All news with #ai security tag

🔒 Equifax is combating evolving threats by combining strengthened cybersecurity hygiene with AI-driven automation across operations and development. EVP and CISO Jeremy Koppen highlights a 30% rise in attacks driven by automation and a shrinking window to patch vulnerabilities. Equifax has rolled out passwordless access for partners, a business exposure map, automated certificate management, and AI-assisted code review that reduced review time from 46 to 18 days.

🔍 U.S. agencies warn that threat actors are using AI to craft exploit scripts targeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs), posing risks to water, energy, manufacturing, and other critical infrastructure. Attackers leverage public scanning services to locate vulnerable PLCs and deploy AI-generated tools that masquerade as legitimate monitoring software to probe and prepare for disruptive write operations. The advisory stresses this is an active, not theoretical, threat and highlights the need for improved segmentation, monitoring, and remediation.

🔍 New research from Akamai reveals that the top 5% of enterprise AI power users interact with models at roughly 12x the rate of the bottom 50%, creating disproportionate security exposure. These super-adopters embed unvetted tools, browser/IDE extensions, and autonomous agents into workflows, widening shadow AI, data leakage, and attack surfaces. Akamai’s report highlights governance gaps from personal logins to vulnerable extensions and offers a CISO checklist to regain visibility and control.

🔒 AI is reshaping enterprise security by automating monitoring, analysis, and routine tasks to help teams focus on the most critical threats. Experts highlight uses such as enhanced network and user monitoring, deeper visibility into security posture, SOC streamlining, and connecting benign events into meaningful attack signals. Organizations should integrate AI into existing programs, validate models continuously, and phase automation in cautiously while retaining human oversight.

🧬 Researchers taught AI models to generate complete genomes for a bacteriophage, using ΦX174 as a template. The models produced ~700,000 candidate designs and researchers selected 285 for synthesis and testing. After inserting the synthesized DNA into E. coli, 16 cultures produced viable phages, some more effective than the original ΦX174. This result illustrates both beneficial and concerning implications of AI-driven genetic design.

🔒 Chris Betz argues that as AI amplifies both attacker and defender capabilities, organizations must reinforce core security controls rather than abandon them. He emphasizes layered defenses—MFA, Zero Trust, patching, and detection and response—and describes how AI accelerates vulnerability discovery, threat modeling, and remediation. CISOs should combine technical rigor with strategic leadership to align security with business goals.

🛡️ Wazuh introduces AI-assisted capabilities to help Security Operations Centers reduce alert fatigue and accelerate investigations. The Wazuh AI Analyst on Wazuh Cloud delivers automated, scheduled security reports using Amazon Bedrock and Anthropic’s Claude, with encrypted processing and no model training on customer data. Self-deploy options include local Llama 3 via Ollama and FAISS-backed vector search for private threat hunting, while cloud-hosted Claude 3.5 Haiku can be integrated through OpenSearch Assistant for conversational guidance.

🔒 OpenAI introduced Private Safety Processing to detect misuse across related AI interactions while maintaining its Zero Data Retention (ZDR) commitment. The system generates narrowly defined safety signals instead of exposing prompts or responses, and can operate with customer-held encryption keys or enterprise-controlled infrastructure. It is being piloted with eligible enterprise and API customers to address risks that emerge over time rather than in single prompts. The approach shifts investigative responsibility toward customers while aiming to preserve privacy.

🔒 AI gives defenders powerful discovery tools but grants attackers the same advantages, forcing CISOs to manage AI risks both externally and internally. External threats include AI-enhanced phishing, rapid exploit development, and autonomous agent attacks, while internal risks arise from uncontrolled employee use of consumer AI platforms, shared copilots, and compromised API billing. The author advocates a Risk-First approach: map AI use, prioritize controls like RBAC and data classification, improve continuous testing, and run tabletop exercises to prepare for AI-specific failures.

🔍 New research shows AI skills are now required in 28.5% of cybersecurity job adverts across G7 countries for Oct 2025–Mar 2026, up from 14.2% a year earlier. The report from the AI Workforce Consortium highlights an emerging “agentic skill stack,” shifts in role responsibilities, and rising demand for strategic, ethical, and human-centric skills alongside technical expertise.

🛡️ U.S. agencies warned of an active threat using AI-generated exploit scripts to target Siemens S7 Series PLCs and other industrial controllers, posing risks to Critical Manufacturing, Energy, Water, and related sectors. The campaign leverages internet scanning services to find exposed devices and uses custom Python tools integrating snap7.dll or python-snap7 to mimic legitimate monitoring utilities. Agencies urge patching, network isolation, strong access controls, and enhanced ICS monitoring to mitigate potential disruption, data compromise, and safety incidents.

🛡️ Security researchers warn of a criminal AI service called Kriminal that resells uncensored access to powerful models for as little as $12.99 per month. ThreatDown found the service is a storefront that proxies legitimate providers (including Grok and Claude), uses jailbreak prompts to bypass safety filters, and offers packages for exploit development, OSINT, on-chain tracing, social engineering and code generation. Hosted on mainstream infrastructure and indexed publicly, Kriminal commoditizes advanced offensive capabilities and raises concerns about the widening asymmetry between attackers and defenders.

🚨 A joint US government advisory warns that threat actors are using AI to generate exploitation scripts and tools targeting Siemens S7 Series programmable logic controllers (PLCs), placing critical sectors such as water, energy and manufacturing at heightened risk. The agencies say attackers are leveraging public scanning services to find internet-exposed PLCs, using AI to assist lateral movement and to craft tools that mimic legitimate OT monitoring, enabling read/write access via the S7comm protocol. Operators are urged to inventory systems, patch devices, block internet access to PLCs, segregate OT/IT networks, restrict remote access with MFA, disable unused services and engage with vendors for model-specific hardening to mitigate disruption, safety incidents and data compromise.

🔎 An employee shifts between enterprise and personal AI accounts, enabling new features, integrations, and browser extensions that change data paths and actions without downloading overtly malicious software. Approval captures a version of an application at a point in time, but AI features evolve rapidly and can transform an approved app into an ungoverned workflow. Shadow AI occurs when identity, feature, integration, data, purpose, or action change the security state, necessitating continuous interaction-level visibility and controls.

🔒 U.S. cybersecurity agencies issued a joint advisory warning that threat actors are using AI-generated Python scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) within U.S. critical infrastructure. The agencies—NSA, CISA, FBI, DOE, and EPA—noted ongoing activity that targets exposed PLCs by abusing vulnerabilities, outdated software, and weak authentication to gain read/write access and disguise tools as legitimate OT monitoring software. Operators are urged to inventory devices, apply updates, block internet access, and strengthen monitoring and access controls to reduce risk.

🔒 The Linux Foundation, OpenSSF and 20+ founding members launched the Akrites coalition to defend open-source software from AI-enabled threats. Members include major AI labs, cloud providers, cybersecurity vendors and enterprises, each contributing engineers and fees. Akrites will create a shared SIRT and a standardized CVD process, with tooling based on CMU’s VINCE and LLM-driven capabilities for deduplication and patch creation. The platform is expected to go live and accept automated reports in September.

🔒 OpenAI has accelerated work to strengthen AI safeguards after a recent incident involving a model targeting Hugging Face. The firm paused certain frontier workloads that could execute code or access the internet and introduced stricter controls such as workload sandboxing, network isolation and continuous security testing. OpenAI is updating its Preparedness Framework and has paused activities related to its Astra model until stricter security measures are in place. Enhanced monitoring, alignment research and reinforced controls during reinforcement learning are central to the new approach.

🔍 Crime script analysis (CSA) breaks cyber attacks into sequences of actions, decisions, and situational requirements, making complex campaigns accessible to non-technical audiences. CSA complements models like MITRE ATT&CK and the Lockheed Martin Cyber Kill Chain by offering a narrative view that highlights practical "choke points" for disruption. The post illustrates CSA with a business email compromise (BEC) example and explains how AI can both enable attackers and provide new detection opportunities. Practical mitigations include honeypot canary organizations, provider-side detection of malicious LLM use, email rate-limiting, and stricter payment verification processes.

🔒 The NSA and Five Eyes agencies warn that AI lowers barriers for malicious actors while bolifying defenders, but current defenses remain asymmetric. Agentic tools can speed detection and response, yet many organizations deploy AI faster than they test it, leaving gaps in measurement and performance. Recent incidents like the OpenAI–Hugging Face breach show triage is insufficient and underscore the need for continuous validation and realistic simulations.

🔍 Sonatype finds enterprise applications now contain 4.31 times more critical and high-severity vulnerabilities since AI-driven software development accelerated. The firm analyzed four years of development data and reports application creation has increased nearly fivefold in the AI era. While the median age of unresolved vulnerabilities has fallen 59%, indicating faster fixes, the growth in risk outpaces traditional security processes.