Claude 4.5 Lands On AWS And Google; Cloud Hardening And Intrusions

Grok 4 Arrives in Azure AI Foundry for Business Use

🔒 Microsoft and xAI have brought Grok 4 to Azure AI Foundry, combining a 128K-token context window, native tool use, and integrated web search with enterprise safety controls and compliance checks. The release highlights first-principles reasoning and enhanced problem solving across STEM and humanities tasks, plus variants optimized for reasoning, speed, and code. Azure AI Content Safety is enabled by default and Microsoft publishes a model card with safety and evaluation details. Pricing and deployment tiers are available through Azure.

Anthropic's Claude Sonnet 4.5 Now Available on Vertex AI

🚀 Anthropic’s Claude Sonnet 4.5 is now generally available on Vertex AI, delivering advanced long-horizon autonomy for agents across coding, finance, research, and cybersecurity. The model can operate independently for hours, orchestrating tools and coordinating multiple agents to complete complex, multi-step tasks. Vertex AI provides orchestration, provisioning, security controls, and developer tooling, and includes Claude Code upgrades like a VS Code extension and an improved terminal interface.

Anthropic Claude Sonnet 4.5 Now Available in Bedrock

🚀 Anthropic’s Claude Sonnet 4.5 is now available through Amazon Bedrock, providing managed API access to the company’s most capable model. The model leads SWE-bench Verified benchmarks with improved instruction following, stronger code-refactoring judgment, and enhanced production-ready code generation. Bedrock adds automated context editing and a memory tool to extend usable context and boost accuracy for long-running agents across global regions.

Cloudflare Birthday Week 2025: Product and Policy Recap

🚀 Cloudflare’s Birthday Week 2025 summarized a broad set of product, policy, and community initiatives designed to strengthen the open Internet and prepare for AI-era and quantum threats. Highlights included a goal to hire 1,111 interns in 2026, new startup hubs, and expanded free developer access for students and non‑profits, plus sponsorships of open-source projects like Ladybird and Omarchy. Technical announcements ranged from post‑quantum upgrades and a Rust-based core proxy to R2 SQL, the Cloudflare Data Platform, Workers performance and security hardening, and new AI safety and bot-management tools.

OpenAI Trials Free ChatGPT Plus and Expands $4 GPT Go

🔔 OpenAI is testing a limited free trial for ChatGPT Plus while expanding its lower-cost $4 GPT Go plan to Indonesia after an initial launch in India. Some existing users see a “start free trial” prompt on the ChatGPT pricing page, though new accounts may be excluded to limit abuse. The $4 option and the $20 Plus tier both provide access to GPT-5 with differing levels of memory, image creation, and research capabilities, and a $200 Pro tier targets heavier professional use.

Secure Network Architectures for Generative AI on AWS

🔐 This post explains how to design defense-in-depth network architectures for generative AI workloads using AWS services. It outlines common external threats — including layer 4 and layer 7 DDoS, web request floods, application-specific exploits, and malicious bots — and maps mitigations to AWS capabilities. The guidance recommends private connectivity via Amazon Bedrock and AWS PrivateLink, edge protections with AWS WAF and AWS Shield, subnet-level controls using AWS Network Firewall, and continuous detection and response with GuardDuty, Inspector, and CloudWatch.

Amazon EC2 Auto Scaling Adds IPv6 Dual-Stack Support

🌐 Amazon EC2 Auto Scaling (ASG) now supports IPv6, enabling dual‑stack (IPv4 and IPv6) configurations for Auto Scaling groups. IPv6 provides a vastly larger address space, letting you assign contiguous ranges to microservices and achieve near‑unlimited scale. Support is available in all commercial AWS regions (except New Zealand) and in GovCloud regions where ASG is offered. Configure networks and addressing via AWS documentation.

Amazon ECS Adds Native IPv6-Only Task and Service Support

🚀 Amazon Elastic Container Service (Amazon ECS) now supports running tasks and services in IPv6-only subnets, eliminating the prior requirement for IPv4 addresses. This enables containerized applications to scale without IPv4 address constraints and helps organizations meet IPv6 compliance mandates. The capability works across all ECS launch types and networking modes; create IPv6-only VPC subnets and ECS will provision networking automatically. See the task networking documentation and a blog walkthrough for launch-specific details and migration guidance.

Adopt New VM Series with GKE Compute Classes, Flex CUDs

⚙️ Google Cloud outlines a practical approach to adopt Gen4 VM families by pairing GKE compute classes with Compute Flexible CUDs, enabling prioritized machine-family fallbacks and spend-based discounts. Compute classes let teams define prioritized machine families (for example, N4 then N2) so the cluster autoscaler can provision preferred hardware while preserving availability. Flex CUDs apply discounts across eligible VM families and follow consumption, protecting committed discounts when fallbacks occur. Together these features reduce migration risk and simplify platform operations.

Google Distributed Cloud at the Edge Powers USAF Operations

🚀 The U.S. Air Force, working with Google Public Sector and GDIT, deployed the Google Distributed Cloud air-gapped appliance to run classified workloads at the tactical edge in DDIL environments. The rugged, transportable system demonstrated secure, Zero Trust-capable processing up to Secret, delivering on-device AI for transcription, OCR, translation, and summarization during Mobility Guardian 2025 in Guam. It also supported containerized IL2 collaboration, Luna AI integration for low-latency air-defense data, a Jupyter-based edge dev environment, and AI-enabled tele-maintenance to convert manuals and visual data into actionable maintenance insights.

Chinese Hackers Exploit Enterprise Network Appliances

🔒 A Chinese state-sponsored group tracked as RedNovember carried out a global espionage campaign from June 2024 to July 2025, compromising defense contractors, government agencies, and major corporations by exploiting internet-facing network appliances. The attackers rapidly weaponized disclosed flaws in devices from SonicWall, Ivanti, Cisco, F5, Sophos, and Fortinet, often within 72 hours of public exploit code. They deployed Go-based tools including Pantegana, Cobalt Strike, and SparkRAT, and relied on open-source tooling and legitimate services to obfuscate attribution and maintain persistent access.

Agent Payment Protocol: Enabling Trusted Agent Commerce

🔐 Agent Payment Protocol (AP2) is an open trust layer that enables AI shopping agents to complete purchases without ever handling raw payment credentials. AP2 enforces a role-based separation—shopping agent, merchant endpoint, credential provider, and payment processor—and relies on verifiable credentials to produce cryptographic proof of intent and approval. It defines three mandate types (Cart, Intent, Payment) to support both human-present and human-not-present flows. Developers can adopt AP2 as an extension to A2A and MCP to reduce PCI scope and improve accountability.

Amazon Bedrock Available in Thailand, Malaysia, and Taipei

🚀 Amazon has launched Amazon Bedrock in the Asia Pacific (Thailand), Asia Pacific (Malaysia), and Asia Pacific (Taipei) regions, enabling local customers to build and scale generative AI applications using a range of foundation models and developer tools. The managed service supports deploying agents and productionizing models to shorten the path from experimentation to real-world deployment. Customers can expect improved latency, regional data residency options, and integration with AWS operational and security services.

AWS Backup Launches in Asia Pacific (New Zealand) Region

🔔 AWS Backup is now available in the AWS Asia Pacific (New Zealand) Region, offering centrally managed, policy-driven protection for compute, storage, and database resources. The fully managed service supports immutable recovery points and vaults to guard against accidental or malicious deletions and to enable reliable restores after data loss. Customers can set up protection via the console, SDKs, or CLI and assign resources using tags or Resource IDs.

Amazon Bedrock Now Available in Israel (Tel Aviv) Region

🚀 Beginning today, Amazon Bedrock is available in the Israel (Tel Aviv) region, enabling customers to build and scale generative AI applications with local infrastructure. The managed service connects organizations to a variety of foundation models (FMs) and provides tools to deploy and operate agents, reducing time-to-production. Local availability can lower latency, support regional compliance needs, and help move projects from experimentation to real-world deployment.

Amazon Bedrock Launches in Middle East (UAE) Region

🚀 Amazon Bedrock is now available in the Middle East (UAE) Region, enabling customers to build, experiment with, and scale generative AI applications using a broad selection of foundation models (FMs) and integrated developer tools. The managed service provides capabilities to deploy and operate agents and production workloads with built-in controls for security and operational management. Customers in the region can begin using Bedrock today and should consult the documentation for supported models, APIs, and recommended practices.

CrowdStrike Adds Correlation Rule Template Discovery

🔍 CrowdStrike has launched the Correlation Rule Template Discovery dashboard in Falcon Next-Gen SIEM to help SOC teams discover and operationalize high-value detection content more quickly. The centralized dashboard maps templates to onboarded telemetry, offers precision search and filtering by data source and MITRE ATT&CK tactics, and exposes quick actions to test and deploy templates as active correlation rules. It highlights new and updated templates, provides compatibility analysis, and surfaces curated research and enablement guidance to accelerate detection and reduce noise.

OpenAI Routes GPT-4o Conversations to Safety Models

🔒 OpenAI confirmed that when GPT-4o detects sensitive, emotional, or potentially harmful activity it may route individual messages to a dedicated safety model, reported by some users as gpt-5-chat-safety. The switch occurs on a per-message, temporary basis and ChatGPT will indicate which model is active if asked. The routing is implemented as an irreversible part of the service's safety architecture and cannot be turned off by users; OpenAI says this helps strengthen safeguards and learn from real-world use before wider rollouts.

UK backs Jaguar Land Rover with £1.5 billion loan guarantee

🔒 The UK Government has granted Jaguar Land Rover a £1.5 billion loan guarantee via UK Export Finance's Export Development Guarantee (EDG) to help the automaker recover after a severe cyberattack halted production and forced system shutdowns. The guarantee backs a commercial bank loan rather than direct state lending, reducing lender risk so JLR can secure larger, better-priced financing and immediate liquidity to pay suppliers. Repaid over five years, the measure is intended to stabilise the supply chain and protect thousands of jobs while JLR works with the NCSC, law enforcement and cybersecurity specialists during a phased return to manufacturing.

EvilAI Campaign: Malware Masquerading as AI Tools Worldwide

🛡️ Security researchers at Trend Micro detail a global campaign called EvilAI that distributes malware disguised as AI-enhanced productivity tools and legitimate applications. Attackers employ professional-looking interfaces, valid code-signing certificates issued to short-lived companies, and covert encoding techniques such as Unicode homoglyphs to hide malicious payloads and evade detection. The stager-focused malware — linked to families tracked as BaoLoader and TamperedChef — performs reconnaissance, exfiltrates browser data, maintains AES-encrypted C2 channels, and stages systems for follow-on payloads. Targets span manufacturing, government, healthcare, technology, and retail across Europe, the Americas and AMEA.

Weekly Recap: Cisco 0-day, Record DDoS, New Malware

🛡️ Cisco firewalls were exploited in active zero-day attacks that delivered previously undocumented malware families including RayInitiator and LINE VIPER by chaining CVE-2025-20362 and CVE-2025-20333. Infrastructure and cloud environments faced major pressure this week: Cloudflare mitigated a record 22.2 Tbps DDoS while misconfigured Docker instances enabled ShadowV2 bot operations. Researchers also disclosed Supermicro BMC flaws that could allow malicious firmware implants, and ransomware actors increasingly abuse exposed AWS keys. Prioritize patching, firmware updates, and cloud identity hygiene now.

UK Convicts 'Bitcoin Queen' in £5.5B Cryptocurrency Seizure

🚨 The Metropolitan Police secured a conviction in what is believed to be the world's largest cryptocurrency seizure after Zhimin Qian (aka Yadi Zhang) pleaded guilty to acquiring and possessing criminal property under the Proceeds of Crime Act. Investigators say Qian ran a multibillion-yuan fraud in China that targeted over 128,000 victims and raised roughly 40 billion yuan before converting proceeds to Bitcoin. The Met seized 61,000 BTC, now valued at approximately £5.5 billion, following a cross-border probe and cooperation with Chinese authorities. An associate involved in laundering attempts was previously sentenced for their role.

UNC6040: Proactive Hardening for SaaS and Salesforce

🔒 Google Threat Intelligence Group (GTIG) tracks UNC6040, a financially motivated cluster that uses telephone-based social engineering to compromise SaaS environments, primarily targeting Salesforce. Operators trick users into authorizing malicious connected apps—often a fake Data Loader—to extract large datasets. The guidance prioritizes identity hardening, strict OAuth and API governance, device trust, and targeted logging and SIEM detections to identify rapid exfiltration and cross‑SaaS pivots.

Cloud Security Alliance Issues New SaaS Security Framework

🔐 The Cloud Security Alliance has published the SaaS Security Capability Framework (SSCF) to establish technical minimum requirements that help SaaS providers and customers apply Zero-Trust principles and address rising third-party risks highlighted by recent Salesforce attacks. The SSCF defines controls across six domains, including identity and access management, data lifecycle, and logging and monitoring, and translates business requirements into concrete, configurable security functions such as log forwarding, SSO enforcement and incident notification. CSA positions the SSCF as a complement to, not a replacement for, frameworks like ISO 27001, while vendors stress that continuous validation and operational implementation are essential to reduce real-world risk.

CISA Adds Five Vulnerabilities to KEV Catalog; Federal Risk

⚠️ CISA added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on Sept. 29, 2025, citing evidence of active exploitation. The newly listed issues are CVE-2021-21311 (Adminer SSRF), CVE-2025-20352 (Cisco IOS/IOS XE stack overflow), CVE-2025-10035 (Fortra GoAnywhere deserialization), CVE-2025-59689 (Libraesva command injection), and CVE-2025-32463 (sudo untrusted-control vulnerability). Federal Civilian Executive Branch agencies must remediate these under BOD 22-01, and CISA urges all organizations to prioritize timely fixes as part of standard vulnerability management.

Surge in SonicWall SSL VPN Attacks by Akira Actors

🔒 Security experts warn of a sharp increase in activity from Akira ransomware operators targeting SonicWall SSL VPN appliances, with intrusions traced to late July. Arctic Wolf links initial access to exploitation of CVE-2024-40766 and describes rapid credential harvesting that can enable access even to patched devices. Observed traces include hosting-provider-origin VPN logins, internal scanning, Impacket SMB activity and Active Directory discovery; organizations are advised to monitor hosting-related ASNs, block VPS/anonymizer logins and watch for SMB session patterns consistent with Impacket to detect and disrupt attacks early.

CISA and NCSC Joint Guidance on Securing OT Systems

🔒 CISA, the FBI, the UK NCSC, and international partners published joint guidance titled Creating and Maintaining a Definitive View of Your Operational Technology (OT) Architecture. The guidance explains how organizations can use data sources such as asset inventories and manufacturer-provided resources, including software bill of materials, to create and maintain an accurate OT record. It highlights benefits like improved risk assessment, prioritization of critical and exposed systems, and stronger architectural controls, and recommends cross-team collaboration and alignment with IEC 62443 and ISO/IEC 27001.

Harrods Breach Exposes 430,000 E-commerce Customer Records

🔒 Harrods has confirmed a new data breach after a compromise at a third-party supplier exposed 430,000 e-commerce customer records. The disclosed information primarily comprises names, contact details and internal marketing tags, while account passwords, payment information and order histories were not included. The retailer says this incident is separate from the May attack attributed to Scattered Spider and that the threat actor has contacted them, apparently seeking extortion. Harrods has notified affected customers and authorities and urges vigilance against phishing and social engineering.

Seven Nations Publish Unified OT Security Guidance

🛡️ National cybersecurity agencies from seven countries released unified operational technology (OT) security guidance on 29 September, aimed at practitioners who deploy or operate OT equipment and systems. The document is organised around five core principles and supplies step-by-step actions for OT security teams to strengthen resilience. It emphasises creating and maintaining a definitive record that covers asset classification, connectivity mapping, system architecture and third-party risks.

Harrods Supply Chain Breach Affects E-commerce Customers

🔒 Harrods has disclosed that some e-commerce customer data was stolen via a breach at a third-party provider, with the retailer notifying affected customers on Friday. The company says the exposed information is limited to basic personal identifiers such as names and contact details and does not include account passwords, payment details or order history. Harrods also said it was contacted by a threat actor but refused to engage, and that this incident is separate from attempts to access Harrods systems in May. Reports indicate as many as 430,000 customer records may have been impacted, in a broader environment of rising retail ransomware and supply-chain risk linked to groups such as Scattered Spider.

Notion 3.0 Agents Expose Prompt-Injection Risk to Data

⚠️ Notion 3.0 introduces AI agents that, the author argues, create a dangerous attack surface. The vulnerability exploits Simon Willson’s lethal trifecta—access to private data, exposure to untrusted content, and the ability to communicate externally—by hiding executable instructions in a white-on-white PDF that instructs the model to collect and exfiltrate client data via a constructed URL. The post warns that current agentic systems cannot reliably distinguish trusted commands from malicious inputs and urges caution before deployment.

First Malicious MCP Server Found in NPM Postmark Package

🛡️ Cybersecurity researchers at Koi Security reported the first observed malicious Model Context Protocol (MCP) server embedded in an npm package, a trojanized copy of the postmark-mcp library. The malicious change, introduced in version 1.0.16 in September 2025 by developer "phanpak", added a one-line backdoor that BCCs every outgoing email to phan@giftshop[.]club. Users who installed the package should remove it immediately, rotate any potentially exposed credentials, and review email logs for unauthorized BCC activity.

Agentic AI: A Looming Enterprise Security Crisis — Governance

⚠️ Many organizations are moving too quickly into agentic AI and risk major security failures unless boards embed governance and security from day one. The article argues that the shift from AI giving answers to AI taking actions changes the control surface to identity, privilege and oversight, and that most programs lack cross‑functional accountability. It recommends forming an Agentic Governance Council, defining measurable objectives and building zero trust guardrails, and highlights Prisma AIRS as a platform approach to restore visibility and control.

Google Cloud Customers: Monthly Innovations Roundup

🚀 This roundup highlights how leading organizations are using Google Cloud to optimize networks, accelerate AI, and scale mission-critical services. From Uber reducing edge latency with Hybrid NEGs to Target rebuilding search with AlloyDB AI hybrid search, customers report measurable gains in performance, cost, and reliability. Healthcare, finance, media, and telecommunications teams also describe operational wins — faster inference, seamless migrations, and stronger real-time experiences.

Kaspersky adds notification anti-phishing for Android

🔒 Kaspersky has added a Notification Protection layer to Kaspersky for Android that detects and blocks malicious links embedded in app notifications. The feature automatically hides suspected links and replaces them with a Kaspersky notice titled 'Dangerous link detected,' preserving the original text minus the link. Kaspersky says scanning is automated and no employee reads private messages. Users must enable Accessibility and notification permissions and can combine this with Safe Messaging and Safe Browsing for fuller protection.

Amazon RDS for PostgreSQL Extended Support Updates

🔒 Amazon RDS for PostgreSQL now provides Extended Support minor versions 12.22-rds.20250814 and 11.22-rds.20250814, delivering critical security patches and bug fixes for affected instances. We recommend upgrading RDS instances to these releases to maintain security and performance. Extended Support offers up to three years of additional fixes after community support ends. Use automatic minor upgrades or RDS Blue/Green deployments to apply updates during maintenance windows.

AWS Network Firewall Adds Reject and Alert for Domain Rules

🔒 AWS Network Firewall now supports Reject and Alert actions for stateful domain list rule groups via the console, enabling more granular control over domain-based traffic. The Reject action blocks specified domains, while the Alert action logs and monitors traffic without disrupting flows. This feature is available in all Regions and supports TLS inspection configuration through the VPC Console or the Network Firewall API, helping organizations refine policy enforcement and observability.

Asahi Halts Japan Operations After Cyberattack Disruption

⚠️ Asahi Group Holdings, Japan’s largest brewer, has suspended multiple domestic operations after a cyberattack disrupted ordering and shipping processes. Call center and customer service desks are currently unavailable to the public, and the company says the incident is confined to Japan-based systems. Investigations are ongoing; there is no confirmed leakage of personal or customer data, no public claim by ransomware gangs, and no recovery timeline has been announced.

CISA Strengthens Cyber Support for State and Local Govts

🔒 CISA has transitioned to a new direct-support model to equip state, local, tribal, and territorial (SLTT) governments with access to grant funding, no-cost cybersecurity tools, and hands-on expertise. The agency’s cooperative agreement with the Center for Internet Security concludes on September 30, 2025, and CISA will deliver funding via DHS/FEMA programs including SLCGP and TCGP. Offered services include cyber hygiene scanning, phishing assessments, vulnerability management, the Cybersecurity Performance Goals and Cyber Security Evaluation Tool, regional advisors and incident response coordination, while CISA continues collaboration with MS-ISAC for Albert sensor users.

XWorm Campaign Signals Rise in Fileless In-Memory Attacks

🔒 Forcepoint Labs describes a multi-stage phishing campaign that delivers the XWorm remote-access trojan via an Office .xlam attachment embedding an OLE native stream. An encrypted shellcode launches a .NET dropper that uses steganography and reflective DLL loading to unpack successive in-memory stages, minimizing on-disk artifacts. Attackers leverage API hashing, unhooked calls and layered encryption to evade sandboxes and traditional scanners; Forcepoint provides IoCs and detection recommendations.

Amazon Connect Dashboards: Compare Any Time Range Easily

📊 Amazon Connect dashboards now let you select and compare arbitrary time ranges — up to 35 days within the past three months — and include Week to Date and Month to Date presets. This makes it easier for contact center teams to focus on specific periods and run side-by-side comparisons of metrics such as handle time or contact volume. For example, managers can compare a current campaign’s metrics to the same range last week to decide if additional staffing is required. Amazon Connect Contact Lens dashboards are available in all AWS commercial regions and AWS GovCloud (US-West).

Microsoft Warns of LLM-Crafted SVG Phishing Campaign

🛡️ Microsoft flagged a targeted phishing campaign that used AI-assisted code to hide malicious payloads inside SVG files. Attackers sent messages from a compromised business account, employing self-addressed emails with hidden BCC recipients and an SVG disguised as a PDF that executed embedded JavaScript to redirect users through a CAPTCHA to a fake login. Microsoft noted the SVG's verbose, business-analytics style — flagged by Security Copilot — as likely produced by an LLM. The activity was limited and blocked, but organizations should scrutinize scriptable image formats and unusual self-addressed messages.

CISA Strengthens Support for SLTT Governments Nationwide

🔒 CISA announced a transition to a new support model to better equip state, local, tribal, and territorial (SLTT) governments to strengthen shared responsibility nationwide. The agency's cooperative agreement with the Center for Internet Security (CIS) will end on September 30, 2025, prompting a shift to direct support. CISA will provide access to grant funding (via DHS/FEMA SLCGP and TCGP), no-cost tools such as cyber hygiene scanning and phishing assessments, regional advisors, and professional services to bolster local cybersecurity posture.

September 2025 security roundup — key incidents and guidance

🔐 Tony Anscombe reviews the top cybersecurity stories for September 2025 and highlights their implications for defenders. Incidents include disruptions at major European airports after a ransomware attack on Collins Aerospace, a prolonged outage at Jaguar Land Rover following an IT breach, and a large npm supply‑chain compromise that drew a CISA alert. He also notes impersonation campaigns targeting macOS users with LastPass‑themed information‑stealers.

Amazon EC2 Auto Scaling Adds FIPS PrivateLink Endpoints

🔒 Amazon EC2 Auto Scaling now supports FIPS 140-3 validated VPC endpoints via AWS PrivateLink, enabling regulated workloads to use cryptographic modules that meet federal requirements. This update allows customers to create FIPS-compliant VPC endpoints in select US and Canada regions to satisfy government and regulated-industry encryption mandates. Refer to AWS guidance for setting up VPC endpoints and integrating AWS PrivateLink with EC2 Auto Scaling.

Brave Launches Ask Brave to Merge AI Chat and Search

🔎 Ask Brave unifies traditional search and AI chat into a single, privacy-focused interface accessible at search.brave.com/ask. The free feature combines search results with AI-generated responses and supports follow-up interaction in a chat-style format. Users can invoke it with a trailing “??”, the Ask button, or the Ask tab; it runs in standard or deep research modes.

Dutch Teens Arrested Over Suspected Foreign Espionage

🔍 Two 17-year-old boys in the Netherlands have been arrested on suspicion of espionage after Dutch media reported they were contacted via Telegram by a pro‑Russian hacker, a connection the National Public Prosecution Service has declined to confirm. One suspect was reportedly seen near sensitive buildings in The Hague, including Europol and the Canadian embassy, carrying a Wi‑Fi sniffer. Police seized electronic equipment during a home search; one teen is on house arrest and the other in pre‑trial detention. Prosecutors say the case is linked to foreign interference and are keeping details closed while the inquiry continues.

Accelerating Customers' Journey from SD-WAN to SASE

🔒 Fortinet explains how partners can guide customers from secure SD-WAN to a full Unified SASE platform to address hybrid work, multi-cloud adoption, and rising cyberthreats. The article emphasizes that Secure SD-WAN is an on-ramp to SASE because it is natively integrated into Fortinet's SASE architecture, enabling expansion without replacing existing deployments. It outlines operational benefits, market growth projections, and partner opportunities around differentiated services, consolidated policy management, and simplified licensing.

AI Becomes Essential in SOCs as Alert Volumes Soar

🔍 Security leaders report a breaking point as daily alert volumes average 960 and large enterprises exceed 3,000, forcing teams to leave many incidents uninvestigated. A survey of 282 security leaders shows AI has moved from experiment to strategic priority, with 55% deploying AI copilots for triage, detection tuning, and threat hunting. Organizations cite data privacy, integration complexity, and explainability as primary barriers while projecting AI will handle roughly 60% of SOC workloads within three years. Prophet Security is highlighted as an agentic AI SOC platform that automates triage and accelerates investigations to reduce dwell time.

Two-Thirds of Organizations Have Unfilled Cyber Roles

🔒 Organizations face persistent cybersecurity staffing and budget gaps, with ISACA finding 65% of firms report unfilled positions. Hiring timelines remain long—38% say entry-level roles take three to six months to fill and 39% report similar delays for non-entry roles—while half of organizations struggle to retain talent. Only 56% believe their board prioritizes cybersecurity, and 53% view budgets as underfunded. ISACA urges faster investment in holistically trained, hands-on cyber workforces to keep pace with evolving threats.

Agentic AI in IT Security: Expectations vs Reality

🛡️ Agentic AI is moving from lab experiments into real-world SOC deployments, where autonomous agents triage alerts, correlate signals across tools, enrich context, and in some cases enact first-line containment. Early adopters report fewer mundane tasks for analysts, faster initial response, and reduced alert fatigue, while noting limits around noisy data, false positives, and opaque reasoning. Most teams begin with bolt-on integrations into existing SIEM/SOAR pipelines to minimize disruption, treating standalone orchestration as a second-phase maturity step.

Can AI Reliably Write Vulnerability Detection Checks?

🔍 Intruder’s security team tested whether large language models can write Nuclei vulnerability templates and found one-shot LLM prompts often produced invalid or weak checks. Using an agentic approach with Cursor—indexing a curated repo and applying rules—yielded outputs much closer to engineer-written templates. The current workflow uses standard prompts and rules so engineers can focus on validation and deeper research while AI handles repetitive tasks.

Medusa Ransomware Tried to Recruit BBC Journalist Insider

🧑‍💻 Threat actors claiming to represent Medusa contacted BBC cybersecurity correspondent Joe Tidy via Signal in July, offering him a cut of any ransom in exchange for providing access to BBC systems. They initially offered 15% of the paid ransom, later adding an extra 10% and even proposing 0.5 BTC placed in escrow. When Tidy hesitated, the actors launched MFA bombing attempts; he alerted the BBC security team and was disconnected from corporate systems as a precaution.

Microsoft Blocks Phishing Using AI-Generated Code Tactics

🔒 Microsoft Threat Intelligence stopped a credential phishing campaign that likely used AI-generated code to hide a payload inside an SVG file disguised as a PDF. Attackers sent self-addressed emails from a compromised small-business account, hiding real targets in the Bcc field and attaching a file named "23mb – PDF- 6 pages.svg." Embedded JavaScript decoded business-style obfuscation to redirect victims to a fake CAPTCHA and a fraudulent sign-in page, and Microsoft Defender for Office 365 blocked the campaign by flagging delivery patterns, suspicious domains and anomalous code behavior.

Broadcom VCF Licensing Change Affects VMware Engine

🔔 Broadcom is changing its VMware Cloud Foundation (VCF) licensing for hyperscalers to an exclusive bring-your-own subscription model effective November 1, 2025. For Google Cloud VMware Engine (GCVE) customers this means future clusters will require purchasing portable VCF subscriptions directly from Broadcom and using GCVE’s existing BYOL option. Google introduced a BYOL path for GCVE in 2024 and notes the managed service itself remains unchanged. Transition rules and timing differ for committed use discounts and on-demand nodes, so customers should review their commitments.

DHS and CISA Launch Cybersecurity Awareness Month 2025

🛡️ The Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency (CISA) announced the official start of Cybersecurity Awareness Month 2025, centered on the theme Building a Cyber Strong America. Administered by CISA, the campaign urges state, local, tribal, and territorial (SLTT) governments, small and medium businesses, and supply chain partners to bolster protections for critical services such as water, power, communications, food, and finance. Officials emphasized a whole-of-society approach and recommended immediate adoption of core controls—recognize and report phishing, require long unique passwords, enable multifactor authentication, keep software patched, enable system logging, back up data, and encrypt sensitive information—to improve resilience nationwide.

TELUS Boosts Productivity with ChromeOS and Cameyo Deployment

🚀 TELUS modernized its global digital workplace by deploying ChromeOS, Google Workspace, Cameyo, and Chrome Enterprise Premium to create a browser-first, zero-trust app streaming platform. The TELUS Desktop Stream replaced costly VDI, avoided a $15 million infrastructure refresh, and cut login times by threefold. More than 100 applications now run through Cameyo, improving call-center throughput and agent productivity. IT teams report simplified management, stronger contextual security, and reduced reliance on VPNs.

Coherence: A New Core Principle for Insider Risk Management

🛡️ Coherence is framed as the operational backbone for insider-risk programs, stressing shared meaning and alignment rather than surveillance alone. The author argues most insider incidents stem from two vectors — malicious intent and human error — both amplified by semantic drift. Building coherence requires aligning messaging across HR, communications, legal, and security, training for narrative fidelity, equipping line managers with rituals and lexicons, and creating feedback channels that surface drift before behavioral anomalies.

Gen Z Frequently Falls for Phishing Despite Savviness

🔒 A YouGov survey commissioned by Initiative Sicher Handeln finds many younger internet users — the so-called Digital Natives — struggle to spot common phishing signals. Nearly half of Gen Z (49%) do not recognise unsolicited attachments as suspicious, and fewer notice impersonal salutations, spelling errors, or bogus urgency. The online poll (Sept 8–10, 2025; 2,044 German adults) prompts the Stop, Question, Protect appeal.

Six Ways to Curb Security Tool Proliferation in Organizations

🛡️ Organizations facing security-tool sprawl should begin by inventorying controls and eliminating those that no longer map to business risk. Use automated analytics and dashboards to surface ineffective or redundant products, and prioritize tools that enable automation to consolidate alerts and workflows. Remove duplicate solutions—often introduced through acquisitions or silos—and move toward unified platforms while fostering continuous training so teams actually use and benefit from deployed tools.

CSO30 Australia 2025: Honoring Leading Cybersecurity Figures

🛡️ At the CSO30 Australia Awards 2025, Australia’s top cybersecurity leaders and teams were recognised for initiatives that materially strengthened organisational security and resilience. The Sydney gala, held alongside the CIO50 and aligned with Foundry’s global program, honoured winners for business value, leadership and emerging talent. Shaun Martin (Aware Super) secured the Business Value award and Manasseh Paradesi (Tyro Payments) won Leadership, while Duné Sookloll took the Next CISO prize—each cited for measurable impact, stakeholder engagement and industry contribution.

Boards Should Be Bilingual: AI and Cybersecurity Strategy

🔐 Boards and security leaders should become bilingual in AI and cybersecurity to manage growing risks and unlock strategic value. As AI adoption increases, models and agents expand the attack surface, requiring hardened data infrastructure, tighter access controls, and clearer governance. Boards that learn to speak both languages can better oversee investments, M&A decisions, and cross-functional resilience while using AI to strengthen defense and competitive advantage.

Security Hardening Essentials for Resource-Constrained SMBs

🔒 Security hardening boosts protection for organizations, especially SMBs, by reducing their attack surface without large additional investments. Key measures include strong authentication and authorization—enforcing strict passwords, multifactor authentication, least-privilege access and network access controls—alongside timely patching, data encryption and segmented, tested backups. Regular staff training, account audits and permission reviews complete a practical, low-cost defense posture.