Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Transcript

Today’s cyber and AI risk environment is rapidly shifting from theoretical concerns to very real, operational threats. The pace of change is striking: attack techniques that were flagged as emerging risks just a year ago are now being actively exploited, especially in sectors like financial services and critical infrastructure. At the same time, the adoption of AI technologies is outstripping most organizations’ ability to govern them effectively, creating a widening gap between innovation and risk management. As regulatory frameworks and security standards begin to mature, the pressure is on for CISOs and risk executives to deliver continuous assurance and robust incident response capabilities across both cyber and AI domains.

Let’s start with a look at the financial sector, where the operationalization of AI-driven threats is now a daily reality. According to a new report, six of the seven major cyber threats identified last year in the banking, financial services, and insurance sector—often referred to as BFSI—are now operational. What’s especially notable is the rise of AI-driven identity attacks as the most significant threat. Attackers are leveraging automation and advanced machine learning techniques to bypass traditional security controls, making it much harder to detect and stop them in real time.

This shift from theoretical to active exploitation means that identity management, monitoring, and response capabilities need to be front and center for risk leaders. It’s no longer enough to rely on static controls or periodic reviews. Instead, organizations need to invest in adaptive defenses that can evolve alongside the threat landscape. Advanced detection tools, behavioral analytics, and continuous monitoring are now essential components of any identity-centric security strategy.

The implications here are clear: if you’re responsible for risk in the financial sector, you need to be asking tough questions about your current approach to identity security. Are your controls keeping up with automated, AI-driven attacks? Do you have the visibility and agility to respond to new attack patterns as they emerge? And most importantly, is your organization prepared to adapt as these threats continue to evolve?

Moving to the software supply chain, we’re seeing ongoing risks associated with third-party cloud services. Progress Software recently issued an urgent warning about an “external security threat” targeting its ShareFile platform. Organizations using ShareFile have been advised to immediately shut down their Storage Zone Controllers due to active exploitation of a significant vulnerability. The potential consequences here are serious—data exposure, ransomware attacks, and widespread disruption.

This incident is a stark reminder of the importance of rapid patching and clear communication with vendors. When a critical third-party service is compromised, the window for response is often measured in hours, not days. Security teams need to have processes in place to quickly assess exposure, implement recommended mitigations, and communicate with both internal stakeholders and external partners. Regular reviews of third-party dependencies and proactive vendor engagement are no longer optional—they’re a fundamental part of resilient operations.

The impact of these supply chain risks isn’t limited to software platforms. Telecommunications providers are also in the crosshairs. In a recent high-profile breach, Dutch authorities suspect local nationals were behind the hack of Odido, a major telecom provider. This attack resulted in the exposure of personal data for six million customers—a staggering number that highlights the scale of the threat.

For organizations, the Odido breach underscores the need to review incident response and customer notification procedures. It’s not just about technical controls; it’s about being able to act quickly and transparently when an incident occurs. Regulatory scrutiny is intensifying, and customer trust can be eroded in an instant. Risk executives should also use incidents like this as an opportunity to assess the security posture of their own critical suppliers. Are your partners as committed to security as you are? Do you have visibility into their controls and incident response capabilities?

Another area of concern is the exploitation of vulnerabilities in widely used open-source components. Security researchers have identified active attacks targeting popular Joomla extensions, putting countless organizations at risk of website compromise and data breaches. This is part of a broader trend: attackers are increasingly focusing on open-source software, knowing that vulnerabilities in these components can provide a pathway into thousands of organizations at once.

For CISOs, the lesson is straightforward: web applications must be kept up to date, and patch management needs to be a top priority. But it’s not just about patching. Organizations should also be monitoring for signs of compromise, reinforcing secure development practices, and ensuring that open-source components are vetted and maintained over time. The days of “set it and forget it” are long gone—ongoing vigilance is required.

Let’s return to the financial sector for a moment, where AI-driven identity attacks are now the leading threat, particularly in markets like India. Attackers are using machine learning to automate credential stuffing, phishing, and account takeover at a scale we haven’t seen before. This trend is likely to expand globally, making it critical for organizations everywhere to strengthen their defenses.

What does this mean in practice? Multi-factor authentication is now table stakes. Behavioral analytics—monitoring for unusual patterns in user activity—can help detect and stop attacks before they succeed. And continuous monitoring of identity-related events is essential for early warning and rapid response. The bottom line: as attackers get smarter and more automated, defenders need to do the same.

But while the threat landscape is evolving, so too is the way organizations are adopting and managing AI technologies. A growing number of executives are warning that the pace of AI adoption is outstripping the development of governance frameworks and clear metrics for return on investment. This misalignment can lead to unmanaged AI deployments, increased regulatory risk, and unforeseen operational impacts.

To address this, risk leaders should be prioritizing the establishment of AI governance committees and maintaining risk registers that track AI use cases and associated risks. Regular reviews are essential to ensure alignment with business objectives and regulatory requirements. The goal is to move from reactive to proactive management of AI risk—embedding governance into the fabric of the organization, not treating it as an afterthought.

On the standards front, we’re seeing important developments. MetaPhase has become one of the first organizations to achieve ISO 42001 certification, the new international standard for AI management systems. This milestone highlights the growing importance of formalized AI governance and risk management. For CISOs, monitoring the adoption of standards like ISO 42001 is critical—not just for compliance, but for demonstrating due diligence and building trust with stakeholders.

The market for AI governance platforms is also expanding rapidly. Projections suggest that by 2035, the market will reach nearly $79 billion. This growth reflects a rising demand for tools that support risk assessment, compliance, and operational oversight of AI systems. Security and risk leaders should be evaluating emerging platforms for integration into their risk management and compliance programs. The right tools can provide the visibility and control needed to manage AI risk at scale.

Transparency and collaboration are also on the rise in the AI security space. Ant Group has open-sourced SingGuard-NSFA, a framework designed to establish new security paradigms for autonomous AI agents. As organizations deploy increasingly autonomous AI systems, tools like SingGuard-NSFA can help enhance security architectures and foster greater transparency. Open-source frameworks support industry-wide collaboration, enabling organizations to learn from each other and build more resilient AI systems.

Another trend gaining momentum is the shift toward continuous, high-confidence assurance in both cyber and AI risk management. Traditional approaches—periodic audits and static controls—are no longer sufficient in a world where threats evolve in real time. Instead, organizations are moving toward real-time monitoring, automated controls, and ongoing validation of security postures. Investing in technologies and processes that enable continuous assurance is becoming a necessity for keeping pace with evolving threats and regulatory expectations.

The security perimeter itself is also being redefined by the proliferation of conversational AI platforms. These dynamic interfaces introduce new vectors for data leakage, social engineering, and unauthorized access. Security leaders need to adapt their controls to account for these changes, implementing robust authentication, data loss prevention, and monitoring of AI interactions. The traditional concept of a fixed perimeter is fading; security must now follow the data and the user, wherever they go.

One point that’s often misunderstood is the distinction between maintaining an AI risk register and having a robust incident response plan. Experts are clear: a risk register is necessary, but it’s not a substitute for a well-developed response playbook. As AI-related incidents become more likely—t