Category Archives: Security

One Token, Three Tools Deep, 2,500 Companies Across Five Continents

Posted on by

One leaked automation token. Three tools deep. Over 2,500 organisations across five continents exposed. That is the entire anatomy of 2026’s largest AI supply chain breach, and it took roughly forty minutes to happen.

How a Security Scanner Became the Weapon

In March 2026, a threat group tracked as TeamPCP compromised Trivy, a widely used open-source security scanner, through a leaked automation token. From there the attackers force-pushed malicious code into Trivy’s own version tags. When LiteLLM, a popular AI gateway that routes traffic between applications and model providers, pulled the poisoned scanner into its build pipeline, it published two compromised releases to PyPI, versions 1.82.7 and 1.82.8. A hidden file inside those packages executed automatically the moment Python started, no import required, harvesting cloud keys, repository tokens, SSH credentials, Kubernetes secrets and AI provider API keys from anyone who installed it. The malicious packages were live for roughly forty minutes before removal. That was enough.

 

A Genuinely Global Exposure List

CloudSEK’s analysis, later corroborated by an FBI advisory in July, identified more than 2,500 affected organisations and 434,000 exposed CI/CD pipelines. The named companies span the world rather than one region: AWS, Nvidia, Salesforce and Airbus’s US Space and Defense division from the US, Samsung Electronics and MediaTek from Asia, Siemens, Volkswagen and Munich Re from Germany, Thales and Orange from France, Roche from Switzerland, Philips from the Netherlands, Vodafone and the London Stock Exchange Group from the UK, and Thomson Reuters from Canada, alongside Cisco, FedEx, Deloitte and dozens more. This was never a story about one country’s technology sector. It was a demonstration of how deeply a single open-source dependency now sits underneath enterprise infrastructure everywhere.

 

The Same Argument, a Different Layer

This publication has already made the case that The September AI Outage Had Two Real Causes. Almost Everyone Reported One. LiteLLM extends that argument one layer deeper, into the software supply chain feeding the infrastructure itself. A vendor risk register that lists which cloud provider or model vendor an organisation depends on is no longer sufficient. It also needs to account for the open-source scanners, build tools and CI pipelines every one of those vendors quietly depends on, tools most procurement processes never ask about because nobody signed a contract for them.

 

What a PMO Should Actually Check

Three questions belong on every technology steering committee agenda this quarter. First, does anyone in the organisation maintain a current list of the open-source build and security tooling embedded in critical CI/CD pipelines, not just the paid vendors. Second, when was a leaked or rotated credential last tested as an actual incident scenario, rather than a line item in a policy document. Third, if a dependency three layers removed from a primary vendor were compromised tomorrow, how long would it take anyone to notice. The organisations named in the LiteLLM breach were not careless. They were exposed by a dependency most of them did not know they had, which is precisely the risk a vendor register built only around visible, contracted suppliers will always miss.

Three Regulators, Three Continents, One 72-Hour Deadline Nobody Is Ready For

Posted on by

Three regulators, on three different continents, converged on almost the same number this year, entirely independently. Washington set 72 hours. Brussels set 72 hours, after an initial 24-hour early warning. Abu Dhabi’s own financial free zones set 24 to 72 hours, depending on which one is asking. None of them coordinated on this. All three concluded, at roughly the same time, that a cyber incident report cannot wait for an organisation to feel ready to send it.

 

What Each Regime Actually Requires

In the United States, the Cyber Incident Reporting for Critical Infrastructure Act, CIRCIA, is expected to be finalised this month. It will require covered entities across 16 critical infrastructure sectors, an estimated 300,000 organisations in total, to report a significant cyber incident within 72 hours and a ransomware payment within 24. In the European Union, the NIS2 Directive is already live. Essential entities, those with 250 or more staff or turnover above 50 million euros, across energy, healthcare, banking, water and digital infrastructure, must send an early warning within 24 hours, a full assessment within 72, and a final report within a month. In the UAE, the pattern repeats at the free zone level. Firms regulated by Abu Dhabi Global Market must report a material cyber incident to the regulator within 24 hours, weekends and public holidays included. Firms in the Dubai International Financial Centre generally work to a 72-hour window. Three jurisdictions, three legal systems, the same rough number.

 

Why This Is a Delivery Problem, Not a Legal One

Most organisations have handed this requirement to legal or compliance to interpret, which is the wrong owner. A 72-hour reporting deadline is not primarily a question of what the law says. It is a question of whether an organisation can detect an incident, assess its materiality, assemble the right people, and produce an accurate report, all inside three days, under pressure, without the benefit of hindsight. That is a programme capability, not a policy position. Legal can tell you what the deadline is. Legal cannot build the operating rhythm that hits it.

 

The Capability Most Organisations Are Missing

The gap rarely shows up in the reporting template. It shows up upstream, in whether anyone can say, inside the first few hours, what actually happened. A US hospital system’s own social media accounts were hijacked by the ransomware group that had already breached it, which posted ransom demands directly to the public before the organisation regained control, a case study in how quickly a slow, uncoordinated response becomes the story itself. A reporting deadline assumes an organisation already knows what it is looking at. Most of the work that determines whether a report is accurate, or even possible, happens before anyone opens the compliance template.

 

What a Real Programme Looks Like

A credible response to any of these three regimes looks less like a legal memo and more like a programme: a named incident commander, a materiality assessment framework agreed before an incident rather than during one, a communications protocol that assumes attackers may control channels an organisation thinks are its own, and a rehearsal cadence, not a policy filed away and never tested. None of that is jurisdiction-specific. An organisation that builds this properly for NIS2 has, with minor adjustment, built it for CIRCIA and for ADGM as well.

The interesting part of this story is not which country moved first. Three regulators, working independently on three continents, arrived at the same conclusion, that organisations cannot be trusted to disclose on their own timeline, so a timeline was imposed. Whichever regime applies, the question worth asking this quarter is simple. Could the organisation hit the deadline today, if the incident happened this afternoon?

93% Have Been Breached by Vulnerable AI Code. 30% Still Ship It Anyway.

Posted on by


Seventy per cent of developers believe AI-generated code carries more vulnerabilities than the code they write themselves. Thirty per cent ship it into production anyway, knowingly. Ninety-three per cent of the same respondents report at least one breach traced back to a vulnerable application. Awareness of the risk and action on the risk are not the same thing. They rarely are, according to every major AI risk study published so far this year.

 

The Core Finding Repeats Across Every Study That Looks

The Purple Book Community’s State of AI Risk Management 2026 report, surveying more than 650 senior cybersecurity leaders across North America and Europe between December 2025 and February 2026, found 59 per cent of organisations acknowledging shadow AI within their own environment, despite 90 per cent claiming confidence in their AI visibility. Seventy-eight per cent are already piloting or deploying agentic AI systems, and 73 per cent say AI-assisted development is outpacing their security review cycles. Fifty-one per cent run 11 or more separate security scanning tools, and 46 per cent of teams spend significant time triaging vulnerabilities that turn out not to matter. Governance has not kept pace with adoption. It has fallen further behind with each new AI capability organisations switch on.

 

The Global Maturity Picture Is Worse Than Any Single Region’s

The World Economic Forum’s Advancing Responsible AI Innovation research, covering 1,500 organisations worldwide, found 81 per cent still sitting in the earliest two stages of responsible AI maturity. Regional breakdowns make that global figure look almost optimistic. In Asia-Pacific, only 1 per cent of organisations have fully operationalised responsible AI practices, a gap researchers describe as more pronounced than the global average. Separate research from Dataiku found 94 per cent of CEOs suspect employees are already using generative AI tools without authorisation, while 75 per cent of data leaders admit low trust in their own organisation’s AI agent deployments.

 

The Middle East Shows a Different Symptom of the Same Disease

Middle Eastern enterprises are not struggling with pilots. Multiple regional AI advisory reports this year describe successful proof-of-concept projects stalling the moment organisations attempt enterprise-wide rollout, blocked by exactly the governance gap the global data points to: no clear ownership of AI risk decisions, inconsistent access controls, and the added complexity of navigating different data protection and AI-specific regulations across Gulf jurisdictions simultaneously. The technology performs in the pilot. The governance structure needed to scale it safely usually does not exist yet.

 

What This Means for How Organisations Govern AI Risk

Every regional variant of this research points to the same structural gap rather than three unrelated problems. A risk committee should treat confidence surveys as a warning sign rather than reassurance, ask specifically what percentage of AI-generated code has been reviewed rather than whether a review process exists on paper, and confirm who owns AI risk decisions before the next agentic AI pilot moves toward production. The pattern holding across North America, Europe, Asia-Pacific and the Gulf is consistent enough to stop treating it as one company’s oversight and start treating it as this year’s defining governance failure.

A Tenfold Attack Surge in London, a Governance Mandate in Abu Dhabi

Posted on by

In January to May 2026, UK healthcare providers logged 264,000 attack events, against 27,000 for the whole of 2025. That is a tenfold jump in five months, according to SonicWall’s telemetry across NHS-linked sensors, and it occurred on a sector where the gap between what boards think they know and what is actually protected has never been wider.

 

The Long Tail of a Single Attack

The clearest illustration of what that gap costs sits two years in the past and is still unresolved. The June 2024 ransomware attack on Synnovis, the pathology provider serving South East London hospitals, exposed data from roughly a million NHS patients and forced more than 10,000 outpatient appointments and 1,700 elective procedures to be postponed. As of April 2026, South London and Maudsley NHS Foundation Trust was still processing pathology results without fully restored systems, and the incident has been linked to a patient death at King’s College Hospital. Nearly two years is not a recovery timeline any board signed off on. It is what happens when governance treats cyber resilience as an IT programme rather than a clinical safety issue.

 

Reactive Versus Mandated: Two Governance Models

The UK’s surge sits inside a largely reactive governance model, where boards respond to incidents and regulators tighten guidance after the fact. Abu Dhabi has taken the opposite route. Its Healthcare Information and Cyber Security standard, now in its second version, is built around six pillars, and governance is listed first, ahead of resilience, capability, partnerships, maturity and innovation. Every hospital, insurer and medical device maker operating in the emirate has to comply, and the standard explicitly frames cyber security as an organisation-wide responsibility covering people and process rather than a narrow technology control bolted onto IT. It is a mandated structure built before the incident, rather than a review commissioned after one.

 

Why the Stakes Keep Rising

The economics make the governance question harder to defer. Healthcare ransom demands have climbed sharply, with one widely cited industry analysis putting the average demand at $16.9 million, up from $577,800 the prior quarter, and healthcare remains one of the most targeted sectors globally, with 77 per cent of organisations reporting a ransomware attempt in the past twelve months, because attackers know disrupted care creates leverage no other industry carries. A board that treats a green status on a cyber dashboard as sufficient assurance is trusting a number it has usually never interrogated.

 

What Boards Should Actually Be Asking

Two different regulatory paths, one shared conclusion. Cyber governance in healthcare cannot sit exclusively with a CISO or an IT director reporting up through a technical channel. It needs a named board-level owner who can answer, in plain terms, three questions: which clinical services stop if this system fails, how long the organisation can run on manual process before patient safety is affected, and when that assumption was last tested rather than assumed. The Synnovis timeline suggests most boards do not currently have confident answers. The Abu Dhabi model suggests what building toward one actually looks like, governance treated as the first pillar of resilience rather than the last line of a post-incident report.

Smarter, Faster, More Dangerous: How Hackers Are Using AI to Target You

Posted on by

Cyberattacks used to take time.
A convincing phishing email required effort. A fake website needed a designer. Voice impersonation meant hours of editing.

Not anymore.

Thanks to generative AI and widely available tools, today’s hackers can launch highly convincing, targeted attacks at scale, and they’re getting much better by the day.
The days of poorly written scam emails and generic threats are long gone. What we’re now seeing is a new era of intelligent, adaptive, and believable cybercrime.

And all that isn’t the scary part.
It’s not just corporations being targeted. It’s you.

What’s Changed?
AI has lowered the barrier to entry for cybercriminals.
What once required technical skills can now be done with simple prompts, pre-built tools, and large language models. Hackers no longer need to be code-savvy, they just need to know what to ask AI to do.

Some of the most common and dangerous tactics include:

1. AI-Enhanced Phishing Emails
You know the old tell-tale signs of a scam email, bad grammar, odd formatting, suspicious links.

But now?
AI models can craft flawless, natural-sounding messages that mimic corporate tone, structure, and urgency. Some are even personalised using information scraped from social media or public platforms.
A Harvard Business Review article warns that AI is not only increasing the volume of phishing scams, it’s making them dramatically more believable, eroding the traditional red flags people rely on.

Examples:

  • “Your HR document has been flagged for review.”
  • “Unusual login activity detected. Please confirm access.”

These messages look like they came from your IT department. They’re often convincing enough to trick even experienced professionals.

2. Instantly Generated Fake Websites
Previously, creating a fake login page or payment portal took time. Now, AI can generate realistic website templates in seconds, complete with company logos, branding, and believable copy.

According to Axios, a security firm found that attackers used generative AI to spin up over 130 phishing sites mimicking Okta’s login pages in under 30 seconds, faster than most organisations can detect them.

Hackers use these sites to:

  • Steal login credentials
  • Collect payment details
  • Harvest personal information

And with AI image tools, they can even generate realistic “employee photos” and fake testimonials to make it all look legitimate.

3. Deepfake Audio and Voice Cloning
Voice imitation isn’t science fiction anymore, it’s a real and rising threat.

With just a few seconds of audio (often taken from videos, podcasts, or voice notes), AI can clone someone’s voice and generate new speech that sounds eerily accurate.

This threat has already gone mainstream. The Wall Street Journal reported a rise in deepfake CEO scams, where criminals impersonated executives to trick employees into making large financial transfers. In one case, a UK engineering firm, Arup, lost $25 million to a realistic deepfake video of its CFO during a fraudulent video call.

Scenarios include:

  • A “CEO” calling an employee requesting an urgent wire transfer
  • A loved one’s voice asking for help while travelling
  • A “bank representative” confirming personal details

As AP News points out, even 30 seconds of audio is enough to train a convincing voice clone.

4. AI Chatbots and Social Engineering
Hackers are deploying AI-powered chatbots on fake websites, posing as support agents or HR reps.

These bots:

  • Engage victims in believable conversations
  • Ask probing questions
  • Capture sensitive information over time

And they learn quickly. The more people interact, the better they become at deception.

5. Highly Targeted Attacks (Spear Phishing 2.0)

With access to LinkedIn profiles, public emails, and personal posts, AI can generate customised attacks that feel personal.

You might receive an email from a “colleague” referencing a recent project. Or a text that uses your child’s name.

This hyper-targeted approach increases trust, and increases the chance you’ll click.

Even Government Sites Are Being Faked

Hackers aren’t just targeting companies and individuals, they’re now cloning government websites with alarming accuracy.

A recent TechRadar report revealed that attackers are using AI to build replicas of official government portals, tricking citizens into submitting tax details, bank info, or ID documents.

Why This Should Concern Everyone

Cybercrime is clearly no longer just a corporate risk.

It’s personal, scalable, and increasingly indistinguishable from real communication.

And the tools hackers use are getting faster, cheaper, and smarter.

Even careful individuals are falling for scams that, five years ago, wouldn’t have passed the sniff test.

As the Economist notes, we’re entering an era where AI-enabled cybercrime may outpace traditional digital defences, causing massive financial and societal damage.

So, What Can You Do?

1. Stay Sceptical, Even When It Sounds Right
Don’t trust by default. Even if a message or voice seems legitimate, double-check independently.

 

2. Verify URLs and Sender Addresses
Look closely at email addresses, links, and domain names. AI-generated scams often use domains that look almost right.

 

3. Avoid Clicking, Go Direct Instead

If you receive a message from your bank, employer, or supplier, visit their website directly rather than clicking a link.

4. Use Multi-Factor Authentication
It adds a second layer of protection even if your login details are compromised.

5. Talk About It
The more we educate each other, family, colleagues, employees, the harder it becomes for scams to succeed.

Takeaways That Matter

AI is a powerful tool, but it’s not neutral.
The same technologies that help us write, code, and communicate are being used to deceive, manipulate, and exploit.

This is more to do with awareness rather fear.

Because when anyone can fake anything, critical thinking becomes your first line of defence.

The best protection you have is to stay informed, stay alert, and stay a step ahead.

Healthcare Data is Every Hacker’s Dream, What We Can Do About It

Posted on by

The United Health technology unit recently disclosed that the 2024 cyberattack affected 190 million Americans, and exposed critical vulnerabilities within the healthcare industry. This breach, among the largest in the healthcare industry, exposed the critical vulnerabilities that hackers exploit. Healthcare data has become a prime target due to its immense value, longevity, and the unique pressures on healthcare organizations to maintain uninterrupted service. To address these threats, the industry must recognize the underlying factors driving attacks and implement strategic measures to defend against them.

Why Healthcare Data Is a Prime Target
Hackers frequently focus on healthcare data because it is uniquely valuable and often less protected than data in other industries. Several factors contribute to this trend:

  • High Market Value of Medical Records:
    Personal health information (PHI) can fetch higher prices on the black market than credit card details. Unlike a credit card number that might be quickly canceled after a breach, medical records contain a wide range of sensitive data, from Social Security numbers to insurance and payment details. This makes it possible for cybercriminals to commit identity theft, insurance fraud, and other illegal activities repeatedly, yielding substantial profits.
  • Data Longevity:
    While financial data often has a short shelf life, once exposed, it’s quickly rendered useless, medical data retains its value for years. A stolen medical record doesn’t expire; it can be exploited long after the initial breach, making it especially attractive to hackers looking for enduring returns on their efforts.
  • Critical Nature of Healthcare Services:
    Healthcare organizations face unique pressures that make them more vulnerable to ransomware attacks. A hospital cannot afford prolonged downtime when patient lives are on the line. This urgency increases the likelihood that organizations will pay ransoms quickly to regain access to critical records and systems. Hackers know that a disruption to healthcare services carries far more leverage than in other industries, and they capitalize on this urgency.
  • Weakness in Cybersecurity Defenses:
    Historically, healthcare entities have lagged behind other sectors in adopting strong cybersecurity measures. Many run outdated legacy systems that are harder to patch or upgrade, and they often have fewer dedicated cybersecurity resources than financial or tech companies. This combination of older infrastructure and limited defenses makes healthcare institutions easier targets and slower to recover after an attack.
  • Regulatory and Legal Pressures:
    The heavily regulated nature of healthcare creates additional incentives for attackers. A major breach can trigger costly lawsuits, hefty fines, and regulatory scrutiny. This pressure increases the likelihood that healthcare organizations will quickly comply with ransom demands to prevent widespread exposure and severe financial penalties.

Consequences Beyond the Breach
When healthcare data is compromised, the ramifications extend far beyond the initial theft. Affected patients face heightened risks of identity theft and financial fraud, along with potential disruptions to their medical care if records are altered or unavailable. For healthcare organizations, breaches result in steep regulatory fines, lawsuits, reputational damage, and the financial burden of remediating vulnerabilities. Collectively, these factors undermine trust in healthcare institutions and erode the public’s confidence in their ability to protect sensitive data.

Strengthening Healthcare Cybersecurity
Given the ongoing and intensifying threats, healthcare organizations must shift their approach from reactive to proactive. This involves:

  • Investing in Advanced Security Measures: Technologies like zero-trust architectures, AI-driven threat detection, and encryption must become standard.
  • Conducting Regular Security Audits: Frequent assessments and penetration tests help identify vulnerabilities before attackers can exploit them.
  • Prioritizing Employee Training: Human error remains a major entry point for cyberattacks. Comprehensive training and simulated phishing exercises can help staff recognize and mitigate risks.
  • Enhancing Incident Response Protocols: Organizations must have well-defined, tested plans to quickly and effectively respond to breaches, minimizing downtime and data loss.

The Role of Policy and Regulation
Stronger regulatory frameworks and better enforcement can push the healthcare sector toward higher cybersecurity standards. Collaboration between government agencies and industry players can lead to standardized best practices, improved reporting protocols, and shared threat intelligence. By collectively raising the baseline for cybersecurity, healthcare institutions can become less appealing targets for cybercriminals.|

Resilience: The Path Forward
The United Health breach served as a wake-up call about events that may have unfolded quietly months prior. To prevent future incidents, healthcare organizations must invest in resilience, upgrading systems, embedding security in every process, and fostering a culture of vigilance.

Cybersecurity in healthcare transcends technical concerns and must be viewed as a strategic imperative. By recognizing the unique value of medical data, understanding why it’s targeted, and taking decisive action, the industry can protect patients, preserve trust, and ensure that healthcare services remain available when they are needed most.

Your Greatest Cybersecurity Asset Isn’t Technology, It’s Your People

Posted on by

Digital transformation is driving innovation at a pace we’ve never seen before. With technologies like Artificial Intelligence (AI), the Internet of Things (IoT), and machine learning (ML) leading the charge, businesses are unlocking new levels of efficiency and creativity. But as organisations embrace this digital revolution, they inadvertently widen the door to cyber threats. Consider the case last year about the US$25 million AI-powered deepfake scam in Hong Kong, a stark reminder of the risks that accompany rapid technological change.

While many organisations pour resources into advanced cybersecurity tools, they often overlook one critical element: their people. Employees are not only a potential vulnerability but also the first line of defense. When equipped with the right mindset, training, and tools, they become your strongest cybersecurity asset.

Employees: The Linchpin of Cybersecurity
Studies consistently show that human error remains the leading cause of data breaches. Nearly a third of employees in Asia, for instance, have been found to click on phishing links or respond to fraudulent requests. With digital footprints growing larger every day, the potential for mistakes multiplies.

However, this isn’t a story of inevitability. When organisations prioritise their people as part of their cybersecurity strategy, the narrative shifts. Employees can detect threats, report anomalies, and respond swiftly, turning potential risks into proactive defenses.

Zero-Trust Security: A Non-Negotiable Foundation
One critical element of strengthening cybersecurity lies in adopting a zero-trust model. The principle is simple yet transformative: trust no one, verify everything. Under this approach, every individual and device attempting to access your network must be authenticated and authorised, no matter their location or role.

By granting employees only the access they need for their specific responsibilities, organisations minimise their exposure to threats. Zero trust isn’t about creating a culture of suspicion; it’s about building a framework that proactively protects against vulnerabilities.

Building a Culture of Cyber Awareness
Creating a security-first organisation requires more than just policies and firewalls. It demands a cultural shift where cybersecurity becomes second nature to everyone.

  • Lead by Example: Leaders must model best practices, actively participate in training, and visibly prioritise cybersecurity initiatives. If leaders care, employees will follow.
  • Normalise Security Discussions: Make cybersecurity part of everyday conversations. Whether in team meetings or company updates, emphasise its importance.
  • Celebrate Successes: Recognise employees who identify and report potential threats. Acknowledgment breeds motivation.

When employees see that cybersecurity isn’t just a box-ticking exercise but an organisational priority, they’ll feel empowered to contribute actively.

Practical Steps to Empower Your Workforce
Here’s how to turn employees into cybersecurity champions:

  1. Continuous Learning
    Cyber threats evolve quickly. Regular training ensures employees stay ahead of the curve, making informed decisions when it matters most.
  2. Simulated Exercises
    Phishing simulations and other drills test readiness in real-world scenarios, reinforcing learning and boosting confidence.
  3. Access Control
    Leverage zero-trust principles to limit access based on roles, ensuring that sensitive data is only available to those who genuinely need it.
  4. Encourage Reporting
    Create a culture where employees feel safe reporting suspicious activity. Fear of blame often delays critical action.
  5. Gamify Cybersecurity
    Inject some fun into learning. Leaderboards, incentives, and competitions can turn cybersecurity into a team-driven challenge.

The Stakes Have Never Been Higher
Cyber breaches cost more than just money. They erode trust, tarnish reputations, and disrupt operations. Yet, many organisations focus disproportionately on technology while underinvesting in their people. This imbalance needs correcting.

The truth is that your employees, armed with the right training, tools, and a zero-trust framework, are your best defense. By embedding a culture of security awareness and recognising the critical role people play, organisations can protect themselves while fostering resilience.

Final Thoughts
Cybersecurity isn’t solely the responsibility of IT teams or a handful of specialists. It’s an organisational commitment, a shared responsibility, and, most importantly, a team effort. Every click, every report, and every moment of vigilance matters.

Empowering your workforce to embrace this responsibility is more than just a strategy; it’s a necessity. Start by educating, equipping, and inspiring your people. Because in the end, the strongest firewall isn’t software. It’s your people.