Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The rise of connected devices has fundamentally reshaped industries, enabling unprecedented levels of automation, efficiency, and innovation. These devices fall under the Extended Internet of Things (XIoT), a broad category encompassing traditional Internet of Things (IoT) devices, operational technology (OT), industrial control systems (ICS), the Internet of Medical Things (IoMT), and other connected assets that span enterprise IT and operational environments.

A phishing campaign is impersonating travel agency Booking.com to target employees in the hospitality industry, according to researchers at Microsoft. The attacks use a social engineering technique called “ClickFix” to trick victims into downloading malware.

Our recent research reveals a concerning discrepancy between employees' confidence in their ability to identify social engineering attempts and their actual vulnerability to these attacks. While 86% of respondents believe they can confidently identify phishing emails, nearly half have fallen for scams in the past. This disconnect between perceived competence and demonstrated vulnerability, the "confidence gap", poses a substantial risk to organizations. The Danger of Overconfidence.

My two previous recent postings on AI covered “Agentic AI” and how that impacts cybersecurity and the eventual emergence of malicious agentic AI malware. Both of those articles started to touch on the idea of automated agentic AI defenses. This posting goes into a little more detail on what agentic AI defenses might mean. It starts with agentic AI, which is a collection of automated programs (i.e., bots or agents) working toward a common goal.

Is true anonymity possible online? As more companies and governments threaten our online privacy, people are looking for more ways to browse the internet with increased privacy or total anonymity. We will therefore explore why people are choosing to browse the web anonymously, why it’s important, and popular tools to browse the web with increased privacy or total anonymity.

A newly identified cyber campaign has been actively targeting organizations across multiple sectors in Japan since January 2025. Threat actors of unknown origin have been exploiting CVE-2024-4577, a critical remote code execution (RCE) vulnerability in the PHP-CGI implementation of PHP on Windows, to gain unauthorized access to victim systems. This campaign has primarily impacted Japan’s technology, telecommunications, and e-commerce industries.

PCI DSS (Payment Card Industry Data Security Standard) v4.0.1 is designed to protect cardholder data and secure payment environments. Compliance with PCI DSS is critical for any organization that stores, processes, or transmits payment card information. The framework helps prevent fraud, data breaches, and financial losses associated with cyber threats targeting payment systems.

We are excited to announce that Indusface has successfully achieved PCI DSS v4.0.1 certification as a service provider, reinforcing our commitment to industry-leading security and compliance. This milestone underscores our dedication to protecting sensitive cardholder data and helping businesses navigate evolving security regulations.

Governments across the globe have introduced new legislation to address the escalating risks of cybersecurity threats. In 2021, the United States issued executive order 14028, requiring government agencies to develop a plan for implementing a zero-trust security strategy. This included rolling out multi-factor authentication (MFA), data encryption, and ensuring employees have secure access to the data and applications they need on their devices according to the principle of least privilege access.

A merger or acquisition is one of the most critical steps a company can take. However, alongside the opportunity it presents for business growth, it also poses significant security threats. A target company—or even its supply chain—may bring with it a host of hidden security risks.