Cyberopex Briefing – Cybersecurity, GRC & AI made practical

Your people already use AI – approved or not. The real question is where your data ends up. Christian Serra walks through three risk areas – shadow AI, oversharing and AI tools as an attack path – and shows how four steps and a practical tip that takes under an hour put AI use on a secure footing.

In this episode

📰 News radar: A second wave of attacks on Danfoss supermarket refrigeration across Europe, including failed attempts at Swiss retailer Coop · Breach of the IT help desk platform for schools in the Swiss canton of Vaud (about 41,500 people affected) · Swiss Federal Office for Cyber Security warns of hacked home networks via outdated services

🔍 Deep dive: AI at work – shadow AI, contracts and data boundaries, fixing permissions before Copilot, prompt injection, Swiss data protection law and AI, and a data traffic light for your AI policy

💡 Practical tip: The AI reality check – three steps to the first draft of your AI policy

📚 Sources

• The Hacker News: New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe (Nov 3, 2026)
• 20 Minuten: Hacking wave hits European supermarkets (German, Nov 2, 2026)
• swissinfo.ch: Teen arrested following cyberattack on Swiss schools (Nov 3, 2026)
• inside-it.ch: Cyberattack on Vaud schools (German, Nov 2, 2026)
• Netzwoche: Criminals hack home networks via outdated services (German, Nov 4, 2026)
• Fortune: Microsoft Work Trend Index 2024 (May 10, 2024)
• Forbes Australia: Samsung bans ChatGPT after code leak (May 2, 2023)
• Microsoft Learn: Data, Privacy, and Security for Microsoft 365 Copilot
• Symantec: Unauthorized relays for OpenAI Codex and Claude Code (Oct 29, 2026)
• Netzwoche: How the Swiss data protection act applies to AI (German, May 12, 2025)

🤖 This episode uses an AI-generated version of Christian Serra's voice. Christian has reviewed and approved all content himself.

✉️ Contact: [email protected] · cyberopex.com

Neutrality doesn't protect you in cyberspace. Christian Serra explains how states use cyber for espionage, sabotage, disinformation and disruption – and why businesses mostly get hit as collateral damage. Plus a concrete list you can build in under an hour.

In this episode

📰 News Radar: Swiss data protection commissioner investigates the PK Softech breach – and Akira stays active in Switzerland · One misused login at the Swiss Ice Hockey Federation · "Silent Train": how Volt Typhoon turns hijacked routers into a covert network

🔍 Deep Dive: Cyber war – the four roles of cyber in conflict, NotPetya and KA-SAT as lessons in collateral damage, DDoS campaigns against Switzerland, and four steps for companies

💡 Practical tip: The collateral damage list – your ten most important providers, three questions, under an hour

📚 Sources

• inside-it.ch: Data protection commissioner investigates PK Softech (Oct 26, 2026, German)
• Swisscybersecurity.net: Medienwerkstatt reports data theft (Oct 26, 2026, German)
• Netzwoche: Swiss Ice Hockey Federation data stolen (Oct 28, 2026, German)
• Lumen Black Lotus Labs: Silent Train (Oct 28, 2026)
• NPR: A breakthrough for the group on the trail of Chinese hackers (Oct 28, 2026)
• NATO CCDCOE: NotPetya (2017)
• Modern Power Systems: Enercon and KA-SAT (Jun 9, 2022)
• SRF: Swiss intelligence report 2026 (Jun 25, 2026, German)

🤖 This episode uses an AI-generated version of Christian's voice. Christian Serra has reviewed and approved all content himself.

✉️ Contact: [email protected] · cyberopex.com

🧩 Since October 14 there is a new standard for AI security: ISO/IEC 27090. In this short special of Cyberopex Briefing, Christian Serra explains what it covers – and what you can do now.

🎧 In this episode:

• 📘 Guidance, not a certificate: you can't get certified against ISO/IEC 27090. It is part of the ISO 27000 family, complements ISO 27001/27002 and fits well alongside ISO 42001.
• ☠️ AI-specific threats: poisoned training data, model theft, manipulated inputs and prompt injection – across the whole lifecycle
• ⚖️ EU AI Act: Article 15 requires an appropriate level of cybersecurity for high-risk AI
• 💡 Practical tip in 3 steps: list your AI systems (including AI in products you buy) · add AI threats to your existing risk assessment · ask your AI vendors the right questions

📚 Sources:

• ISO: ISO/IEC 27090:2026 – Guidance for addressing security threats and compromises to AI systems
• IEC Webstore: ISO/IEC 27090:2026
• EU: Regulation (EU) 2024/1689 (AI Act), Article 15

🤖 This episode uses an AI-generated version of Christian Serra's voice. Christian reviews and approves all content and sources himself.

✉️ Contact: [email protected] · 🌐 cyberopex.com

🇨🇭 Switzerland isn't in the EU – yet NIS2 keeps landing on the desks of Swiss and other non-EU companies. In episode 2 of Cyberopex Briefing, Christian Serra walks through the three paths by which the EU directive reaches you – and what to do now.

🎧 In this episode:

• 📰 News radar: ransomware attack on pension fund software vendor PK Softech (Publica) and a fraud warning from Zurich police · 115,000 customer records from an Offerz test environment · actively exploited flaws in Cisco Secure Email Gateway and Palo Alto firewalls
• 🔍 Deep dive: NIS2 from outside the EU – EU subsidiaries, digital service providers and the supply chain, plus Switzerland's own reporting duty and five concrete steps
• 💡 Practical tip: three questions for your three most important software providers – done in under an hour

📚 Sources:

• Cash/AWP: Attack on Publica supplier (German)
• SRF: How did sensitive pension data end up at an external software firm? (German)
• Zurich cantonal police: fraudsters target pension funds after cyberattack (German)
• Cash/AWP: Attack on Offerz – 115,000 customer records (German)
• Help Net Security: CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
• EU: Directive (EU) 2022/2555 (NIS2), Articles 21 and 26
• Börse Express: BSI registration for 29,500 companies (German)
• SECJUR: Austria's NISG 2026 (German)
• Blick: Swiss reporting duty for critical infrastructure – first-year review (German)

🤖 This episode uses an AI-generated version of Christian Serra's voice. Christian reviews and approves all content and sources himself.

✉️ Contact: [email protected] · 🌐 cyberopex.com

Since 11 September, manufacturers selling into the EU must report actively exploited vulnerabilities within 24 hours – including Swiss and other non-EU companies. In the first episode of Cyberopex Briefing, Christian Serra explains what that means in practice and what to do on Monday.

In this episode:

• News radar: attacks on Swiss organizations up 36% · EU AI Act transparency rules (Art. 50) now in force · Amgen and third-party cloud risk
• Deep dive: Cyber Resilience Act – the 24-hour reporting clock, ENISA's Single Reporting Platform and five steps to take now
• Practical tip: the 30-minute, 24-hour drill for your response team

Sources:

• Netzwoche: Cyberattacks on Swiss companies up 36% in August (German)
• European Commission: Cyber Resilience Act – Reporting obligations
• ENISA: The CRA Single Reporting Platform is launched
• McCann FitzGerald: CRA reporting obligations apply from 11 September 2026
• McCann FitzGerald: EU AI Act transparency compliance (Art. 50)
• BleepingComputer: Amgen cloud data breach

This episode uses an AI-generated version of Christian Serra's voice. Christian reviews and approves all content and sources himself.

Contact: [email protected] · cyberopex.com

Cyberopex Briefing – about twelve minutes every Tuesday on cybersecurity, compliance, and AI, made practical for your organization.

What you get in every episode:

• News radar: three stories of the week – what happened and what to do about it
• Deep dive: from NIS2 and the Cyber Resilience Act to cyber warfare and industrial espionage
• Practical tip: something you can act on in under an hour

This trailer is recorded in Christian’s real voice. Regular episodes use an AI-generated version of his voice – Christian reviews and approves all content and sources himself.

Topic ideas: [email protected]
Website: cyberopex.com