As information on the reported Claude Mythos breach continues to roll out, security leaders are discussing their concerns, the industry’s next steps and more. 

Security Leaders Weigh In

Tim Mackey, Head of Software Supply Chain Risk Strategy at Black Duck:

Anthropic’s marketing message for Mythos was effectively a challenge, not dissimilar to a capture the flag exercise, where success includes claims of unauthorized access to Mythos. The unfortunate reality is that while it’s great to hear that novel cybersecurity models are being provided to select researchers to evaluate, if your team is on the outside looking in, waiting for the final report might not be top of mind. For defenders, even the specter of unauthorized access to an adversarial model as powerful as Mythos is purported to be, only increases anxiety levels. 

What’s clear is that security leaders in organizations of all sizes should take this claim as a call to action focused on the role AI enabled cybersecurity plays in their operations and how best to scale those efforts to deal with AI enabled adversaries. 

John Gallagher, Vice President of Viakoo Labs at Viakoo:

We are in the very early days of understanding the impact of Mythos Preview, and as a security community it is critical we share information and experience on it. If there are rogue entities with access who are not sharing their experiences it can only be viewed negatively. 

If true, this deeply undermines Project Glasswing which was setup up explicitly to give cyber defenders early access to Mythos Preview in order to define and mount defenses against it. Threat actors having early access to Mythos Preview puts them on the same footing (or possibly with advantages) versus cyber defenders.

Uncontrolled access to Mythos Preview will hit hardest on operators of critical OT, IoT, and ICS systems. Already knowing the fifty IT organizations with early access to Mythos would naturally focus threat actors on targets outside of those 50 companies, most likely non-standard operating systems that are prevalent in OT and IoT. 

Threat actors are highly sophisticated, very well-funded, and determined. We are in a race to harden systems and have rapid patching at high scale in place before threat actors can leverage Mythos Preview; cyber defenders establishing and maintaining a lead is the highest priority.  

Ram Varadarajan, CEO at Acalvio:

The Mythos breach didn’t require a sophisticated attack. It just required a contractor, a URL pattern, and a Day-One guess, which means the “controlled release” model failed at its weakest link before the model’s capabilities were ever the issue. This is the supply chain problem that perimeter-centric security has always underestimated: access controls are a policy, not an architecture, and policies fail. 

Deception infrastructure is what’s needed and operates precisely in the post-breach environment. It doesn’t assume the perimeter held, it instruments the terrain inside so that when someone wanders in uninvited, their every move becomes a signal.

Nicole Carignan, Senior Vice President, Security & AI Strategy, and Field CISO at Darktrace:

There has been significant attention following reporting that Anthropic is investigating unauthorized access to Mythos, an AI system capable of identifying critical software vulnerabilities. While the investigation focuses on access and controls, the broader security implications are more important — and predictable. This highlights the continued weaponization of commercial tooling. Frontier and near frontier models are increasingly dual use by default. Capabilities designed to improve software quality and security can be repurposed with minimal friction to accelerate vulnerability discovery for malicious ends. This is not a failure of intent; it is an outcome of scale, accessibility, and capability diffusion.

These models will continue to be a target for threat actors to gain access to in order to achieve initial access capabilities to organizations. More concerning is access to critical vulnerabilities that have not yet been released to the public. Possession of undisclosed, high severity vulnerabilities enables threat actors to facilitate more sophisticated and scaled access to organizations through exploiting an “unknown” vulnerability. This further the breakdown in the  threat vulnerability management- centric security program. Detection of exploitation and attempted exploitation becomes the only viable line of defense.

It is also important to be realistic about containment. This was never going to be contained to a single model, organization, or access control failure. Threat actors do not need this system; they need a system with sufficient capability. Whether through parallel development, model leakage, fine tuning, or the combination of multiple weaker models and tools, similar outcomes can be achieved. 

The strategic mistake would be to treat this as an isolated incident rather than a signal. Advanced vulnerability discovery capabilities will continue to proliferate, and the window between discovery and exploitation will continue to shrink. Security teams must operate under the assumption that unknown vulnerabilities are already being found and potentially acted upon.

This reinforces the need for scaled visibility, behavioral analytics, anomaly detection, and autonomous containment across endpoints, cloud, identities, SaaS, and critical infrastructure. Organizations must be able to detect exploitation of vulnerabilities they do not yet know exist — and respond at machine speed.

Finally, this is another reminder that investment in AI adoption without commensurate investment in security and risk management is unsustainable. Especially for critical infrastructure and highly targeted sectors, resilience will depend less on how quickly vulnerabilities can be patched, and more on how effectively exploitation can be detected and contained when prevention inevitably fails.

Diana Kelley, Chief Information Security Officer at Noma Security:

Based on what has been made public so far, this doesn’t look like a compromise of Anthropic’s core systems. It appears more like a boundary failure between trusted environments, involving a third-party access path. That’s a familiar pattern. Third-party privileges often become the weakest link in otherwise well-controlled systems, and this looks consistent with that kind of exposure.

The stakes here scale with the asset. This isn’t just unauthorized access to data, it’s access to a capability designed to identify and potentially chain vulnerabilities. It’s a good reminder that in AI environments, controlling who can access the model, where, and under what constraints is becoming just as critical as protecting the underlying infrastructure.

Heath Renfrow, Co-Founder and Chief Information Security Officer at Fenix24:

The reported unauthorized access to Claude Mythos isn’t surprising… it’s inevitable.

When a frontier model is restricted, high-value, and connected through third-party ecosystems, it becomes a target. This wasn’t a sophisticated breach of core systems; it appears to be exploitation of exposure at the edges-likely access pathways, assumptions in deployment patterns, or partner integrations.

That distinction matters.

Because it reinforces a broader reality: The modern attack surface isn’t just your infrastructure-it’s your ecosystem.

What this actually tells us: 

• Third-party access is now the weakest link. Even if Anthropic’s core environment wasn’t compromised, access through a vendor still represents a breakdown in control. This mirrors what we see in ransomware every day-attackers don’t go through the front door, they go where governance is weakest.
• “Curiosity-driven” access is still a security failure. The claim that the group wasn’t malicious is irrelevant. Unauthorized access = loss of control. Period.
• AI models introduce a new class of asset risk. Frontier models like Mythos aren’t just software-they are intellectual property, decision engines, and potential operational dependencies. That elevates the impact of even limited exposure.

This is exactly why detection is not enough — and why the industry is still behind. Organizations rushing to adopt AI should be asking:

• If this system is compromised, can we recover it?
• If access pathways are abused, can we isolate and rebuild trust quickly?
• Do we even understand what this model is connected to?

Agnidipta Sarkar, Chief Evangelist at ColorTokens:

While Anthropic is investigating, the only information publicly available so far is that the attack used the oldest trick in the book, impersonating someone with existing access. A member of a Discord group interested in unreleased AI models gained access using the credentials of a third-party contractor employee. The users reportedly guessed the model’s URL based on knowledge of Anthropic’s URL patterns for other models. The good news is that Anthropic detected the breach and contained it to that specific vendor’s environment.

One of the key controls that every modern environment needs is microsegmentation, which can effectively reduce the blast radius to specific vendors and leave no elbow room for attackers to navigate. I am hoping Anthropic is using similar controls to keep the attack contained, such as zero trust mechanisms. In the end, if the target is not available, the attack does not progress.

https://www.securitymagazine.com/articles/102253-security-leaders-discuss-the-claude-mythos-breach

A Common Vulnerability Exposure (CVE) that cannot reach the privilege plane is operationally ineffective — even at a CVSS Score of 10. This should be a core philosophy that is embedded into the fabric of software engineering that spans across software development and software maintenance activities. While vulnerabilities increase year-over-year due to improved reporting and better detection capabilities, the Mythos Preview represents a breakthrough in vulnerability detection and discovery that security testing tools obviously missed, and a powerful offensive capability that greatly accelerates the timeline for discovery, disclosure, exploitation, and remediation. The timing of the Mythos Preview could not be more telling, as the White House looks to leverage offensive cyber to shape adversary behaviors. This changes the math on which CVEs threat actors can afford to weaponize. The 33,000 privilege-path dependent CVEs sitting dormant in Exploit Prediction Scoring System (EPSS) are now squarely in the crosshairs. 

After the announcement of this breakthrough in accelerated vulnerability detection and discovery, industry has been focusing on the potential reality of more CVEs, the strain it will have on vulnerability management programs, and the increased blast radius for threat actors to target. While vulnerability management and patching remain necessary, they are not sufficient to address the new reality that Mythos represents. Threat actors are weaponizing these vulnerabilities and CVEs in minutes, and in many cases as part of zero-day campaigns. 

The Vulnerability Management Treadmill

Pre-Mythos, many organizations struggled to keep pace with the year-over-year increase in CVEs. The thought of an increased patching workload has government officials and industry reeling, looking for answers. The Cloud Security Alliance in their rebuttal notes that existing CVE/NVD infrastructure was built for dozens of critical CVEs per month, not hundreds. Mythos does not just strain the CVE/NVD process — it obliterates the assumptions it was built on. Dr. Mehdi Mirakhorli, Computer Scientist and Professor at the University of Hawaii, calls this a never-ending cycle that has become an upgrade-and-patch treadmill. The truth is that faster discovery does not lead to or can be met with faster remediation. Patch and vulnerability management programs were never designed for human-speed remediation against machine-speed exploitation.

The Privilege Path Dependency (PPD)

There are approximately 326,000 CVEs published in the Exploit Prediction Scoring System (EPSS) database, of which approximately 33,000 CVEs are privilege path dependent, meaning these CVEs require existing privileges to exploit, or they grant and accelerate privilege access as an outcome.  CISA’s Known Exploited Vulnerabilities catalog confirms this: 70% of CVEs confirmed in active attacks are privilege-path dependent — not a theory about CVE structure, but a measurement of adversary selection behavior. Once exploited, these CVEs will produce meaningful progression and impact. Pre-Mythos these CVEs were only protected by threat actor resource constraints. 

This is an important note worth mentioning because the Mythos Preview makes what was uneconomical for threat actors, economical. These CVEs require an architectural response that operates independent of discovery and remediation timelines. An appropriate response for CVEs that require and accelerate privilege access is called Privilege Disruption — designed to collapse attack chains and paths that lead to privilege. Privilege Disruption puts the CVEs threat actors target and depends on in a chokehold to make them operationally ineffective.

In my work with federal agencies, I have seen organizations patch 95% of critical CVEs within SLA windows and still experience significant breaches — because the one CVE that mattered was a privilege-path dependent CVE that sat below the priority threshold. The breach was not about volume. It was about which CVE reached the privilege plane.

The CVEs No One Is Talking About

Everyone has been focusing on two major arguments from the revelations of Project Glasswing.

The first argument contends that more vulnerabilities discovered faster will lead to larger, unmanageable backlogs, more rationalized risk acceptance, and misaligned vulnerability management practices at higher velocity.

The second argument contends that AI will not change the fundamental economics of adversary selection of CVEs to exploit. This is based on the notion that the exploitation rate is already low — roughly 1 to 2 percent of published CVEs have ever been weaponized. While these arguments are not wrong, they completely miss the CVEs that actually matter — the ones that allow threat actors to convert their initial access into mission capability and meaningful control. This is where the 33,000 come in. That sweet spot poses significant risk precisely because those CVEs can reach the privilege plane across our software ecosystem. 

Flipping Dormant and Uneconomical CVEs 

Up until now or pre-Mythos, these CVEs have been dormant because of structural barriers like chaining complexity and reliability engineering cost. Each year approximately 74-95% of CVEs are dormant. Threat actors have had close to a decade to weaponize these CVEs but probably haven’t done so because these CVEs have been considered uneconomical. Now that it is possible with Mythos, weaponization costs could drop to $2000 (as cited in Mythos report), bringing the sweet spot of CVEs into focus for threat actors. Threat actors will not need to exploit and weaponize new CVEs as part of their campaigns — the sweet spot of 33,000 represents an extremely attractive and realistic selection target. 

The real danger and potential impact Mythos creates today can simply be characterized by some portions are already being weaponized by nation-states unobserved, some are within reach of mid-tier actors now, and some will cross the threshold as Mythos-class tools commercialize and other AI vulnerability detection tools emerge.  

Contextualizing the 33,000 CVEs

The 33,000 CVEs deserve more context and analytical precision because it represents a major attack surface that threat actors can now weaponize in their campaigns. Mythos removes the dormancy of these CVEs and make them economically feasible to weaponize. Once threat actors target these privilege-path dependent CVEs, it will give them the fuel (privilege) to establish meaningful control and exploit the vulnerability prevalence that exists across an environment or sector. This is not speculation; this is based on cyberattacks we have seen like Salt Typhoon that targeted various telecommunications companies worldwide. Salt Typhoon did not just find a foothold in telecom infrastructure — the threat actors weaponized privilege-path CVEs that gave them the privilege plane to move laterally across carriers, harvest credentials, pre-position, and establish persistent access. This is exactly the operational pattern that privilege-path dependent CVEs enable. 

The Salt Typhoon CVE selection illustrates this precisely. CVE-2023-20198 (Cisco IOS XE, CVSS 10.0) granted unauthenticated privilege — full administrative control — as its primary outcome, a textbook Tier 1 PPD CVE. It was immediately chained with CVE-2023-20273 to escalate further to root and write a persistent implant — a compound privilege chain where neither CVE achieves the campaign objective alone. CVE-2024-21887 and CVE-2023-46805 on Ivanti Connect Secure were deliberately paired the same way: authentication bypass enabling command injection in a privileged runtime context. Salt Typhoon did not select these CVEs randomly — they selected CVEs that gave them the privilege plane.

This is the same structural weakness categories that define the sweet spot of 33,000 CVEs. This is not coincidence — this is threat actor selection in action. They weaponize CVEs that are going to give them strategic advantage and bypass security controls.   

This CVE problem should not be ignored because the numbers reveal a tremendous exposure. Two independent analytical methods converge on the same answer from different directions. CWE Tier 1 structural analysis — examining weaknesses where privilege-path dependency is definitional — identifies approximately 38,000 CVEs in the NVD corpus that explicitly meet this classification. EPSS exploitation probability analysis of the April 2026 dataset identifies approximately 4,986 CVEs in the pre-Mythos active attack surface that are privilege-path dependent. The gap between those two numbers — roughly 33,000 CVEs — represents vulnerabilities that are structurally built to reach the privilege plane, but that adversary economics has kept dormant. Mythos closes that gap. 

CISA KEV Correlation

Threat actors’ selection matters — they need privilege access to fuel their operations and campaigns. Not only does Salt Typhoon confirm this, but CISA KEV makes this concrete — 70% of confirmed weaponized CVEs involve the privilege plane. This is a measurement of threat actor behavior, and not a theory about CVE structure. This further confirms that threat actors think in capability gaps, not CVEs because there are some CVEs that do not make sense economically for threat actors to weaponize — they only need one path to privilege. This extends to software supply chain targeting, where threat actors are increasingly focused on finding those CWEs that land on the privilege plane in widely deployed vendor or open-source software code.   

Privilege Disruption: The Architectural Response

This is precisely the psychology the White House cyber strategy is encouraging — defend against the sweet spot and impose cost, risk, and uncertainty on threat actors’ operations and campaigns. Privilege Disruption is that mechanism. When the privilege plane is architecturally constrained, the path threat actors depend on collapses — regardless of how many CVEs Mythos or any other AI vulnerability detection tool generates. Federal agencies cannot patch their way to adequately defend against Mythos-speed exploitation. The 33,000 privilege-path dependent CVEs that Salt Typhoon and campaigns like it depend on require an architectural response. Privilege Disruption is that response — and it operates before the exploit is written.

Architecturally, Privilege Disruption operates at three chokepoints across the MITRE ATT&CK lifecycle. At Persistence, credential vaulting and rotation ensure that foothold access cannot be converted into standing privilege. At Privilege Escalation — the decisive chokepoint — endpoint least-privilege enforcement removes the execution context that makes CVE exploitation produce privileged outcomes. At Lateral Movement, privileged session governance collapses the pathways that converts a single compromised asset into campaign-scale access. This is distinct from traditional PAM, which governs privileged accounts reactively. Privilege Disruption, as part of a privilege-centric identity security strategy, governs the privilege plane architecturally — making it structurally unavailable to threat actors regardless of which CVE they weaponize.  

https://www.securitymagazine.com/articles/102250-operationally-ineffective-putting-cves-in-a-chokehold-with-privilege-disruption

NIST recently announced changes to how it handles cybersecurity vulnerabilities and exposures (CVEs) included in the National Vulnerability Database (NVD). 

What’s Changing?

Previously, the NVD program attempted to analyze all CVEs in order to provide details, such as severity scores and product lists. With the new changes, NIST will still list all CVEs in the NVD, but only those that meet the prioritization criteria will be immediately enriched, or listed with added details. 

Mayuresh Dani, Security Research Manager at Qualys Threat Research Unit, says, “To me, this change represents a welcome transition from a Universal Vulnerability Library to a more refined Risk-Based Vulnerability Triage model.” 

Trey Ford, Chief Strategy and Trust Officer at Bugcrowd, adds, “What NIST is acknowledging is something the research community has understood for years: you cannot centralize vulnerability triage at this volume and expect it to hold. The signal that actually drives remediation priority has always come from real-world exploitability, not database metadata, and that requires human researchers with adversarial instincts working continuously against live environments. The next generation of vulnerability programs will be built around that kind of active, distributed signal, not quarterly enrichment cycles.”

Understanding the New Prioritization Criteria

As of Apr. 15, NIST is now prioritizing the following CVEs for enrichment: 

While all CVEs submitted will continue to be added to the NVD, those that do not meet the above criteria will be classified as “Lowest Priority – not scheduled for immediate enrichment.”

Dani states, “This change will significantly impact solutions, specifically hardcoded tools, that provide a verdict based on the NVD’s Common Platform Enumeration (CPE) strings. This could lead to a situation where a critical CVE does not list the CPE information as it has not been enriched by the NVD and no alerts will be generated for such vulnerability. 

“I also feel that this move will force the industry to move away from ‘Patch Everything’ toward ‘Patch What Matters.’ Just the burden of determining its severity and relevance now falls entirely on the individual organization. This can be offset when CNAs provide the additional metadata as they understand the architecture of their own products better than a NIST analyst. However, there might be situations where a vendor downplaying a vulnerability in their product for PR purposes. 

“Overall, I will miss the loss of a neutral third-umpire since NIST acted as an unbiased third party up until now.” 

Why the Change? 

The purpose behind this change is to focus attention on the CVEs with the highest chances of causing widespread impact. The change is also prompted by a “surge in CVE submissions,” according to NIST’s released statement. The trend in rising submission, “which increased 263% between 2020 and 2025,” is not expected to lessen in the near future. CVE submissions within the first three months of 2026 have been approximately one-third higher than the same time frame in 2025. 

“We are working faster than ever,” NIST’s statement reads. “We enriched nearly 42,000 CVEs in 2025 — 45% more than any prior year. But this increased productivity is not enough to keep up with growing submissions. Therefore, we are instituting a new approach. The changes described below will allow us to focus on the most critical CVEs while being transparent about how we are managing our current workload. They will also allow us to stabilize the program while we develop the automated systems and workflow enhancements required for long-term sustainability.” 

Vincenzo Iozzo, CEO and Co-Founder at SlashID, explains, “We’ve seen a dramatic spike in AI-reported valid vulnerabilities. According to reports, last year alone, the number of reported vulnerabilities more than doubled. As a result, the new NIST policy is sensible and the categories still covered are the most critical ones. Further, LLMs are approaching the point where they are good enough to allow individual organizations to prioritize and contextualize vulnerabilities in their environment reducing the need for enriched CVEs.” 

“We recognize that these changes will affect our users,” NIST stated. “However, this risk-based approach is necessary to manage the current surge in CVE submissions while we work to align our efforts with the needs of the NVD community. This shift also allows us to dedicate the resources required to develop the automated systems and workflow enhancements that will ensure the program’s long-term sustainability.”

https://www.securitymagazine.com/articles/102255-nists-new-prioritization-criteria-for-cves-examined-by-experts

Sotto la superficie degli oceani si estende una rete invisibile ma cruciale per il funzionamento del mondo contemporaneo: sono i cavi sottomarini in fibra ottica, attraverso cui transita la quasi totalità del traffico dati internazionale. Senza queste infrastrutture, spesso poco percepite dall’immaginario collettivo, non funzionerebbero i mercati finanziari, la logistica globale, i servizi cloud e una parte significativa delle comunicazioni governative e militari.

Con l’intensificarsi delle rivalità tra Stati Uniti, Cina e Russia, questi cavi stanno assumendo una nuova centralità strategica. Da semplice infrastruttura di rete sono diventati potenziali bersagli in scenari di tensione ibrida e soprattutto strumenti di pressione geopolitica. La loro sicurezza oggi è parte integrante della riflessione sulla resilienza delle infrastrutture critiche occidentali.

Una rete globale esposta a minacce silenziose

I cavi sottomarini, pur essendo progettati per resistere a guasti e usura, non sono esenti da possibili danni. In aree geopoliticamente sensibili si sono già verificati episodi sospetti che coinvolgono la loro integrità fisica. Il danneggiamento volontario di queste infrastrutture, realizzabile anche con mezzi apparentemente innocui come un’ancora trascinata, è una minaccia concreta e già manifestatasi in contesti come il Mar Baltico o il Mar Cinese Meridionale, come illustrano altri contributi presenti in questo Quaderno.

Queste azioni non richiedono necessariamente capacità militari avanzate. Possono essere eseguite da navi civili o da unità non convenzionali, e spesso restano avvolte da ambiguità, rendendo difficile attribuirle con certezza. Proprio questa opacità le rende strumenti efficaci di destabilizzazione sotto la soglia del conflitto aperto.

Cybersecurity e cavi sottomarini: intercettazione e controllo dei flussi

Oltre al danneggiamento fisico, esiste una dimensione più sofisticata e meno visibile: l’accesso ai dati che attraversano i cavi. La possibilità di intercettare informazioni sensibili, alterare i flussi o inserirsi nei sistemi di gestione delle stazioni di approdo è considerata una minaccia concreta in contesti di confronto tra potenze tecnologiche. In particolare, preoccupa la crescente presenza di attori statali, soprattutto cinesi, nel mercato della costruzione, manutenzione e riparazione dei cavi globali.

Il rischio non è solo quello di un sabotaggio in tempo di guerra, ma anche la raccolta sistematica di dati, o la predisposizione di backdoor attivabili in caso di necessità. Il controllo diretto o indiretto delle infrastrutture da parte di soggetti esterni può compromettere la riservatezza delle comunicazioni strategiche, specialmente in ambito militare e governativo.

La dimensione strategica del rischio

Nel nuovo contesto geopolitico, l’infrastruttura dei cavi assume i contorni di una leva strategica. Colpirla non significa solo interrompere la connettività, ma può servire a disorientare l’avversario, a rallentarne le capacità decisionali o ad isolare temporaneamente un’area geografica in momenti critici. In caso di escalation, un attacco coordinato a più tratte potrebbe causare un blackout informativo di ampia portata, influenzando operazioni militari e comunicazioni civili.

Oltre all’aspetto operativo, c’è un valore simbolico: la dimostrazione che nessun sistema è al sicuro. Il solo fatto di mostrare di possedere la capacità tecnica per interferire con queste reti può costituire un deterrente o uno strumento di pressione, in una logica di competizione sistemica tra blocchi.

Scenari di evoluzione: dalla frammentazione dell’infrastruttura al decoupling digitale

Il futuro di questa infrastruttura strategica potrebbe seguire più percorsi, e quello forse di più particolare interesse e di cui si intravedono segnali consiste in una prospettiva strutturale, ossia la progressiva divisione dell’ecosistema dei cavi in reti regionali, orientate politicamente. Da un lato, le potenze occidentali stanno investendo in nuove rotte che evitano approdi in territori percepiti come ostili. Dall’altro, la Cina promuove progetti infrastrutturali digitali che collegano Asia, Africa e America Latina lungo direttrici alternative. Il risultato potrebbe essere un internet più frammentato, in cui i dati viaggiano all’interno di blocchi geopolitici separati, con minime interdipendenze.

Le contromisure: resilienza, monitoraggio, autonomia

Di fronte a queste minacce, si stanno sviluppando risposte multilivello. Sul piano militare, diverse marine hanno potenziato la capacità di sorveglianza delle zone dove transitano cavi strategici, anche attraverso l’uso di droni subacquei e sensori avanzati. Organizzazioni internazionali come la NATO hanno istituito cellule specializzate nel monitoraggio delle infrastrutture sottomarine, promuovendo la cooperazione tra governi e operatori privati.

In parallelo, si lavora sulla ridondanza: aumentare il numero di collegamenti, diversificare i tracciati, rafforzare la rapidità di intervento in caso di guasto. Alcuni paesi stanno pre-posizionando materiali di riparazione, migliorando la capacità di risposta a interruzioni improvvise. Anche la cybersecurity è al centro delle strategie, con misure che vanno dalla protezione dei sistemi di controllo, all’uso esteso della crittografia end-to-end, fino alla sperimentazione di nuove tecnologie resilienti come la distribuzione quantistica delle chiavi.

Conclusioni

Il panorama strategico globale ha riscoperto, sotto nuove vesti, l’importanza dei cavi sottomarini. Un tempo considerati semplice infrastruttura tecnica, oggi sono riconosciuti come asset critici da proteggere, monitorare e difendere. In un’epoca in cui la superiorità informativa è un vantaggio competitivo fondamentale, il controllo dei flussi di dati è diventato parte integrante delle strategie di sicurezza nazionale.

Le sfide che si prospettano richiedono un approccio integrato: cooperazione internazionale, innovazione tecnologica, rafforzamento delle capacità di difesa e consapevolezza del rischio. I fondali oceanici non sono più un’area neutra, sono il nuovo terreno dove si gioca, in silenzio, una parte rilevante del futuro equilibrio globale.

Scopri di più consultando il white paper “Quaderni di Cyber Intelligence #8”, dove troverai analisi avanzate, case study e prospettive strategiche dedicate alle infrastrutture critiche, alla geopolitica digitale e alla governance della dimensione subacquea.

https://www.ictsecuritymagazine.com/articoli/cavi-sottomarini-cyber/

Apr 23, 2026 Giancarlo Calzetta Approfondimenti, Attacchi, Attacchi, In evidenza, News, RSS 0

---

Vi ricordate il vecchio adagio “cambia la password almeno ogni sei mesi”? Ecco, da tempo ormai questa prassi e diventata tra quelle sconsigliate da molti esperti, ma resta ancora in auge in alcuni ambienti, tanto che, secondo le analisi di Forrester, ogni reset di password può costare fino a 70 dollari all’azienda del dipendente che deve effettuarlo. Un dato che, da solo, racconta quanto questa attività sia diffusa e strutturalmente rilevante nei processi IT aziendali. Non sorprende quindi che molte organizzazioni abbiano introdotto strumenti di self-service password reset (SSPR), nel tentativo di alleggerire il carico sugli helpdesk. Purtroppo, il numero di richieste gestite manualmente resta elevato, tra onboarding agli strumenti self-service ed eccezioni operative. Inoltre, questa apparente banalità operativa nasconde però un problema molto più profondo: il reset password è uno dei punti di ingresso più sfruttati dagli attaccanti, perché consente di aggirare controlli anche avanzati come la multi-factor authentication.

Quando un reset apre la porta all’attacco

Il motivo è semplice: se un attaccante riesce a convincere un operatore a resettare una password, ottiene credenziali legittime. A quel punto, non è più necessario sfruttare vulnerabilità tecniche, perché l’accesso avviene attraverso canali perfettamente validi.

Un esempio concreto arriva dall’attacco del 2025 contro il retailer britannico Marks & Spencer. L’incidente ha avuto un impatto devastante, con la sospensione delle vendite online per cinque giorni e perdite stimate in circa 3,8 milioni di sterline al giorno.

Secondo le ricostruzioni, il gruppo Scattered Spider avrebbe ottenuto l’accesso iniziale impersonando un dipendente e contattando un service desk esterno. Un semplice reset di password ha fornito agli attaccanti credenziali valide, eliminando la necessità di qualsiasi exploit.

Dal primo accesso al dominio completo

Una volta entrati, gli attaccanti hanno sfruttato Active Directory per estrarre il file NTDS.dit, che contiene gli hash delle password di tutti gli utenti di dominio. Attraverso tecniche di cracking offline, è stato possibile recuperare ulteriori credenziali.

A quel punto, l’attacco si è trasformato in un’escalation silenziosa: movimenti laterali, utilizzo di strumenti legittimi e accessi apparentemente normali hanno consentito di espandere progressivamente il perimetro compromesso.

Quando il livello di accesso è diventato sufficiente, è entrato in gioco il ransomware, con la cifratura dei sistemi critici per pagamenti, e-commerce e logistica. Il risultato è stato un blocco operativo su larga scala, con impatti diretti su clienti e transazioni.

Il service desk come superficie d’attacco

Gli attacchi di social engineering di questo tipo sono particolarmente insidiosi perché non presentano indicatori evidenti di compromissione. Dal punto di vista dell’helpdesk, si tratta semplicemente di una richiesta di supporto come tante altre.

Ed è proprio questa normalità a rappresentare il problema: il service desk diventa un punto di accesso privilegiato per gli attaccanti, soprattutto quando i processi di verifica dell’identità si basano su informazioni facilmente reperibili o aggirabili. In assenza di controlli robusti, una richiesta apparentemente innocua può trasformarsi in un incidente critico.

Per ridurre il rischio, è necessario introdurre meccanismi di verifica che non possano essere facilmente replicati o simulati. L’operatore non deve basarsi su dati dichiarativi, ma deve attivare codici temporanei su dispositivi registrati o integrare sistemi di identità esistenti.

Il punto chiave è la standardizzazione: ogni richiesta deve seguire lo stesso processo, senza eccezioni o discrezionalità, eliminando una delle principali leve sfruttate dagli attaccant.

---

---

---

https://www.securityinfo.it/2026/04/23/reset-password-una-misura-di-sicurezza-che-diventa-minaccia/?utm_source=rss&utm_medium=rss&utm_campaign=reset-password-una-misura-di-sicurezza-che-diventa-minaccia

As artificial intelligence (AI) is increasingly woven into daily work functions and its capabilities grow, it becomes more important that the interactivity, workflows, and decision pathways of these models are tested and understood. Otherwise, organizations could find themselves exposed through their own AI tools. 

This is where the value of AI-specific red teaming comes in. But how can organizations implement this effectively? 

To learn more, Security magazine spoke with Dr. Peter Garraghan, CEO and CTO of Mindgard, Professor in Computer Science at Lancaster University, and fellow of the UK Engineering Physical Sciences and Research Council (EPSRC). 

Security magazine: Tell us about your background and career.

Garraghan: I began my career focusing on distributed systems, cloud infrastructure, and systems security. My academic work as a Chair Professor at Lancaster University has centered on creating and building computing infrastructure of the future. Over time, it became clear that artificial intelligence — and more specifically deep neural networks — was introducing a new class of security problem, one that did not fit neatly into traditional security frameworks.

Around the mid-2010s, as deep neural networks began to outperform other types of machine learning in complex tasks and the introduction of the transform architecture (that presently underpins modern LLMs and agents), I saw a widening gap between AI capability and AI risk. Organizations were deploying models into critical workflows without robust ways to test how those systems behaved under adversarial manipulation. That realization led me to found Mindgard as a research-driven effort to bring attacker-aligned testing methodologies to AI systems. The intent was not to promote fear around AI, but to ensure that as these systems became embedded in enterprise decision-making, they were subjected to the same scientific rigor and adversarial scrutiny that we expect in other high-risk domains.

Security: How is red teaming different from AI-specific red teaming?

Garraghan:
Red teaming is the structured simulation by an adversary to test how an organization withstands challenges. It is not limited to technical systems. A red team may probe strategy, governance, operational processes, physical security, insider risk, or technology controls. The purpose is to think and act like a real attacker to expose blind spots, flawed assumptions, and systemic weaknesses before a genuine adversary does.

AI-specific red teaming applies that adversarial discipline to intrinsically probabilistic systems whose behavior is shaped by data and language. Unlike conventional systems, AI models can be influenced through phrasing, context manipulation, data sources, or tool integrations. Risk often emerges from how models interact with workflows and users rather than from a single technical flaw. As a result, AI red teaming must evaluate behavior and decision pathways over time, particularly as these systems become embedded in business-critical operations.

Security: Why is this an important distinction to make?

Garraghan:
Many organizations underestimate AI risk by applying legacy testing assumptions. Asking a model a series of harmful questions and observing refusals is not equivalent to red teaming. It does not reflect how real adversaries operate, nor does it account for indirect or multi-step exploitation.

Security: How should effective AI red teams operate?

Garraghan:
Start with adversary emulation; model intent, persistence, and economic motivation, rather than simply testing edge cases. AI systems are interactive, so testing should reflect iterative probing and escalation. A single prompt rarely reveals systemic weaknesses; exploitation often emerges across multiple steps.

Equally important is scope. The model alone is rarely the sole point of failure. Red teams must assess orchestration layers, retrieval mechanisms, external data sources, access controls, and downstream actions. Automation can help scale adversarial testing across thousands of variants, but human expertise remains critical to interpret emergent behavior and design novel attack paths. Finally, results must be measurable and mapped to impact. AI red teaming should produce evidence that informs governance and remediation, not anecdotal observations that lack operational relevance.

Security: Is there anything we haven’t discussed that you’d like to add?

Garraghan:
I would emphasize that AI security is about disciplined risk management, not eliminating every possible failure, and that it is a rapidly evolving space both on the scientific and technological front. These systems are probabilistic by design, so the goal is to understand how they fail and to keep those failures within acceptable bounds. We are also entering an era where language acts as a control surface. In AI systems, natural language can directly shape behavior, and as autonomous agents gain access to data and actions, behavioral manipulation shifts from content risk to operational risk. That change requires the same rigor and governance we apply to any security-critical system.

https://www.securitymagazine.com/articles/102249-how-should-effective-ai-red-teams-operate

L’AI ridisegna i confini della digital forensics e apre interrogativi inediti per magistratura e forze dell’ordine

C’è un momento preciso in cui una tecnologia smette di essere neutrale. Non è quando viene usata per fare del male, perché quella è una storia antica quanto il fuoco. È quando diventa così pervasiva, così duttile, così integrata nella catena causa-effetto del crimine da rendere irriconoscibile la distinzione tra arma e scudo. Con l’intelligenza artificiale applicata alla cybersecurity, quel momento è adesso.

Un paper depositato su arXiv il 16 ottobre 2025, dopo essere stato presentato all’APWG-EU Tech Summit and Researchers Forum di Cagliari nel giugno dello stesso anno, mette a fuoco con rara lucidità questa doppia natura dell’AI applicata alla criminalità informatica.

I suoi autori, Silvia Lucia Sanna, Leonardo Regano, Davide Maiorca e Giorgio Giacinto, lavorano tutti all’Università di Cagliari, nell’ambito del progetto SERICS finanziato dal PNRR europeo. Il titolo, sobrio e tecnico, non tradisce l’ambizione dell’analisi: Improving Cybercrime Detection and Digital Forensics Investigations with Artificial Intelligence. Ma quello che il paper contiene è molto più di un inventario di tecniche. È una mappa concettuale di un territorio in rapida trasformazione, con implicazioni che si estendono ben oltre i laboratori universitari, fino alle aule dei tribunali.

Il doppio volto dell’AI nella criminalità informatica e nelle indagini digitali

La premessa da cui muovono i ricercatori cagliaritani è scomoda ma ineludibile: i modelli linguistici di grandi dimensioni, Gemini, Copilot e ChatGPT, che oggi assistono gli analisti forensi nell’elaborazione di enormi volumi di evidenze digitali, sono gli stessi strumenti che i criminali informatici possono impiegare per nascondere le proprie tracce, automatizzare attacchi e generare contenuti sintetici difficili da attribuire.

Non si tratta di un paradosso astratto. È la descrizione operativa di un ecosistema in cui l’AI agisce simultaneamente come lente d’ingrandimento per gli investigatori e come nebbia artificiale per chi vuole sottrarsi all’indagine. Il riferimento esplicito nel paper è a un recente rapporto Europol sul cybercrime in Europa, che conferma la persistenza e la crescente complessità del fenomeno, richiedendo strumenti di contrasto all’altezza.

Sul versante difensivo, il contributo dell’AI alla forensics digitale è già consistente e documentato. I sistemi di machine learning permettono di analizzare in tempo reale flussi di dati di rete alla ricerca di pattern anomali, di classificare malware con una granularità che gli approcci signature-based non possono raggiungere, di correlare eventi distribuiti su infrastrutture eterogenee ricostruendo catene di attacco che altrimenti rimarrebbero invisibili.

I Large Language Model, in particolare, stanno emergendo come strumenti di supporto cognitivo per gli analisti: capaci di supportare la fase di reporting, producendo bozze di documenti, definendo glossari tecnici e sintetizzando le evidenze in linguaggio comprensibile anche per i non specialisti, e di accelerare il triage su volumi di prove che nessun team umano potrebbe processare nei tempi richiesti da un’indagine.

Ma è sull’altro versante, quello offensivo e anti-forense, che il paper introduce gli elementi più perturbanti.

Il caso studio: steganografia LSB generata da tre chatbot

Il contributo più originale della ricerca riguarda un caso studio condotto direttamente dai ricercatori, che vale la pena esaminare nella sua specificità tecnica. Sanna e colleghi hanno testato Gemini, Copilot e ChatGPT su due capacità distinte: la generazione di immagini con contenuto steganografico tramite tecnica LSB (Least Significant Bit) e la produzione di codice Python funzionante per la codifica e decodifica di immagini steganografiche.

La steganografia digitale applicata sulle immagini è una delle tecniche di occultamento dati più consolidate: consiste nel modificare i bit meno significativi dei pixel di un’immagine per nascondervi informazioni, in modo percettivamente invisibile all’occhio umano. L’immagine di input usata nel test è un file PNG bianco prelevato da Wikimedia, nel quale è stato incorporato il messaggio segreto “This is a secret message APWG.” Le immagini generate e i contenuti nascosti sono stati poi verificati con zsteg, un tool Linux specializzato in analisi steganografica, e con uno script esterno disponibile su GitHub.

I risultati sono significativi: tra i tre modelli testati, Copilot si è dimostrato il più performante nell’esecuzione di entrambi i compiti. Un dato che non è un dettaglio minore: emerge da un test controllato e comparativo, con implicazioni dirette sulla valutazione del rischio nei diversi ecosistemi di AI generativa.

È fondamentale riportare una precisazione che i ricercatori stessi formulano in modo esplicito: la presenza di questi chatbot in un contesto digitale non è di per sé un indicatore di criminalità o attività malevola. La tecnica steganografica, se impiegata da un criminale informatico, diventa uno strumento anti-forense, ma la stessa tecnica ha usi legittimi nella protezione delle comunicazioni. Questa distinzione, che il paper enuncia con chiarezza, è essenziale per evitare letture fuorvianti del lavoro.

La sfida per gli investigatori: quando il codice viene scritto dall’AI

Il dato che rende la ricerca particolarmente rilevante per chi lavora nelle investigazioni non è tanto la tecnica in sé, ma la democratizzazione del suo accesso. Un soggetto privo di competenze di programmazione avanzata può chiedere a un modello linguistico di generare uno script steganografico, personalizzarlo e incorporarlo in un flusso operativo d’attacco. La barriera tecnica all’ingresso si abbassa in modo radicale. La rilevabilità del contenuto nascosto, già difficile per sua natura, non peggiora sul piano tecnico, ma si moltiplica su scala: più attori potenziali, più artefatti, più rumore di fondo per gli investigatori.

Si pone poi un problema ulteriore, che il paper apre pur senza pretendere di risolverlo: come si documenta e si attribuisce, in sede processuale, un contenuto generato tramite AI? Quando il codice che nasconde le prove è stato scritto da un chatbot su richiesta dell’indagato, la catena causale che collega soggetto e artefatto diventa più complessa da dimostrare. Non si tratta ancora di un tema affrontato esplicitamente dal sistema giudiziario italiano, ma è la traiettoria logica di ciò che questo tipo di ricerca rende oggi tecnicamente possibile.

Il paper anticipa infine una visione ancora più radicale per il futuro: gli autori prevedono che l’AI sarà usata in modo sempre più pervasivo tanto nel cybercrime quanto nella digital forensics, fino a configurare scenari di AI-vs-AI interamente autonomi, in cui sistemi di attacco e sistemi di difesa si fronteggiano senza intermediazione umana diretta.

Implicazioni operative per gli investigatori

Per chi lavora sul campo, unità di cybercrime, CERT, team SOC e magistratura specializzata, il paper suggerisce alcune linee di riflessione immediate.

La prima riguarda la formazione. Se gli LLM sono strumenti già usati sia dagli analisti sia dagli attaccanti, le competenze necessarie per valutarne l’output, comprenderne i limiti e riconoscerne i pattern, devono entrare nei programmi di aggiornamento delle forze dell’ordine in modo strutturale, non episodico.

La seconda riguarda la catena di custodia digitale. In un contesto in cui contenuti generati da AI si moltiplicano, la documentazione del processo di raccolta e analisi delle evidenze deve includere procedure specifiche per l’identificazione di artefatti potenzialmente prodotti o modificati tramite AI. Non è più sufficiente certificare che un file “esiste”: occorre certificare con quale grado di confidenza si possa classificare la sua origine.

La terza, la più delicata, riguarda il valore probatorio delle analisi AI-assistite in sede processuale. Come approfondito anche nel dibattito sulla digital forensics e il diritto, gli strumenti di rilevazione automatica sono accurati ma non infallibili, e la loro accuratezza varia in funzione del modello che ha generato il contenuto e delle eventuali tecniche di offuscamento applicate. Utilizzarli come prova diretta senza un adeguato framework di riferimento e senza perizia tecnica qualificata rischia di introdurre nel processo una forma di errore sistematico difficile da contestare.

Vale la pena segnalare, infine, un ulteriore problema di contesto: l’uso di Private AI in ambito forense sta emergendo come requisito operativo nelle indagini più sensibili, proprio perché l’invio di evidenze digitali a servizi AI in cloud introduce criticità di controllo dei dati incompatibili con la catena di custodia.

Un contributo italiano al dibattito globale

Vale la pena sottolineare la provenienza istituzionale di questo lavoro, non per campanilismo, ma per una ragione sostanziale. Il paper nasce all’interno del progetto SERICS (Security and Rights in CyberSpace), uno dei spoke del PNRR dedicati alla cybersecurity, che coinvolge decine di atenei e centri di ricerca italiani. Il fatto che Silvia Lucia Sanna conduca questa ricerca nell’ambito del Dottorato Nazionale in Intelligenza Artificiale (Sapienza Università di Roma in collaborazione con l’Università di Cagliari) segnala una continuità di investimento sistemico che va ben al di là del singolo paper.

L’Italia è uno dei paesi europei in cui il dibattito sull’uso processuale dell’AI è più vivo, sia per la tradizione di dottrina giuridica in materia di prova digitale, sia per la presenza di strutture investigative specializzate con sensibilità tecnica crescente. Un lavoro come quello di Sanna e colleghi non è solo un contributo alla letteratura accademica: è un documento che può e dovrebbe alimentare la formazione delle procure specializzate e informare le linee guida che le istituzioni competenti stanno costruendo attorno all’uso investigativo dell’intelligenza artificiale.

Conclusione: la neutralità non è un’opzione

L’intelligenza artificiale non ha alleanze. Ottimizza obiettivi. Se l’obiettivo è rilevare una comunicazione criminale nascosta in un’immagine, l’AI può farlo. Se l’obiettivo è nascondere quella comunicazione in modo da complicarne l’individuazione e l’attribuzione, l’AI può farlo con la stessa competenza e, come dimostra il caso di Copilot nel test dei ricercatori cagliaritani, con una certa efficacia.

Questa simmetria non è una ragione per limitare l’uso dell’AI nella forensics. È invece una ragione per sviluppare, con urgenza e rigore, i framework tecnici, legali e procedurali che permettano di usare questi strumenti in modo robusto, verificabile e giuridicamente sostenibile.

Il paper di Sanna, Regano, Maiorca e Giacinto non offre risposte definitive. Offre qualcosa di più prezioso: dati sperimentali concreti e le domande giuste. In un campo che cambia a questa velocità, è già un contributo straordinario.

https://www.ictsecuritymagazine.com/articoli/ai-criminalita-informatica/

Crypto scammers are targeting the thousands of ships stranded near the Strait of Hormuz—and at least one ship that faced Iranian gunfire may have been tricked into believing it had paid Iran for safe passage.

The first warning of such a crypto scam came from the Greek maritime risk management company MARISKS on April 20, according to Reuters. The company alerted shipowners that scammers posing as Iranian authorities had sent messages to shipping companies asking for “transit fee” payments in bitcoin or tether.

That may be particularly confusing for shipping companies because of how Iran has asserted control over the Strait of Hormuz—a vital shipping channel and maritime chokepoint that normally allows Persian Gulf countries to provide one-fifth of the world’s oil and liquefied natural gas supply. Iranian authorities have demanded cryptocurrency payments from oil tankers to pass through the waterway and required ships to follow a route near Iran’s coastline to undergo inspection.

MARISKS identified one ship as having potentially fallen victim to crypto scams after it attempted to pass through the strait on April 18, although Reuters was unable to confirm that information. The incident supposedly occurred during a brief window when Iran claimed it was allowing ships to undergo inspection to pass through, but the ship in question turned back after Iranian military forces fired upon it. There are about 2,000 ships and 20,000 mariners still stranded near the strait.

That ship may not be alone in falling for a crypto scam while seeking safe passage. On April 22, the Liberia-flagged cargo ship Epaminondas, owned by the Greek company Technomar shipping and operated by the global shipping company MSC, was fired upon after it had reportedly received permission to pass through the strait, and authorities are checking whether the message purporting to grant safe passage “may have been fraudulent,” according to Ekathimerini.

https://arstechnica.com/security/2026/04/crypto-scam-lures-ships-into-strait-of-hormuz-falsely-promising-safe-passage/

Crypto scammers are targeting the thousands of ships stranded near the Strait of Hormuz—and at least one ship that faced Iranian gunfire may have been tricked into believing it had paid Iran for safe passage.

The first warning of such a crypto scam came from the Greek maritime risk management company MARISKS on April 20, according to Reuters. The company alerted shipowners that scammers posing as Iranian authorities had sent messages to shipping companies asking for “transit fee” payments in bitcoin or tether.

That may be particularly confusing for shipping companies because of how Iran has asserted control over the Strait of Hormuz—a vital shipping channel and maritime chokepoint that normally allows Persian Gulf countries to provide one-fifth of the world’s oil and liquefied natural gas supply. Iranian authorities have demanded cryptocurrency payments from oil tankers to pass through the waterway and required ships to follow a route near Iran’s coastline to undergo inspection.

MARISKS identified one ship as having potentially fallen victim to crypto scams after it attempted to pass through the strait on April 18, although Reuters was unable to confirm that information. The incident supposedly occurred during a brief window when Iran claimed it was allowing ships to undergo inspection to pass through, but the ship in question turned back after Iranian military forces fired upon it. There are about 2,000 ships and 20,000 mariners still stranded near the strait.

That ship may not be alone in falling for a crypto scam while seeking safe passage. On April 22, the Liberia-flagged cargo ship Epaminondas, owned by the Greek company Technomar shipping and operated by the global shipping company MSC, was fired upon after it had reportedly received permission to pass through the strait, and authorities are checking whether the message purporting to grant safe passage “may have been fraudulent,” according to Ekathimerini.

https://arstechnica.com/security/2026/04/crypto-scam-lures-ships-into-strait-of-hormuz-falsely-promising-safe-passage/

Microsoft released an emergency patch for its ASP.NET Core to fix a high-severity vulnerability that allows unauthenticated attackers to gain SYSTEM privileges on devices that use the Web development framework to run Linux or macOS apps.

The software maker said Tuesday evening that the vulnerability, tracked as CVE-2026-40372, affects versions 10.0.0 through 10.0.6 of the Microsoft.AspNetCore.DataProtection NuGet, a package that’s part of the framework. The critical flaw stems from a faulty verification of cryptographic signatures. It can be exploited to allow unauthenticated attackers to forge authentication payloads during the HMAC validation process, which is used to verify the integrity and authenticity of data exchanged between a client and a server.

Beware: Forged credentials survive patching

During the time users ran a vulnerable version of the package, they were left open to an attack that would allow unauthenticated people to gain sensitive SYSTEM privileges that would allow full compromise of the underlying machine. Even after the vulnerability is patched, devices may still be compromised if authentication credentials created by a threat actor aren’t purged.

“If an attacker used forged payloads to authenticate as a privileged user during the vulnerable window, they may have induced the application to issue legitimately-signed tokens (session refresh, API key, password reset link, etc.) to themselves,” Microsoft said. “Those tokens remain valid after upgrading to 10.0.7 unless the DataProtection key ring is rotated.”

Microsoft describes ASP.NET Core as a “high-performance” web development framework for writing .Net apps that run on Windows, macOS, Linux, and Docker. The open-source package is “designed to allow runtime components, APIs, compilers, and languages [to] evolve quickly, while still providing a stable and supported platform to keep apps running.”

https://arstechnica.com/security/2026/04/microsoft-issues-emergency-update-for-macos-and-linux-asp-net-threat/