Latest / Daily Cyber Briefing / Daily Cyber & AI Briefing — 2026-06-29

Transcript

Daily Cyber & AI Briefing — 2026-06-29 · Daily Cyber Briefing

• 0:07
  SPEAKER_00: Grab your coffee or Red Bull or whatever your morning vice is, and this is your daily cyber and AI briefing, and I am your host, Michael Hoosh.
• 0:16
  SPEAKER_00: The rapid expansion of artificial intelligence across industries is fundamentally reshaping the cyber risk landscape.
• 0:23
  SPEAKER_00: As organizations race to adopt AI-driven solutions, many are finding that their governance frameworks simply aren't keeping up.
• 0:32
  SPEAKER_00: This gap between innovation and oversight is creating new vulnerabilities, drawing the attention of regulators, attackers, and security leaders alike.
• 0:41
  SPEAKER_00: Let's start with the financial sector, where we're seeing some of the most concrete moves toward AI regulation.
• 0:49
  SPEAKER_00: The Banco Central and Pilipinas, or BSP, has rolled out a formal AI governance framework for banks.
• 0:56
  SPEAKER_00: The goal is straightforward, ensure responsible AI adoption while maintaining financial stability.
• 1:03
  SPEAKER_00: This isn't just about compliance checklists, it's about risk management, transparency, and building trust in a sector that relies on both.
• 1:11
  SPEAKER_00: For CISOs and risk managers, this development signals a broader trend.
• 1:16
  SPEAKER_00: Other jurisdictions and industries are likely to follow suit, and that means organizations need to assess their own AI governance maturity now, not later.
• 1:26
  SPEAKER_00: Are your AI deployments auditable?
• 1:29
  SPEAKER_00: Can you demonstrate responsible use?
• 1:32
  SPEAKER_00: These are questions regulators will soon be asking everywhere.
• 1:36
  SPEAKER_00: But it's not just the Philippines.
• 1:38
  SPEAKER_00: Across the globe, AI adoption is outpacing the development of governance structures.
• 1:43
  SPEAKER_00: A recent report highlights that as organizations deploy AI at scale, many are leaving themselves exposed to operational, ethical, and security risks.
• 1:54
  SPEAKER_00: The gap between innovation and oversight isn't just a theoretical concern, it's a practical one without robust governance.
• 2:03
  SPEAKER_00: Organizations face a higher likelihood of compliance failures, data mishandling, and reputational damage.
• 2:10
  SPEAKER_00: Security leaders need to prioritize the integration of governance controls into every AI project.
• 2:15
  SPEAKER_00: That means clear documentation, transparent decision-making processes, and a readiness to adapt as regulatory expectations evolve.
• 2:24
  SPEAKER_00: While AI governance is a headline issue, the underlying cyber risks haven't gone away.
• 2:30
  SPEAKER_00: In fact, they're evolving.
• 2:32
  SPEAKER_00: Let's talk about vulnerabilities in enterprise platforms, starting with Oracle eBusiness Suite.
• 2:38
  SPEAKER_00: There's a critical flaw being actively exploited right now.
• 2:42
  SPEAKER_00: Hackers are leveraging this vulnerability to breach networks, exfiltrate data, and move laterally within organizations.
• 2:51
  SPEAKER_00: Oracle PeopleSoft environments have also been hit with confirmed data leaks making the rounds.
• 2:58
  SPEAKER_00: If your organization runs any affected Oracle platforms, immediate patching is essential, but patching alone isn't enough.
• 3:05
  SPEAKER_00: Incident response plans need a fresh look, and monitoring should be ramped up.
• 3:10
  SPEAKER_00: This is a live threat and it's not going away quietly.
• 3:14
  SPEAKER_00: Identity-based attacks are another area seeing a surge, particularly those powered by AI.
• 3:20
  SPEAKER_00: PWC reports a significant uptick in these attacks, with adversaries using automation and sophisticated techniques to bypass traditional defenses.
• 3:29
  SPEAKER_00: The targets are often cloud and supply chain environments where weak authentication and access controls present easy entry points.
• 3:37
  SPEAKER_00: The implication is clear.
• 3:43
  SPEAKER_00: Adaptive authentication, continuous monitoring, and a zero trust mindset are no longer optional.
• 3:50
  SPEAKER_00: They're foundational.
• 3:52
  SPEAKER_00: As the attack surface expands with both AI and cloud adoption, security experts are emphasizing four defenses that matter most.
• 4:00
  SPEAKER_00: First, robust identity management, making sure only the right people have access to the right resources at the right time.
• 4:09
  SPEAKER_00: Second, continuous monitoring, because static defenses can't keep up with dynamic threats.
• 4:15
  SPEAKER_00: Third, securing the software supply chain since attackers are increasingly looking for weaknesses in third-party components and integrations.
• 4:24
  SPEAKER_00: And fourth, ASI native threat detection, leveraging machine learning to spot anomalies, and emerging attack patterns that traditional tools might miss.
• 4:35
  SPEAKER_00: Security leaders should benchmark their controls against these priorities and address any gaps.
• 4:40
  SPEAKER_00: AI agents, those autonomous systems making decisions and taking actions on behalf of organizations, are also on the rise.
• 4:48
  SPEAKER_00: A recent study by AVPOIN finds that as the use of these agents accelerates, so do the associated security risks.
• 4:56
  SPEAKER_00: We're talking about data leakage, model manipulation, and unauthorized access.
• 5:01
  SPEAKER_00: The takeaway here is the need for dedicated AI security controls and clear policies governing agent deployment.
• 5:08
  SPEAKER_00: If you're using AI agents, it's time to evaluate your risk assessments and ensure they're up to date.
• 5:14
  SPEAKER_00: Transparency in AI decision making is quickly becoming a regulatory flashpoint.
• 5:19
  SPEAKER_00: In a recent CIO review survey, 78% of organizations admitted they can't clearly explain how their AI systems make decisions.
• 5:28
  SPEAKER_00: That's a problem, because explainability is the first thing regulators are likely to ask about.
• 5:33
  SPEAKER_00: A lack of transparency doesn't just create compliance headaches, it erodes trust with stakeholders and customers.
• 5:41
  SPEAKER_00: Security and risk executives need to make AI transparency and documentation a core part of their governance programs.
• 5:49
  SPEAKER_00: Let's shift to another active threat: the exploitation of Simple Help remote support software.
• 5:55
  SPEAKER_00: Threat actors are targeting a critical vulnerability in Simple Help to deploy gen stealer malware.
• 6:01
  SPEAKER_00: The goal is credential theft and data exfiltration, and the campaign is ongoing.
• 6:06
  SPEAKER_00: This highlights the broader risks associated with remote access tools, which have become ubiquitous in hybrid and remote work environments.
• 6:14
  SPEAKER_00: Organizations using Simple Help need to act immediately, patch the software, monitor for anomalous activity, and review remote access policies.
• 6:24
  SPEAKER_00: On the international stage, the Five Eyes Intelligence Alliance, comprising the US, UK, Canada, Australia, and New Zealand, has issued a call to action for business leaders.
• 6:36
  SPEAKER_00: Their message, AI-driven cyber risks demand proactive management, cross-sector collaboration, and the adoption of AI native security controls.
• 6:46
  SPEAKER_00: This isn't just a government concern, it's a business imperative.
• 6:50
  SPEAKER_00: CISOs should review the five eyes recommendations and align their strategies with international best practices.
• 6:58
  SPEAKER_00: Legacy platforms remain a persistent source of cyber risk.
• 7:02
  SPEAKER_00: ServiceNow and Accenture are teaming up to tackle this problem, aiming to modernize risk management and incident response for organizations still dependent on older technologies.
• 7:14
  SPEAKER_00: The broader industry is pushing to reduce technical debt and improve resilience, especially as attackers combine traditional and AI-enabled techniques.
• 7:25
  SPEAKER_00: Security leaders should take a hard look at their own legacy environments and consider modernization initiatives where feasible.
• 7:32
  SPEAKER_00: The ecosystem of AI security solutions is also expanding, with vendors like Hidden Layer integrating AI native security capabilities into platforms such as Databricks Unity AI Gateway.
• 7:45
  SPEAKER_00: These tools promise enhanced threat detection and model protection for enterprise AI workloads.
• 7:53
  SPEAKER_00: As the number and complexity of AI deployments grow, CISOs should evaluate whether specialized AI security tools fit within their operational stack.
• 8:03
  SPEAKER_00: Guidance for enterprise AI deployment is evolving as well.
• 8:07
  SPEAKER_00: The release of GLM 5.2 provides actionable recommendations for integrating AI into business processes while managing security, scalability, and compliance risks.
• 8:20
  SPEAKER_00: Security executives should review these guidelines to inform their AI risk management strategies and ensure that new deployments don't introduce unforeseen vulnerabilities.
• 8:31
  SPEAKER_00: So, what are the strategic implications of all these developments?
• 8:34
  SPEAKER_00: First, regulatory scrutiny of AI is intensifying.
• 8:39
  SPEAKER_00: Sector-specific frameworks, like the one from BSP, are emerging and likely to expand globally.
• 8:46
  SPEAKER_00: Organizations need to anticipate this wave of regulation and prepare accordingly.
• 8:51
  SPEAKER_00: Second, the gap between AI adoption and governance is a material risk.
• 8:57
  SPEAKER_00: It's not enough to deploy AI quickly.
• 9:00
  SPEAKER_00: Controls and transparency must be embedded from the start.
• 9:03
  SPEAKER_00: This means building explainability into your models, documenting decision processes, and ensuring that AI systems are auditable.
• 9:12
  SPEAKER_00: Third, critical vulnerabilities in widely used enterprise platforms are a persistent threat.
• 9:18
  SPEAKER_00: Continuous patch management and incident readiness aren't just best practices, they're essential.
• 9:23
  SPEAKER_00: Attackers are watching for laggards, and the cost of delay can be measured in data breaches and business disruption.
• 9:29
  SPEAKER_00: Fourth, identity and cloud security are top priorities.
• 9:32
  SPEAKER_00: Attackers are leveraging automation and exploiting supply chain weaknesses to bypass defenses.
• 9:39
  SPEAKER_00: Organizations need to strengthen their identity and access management, adopt adaptive authentication, and continuously monitor for suspicious activity.
• 9:50
  SPEAKER_00: Let's distill what matters most today.
• 9:52
  SPEAKER_00: If your organization uses Oracle eBusiness Suite or Simple Help, immediate assessment and remediation are non-negotiable.
• 10:01
  SPEAKER_00: The risks are active and publicized, and attackers are moving quickly.
• 10:05
  SPEAKER_00: At the same time, organizations must accelerate the development of AI governance frameworks.
• 10:10
  SPEAKER_00: Regulatory and stakeholder expectations are rising, and being caught unprepared could have significant consequences, not just in terms of fines, but also in lost trust and competitive disadvantage.
• 10:22
  SPEAKER_00: Finally, strengthening identity, cloud, and AI native security controls is critical.
• 10:27
  SPEAKER_00: As attack services expand and threat sophistication increases, foundational cyber hygiene is your first and best line of defense.
• 10:35
  SPEAKER_00: To wrap up, the convergence of rapid AI adoption, evolving regulatory expectations, and persistent cyber threats demands a dual-track approach.
• 10:46
  SPEAKER_00: Accelerate innovation, but embed risk controls at every stage.
• 10:50
  SPEAKER_00: Prepare for increased scrutiny and make sure your governance, transparency, and incident response capabilities are up to the challenge.
• 10:59
  SPEAKER_00: Thanks for listening.
• 11:00
  SPEAKER_00: Stay vigilant, stay informed, and keep security at the core of your digital transformation.
• 11:06
  SPEAKER_00: That's a wrap, peeps.
• 11:08
  SPEAKER_00: Stay secure, stay sharp, and don't forget to hug your CISO.