Hudson Rock said the attackers went on to “actively intercept SSL VPN authentication hashes and crack them using a massive, dedicated 45-GPU cluster managed via Hashtopolis.” From there, they used the GPU cluster to crack the hashes, meaning to try massive combinations of plain-text passwords until they found the right one. These passwords allowed the threat actors to move laterally to compromise Active Directory environments and other centralized authentication systems.

“This aggressive methodology has led to severe, real-world consequences,” Hudson Rock said. “Diachenko’s research confirmed full network compromises at multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey. Most alarmingly, this includes a Turkish NATO defense contractor from which classified defense documents were successfully exfiltrated by the group.”

In the interview, Diachenko put it more succinctly. “The scale is the sophistication,” he said.

The scale didn’t stop there. The attackers used the massive cluster to run a” feedback-driven, 12-level recursive system.” In other words, there wasn’t a single flat dictionary run. Password candidates came from custom dictionaries with as many as eight words, common keyboard patterns, and cracking rules. Each one looped back with each step. When guesses were successful, the passwords were fed back as seeds to generate still more candidates. In other words, the cracking techniques improved with each successful guess.

“They were quite innovative on that,” the researcher said.

The innovation contrasts sharply with the operational security of the attackers, who left artifacts on the server they used. In hacker circles, such moves are considered amateur mistakes.

Hudson Rock said that the top countries where compromised devices were found were India, the US, Taiwan, Mexico, Turkey, and Thailand. The top industries affected were IT services, construction materials, telecommunications, construction and engineering, industrial equipment, and financial services. Other organizations whose data appeared in the database included: Foxconn, Samsung, Comcast, Siemens, PwC, and Accenture. Hudson Rock said that the database listed thousands of others, including major government agencies and critical infrastructure providers.

Firewalls have long been a favorite network entry point for hackers. These devices accept connections from the outside Internet, sit at the perimeter of a network, and have access to valuable resources deep inside.

The links above list a number of steps Fortinet firewall users should take to ensure their networks are secure. Given that the data has been available to cybercriminals and potentially other threat actors who, like Diachenko, found it, the risk is substantial.

https://arstechnica.com/security/2026/06/massive-breach-spills-credentials-for-thousands-of-sensitive-networks/

Giu 16, 2026 Giancarlo Calzetta Eventi, In evidenza, News, Prodotto, RSS 0

---

Sebbene il numero di casi d’uso nel nostro Paese sia ancora molto basso, le previsioni di tutti gli esperti dicono che gli agenti AI diventeranno i veri “operati” dell’automazione dei processi in azienda. Il problema è che chi dovrà gestirne la sicurezza non ha ancora l’esperienza necessaria per farsi un quadro chiaro di come questi opereranno in concreto sulla rete interna, su quella esterna e sui client. Questa carenza di visione complica enormemente la creazione di una infrastruttura di sicurezza efficace.

In particolare, governare e proteggere un numero crescente di agenti AI autonomi che operano in modo indipendente, accedono ai dati aziendali e prendono decisioni alla velocità delle macchine pone una serie di sfide che è bene affrontare insieme a chi ha già avuto modo di sperimentare con casi reali, in ambiti complessi.

A questo proposito, Zscaler ha annunciato una serie di innovazioni che estendono le funzionalità della piattaforma Zero Trust Exchange alla protezione dell’ecosistema Agentic AI con l’obiettivo di offrire quella che l’azienda definisce la prima piattaforma Zero Trust completa progettata specificamente per la nuova generazione di agenti intelligenti.

L’Agentic AI cambia le regole della sicurezza

Durante la sessione europea del loro evento annuale Zenith Live, tenutasi a Vienna, Zscaler ha condiviso la sua visione sull’evoluzione dell’AI che, a suo dire, sta introducendo complessità che le architetture di sicurezza tradizionali non sono state progettate per gestire. Gli agenti autonomi non si limitano infatti a eseguire istruzioni ricevute dagli utenti, ma possono generare task, creare subagenti, accedere a servizi, utilizzare credenziali e interagire con applicazioni e dati aziendali senza un intervento umano diretto.

Questo scenario genera nuove problematiche in termini di visibilità, governance e controllo degli accessi, rendendo più difficile comprendere quali agenti stiano operando, quali dati utilizzino e quali azioni siano autorizzati a compiere. Parallelamente, la crescente integrazione dell’AI nei processi di sviluppo software espone endpoint e workstation a plugin, estensioni e strumenti potenzialmente malevoli che molte soluzioni di sicurezza tradizionali non sono attualmente in grado di individuare efficacemente.

AI Broker: controllo sulle comunicazioni tra agenti

Una delle principali novità presentate dall’azienda è Zscaler AI Broker, una soluzione progettata per proteggere le comunicazioni tra agenti AI attraverso broker MCP (Model Context Protocol) e framework Agent-to-Agent.

Il sistema introduce un Agent Registry integrato che consente alle aziende di ottenere una visibilità dettagliata sulle risorse accessibili da ciascun agente e di applicare controlli granulari sugli accessi. L’obiettivo è evitare che gli agenti possano espandere autonomamente i propri privilegi o accedere a informazioni non necessarie per l’esecuzione delle attività assegnate.

Endpoint AI Security amplia la protezione sui dispositivi

Accanto al broker per gli agenti, Zscaler ha introdotto Endpoint AI Security, una soluzione che estende la protezione fino ai dispositivi utilizzati dai dipendenti. La piattaforma è progettata per individuare minacce nascoste all’interno di browser, estensioni, plugin e strumenti AI installati localmente, componenti che spesso sfuggono alle tradizionali piattaforme di Endpoint Detection and Response. L’approccio consente di applicare policy coerenti tra cloud ed endpoint, offrendo una visione unificata dei rischi legati all’utilizzo dell’intelligenza artificiale all’interno dell’organizzazione.

AI Access Graph punta sulla governance dei dati

Un altro tassello fondamentale della strategia presentata a Vienna è rappresentato da Zscaler AI Access Graph, una tecnologia sviluppata a partire dall’acquisizione di Symmetry Systems. La soluzione crea una mappatura delle relazioni tra identità, applicazioni, modelli AI e fonti dati, consentendo alle organizzazioni di comprendere in modo più accurato chi accede alle informazioni, attraverso quali agenti e per quali finalità.

L’integrazione con Zero Trust Exchange permette di applicare controlli più rigorosi, ridurre gli accessi non necessari e tracciare in tempo reale la lineage dei dati lungo l’intero percorso, dalla sorgente fino all’utilizzo da parte degli agenti AI. Considerato che i requisiti normativi diventano sempre più stringenti, la capacità di ricostruire i flussi informativi potrebbe diventare uno degli elementi chiave per la governance dell’intelligenza artificiale.

Più visibilità sugli asset AI e oltre 250 applicazioni GenAI monitorate

Le novità annunciate includono anche un importante aggiornamento di Zscaler AI Protect, la piattaforma introdotta all’inizio del 2026 per la protezione degli ambienti AI. Sul fronte dell’asset management, la soluzione amplia le capacità di discovery permettendo di individuare AI integrate nelle applicazioni SaaS, server MCP presenti nei cloud pubblici e rischi nascosti nei codebase agentici attraverso attività di scansione del codice. La visibilità viene inoltre estesa alle attività AI che avvengono direttamente sugli endpoint aziendali.

Particolarmente interessante è il rafforzamento delle funzionalità di Secure Access to AI, che ora consentono di estrarre e analizzare i prompt provenienti da oltre 250 applicazioni GenAI, offrendo una visione completa delle conversazioni e supportando le Compliance API di Anthropic e OpenAI. L’azienda introduce inoltre guardrail basati sull’intento dell’intera conversazione e non sul singolo prompt, un approccio che mira a ridurre i tentativi di aggiramento delle policy attraverso sequenze di richieste apparentemente innocue.

Sicurezza dell’AI lungo tutto il ciclo di vita

L’ultima area di innovazione riguarda la protezione delle applicazioni AI durante l’intero ciclo di vita. Le nuove funzionalità comprendono attività di AI red teaming dedicate ai server MCP, servizi di prompt hardening e strumenti di conformità basati su heat map che aiutano le organizzazioni a identificare le aree più esposte dal punto di vista della governance. L’obiettivo è quello di integrare la sicurezza fin dalle fasi iniziali di sviluppo e distribuzione delle applicazioni AI, evitando che i controlli vengano aggiunti solo successivamente quando i sistemi sono già operativi.

La strategia presentata da Zscaler evidenzia come a fianco della protezione dell’utente serva trovare spazio per la protezione degli agenti AI. Con l’aumento delle identità non umane, delle comunicazioni agent-to-agent e dei workflow automatizzati, le aziende avranno bisogno di strumenti in grado di garantire visibilità, controllo e governance su un ecosistema sempre più distribuito per riuscire a evitare intrusioni e garantire la governance richiesta dalle normative più recenti.

---

• agent-to-agent security, agentic AI, AI Access Graph, AI Broker, AI Protect, cybersecurity AI, Endpoint AI Security, governance AI, identità non umane, MCP security, sicurezza agenti AI, sicurezza enterprise, Zero Trust Exchange, zscaler

---

---

https://www.securityinfo.it/2026/06/16/zscaler-porta-la-zero-trust-nellera-degli-agenti-ai/?utm_source=rss&utm_medium=rss&utm_campaign=zscaler-porta-la-zero-trust-nellera-degli-agenti-ai

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Handlee&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #404144; } figure { padding: 4px; margin: auto; } figcaption { color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 14px; padding: 10px; text-align: left; } .highlight { padding: 3%; border-top: 8px solid #207BBC; border-bottom: 3px solid #207BBC; width: 100%; Nunito Sans’,Arial,sans-serif; font-size: 15px; background-color: #EAF1F7; margin-top: 25px; margin-bottom: 25px; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Handlee”, Arial, sans-serif; font-size: 20px; text-align: center; color: #0067A6; } .pqFull:before { content: ‘\275D’; position: absolute; top: -.10em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 4rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content: “\2013 \2003” attr(cite); display: block; text-align: center; font-size: 18px; color: #404144; }
.w3-container:after, .w3-container:before, .w3-row:after, .w3-row:before { content: “”; display: table; clear: both } .w3-container { padding: 5px; } .w3-col, .w3-half, .w3-third, .w3-twothird, .w3-threequarter, .w3-quarter { float: left; width: 100% } @media (min-width:601px) { .w3-col.m1 { width: 8.33333% } .w3-col.m2 { width: 16.66666% } .w3-col.m3, .w3-quarter { width: 24.99999% } .w3-col.m4, .w3-third { width: 33.33333% } .w3-col.m5 { width: 41.66666% } .w3-col.m6, .w3-half { width: 49.99999% } .w3-col.m7 { width: 58.33333% } .w3-col.m8, .w3-twothird { width: 66.66666% } .w3-col.m9, .w3-threequarter { width: 74.99999% } .w3-col.m10 { width: 83.33333% } .w3-col.m11 { width: 91.66666% } .w3-col.m12 { width: 99.99999% } } .w3-row-padding, .w3-row-padding>.w3-half, .w3-row-padding>.w3-third, .w3-row-padding>.w3-twothird, .w3-row-padding>.w3-threequarter, .w3-row-padding>.w3-quarter, .w3-row-padding>.w3-col { padding: 0 8px }

Geopolitical conflict is no longer confined to land, sea or air. Today, it unfolds silently across networks, servers and endpoints. Governments, critical infrastructure operators, and private enterprises are increasingly targeted by cyber operations designed to disrupt services, steal sensitive data, or undermine national stability.

Unlike traditional warfare, cyberwarfare does not require armies crossing borders. A coordinated attack launched from anywhere in the world can disrupt supply chains, shut down utilities, or expose millions of customer records within minutes. From ransomware attacks on healthcare systems to disruptions in logistics and satellite communications, organizations across sectors have faced outages, financial loss, and reputational damage. As organizations digitize operations and connect critical systems to the internet, the line between national security and enterprise cybersecurity continues to blur.

The Rise of Cyberwarfare

According to the European Union Agency for Cybersecurity’s 2025 Threat Landscape report, the global cyberthreat environment is shaped primarily by state-nexus actors and organized cybercriminal groups, with increasing convergence in their tools, tactics, and objectives alongside the growing professionalization of cybercrime and its alignment with geopolitical dynamics.

Critical infrastructure sectors, such as energy, transportation, finance, and telecommunications, have emerged as primary targets for these attacks. Disruptions in these areas can trigger significant economic damage and widespread societal impact, making them especially attractive to threat actors.

In 2026, geopolitical dynamics continue to be the leading influence on cyber risk strategies. According to the World Economic Forum, 64% of organizations now factor geopolitically driven cyberthreats into their security strategies, while 23% of public sector organizations report insufficient cyber resilience capabilities.

Why Enterprises are in the Crosshairs

Enterprises are no longer incidental casualties; they are deliberate targets in cyberwarfare. Organizations that run cloud platforms, digital services, supply chains, and communication infrastructure sit at the core of modern economies, making them high-impact points of disruption.

Recent developments have already validated this shift toward physical targeting of enterprise infrastructure. In early 2026, drone strikes on commercial cloud data centers in the Middle East caused structural damage and triggered widespread service disruptions across dependent digital services. These incidents marked one of the first clear instances of data centers being directly targeted in kinetic conflict, highlighting their growing role as strategic assets. The outages extended beyond the immediate blast radius, affecting critical sectors reliant on cloud infrastructure and exposing how modern conflict increasingly focuses on the core infrastructure of the digital economy.

This strategy is not limited to physical attacks. Supply chain compromises further amplify impact by exploiting trust at scale. By infiltrating a trusted enterprise platform, attackers can scale their reach exponentially across downstream organizations. Incidents such as the Sunburst supply chain attack demonstrated how deeply embedded trust relationships can be exploited, turning widely used software into vectors for national security compromise.

The use of disruptive malware in enterprise environments highlights the potential for even broader operational fallout. Wiper malware outbreaks mimicking NotPetya have crippled global shipping, manufacturing, and commerce, disrupting essential supplies and proving that the consequences extend far beyond the initial target.

What makes these attacks particularly effective is the structure of modern enterprises themselves. Deep interdependencies, reliance on shared platforms, legacy systems, and limited visibility across complex environments create ideal conditions for attackers to move quickly, amplify impact, and align cyber operations with broader geopolitical objectives.

Cybersecurity Priorities in a Geopolitically Volatile Time

As cyberwarfare becomes a permanent feature of the geopolitical landscape, organizations must rethink how they approach security. Cybersecurity can no longer be treated solely as an IT function; it must be embedded into enterprise risk management and business strategy.

Adopt a risk-based security approach: Align cybersecurity priorities with business-critical assets and evolving threat landscapes to focus efforts where impact is highest.

Ensure leadership and board-level alignment: Make cybersecurity a strategic priority with clear governance, executive ownership, and regular oversight at the leadership level.

Strengthen identity, endpoints, and visibility: Enforce least-privilege access, strong authentication, and continuous monitoring while securing endpoints and leveraging threat logs for faster detection and response.

Promote a security-first culture: Build organization-wide awareness through regular training, ensuring employees act as the first line of defense.

Enhance resilience through testing and response readiness: Continuously test defenses, maintain robust incident response plans, and ensure rapid recovery to minimize disruption.

As cyberwarfare becomes a permanent feature of the geopolitical landscape, organizations must rethink how they approach security.

Preparing for Sustained Digital Conflict

Cyberwar is no longer a distant, theoretical threat; it is an active and evolving reality shaping how nations and businesses operate. In a world where attacks can be swift, borderless, and strategically motivated, preparedness becomes a competitive advantage. Organizations that embed security into their core strategy by anticipating risks, strengthening resilience, and fostering a culture of vigilance will be far better positioned to withstand and recover from disruption.

Ultimately, the question is no longer if enterprises will be impacted by cyber conflict but when. Those that act now will not only defend against emerging threats but also build the trust and reliability required to thrive in an increasingly volatile digital landscape.

https://www.securitymagazine.com/articles/102371-cyberwar-at-the-front-line-why-enterprises-must-prepare-for-digital-conflict

Danish pharmaceutical firm Novo Nordisk announced it faced a data breach related to clinical trials, releasing notification letters to both patients and healthcare providers (HCPs) involved. According to the statement, a threat actor gained access to a limited number of the company’s internal IT systems, which included access to certain personal data. 

What Data Is Compromised?

Patient risk is somewhat reduced, as the exfiltrated patient data was deidentified. 

“Pseudonymized clinical trial data can create a false sense of comfort, but it could have been worse,” comments John Bruggeman, vCISO at CBTS. “The risk is that with life sciences, the context around the data matters. Trial participation city or state, treatment area, demographics that were not anonymized, and research attributes can become sensitive when combined with other sources. Attackers do not need a complete patient profile to create harm. Thankfully though patient PII was not disclosed, so in today’s environment I’ll take that as a win.”

However, this doesn’t mean the incident is absent of risk. 

Ross Filipek, CISO at Corsica Technologies, explains, “A breach involving clinical trial data creates a different kind of risk than a typical consumer data incident. Novo Nordisk says the exposed information was not tied directly to names, which is good. It also said no usable identifiers were obtained, which lowers the immediate risk. However, health data can still carry long-term value when it is combined with other stolen information. Even when an ePHI breach does not include patient names, attackers may try to reverse-engineer identities by pairing details like birth date, postal code, or gender with outside data sources.

“For patients, the immediate danger may be limited. The bigger concern is what happens later. Attackers can use partial medical details to build convincing phishing messages, impersonate trusted organizations, or pressure people with information that feels deeply personal. That is especially concerning in healthcare, where trust is already fragile.

“There is also a downstream business risk. Clinical trials depend on confidence from patients, providers, regulators, and research partners. Even a limited breach can create hesitation. If attackers had dwell time inside the environment, the concern shifts from data exposure to data integrity. A pharmaceutical or healthcare organization may need to determine whether research data was altered, whether regulatory obligations were triggered, and whether any intellectual property was exposed. Active trials could also face delays while the incident is investigated. Healthcare organizations need strong visibility into sensitive data, tighter access controls, and active monitoring before a contained incident becomes a broader trust problem.”

Affected patient data includes: 

• Patient IDs (consisting of a random alphanumeric string)
• Trial participation information
• Sex 
• Year of birth
• Lifestyle factors (such as BMI, smoking, etc.) 
• Biomarkers 
• Health/immunogenicity data

Affected HCP data includes: 

• Name and registration number 
• Email address
• Phone number 
• WhatsApp information 
• Office location

While patients may be at a slightly lower risk, especially when compared to other healthcare breaches, experts warn the HCPs could be at risk of targeted attacks. 

Bruggeman states, “Attackers can use information stolen from Novo Nordisk to target the doctors helping to bring valuable medical research to drug makers. Now attackers can make a message feel credible, even professional, given the contact details that were compromised. Imagine a doctor involved getting a message from an attacker about a trial update that is in fact fake? Or request documents, or payments, or a medical portal password reset when the attacker has enough context.”

Was This Breach Corporate Espionage? 

“There are markers to this case which suggest the possibility of corporate espionage,” asserts Joseph Perry, Cybersecurity Researcher and Advanced Services Lead at Arcova. “Novo Nordisk’s intellectual property are fabulously valuable, the accessed patient information is related to ongoing clinical trials, and based on the patient letter and hcp letter it appears the threat actor’s purpose was data exfiltration (as opposed to, e.g., ransomware). Overall, based on available information, the incursion appears to be relatively limited and, at this point, contained. However, given that the discovery and containment appear to have happened after the external copying of data, there’s an open question as to whether this was contained before or after complete mission success. 

“In general, this flows with a broadening trend in cybercrime. For years, we’ve discussed the commodification of certain attacker flows (e.g., the rise of Initial Access Brokers) and the move to platforms and monolithic providers. What that all boils down to, what we’re seeing, is the ongoing professionalization of cybercrime. We don’t have any evidence as to who the attacker was, nor do we have proof of their motivation. But if the hints we’re seeing in public disclosure pan out, and this does turn out to be an act of corporate espionage, that would be yet another example of cybercrime’s mainstreaming. The calculation is simple enough; if the risk of discovery is small relative to the potential profit, at least some unscrupulous folks will attempt to leverage cybercrime as a business tactic.” 

https://www.securitymagazine.com/articles/102370-breaking-down-the-novo-nordisk-data-breach

The Office of the Maine Attorney General has removed its public-facing data breach database due to abuse of the reporting system. According to the office’s statement, two companies are known to be affected by false reports of data breaches. The false reports have since been removed from the database. 

The two companies known to be impacted by fraudulent filings are Discord and VRChat. 

“After conversations with VRChat, one of two affected companies, it has become clear that the reported data breaches were hoaxes submitted by an unknown entity unrelated to either company,” the office’s statement reads. 

The false report against Discord claimed 10 million individuals were affected by a breach. 

The fake data breach report against VRChat claimed 2.4 million users were impacted by a data breach, exposing information such as usernames, email addresses, subscription statuses, login histories, and user IDs for connected platforms.

The office states it has no knowledge of any legitimate data breach claims against either Discord or VRChat. 

“We are reviewing our procedures to make this abuse less likely in the future while preserving the public availability of such information,” the office states. “The public-facing database will remain offline until then.” 

Organizations that need to submit a data breach report can continue to do so through the office’s online reporting service. 

https://www.securitymagazine.com/articles/102369-maine-data-breach-reporting-portal-abused-taken-offline

Update: New information reveals claims of this breach were falsified. More information on the fraudulent report can be found here. The story below is based on statement provided in the fraudulent report and was written prior to those claims being proven false.

VRChat, an online virtual world platform, experienced a data breach affecting approximately 2.4 million users. According to a notice filed by the organization, compromised information may include: 

• Usernames 
• Email addresses 
• Subscription statuses 
• User IDs for other platforms (like Steam or Meta) that are linked to the VRChat account 
• Login histories (including devices, hardware identifiers, and IP addresses)

The organization has stated it has seen no evidence for the compromise if passwords, credit card or payment information, or government identification documents. 

At this time, the organization has contained the incident and engaged in forensic investigation. It has also established further security measures and collaborated with cybersecurity professionals to monitor additional threats. 

The organizations warns users to be cautious of phishing attempts, particularly in the case of unsolicited messages claiming to be from the platform itself. 

https://www.securitymagazine.com/articles/102365-24m-impacted-by-vrchat-breach

Research shows identity crimes are increasingly leading to multiple fraud instances rather than creating isolated events. The identity Theft Resource Center’s 2026 Trends in Identity Report reveals approximately a quarter of victims (25.6%) deal with two or more concurrent events, which represents a 23.5% increase from the year prior. 

Key Findings

• Computers and mobile devices saw an increase in unauthorized access (78% year-over-year). These instances rose from 15.3% of identity compromises to 27.2%. 
• Year-over-year, scams prompting victims to share personal information decreased from 43.1% to 36.1% of instances. 
• Among victims with no financial loss, 53% were able to find a resolution. Conversely, among those with a financial loss, only 9% found resolution. 0% of those who experienced three or more financial repercussions found a resolution. 
• The most common crime against minors is fraudulent employment, accounting for 40% of misuse cases. 
• Financial institutions detected more attempted misuse cases (28.6%). 

Security Leaders Weigh In

Patrick Harr, CEO at DataVisor:

Identity crimes are becoming multi-layered because one successful compromise now gives criminals reusable access across multiple systems. A stolen credential set, a compromised device, or an account-problem scam can cascade into account takeover, new-account fraud, employment misuse, and other downstream abuse, especially when attackers harvest high-value PII and reuse it across channels. AI is accelerating that trend by helping criminals create more convincing, personalized outreach at scale and by making fake identities, fake profiles, and impersonation cheaper to operate.

Unauthorized device access is growing because the phone or laptop is now the control center for a person’s digital identity. If a fraudster gets onto the device, or into the cloud account tied to it, they may gain access to logged-in apps, stored credentials, messages, MFA flows, and recovery paths, which is far more valuable than tricking a victim one account at a time. AI-enhanced phishing, malware delivery, voice cloning, and account-takeover techniques are making it easier to get that foothold and use it quickly. 

Cases with financial loss are much harder to resolve because the crime has already moved from compromise to monetization. At that point, victims and institutions are no longer dealing with a simple access issue; they are trying to trace and recover money that may already have moved through multiple accounts or fast payment rails, often across institutions. That is why reactive response models break down so badly once money has left the account, and why prevention at the moment of authorization matters more than remediation afterward.

Another finding: fraudulent employment is the most common crime against minors. Minors are attractive targets because they often have clean identities, little or no credit history, and less active monitoring, which makes their information useful for both synthetic identity fraud and employment-related misuse. Children’s SSNs are especially attractive because they can be paired with fabricated details to build a believable synthetic profile. 

James Maude, Field CTO at BeyondTrust:

We live in an age where identity compromise is so common that only the most noteworthy losses are worth reporting. Many customer facing organizations will quickly write off losses associated with compromised customer identities as they have accepted that adding additional security that would protect customers’ accounts would only increase friction and lower the likelihood of future purchases. In the age of online shopping and instant gratification, any security mechanisms to challenge a user and verify their identity can be seen as a competitive disadvantage.

Identity has become the new perimeter as businesses and individuals move their entire lives into cloud applications and service meaning that a compromised identity can provide access to large amounts of data and systems. Within the business world we are seeing lines between personal and professional accounts blur meaning that a user’s personal accounts or devices being compromised can impact their business identity as well.

It is so common place now that almost everyone knows someone who has been the victim of identity compromise and there is often a social stigma or element of shame that leads to reduced reporting. If you have heard about scams constantly and then fall victim you might be more likely to try and ignore it and move on than report it and explain why you clicked the link.

To reiterate, identity is the new perimeter. Organizations, as well as individuals, are beginning to realize this and better understand and protect their identity attack surface. At a basic level having robust MFA controls on all high value personal accounts is absolutely essential. At the organization level being able to understand all the paths to privilege an identity has in your environment and proactively reduce those risks is key to success. 

https://www.securitymagazine.com/articles/102364-identity-crimes-have-become-multi-layered

Giu 09, 2026 Redazione Approfondimenti, In evidenza, Interviste, News, RSS, Scenario, Scenario 0

---

Il nuovo assetto geopolitico mondiale ha messo a nudo una serie di problematiche che sono state trascurate troppo a lungo. In pratica, quello che per anni abbiamo visto accadere nel software, ovvero l’entusiasmo per le nuove feature che andava a coprire la necessità di rendere sicuro il loro utilizzo, si è applicato anche in mille altri settori lontanissimi dal coding. L’esperienza di Alessio Fasano, Country Manager della Southern EMEA Region di FireMon con un passato da CSO in una primaria Telco nazionale, ci offre una prospettiva privilegiata su come l’Europa e l’Italia stiano affrontando queste minacce.

Il conflitto tra Ucraina e Russia ha riacceso i riflettori su vulnerabilità che vanno ben oltre il semplice sabotaggio fisico. Sebbene incidenti come il taglio dei cavi sottomarini nel Mar Rosso rappresentino un rischio concreto di interruzione della connettività, la preoccupazione principale degli esperti riguarda le cosiddette landing station. Questi nodi, dove i cavi approdano e il traffico viene aggregato, sono apparati critici che richiedono una visibilità totale. Il timore non è solo l’assenza di segnale, ma che la rete stessa diventi il veicolo per infiltrazioni profonde nei sistemi informatici aziendali e governativi, sfruttando ogni possibile punto d’accesso tra i cinque domini, dal sottomarino allo spaziale.

Una situazione poco omogenea

La preparazione del sistema Paese rispetto a tali scenari appare oggi variegata, definibile come una situazione a macchia di leopardo. Mentre i settori utility e finanziario hanno mostrato una maggiore maturità, le telecomunicazioni e i trasporti si trovano a gestire una complessità tecnologica e operativa senza precedenti. In questo contesto, le normative europee e nazionali hanno agito come una leva fondamentale per scuotere la consapevolezza dei board. In Italia, il Perimetro di Sicurezza Nazionale Cibernetica ha imposto un primo importante risveglio, passando da una gestione puramente burocratica a implementazioni tecniche reali sui sistemi. Tuttavia, il percorso è ancora lungo e si prevede che la NIS2, il regolamento DORA e l’AI Act spingeranno ulteriormente le aziende verso una postura di sicurezza non più tattica ma strategica, finalizzata alla sovranità digitale europea.

Le Telco stanno cambiando

Un elemento di ulteriore complicazione è rappresentato dalla recente ondata di consolidamento e acquisizioni nel settore Telco. Le operazioni finanziarie che portano alla creazione di “super-telco” generano un’amplificazione della complessità operativa immediata. I tecnici si trovano improvvisamente a gestire un numero di device moltiplicato, dovendo far convivere infrastrutture diverse e proteggere contemporaneamente segmenti corporate e business.

Senza strumenti avanzati di Network Security Policy Management che garantiscano automazione e semplificazione, queste realtà rischiano fermi disastrosi a seguito di attacchi mirati. La difficoltà principale nel risolvere queste inefficienze non è però tecnologica, ma organizzativa: persistono ancora silos invalicabili tra chi gestisce la sicurezza, il networking e le operazioni, con ogni dipartimento impegnato a difendere il proprio status quo invece di collaborare per una visibilità comune.

Il CISO deve evolvere insieme alla situazione

Il superamento di queste barriere è oggi guidato dalla figura del CISO, il cui ruolo è profondamente maturato negli ultimi anni. Grazie alle responsabilità introdotte dalle nuove normative, il responsabile della sicurezza ha finalmente ottenuto un posto al tavolo delle decisioni, sebbene rimangano margini di miglioramento nella segregazione dei compiti e nei riporti gerarchici, che dovrebbero puntare direttamente al CEO per garantire massima efficacia. Il CISO moderno è colui che deve traghettare l’azienda oltre il concetto di resilienza, tipicamente legato alla ridondanza dei sistemi gestita dal COO, per approdare a quello di antifragilità. Essere antifragili significa avere la capacità di reagire all’imprevedibile e di adattarsi velocemente durante una crisi. In un mondo in cui la domanda non è più se si verrà attaccati, ma quando accadrà, la chiave del successo risiede nel training costante, nelle simulazioni in War Room e nella capacità di gestire l’incidente con strumenti che permettano risposte rapide e basate sui dati.

---

• AI Act, Alessio Fasano, antifragilità, cavi sottomarini, CISO, cyber resilience, cybersecurity, DORA, FireMon, geopolitica, gestione del rischio cyber, Infrastrutture critiche, infrastrutture strategiche, landing station, network security policy management, NIS2, Perimetro di Sicurezza Nazionale Cibernetica, resilienza informatica, sicurezza delle reti, sicurezza infrastrutture, sicurezza nazionale, sovranità digitale, telco, Telecomunicazioni

---

---

https://www.securityinfo.it/2026/06/09/infrastrutture-critiche-e-geopolitica-e-lera-dellantifragilita/?utm_source=rss&utm_medium=rss&utm_campaign=infrastrutture-critiche-e-geopolitica-e-lera-dellantifragilita

Including npm packages in software development projects saves time but can introduce unseen but known vulnerabilities.

CVE Lite CLI is a lightweight command line security scanner that operates on lockfiles during software development. It focuses on JavaScript and Typescript files and is an OSV-powered dependency scanner supporting npm, pnpm and Yarn.

It is an open source tool developed by Sonu Kapoor, now community supported and recently adopted as an OWASP Incubator Project.

Kapoor has been a software developer for 25 years and has experienced and understands all the frustrations and delays in the secure software development process. It is these frustrations and delays that CVE Lite CLI is designed to ease.

“Each project you build doesn’t simply contain your own code. It pulls in hundreds of open source packages. Each of those packages might pull in other packages with their own dependencies, until a typical JavaScript project might involve thousands of these dependencies,” he explains.

The developer has probably never heard of the majority and doesn’t know how they got included. At this stage the developer is flying blind. “Any one of those packages could have a known security vulnerability – and most developers have no idea it’s there.” 

SBOMs were introduced to solve this problem, especially within OSS. In theory, they should solve this problem; but SBOMs cannot be trusted, especially within OSS. Developers must use scanners to locate vulnerabilities in unknown but automatically included npm packages. Scanners exist, but they can often only be used at a non-optimal time, and do not provide fully optimal assistance.

“CVE Lite CLI is a free, open-source command line tool that scans your projects in seconds and tells you exactly which included packages contain a vulnerability. But it doesn’t just tell you what is broken – it tells you how to fix it: it is not simply a huge log or list of warnings,” he continues. “It uses its own internal algorithm to analyze any vulnerable dependency and provide the safest command to include an alternative non-vulnerable package that won’t break the application.”

The tool allows the developer to produce secure code as part of the process of coding. 

Today, much coding is done with the assistance of an AI coding agent. An alternative approach would be to allow the AI to do the scanning; but that produces its own problems even if we ignore the current concern that AI agents are not sufficiently security aware.

“With AI, a scan in the CI is usually the last step that happens after all the other tasks, the npm run build, any linting, unit tests, building an image – and then it runs the CI scan. Depending on how big your project is, this could be a 10 minute thing, but in most enterprise companies I’ve worked in, it takes anywhere between one to two or three hours. And even that depends on an agent being free. So, in CI, if an agent isn’t free, you’re probably waiting another couple of hours before you see the result of the scan.”

So that’s the first issue: time wasted. Few developers have the time to just sit and wait for hours. Most will move on and start the next project – which produces the second issue: loss of context in the first project. Humans are no different to AI agents in this respect. Loss or lack of context can produce bad decisions. The effect of any lack of immediate context surfaces when the developer receives the result of the AI scan.

“Most of these AI scans give you a large log of problems but don’t give you any fixes. They might give you a coarse-grained command, such as ’This package has this CVE: fix it’, but they don’t tell you how to fix it. CVE Lite CLI will give you the command you need to replace the vulnerable npm with a safe npm package.”

The result is a combination of wasted time and increased frustration, all of which could be eliminated by securing the code and its npm or pnpm or Yarn inclusions as they are included during development. Each CVE Lite CLI runs on the developer’s own device, can be used on demand instantly, completes its scan within seconds, and helps fix any discovered vulnerable inclusions.

Needless to say, perhaps, it automatically scans the new npm that its recommended command brings in, ensuring that the proposed fix is a genuine fix. Kapoor cites an example from experience where the developer went through more than 25 separate iterations of seeking a safe alternative to a vulnerable npm package. 

“Imagine the frustration,” he says. “You have to install the package. The CI scan says it contains a vulnerability, so you try a different npm. You push it up to CI, you wait for CI to run, and CI says you’re still vulnerable. Okay, so you try the next version. And you go into the same loop again: you push it up, you wait for CI, and it tells you again it’s vulnerable.” Imagine doing this 25 times. That’s a huge and frustrating waste of time.

The biggest problem is when such frustration and time-wasting becomes a hassle. “What can happen then,” he adds, “is that some developers start ignoring the vulnerability out of sheer frustration when they should be fixing it. CVE Lite CLI prevents this by running local scans within seconds, allowing the developer to see the problem, fix the problem, and then move on.”

Learn More at CodeSecCon – The event that defines how modern applications are built, secured, and maintained in the age of AI.

Related: Supply Chain Attack Hits 32 Red Hat NPM Packages

Related: Software Dependencies Exposed Microsoft, Apple to High-Impact Attacks

Related: Vibe Coding: When Everyone’s a Developer, Who Secures the Code?

Related: Open Source DockSec Uses AI to Cut Through Vulnerability Noise in Docker Images

https://www.securityweek.com/owasp-incubator-project-helps-developers-find-and-fix-vulnerable-dependencies-in-seconds/

Other noteworthy stories that might have slipped under the radar: Ultrahuman data leak, The Gentlemen ransomware analysis, Hola Browser bundles miner.

The post In Other News: Anthropic Maps AI Threats, Unpatched Comodo Flaw, Palantir Chief Eyed for CISA appeared first on SecurityWeek.

https://www.securityweek.com/in-other-news-anthropic-maps-ai-threats-unpatched-comodo-flaw-palantir-chief-eyed-for-cisa/