s findings show that a significant portion of files shared openly online contain sensitive personal data such as identification details, financial records, or login information. This raises concerns about how easily such data can be accessed by unintended users. The issue is not limited to publicly shared files. According to the Council, between 68 percent and 77 percent of privately shared files may also be accessible to unintended recipients due to weak access controls or misconfigured sharing settings. This highlights a broader problem where users assume that private sharing automatically ensures security. In many cases, improper permissions or link-based access can lead to unintentional exposure of sensitive personal data.

Cyber Security Council Highlights Encryption as Critical Safeguard

The UAE Cyber Security Council emphasized that encryption remains one of the most effective ways to protect sensitive personal data. Files that are encrypted before being shared or stored online are significantly less vulnerable to unauthorized access. The advisory noted that cloud storage platforms do not guarantee automatic protection of data. Without encryption, sensitive files remain exposed if access controls are bypassed or misconfigured. Alongside encryption, secure account management plays a key role in reducing risk. Weak passwords, reused credentials, and lack of authentication measures continue to be major contributors to data exposure incidents.

Key Cybersecurity Practices Recommended

To address the risks associated with exposed sensitive personal data, the Cyber Security Council outlined several essential cybersecurity practices. Users are advised to use strong and regularly updated passwords and enable two-factor authentication across all accounts. Avoiding public links when sharing sensitive files is also critical, as these links can be easily forwarded or accessed without proper restrictions. The Council stressed the importance of reviewing privacy settings and managing access permissions carefully. Monitoring file usage and access logs can help identify unusual activity and prevent misuse. Additional measures include deleting unused files and inactive sharing links, securing Wi-Fi networks, and keeping devices and software up to date. Users are also encouraged to review application permissions and limit access to only necessary services. When accessing files over public networks, the use of virtual private networks can provide an added layer of security. Regular data backups and secure database management on cloud platforms are also recommended to prevent data loss and unauthorized access.

Awareness Remains Key to Reducing Exposure

The Cyber Security Council noted that many cases involving sensitive personal data exposure are the result of simple, preventable mistakes. Lack of awareness around basic cybersecurity practices continues to be a major factor. The “Cyber Pulse” campaign, now in its second year, aims to address this gap by promoting safer digital behaviour among individuals and organisations. The initiative forms part of broader national efforts to build a secure and resilient digital environment. By encouraging users to adopt stronger security measures and understand the risks of improper file sharing, the Council aims to reduce the exposure of sensitive personal data and improve overall cybersecurity hygiene. The latest findings serve as a reminder that while technology platforms continue to evolve, the responsibility to secure data often lies with users. Simple steps such as enabling encryption, managing access, and reviewing shared content can significantly reduce the risk of data exposure.

Law enforcement agencies across Europe, the United States, and other partner nations cracked down on the commercial DDoS-for-hire ecosystem, targeting both operators and customers of services used to knock websites offline.

The coordinated effort led to the seizure of 53 domains, four arrests, 25 search warrants, and warning notices sent to more than 75,000 people suspected of using so-called “booter” or “stresser” platforms.

A Crackdown on DDoS-for-Hire

DDoS-for-hire platforms allow customers to pay relatively small fees to launch distributed denial-of-service attacks against websites, gaming services, businesses, and public infrastructure. In fact, AI-driven threat intelligence company Cyble, in a new research report released today said, DDoS was the primary mode of attack during the ongoing Iran-Israel and U.S. conflict. Cyble recorded a 140% increase in DDoS attacks targeting Israeli entities after September 2025, and at the height of the conflict, saw 40 DDoS attacks per day.

These DDoS-for-hire services often market themselves as legitimate stress-testing tools, but authorities say they are widely abused for harassment, extortion, and disruption.

The latest enforcement wave is part of the long-running international initiative known as "Operation PowerOFF," which has previously dismantled multiple booter services and disrupted related infrastructure.

Read: DDoS-for-Hire Empire Dismantled as Poland Arrests Four, U.S. Seizes Nine Domains

U.S. Authorities Seize Key Infrastructure

The U.S. Department of Justice said investigators in Alaska seized infrastructure linked to eight DDoS-for-hire domains, including services branded as Vac Stresser and Mythical Stress, both of which allegedly advertised the ability to launch tens of thousands of attacks per day. Investigators also searched backend servers tied to the platforms.

Officials did not immediately identify those behind the services, but said the action was intended to disrupt the technical backbone used to power attacks globally.

75,000 Users Contacted Directly

In one of the more unusual aspects of the operation, authorities contacted more than 75,000 suspected users directly through warning emails and letters.

Law enforcement agencies appear to be using deterrence alongside takedowns—sending a message that paying for DDoS attacks leaves a trail and may bring legal consequences.

Security experts say the tactic could be particularly effective against younger or low-level offenders who use these platforms for gaming disputes, personal retaliation, or vandalism without fully understanding the legal risks.

Investigators said they identified around three million criminal accounts connected to the wider DDoS-for-hire ecosystem. The sheer number of accounts shows how industrialized cybercrime services have become. Instead of building botnets or malware, users can simply rent attack capability on demand.

DDoS attacks overwhelm a target with traffic, often causing websites, applications, or networks to crash. While sometimes dismissed as nuisance attacks, they can disrupt hospitals, financial institutions, government portals, and emergency services.

Recent years have also seen DDoS attacks used as smokescreens to distract security teams while other intrusions unfold.

Read: Europol Issues Public Alert: ‘We Will Never Call You’ as Phone and App Scams Surge

A Persistent Cat-and-Mouse Game

Despite repeated takedowns, booter services often reappear quickly under new names, new domains, or relocated hosting providers. Researchers have found that while seizures can significantly reduce traffic in the short term, the market has proven resilient over time.

That means operations like PowerOFF may need to combine arrests, infrastructure seizures, financial disruption, and user deterrence to have lasting impact.