Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

For years, security leaders were asked a simple question: are we secure? Today, that question is harder to answer. Boards, regulators, insurers, and customers want proof of resilience: assurance that organizations understand their exposure, are prioritizing the right work, and are reducing risk over time.

AI security tools are no longer just defensive layers. They are high value targets being studied, fingerprinted, and bypassed much like traditional endpoint detection and response (EDR) platforms and antivirus solutions were in their early days. The speed and scale at which these tools are being deployed makes reactive defense increasingly unsustainable.

According to a 2024 report from IoT Analytics, there were 16.6 billion Internet of Things (IoT) connected devices at the end of 2023, and that number is expected to grow to 41.1 billion by 2030. This means an increased attack surface for malicious actors to take advantage of, especially given that the security posture of the vendors that provide these devices varies greatly.

The automotive industry is changing faster than ever, with smarter factories, connected vehicles, digital supply chains, and software-driven everything. But as the industry accelerates into this new era, something else is racing alongside it: cyber threats. Over the past year, Bitsight Threat Intelligence data has shown a sharp rise in ransomware activity targeting companies across the auto ecosystem. And what’s striking is how often the same names keep appearing.

When threat actors compromise your vendors, they are rarely aiming for a single, isolated win. They are looking for leverage. Every third party represents a potential force multiplier: a trusted connection, a shared platform, a pathway into multiple downstream environments. We recently looked at the vulnerabilities that are most commonly being used against vendors, but vulnerabilities alone don’t tell the full story.

Over the past year, Bitsight TRACE has identified 14,220 unique internet-exposed Open Platform Communications Unified Architecture (OPC UA) servers globally. Given OPC UA's critical role as a communication backbone for modern industrial control systems (ICS) across numerous sectors, this level of exposure warrants a closer look. Our analysis reveals that over half (51.74%) of these devices allow unauthenticated access, while 80.26% transmit data in plaintext without encryption or integrity protection.

Organizations are facing a complicated and unwieldy cybersecurity perimeter due to the sprawling web of third-party dependencies that now account for 30% of all data breaches. This network of interconnected applications and infrastructure gives threat actors an opportunity through an extended attack surface to exploit organizations. Attackers are also moving faster by leveraging AI to weaponize zero-day vulnerabilities in days rather than weeks, and most organizations remain dangerously behind the curve.

Cyber threat intelligence is often presented as a catalog of named threat actors, past incidents, and attribution labels that promise clarity. For defenders trying to understand risk, this structure feels reassuring. It suggests that threats can be identified, tracked, and anticipated based on observed behaviors. In practice, that confidence is often overstated.

Actions have consequences. In cybersecurity, we often only see actions at the surface level: a suspicious IP, a new domain, or a single mention on a dark web forum. For threat hunters, the consequences of treating these actions as isolated incidents are significant. These signals are rarely "one-offs." They are the visible tips of coordinated campaigns built on months of planning, spanning multiple tactics, techniques, and procedures (TTPs). Today’s adversaries are organized.

Patching cadence is a critical component of maintaining an organization’s cybersecurity posture. It refers not just to whether patches are applied, but how quickly and consistently vulnerabilities are addressed across systems and software. A regular, timely patching process reduces the window of exposure to known vulnerabilities, limiting opportunities for exploitation and strengthening overall vulnerability management.