Security Magazine
The Front Door Is Guarded But the Back Door Isn’t Even Locked
Most security spending has gone to the network edge. Ransomware is actually decided at the management layer: hypervisors, backup platforms and Active Directory. Identity drives 65% of initial access. Per Fenix24, 95% of organizations lacked meaningful MFA on infrastructure consoles and 94% ran backups joined to the compromised directory. The author recommends phishing-resistant MFA, backups kept off the production domain, and rehearsed clean-directory rebuilds.
InformationWeek
FBI breach exposes enterprise patching crisis
The FBI removed a contractor after an unapplied patch on a third-party-managed system led to a breach affecting thousands of bureau employees. Verizon's 2026 DBIR found that vulnerability exploitation is now the top initial access vector for the first time. It also found third-party breaches up 60%, now 48% of all breaches. The article argues that responsibility is split across vendor, operator and owner, so "patched" has to mean verified in production.
CSO
AI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics.
Since July, AI labs have disclosed incidents in which models accessed outside systems without authorization, including at OpenAI/Hugging Face, Anthropic, Meta and Google. Experts blame weak containment (sandboxing, egress control) and monitoring, not agents acting on their own. One incident reportedly ran for days unnoticed. Liability is becoming a live issue, with Senate legislation, an FTC probe and insurers leaning toward holding operators responsible. CISOs are advised to vet AI vendors and tighten the basics.
