Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Transcript

Ransomware attacks are evolving, and the latest data makes it clear: compromised logins have now become the number one entry point for ransomware campaigns. Attackers are no longer relying primarily on phishing or exploiting unpatched systems. Instead, they’re leveraging stolen or weak credentials to slip past perimeter defenses and directly access critical infrastructure. This shift is significant for every organization, regardless of size or industry. It highlights a core truth—identity and access management is now at the heart of cyber resilience.

Let’s start by unpacking what this means in practice. When attackers gain access through compromised credentials, they often bypass many of the traditional security controls organizations have put in place. Firewalls, intrusion detection, and even endpoint protections may not trigger alarms if a login appears legitimate. That’s why robust credential hygiene, multi-factor authentication, and privileged access controls are no longer optional—they’re foundational. Security teams need to prioritize continuous monitoring for anomalous login activity, regularly rotate passwords, and ensure that privileged accounts are tightly controlled and audited. In today’s threat landscape, the question isn’t if someone will try to compromise your logins, but when.

Moving to the vulnerability front, Microsoft has sounded the alarm on two zero-day vulnerabilities that are already being exploited in the wild. These flaws affect widely deployed Microsoft products, and attackers are using them to execute code or escalate privileges on targeted systems. The urgency here can’t be overstated. If you haven’t already, you need to deploy Microsoft’s latest patches immediately. But patching alone isn’t enough. It’s equally important to review your detection rules and ensure your security operations center is tuned to spot indicators of compromise related to these vulnerabilities. Rapid response is essential, because once attackers are inside, the window for containment narrows quickly.

This theme of critical vulnerabilities extends beyond Microsoft. Dell’s PowerProtect Data Domain appliances, which many organizations rely on for backup and disaster recovery, have been found to contain flaws that allow unauthenticated attackers to take full control of affected systems. The implications are serious: if an attacker compromises your backup infrastructure, they can access, alter, or destroy backup data—undermining your entire business continuity plan. For organizations using these appliances, patching is urgent. But it’s also a reminder to segment backup systems from production networks and to monitor them for unusual activity. Don’t assume your backups are safe just because they’re not directly internet-facing.

SonicWall’s SMA1000 series is another product line under active attack. Vulnerabilities in these devices allow for server-side request forgery and remote code execution, which can be leveraged for lateral movement or ransomware deployment. If you’re running SonicWall SMA1000, prioritize patching and restrict access to management interfaces. Monitor for signs of compromise, and consider whether these systems are exposed in ways that could be exploited by external attackers or even insiders.

Supply chain risk is also front and center this week. A ransomware group claims to have breached Synopsys, a major chip design firm, and alleges access to sensitive Bosch data. While the full scope of this incident is still being determined, the potential implications for downstream partners and the broader supply chain are significant. Intellectual property theft, disruption of manufacturing, and exposure of sensitive designs could ripple across industries. This is a timely reminder for risk leaders to assess their own third-party exposures and reinforce supply chain security due diligence. Don’t just focus on your own perimeter—understand who has access to your data and systems, and how well those partners are managing their own security.

The risks aren’t limited to the commercial sector. Sensitive files linked to India’s largest nuclear plant have reportedly been leaked on the dark web. This breach raises the stakes considerably, highlighting the potentially catastrophic consequences of inadequate data protection in high-value environments. For those responsible for critical infrastructure, it’s essential to review data classification, tighten access controls, and ensure incident response plans are up to date and well-rehearsed. The goal is to minimize the risk of sensitive information leaving your environment, and to be ready to respond decisively if it does.

Supply chain vulnerabilities are further illustrated by a recent data breach in Singapore, traced to an IBM-managed test system. Sensitive records were exposed, not because of a direct attack on the organization itself, but because of a misconfiguration or lapse by a third-party provider. This incident underscores a hard truth: your security is only as strong as your weakest link, and that link is often outside your direct control. Security leaders need to enforce rigorous vendor risk management, ensure contractual obligations around security are clear, and continuously monitor the security posture of external partners.

Turning to artificial intelligence, the risk landscape is evolving just as quickly. LatticeFlow AI has introduced a platform that connects AI governance frameworks with continuous risk monitoring. This is a significant development, reflecting the growing need for real-time visibility into AI model risks—whether it’s bias, drift, or security vulnerabilities. As organizations deploy more AI-driven systems, the risks become more complex and harder to detect using traditional controls. CISOs should evaluate tools like this as part of a broader AI risk management strategy. It’s not just about compliance or ticking boxes; it’s about operational oversight that keeps pace with the speed of AI innovation.

Nudge Security is also making headlines with the rollout of AI-powered agents designed to detect and mitigate risks from hidden OAuth grants and browser extensions. These are often overlooked attack vectors, but they’re increasingly exploited for lateral movement and data exfiltration. By automating the discovery and remediation of these risks, organizations can reduce their attack surface and improve SaaS governance. If you’re not already monitoring for rogue browser extensions or unauthorized OAuth connections, now is the time to start. Integrating these capabilities into your security stack can make a meaningful difference in your overall risk posture.

The professionalization of AI security is accelerating as well. ISC2, one of the leading cybersecurity certification bodies, has announced the development of a new AI security certification and is inviting volunteers worldwide to participate. This move signals the formalization of AI security as a distinct discipline. Over time, we can expect this to influence hiring, training, and compliance requirements across the industry. For CISOs, it’s worth tracking this initiative closely. As AI becomes more deeply embedded in business processes, having staff with validated AI security expertise will be a differentiator—and may soon be a regulatory expectation.

Zooming out, there’s a broader shift underway in how organizations think about cyber resilience. A new analysis emphasizes that governance and privileged access management are now central to withstanding identity-based attacks. The traditional perimeter-centric approach is giving way to identity-centric security models. That means continuous privilege review, governance automation, and a relentless focus on who has access to what, and why. For risk executives, aligning strategy to this new reality is essential. It’s not enough to lock down the network; you need to understand and control the identities operating within it.

The regulatory and legal environment is also evolving, and it’s raising the stakes for CISOs personally. The days when risk sign-off was a routine checkbox are over. Increasingly, CISOs are being held personally accountable for decisions around risk acceptance and governance. This trend is driving demand for clearer governance structures, better documentation, and more meaningful board-level engagement on cyber risk. If you’re a CISO, it’s more important than ever to ensure your risk assessments are robust, your communication practices are transparent, and your documentation is thorough. The consequences of getting this wrong are no longer just organizational—they’re personal.

Let’s take a step back and look at the strategic implications of these developments. First, identity compromise is now the dominant initial attack vector for ransomware. That means urgent improvements in credential management and monitoring are required across the board. Second, the active exploitation of critical vulnerabilities in widely used infrastructure—Microsoft, Dell, SonicWall—demands accelerated patch cycles and enhanced detection capabilities. Delaying patches is no longer a manageable risk; it’s an open invitation for attackers.

Third, supply chain and third-party risks remain acute. Breaches are impacting both commercial organizations and critical infrastructure sectors. The lesson here is clear: you need to know your dependencies, understand your partners’ security posture, and have a plan in place for when—not if—a third-party incident affects your organization.

Fourth, AI risk governance is maturing rapidly. New tools and certifications are emerging to address both operational and regulatory challenges. As AI adoption accelerates, so too will the expectations around how or