Mailchimp
Not subscribed to OpsMatters Newsletter
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Latest posts
Is Your Endpoint Strategy Broken?
Endpoint security is changing, but are organisations still protecting devices for a way of working that no longer exists? From Windows endpoints drifting out of compliance to VDI, preventative security and a radically different approach to what runs locally, the full Razorwire episode asks whether it’s time to rethink the endpoint. Watch the full episode to discover what modern endpoint security could look like.
Rethinking the Endpoint - IGEL Spotlight on Technology
If most of your applications no longer run on the endpoint, why are you still managing and securing it as though they do?
Ungentlemanly behavior: Insights into a ransomware operation
They call themselves The Gentlemen Behind the name is one of the most active ransomware operations of the past 12 months, linked to 683 victims and a playbook built around compromised credentials, legitimate tools, rapid privilege escalation, and aggressive defense evasion. In this video, Susie Evershed and Rafe Pilling break down the latest research from Sophos Counter Threat Unit (CTU), revealing how some affiliates can move from initial compromise to ransomware deployment in less than 24 hours.
Demo: Sophos AI Defense in Action
Sophos AI Defense is available as an add-on and is fully integrated with Sophos EDR, Sophos XDR, and Sophos MDR. The result is practical AI security: better visibility, faster investigation, and stronger protection against the real ways AI agents are being used in the enterprise. To learn more, visit Sophos.com/AI Defense.
What is GRC transformation? A practical definition for enterprise CISOs
GRC transformation is the organizational change from running governance, risk, and compliance as periodic, check-the-box paperwork to running it as continuous, AI-native cyber risk assurance measured in business outcomes. It is not a tooling upgrade. It is a change in what you are asked to prove. The old question was whether the work got done by audit time. The new question is whether risk is understood and the controls meant to manage it are working right now.
An agent breaks in production. Who's accountable?
We asked eight security and product leaders who's accountable when an agent ships to production and breaks something. Nobody said the model. Harish Gaggar named the reason. An agent runs on permissions someone approved and configuration someone set. Ron Reiter drew the line in the same place, accountability sits with whoever decided what the agent could actually do. As agents act across more systems, the accountability trail gets harder to follow. Most teams cannot determine which human granted an agent access.
AI agents can inherit local admin rights
An AI agent runs as a process under whatever account launched it, and it inherits that account's access token. If the account has local admin rights, so does the agent, along with every helper process and script it spawns, an example would be Claude Desktop running under an admin account, spawning PowerShell helpers. What makes agents different from a typical privileged app is that their next action often comes from content parsed at runtime, including untrusted input.
When the Loss Is Downtime Rather Than Data
Most cyber loss models are shaped around a breach. Records exposed, notification cost per record, regulatory penalty, credit monitoring, litigation. The arithmetic is well established and the inputs are reasonably well evidenced. Apply that model to an outage where nothing left and nothing was taken and every one of those categories returns zero. The organization was down for four days and the model reports almost no loss, which is not a calibration problem but the wrong model.
A Complete Audit Trail That Names No One
An AI assistant reads four hundred documents across a tenant. Every read is logged. The application is named, the file is named, the timestamp is exact, and the access is attributed to an account that belongs to nobody. The audit trail is complete and it cannot answer the question an auditor asks. Nobody asks whether an access was recorded. They ask who reached the data and whether that person was authorized, and a shared service account answers neither.
OWASP Top 10 for Large Language Model Applications: Complete Guide to LLM Security Risks
Companies rush to utilise the potential of large language models; however, every new use case of generative AI introduces attack vectors previously unknown in traditional web security. The present guide provides an overview of the official OWASP GenAI LLM Top 10 2026 list and explains the appearance of each vulnerability in practice along with mitigation recommendations.