Gambit Security investigated three real-world attacks in which cybercriminals used AI for scripts, exploit tools, DevOps tasks, and interactive attacks. AI not only appears to accelerate attacks, but can also determine which corporate data and systems are most critical to a victim. In one attack, AI even mapped out backups, restore points, and recovery processes, […]
80% of European companies believe they have control over their email, while approximately half are dependent on non-European providers. 56% fear that corporate data could become accessible through extraterritorial legislation such as the US CLOUD Act. Data storage in Europe does not automatically mean data sovereignty: the jurisdiction under which the provider falls is also […]
Researchers have uncovered new attack vectors that can undermine passkey authentication, challenging the idea that passwordless automatically means attack-proof. The attacks focus on weaknesses around the authentication flow and implementation, rather than breaking the underlying cryptography. Manipulation of WebAuthn processes, fallback mechanisms and compromised environments can potentially allow attackers to bypass or weaken passkey protection. […]
AI agents challenge traditional IAM by acting at machine speed and scale, with unpredictable access patterns that human-centric security models weren’t designed for. Prompt injection, credential exposure and multi-agent delegation create attack paths that conventional authentication and authorization controls struggle to govern. Existing behavioral monitoring can be effectively blind to autonomous agents, while ownership, accountability, […]
Gartner sees Verifiable Credentials (VCs) and decentralized identity as transformational technologies poised to reshape digital identity across industries. VCs enable standardized, secure and compliant data exchange between multiple parties at lower cost and higher speed. Instead of repeatedly proving identity, users can receive verified credentials once and reuse them cryptographically across services and transactions. Decentralized […]
Hackers breached the MyDr medical platform, potentially compromising sensitive data belonging to nearly 19 million Polish patients. The platform is used by thousands of clinics and medical practices, dramatically increasing the scale and impact of the breach. The stolen information reportedly includes highly sensitive medical data, with politicians and other public figures among those affected. […]
The EDPS is deeply concerned about the European Commission’s plans to significantly expand Europol’s powers. Europol would soon be permitted to process personal data for long periods from individuals with no demonstrable links to crime. The watchdog warns of the increased volume of data, new data categories, and insufficient oversight and safeguards. The EDPS demands, […]
Supermarket chain Sainsbury’s has committed another painful blunder with its facial recognition software. An innocent customer was wrongly identified as a shoplifter, after which he was publicly removed from the supermarket and prevented from paying for his groceries. Although Sainsbury’s later acknowledged the error and offered £150 in compensation – which the customer immediately donated […]
Apparel giant Levi Strauss & Co. recently disclosed a cybersecurity incident after attackers used targeted social engineering tactics to compromise three employees’ company computers. This initial breach allowed the attackers to gain access to internal files and successfully exfiltrate specific corporate information. Thanks to a rapid incident response, Levi’s managed to contain the intrusion effectively. […]
CISA and international cybersecurity agencies have updated the minimum requirements for a Software Bill of Materials (SBOM), significantly strengthening software supply chain transparency. New mandatory elements, such as author digital signatures, hashes, licensing information, and the context of SBOM generation, ensure much better code integrity and traceability. A robust SBOM must map all components and […]