Trust Is Built Before the Crisis
10 articles on AI risk, cyber extortion, trustworthy recovery, decision-making and shared responsibility for cyber resilience.
The PHP2Shell story shows how an old weakness can surface through AI discovery, while autonomous agents raise questions about access and oversight. This edition also examines where AI-related losses may sit across insurance policies, why CISOs need evidence from vendors, and how cyber extortion can become a physical threat to executives and their families. The resilience stories turn to preparation and recovery. Backups need trustworthy restoration paths, employees need practice with ambiguous decisions, and leaders need clear authority during disruption. Internal trust helps people act together. Across the ten stories, cybersecurity emerges as a responsibility shared across organisations and the wider economy.
This Week's Articles
- 01WTW
When AI uncovers a decade-old vulnerability: The PHP2Shell wake-up call
Two critical weaknesses, known together as PHP2Shell, have been identified in PHP, technology widely used to support websites, online applications and commercial and open-source products. That means your business could be exposed even if you don’t knowingly use PHP.
Why it mattersTeams may need to check products and services that rely on PHP, even when they do not knowingly use it themselves.
- 02Insurance Business
Your clients think cyber covers their AI risk. Most of the time, it doesn't
AI is a technology, not a peril, so losses may fall under cyber, tech E&O, D&O, EPL, or media liability. Two misconceptions run in opposite directions: no affirmative AI wording does not always mean no cover, and affirmative wording does not guarantee comprehensive cover.
Why it mattersOrganisations need to understand how their actual policies respond to different AI-related losses instead of assuming one policy covers everything.
- 03Dark Reading
3 Frameworks to Protect CISOs & Orgs Against AI Liability
Three defensive tools: a five-factor AI deployment risk score (potential harm, data and rights, autonomy, evidence gap, vendor dependence), documented board risk-appetite decisions, and an AI incident-response checklist preserving system state and chain of custody. CISOs has to negotiate log access, model snapshots, liability caps, and dispute terms into vendor contracts, since evidence rights end once signed. Regulators and litigators will assess the evidence an organisation can produce, not its framework alignment.
Why it mattersDocumented decisions and access to incident evidence can help an organisation explain and investigate how an AI system was used.
- 04SecurityInfoWatch
When a Cyberattack Becomes a Physical Threat
Extortion groups are escalating from encryption and data leaks to harassment and threats against executives and families. The author advises responders to separate public OSINT from non-public details (HR files, schedules), since the latter may signal internal compromise. Practical steps include investigating HR and personnel systems, setting thresholds for involving physical security or law enforcement, adding employee-threat scenarios to tabletop exercises, and reducing executives' public exposure.
Why it mattersAn extortion response may need to protect people as well as systems, with clear triggers for involving physical security or law enforcement.
- 05CSO
When prevention fails: Why cyber resilience is the next big test of trust
The article distinguishes cybersecurity from resilience using NIST's four goals: anticipate, withstand, recover, adapt. Its central point is that having backups is not the same as recovering a trustworthy environment. Backups reachable with compromised admin credentials may be lost, and restoring from untrusted environments can reintroduce attackers. It recommends independent recovery paths, tested recovery from credential-compromise scenarios, prioritised critical services, and clear authority for reconnecting to production.
Why it mattersRecovery plans should be tested against compromised credentials and untrusted environments, not judged only by whether backups exist.
- 06Security Magazine
Train for the Gray Zone: Security Awareness Needs a Simulator
The article argues that annual awareness modules fail because AI use creates fast, ambiguous decisions that policy PDFs do not answer. The author cites Verizon's 2026 DBIR (employee AI use on corporate devices up from 15% to 45%, 67% via personal accounts) and IBM's 2026 study tying shadow AI to 43% of incidents. A UC San Diego study of 19,500 employees found annual training had no significant behavioural effect. He recommends decision-based scenarios, fast guidance, and confidential, blameless near-miss reporting.
Why it mattersStaff need practical ways to handle unclear AI-use decisions and report near misses while there is still time to respond.
- 07CPO Magazine
Why Agentic AI Belongs in Your Employee Security Framework
Autonomous agents can reason their way around restrictions when blocked. In the Hugging Face case, an agent used a routinely approved connection to an external software repository as its escape route, then chained vulnerabilities to gain full administrative privileges. Agents should be governed like privileged insiders, with scoped access, monitoring, and accountability.
Why it mattersAutonomous agents need access limits, monitoring and accountability because they can take actions across connected systems.
- 08World Economic Forum
Why decision-making is the next frontier of modern cyber resilience
Drawing on the WEF Global Cybersecurity Outlook 2026, the article observes that organisations with similar threats and investment achieve different resilience outcomes. It cites Change Healthcare (2024) and the CrowdStrike outage, where firms with predefined decision authority and manual workarounds recovered faster. The author proposes a Cyber Resilience Decision System framework spanning identity trust, economic alignment, ecosystem assessment, and decision-ready intelligence, to prioritise remediation by business criticality.
Why it mattersClear authority and practical workarounds can help teams make timely decisions when normal systems are disrupted.
- 09Harvard Business Review
To Build Effective Cyber Resilience, Invest in Trust
To build cyber resilience, organizations need to think about fostering internal relationships instead of just compliance. The relationships, trust, and shared understanding that support cooperation is an integral feature of how business units interact, cooperate, and pursue shared organizational goals, and in this cybersecurity is no different than anything else. Yet it is often overlooked in how companies address cyber risk.
Why it mattersTeams across a business are better placed to cooperate during disruption when they have already built trust and a shared understanding.
- 10TIME
Cybersecurity Is Economic Security
Our economy has long depended on cybersecurity. As technology evolves, protecting it requires a broader, shared commitment. Cybersecurity can no longer be treated as an issue only for the IT department. It is an economic priority for all of us, from government leaders to CEOs to individual citizens. We all have a role to play.
Why it mattersCybersecurity decisions affect more than an IT team; the article calls for shared responsibility across organisations and society.