Latest / Daily Cyber Briefing / Daily Cyber & AI Briefing — 2026-10-08

Transcript

Daily Cyber & AI Briefing — 2026-10-08 · Daily Cyber Briefing

• 0:07
  SPEAKER_00: Grab your coffee or Red Bull or whatever your morning vice is, and this is your daily cyber and AI briefing, and I am your host, Michael Hoosh.
• 0:16
  SPEAKER_00: Today's cyber and AI risk landscape is shifting rapidly, with new challenges emerging on multiple fronts.
• 0:23
  SPEAKER_00: As organizations accelerate their adoption of artificial intelligence, the gap between innovation and governance is becoming more pronounced and more dangerous.
• 0:34
  SPEAKER_00: At the same time, adversaries are evolving their tactics, exploiting vulnerabilities and critical infrastructure, and leveraging new technologies like blockchain to complicate detection and response.
• 0:45
  SPEAKER_00: For security leaders, the convergence of these trends means that the stakes for effective governance, technical controls, and executive oversight have never been higher.
• 0:55
  SPEAKER_00: Let's start with one of the most pressing issues, the state of AI governance, particularly in highly regulated sectors like healthcare.
• 1:03
  SPEAKER_00: A recent report from Clearwater found that an astonishing 91% of healthcare organizations cannot verify the existence or effectiveness of AI governance within their operations.
• 1:14
  SPEAKER_00: This isn't just a compliance problem.
• 1:16
  SPEAKER_00: It's a material risk that touches on regulatory, ethical, and operational dimensions.
• 1:22
  SPEAKER_00: Healthcare is moving quickly to integrate AI into both clinical and administrative functions, from diagnostic support to patient scheduling and billing.
• 1:31
  SPEAKER_00: But without clear oversight, organizations are exposed to a host of risks, from biased decision making and privacy breaches to regulatory penalties and reputational harm.
• 1:41
  SPEAKER_00: For CISOs and risk executives in healthcare, the message is clear.
• 1:45
  SPEAKER_00: It's time to establish and document robust AI oversight processes.
• 1:50
  SPEAKER_00: This means not just having policies on paper, but ensuring that governance structures are in place, roles, and responsibilities are defined, and that the effectiveness of these controls can be demonstrated to auditors, regulators, and, if necessary, the public.
• 2:06
  SPEAKER_00: The lack of verifiable governance is increasingly seen as a business risk that can impact everything from patient safety to executive tenure.
• 2:15
  SPEAKER_00: And this brings us to a broader trend across industries.
• 2:18
  SPEAKER_00: Forrester recently issued a warning that missing or inadequate AI governance is now a board level risk, with the potential to cost CEOs their jobs if AI driven failures occur.
• 2:29
  SPEAKER_00: This marks a significant shift in accountability.
• 2:32
  SPEAKER_00: Where AI was once seen as a technical or operational issue, it's now squarely in the sights of boards and executive committees.
• 2:40
  SPEAKER_00: The implication is that CISOs and security leaders need to ensure that AI risk management is not siloed within IT or security, but integrated into enterprise governance frameworks.
• 2:52
  SPEAKER_00: This includes establishing reporting mechanisms, conducting regular risk assessments, and ensuring that the board is fully briefed on the organization's AI risk posture.
• 3:02
  SPEAKER_00: Why is this shift happening now?
• 3:05
  SPEAKER_00: Part of the answer lies in the operational realities of AI adoption.
• 3:08
  SPEAKER_00: According to research from Optro, one in three organizations has already acted on incorrect decisions made by AI agents.
• 3:16
  SPEAKER_00: That's 33% of organizations making potentially costly or damaging moves based on flawed outputs from AI systems.
• 3:24
  SPEAKER_00: This isn't just a theoretical risk.
• 3:26
  SPEAKER_00: It's already playing out in real-world contexts, from financial services to logistics to healthcare.
• 3:32
  SPEAKER_00: The lesson here is that over reliance on AI without adequate human oversight or validation can lead to significant operational errors and regulatory exposure.
• 3:43
  SPEAKER_00: So, what should organizations do to mitigate these risks?
• 3:47
  SPEAKER_00: First, it's essential to ensure that AI outputs, especially in high stakes or automated decision-making contexts, are subject to human review.
• 3:56
  SPEAKER_00: This doesn't mean slowing down innovation, but rather building in checkpoints and escalation paths so that critical decisions are not made blindly on the basis of AI recommendations.
• 4:08
  SPEAKER_00: Second, organizations should invest in training and awareness programs to help staff understand the strengths and limitations of AI, as well as the importance of oversight and validation.
• 4:20
  SPEAKER_00: Let's pivot now to the evolving threat landscape, where adversaries are taking advantage of both technical vulnerabilities and the complexity of modern supply chains.
• 4:30
  SPEAKER_00: One of the most notable developments comes from North Korean threat actors, identified by Unit 42, who are now leveraging blockchain infrastructure to facilitate cloud supply chain attacks.
• 4:42
  SPEAKER_00: This is a significant evolution in attack methodology.
• 4:46
  SPEAKER_00: By using blockchain as part of their attack chain, these actors are making it harder for defenders to detect and attribute malicious activity.
• 4:55
  SPEAKER_00: The decentralized and often opaque nature of blockchain transactions provides attackers with new ways to mask their operations, complicating incident response, and forensic investigations.
• 5:07
  SPEAKER_00: For organizations that rely on cloud services, and that's virtually everyone at this point, this underscores the need for rigorous supply chain security controls.
• 5:16
  SPEAKER_00: It's not enough to trust that your cloud provider has things under control.
• 5:20
  SPEAKER_00: Security teams need to review their cloud supply chain controls, monitor for blockchain-based attack vectors, and ensure that third-party risk management processes are up to date.
• 5:31
  SPEAKER_00: This may involve working more closely with cloud providers, conducting targeted threat modeling exercises, and investing in monitoring tools that can detect anomalous activity across both traditional and blockchain-based infrastructure.
• 5:45
  SPEAKER_00: Meanwhile, attackers are also exploiting critical vulnerabilities in widely used platforms.
• 5:51
  SPEAKER_00: Citrix Netscaler, for example, is currently the target of active exploitation.
• 5:56
  SPEAKER_00: Attackers are deploying web shells and stealing configuration data, enabling persistent access and lateral movement within affected environments.
• 6:06
  SPEAKER_00: This kind of exploit is particularly dangerous because it allows adversaries to maintain a foothold in the network, move laterally, and potentially escalate privileges or exfiltrate sensitive data over an extended period.
• 6:20
  SPEAKER_00: The practical implication is straightforward.
• 6:23
  SPEAKER_00: Organizations using Citrix Netscaler appliances need to prioritize patching and conduct forensic reviews to identify any signs of compromise.
• 6:33
  SPEAKER_00: This is not a theoretical risk.
• 6:35
  SPEAKER_00: Active exploitation is underway, and the window for remediation is closing quickly.
• 6:41
  SPEAKER_00: Patch management, vulnerability scanning, and continuous monitoring are essential components of an effective defense.
• 6:48
  SPEAKER_00: A similar story is unfolding with Zamod, an open source help desk platform.
• 6:53
  SPEAKER_00: A proof-of-concept exploit has been released for a critical vulnerability that enables session hijacking and remote code execution.
• 7:01
  SPEAKER_00: For organizations relying on Zamod for customer support, this poses a high risk, not just to the integrity of the help desk system, but to the broader environment if attackers can use compromised sessions to pivot further into the network.
• 7:16
  SPEAKER_00: Prompt patching and a review of session management practices are strongly advised.
• 7:21
  SPEAKER_00: But it's not just software vulnerabilities that are being exploited.
• 7:24
  SPEAKER_00: Attackers are also targeting the very infrastructure that underpins trust on the Internet.
• 7:29
  SPEAKER_00: In a recent campaign, hackers hijacked country code top-level domains, specifically.g8 for Ghana,.sl for Sierra Leone, and as for American Samoa, and used that access to issue rogue TLS certificates for Google domains.
• 7:45
  SPEAKER_00: This kind of attack undermines the global certificate ecosystem, opening the door to phishing man-in-the-middle attacks and widespread loss of trust.
• 7:54
  SPEAKER_00: For organizations, the lesson is clear.
• 7:57
  SPEAKER_00: Monitoring certificate transparency logs and reviewing domain security controls should be standard practice.
• 8:03
  SPEAKER_00: Domain hijacking is not just a problem for registrars or certificate authorities.
• 8:09
  SPEAKER_00: It can have downstream effects on any organization that relies on trusted internet infrastructure.
• 8:14
  SPEAKER_00: Zooming out, Microsoft's 2026 digital defense report paints a picture of escalating sophistication in both AA-driven threats and identity-based attacks.
• 8:26
  SPEAKER_00: The report calls for enhanced identity management, AI model security, and continuous monitoring as foundational controls.
• 8:34
  SPEAKER_00: Identity has always been a critical attack vector, but as AI systems are increasingly integrated with authentication and authorization processes, the risk of privilege escalation and unauthorized access grows.
• 8:48
  SPEAKER_00: CISOs should ensure that their security roadmaps are aligned with these evolving threat vectors, prioritizing investments in identity security, AI model validation, and real-time monitoring.
• 8:59
  SPEAKER_00: Another area that deserves attention is privileged access management, or PAM.
• 9:04
  SPEAKER_00: As organizations adopt AI at scale, the attack surface expands and the risk of privilege escalation increases.
• 9:12
  SPEAKER_00: Blue Dive and Delinea have both emphasized the importance of strengthening PAM to prevent unauthorized access and mitigate the impact of AI-driven or automated attacks.
• 9:23
  SPEAKER_00: This is not just about technology, it's about process and discipline.
• 9:28
  SPEAKER_00: Effective PAM involves not only deploying the right tools, but also establishing clear policies, conducting regular reviews, and ensuring that privileged accounts are tightly controlled and monitored.
• 9:40
  SPEAKER_00: So, what should CISOs and risk leaders prioritize as they navigate this landscape?
• 9:46
  SPEAKER_00: A new analysis from Solutions Review offers some guidance.
• 9:50
  SPEAKER_00: The key takeaway is that while AI introduces new risks and requires adaptation, the fundamentals of security remain unchanged.
• 10:00
  SPEAKER_00: Asset inventory, vulnerability management, privilege access controls, and incident response planning are as important as ever.
• 10:08
  SPEAKER_00: What's changing is the context.
• 10:10
  SPEAKER_00: AI is amplifying the impact of both successes and failures, and adversaries are moving quickly to exploit any gaps.
• 10:18
  SPEAKER_00: This brings us back to the strategic imperative for organizations, integrating AI oversight into risk management programs while maintaining vigilance against technical exploits.
• 10:29
  SPEAKER_00: AI governance can no longer be treated as an afterthought or a compliance checkbox.
• 10:35
  SPEAKER_00: It needs to be embedded into the organization's culture, processes, and decision-making frameworks.
• 10:42
  SPEAKER_00: This means cross-functional collaboration between security, compliance, IT, legal, and business units.
• 10:49
  SPEAKER_00: It means clear policies, regular risk assessments, and active engagement with the board and C-suite.
• 10:56
  SPEAKER_00: Internal audit also has a critical role to play in building trust in AI.
• 11:02
  SPEAKER_00: According to KPMG and other sources, internal audit functions should be involved in assessing the effectiveness of AI controls, identifying gaps, and providing assurance to stakeholders.
• 11:13
  SPEAKER_00: This is especially important as regulators and customers alike demand greater transparency and accountability in the use of AI.
• 11:20
  SPEAKER_00: Let's recap the key strategic implications.
• 11:23
  SPEAKER_00: First, gaps in AI governance are now a material business risk, with direct consequences for executive accountability and organizational trust.
• 11:34
  SPEAKER_00: Boards and CEOs are paying attention, and failures in this area can have career-ending implications.
• 11:40
  SPEAKER_00: Second, the attack surface is expanding as adversaries innovate with blockchain-based supply chain attacks and exploit critical vulnerabilities in widely used platforms.
• 11:50
  SPEAKER_00: The complexity of modern IT environments means that defenders need to be proactive, not reactive.
• 11:57
  SPEAKER_00: Third, over-reliance on AI agents without adequate oversight can lead to operational errors and regulatory exposure.
• 12:05
  SPEAKER_00: Human in the loop processes, validation, and escalation paths are essential to mitigate these risks.
• 12:12
  SPEAKER_00: Finally, strengthening foundational controls, privileged access management, vulnerability management, and identity security remains essential as AI adoption accelerates.
• 12:23
  SPEAKER_00: These are the bedrock of effective cyber risk management, and they become even more important in an AI-driven world.
• 12:31
  SPEAKER_00: So what matters most today?
• 12:33
  SPEAKER_00: First, immediate action is needed to verify and document AI governance, especially in regulated sectors like healthcare.
• 12:40
  SPEAKER_00: Don't wait for a regulatory inquiry or a public incident to start building your governance framework.
• 12:46
  SPEAKER_00: Proactive documentation and oversight can make the difference between a manageable issue and a crisis.
• 12:52
  SPEAKER_00: Second, patch management and monitoring for active exploits, such as those targeting Citrix, NetScaler, and Xamad, should be prioritized to reduce exposure to ongoing attacks.
• 13:04
  SPEAKER_00: The threat environment is dynamic and attackers are quick to exploit unpatched systems.
• 13:09
  SPEAKER_00: Third, CISO engagement with the board and C-suite on AI risk is critical.
• 13:15
  SPEAKER_00: This isn't just about technical controls.
• 13:18
  SPEAKER_00: It's about aligning governance, risk appetite, and incident response at the highest levels of the organization.
• 13:25
  SPEAKER_00: Regular briefings, clear reporting, and open dialogue are essential to ensure that AI risk is managed effectively and transparently.
• 13:33
  SPEAKER_00: As we look ahead, the convergence of AI adoption and persistent cyber threats will continue to reshape the risk landscape.
• 13:41
  SPEAKER_00: Organizations that succeed will be those that integrate AI oversight into their risk management programs, maintain a relentless focus on foundational controls, and foster a culture of cross-functional collaboration and executive engagement.
• 13:56
  SPEAKER_00: That's the briefing for today.
• 13:58
  SPEAKER_00: Stay vigilant, stay informed, and keep risk in perspective as you navigate the evolving intersection of cyber and AI threats.
• 14:07
  SPEAKER_00: That's a wrap, peeps.
• 14:08
  SPEAKER_00: Stay secure, stay sharp, and don't forget to hug your CISO.