Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

For years, cybersecurity has had a familiar villain: the external attacker. The hacker breaking through the firewall, stealing credentials or exploiting an unpatched vulnerability. It is the scenario we have trained for, built defenses around and spent decades trying to prevent. But the next major breach may not begin with someone breaking into your environment at all, it may begin with an AI agent that already has access.

Phishing is a form of social engineering that has evolved beyond simple lures into complex, multi-stage attacks exploiting trusted software, cloud identities and business platforms to bypass traditional security. Attackers leverage these campaigns to deliver trojans capable of stealing credentials and also establishing remote code execution, which might serve as a gateway for lateral movement.

A new report commissioned by IBM has found that one in four breaches is now AI-enabled, up 56% from last year. “Most AI-driven attacks reported in the study targeted critical infrastructure sectors (62%), with financial services and energy organizations experiencing the highest concentration, raising the risk of broader systemic disruption,” the report says. “Financial services breaches were reported to cost on average $6.3 million, while energy breaches cost on average $5.2 million.

For years, ransomware was treated mostly as a malware problem. A user clicked something bad, files were encrypted, a ransom note appeared and everyone had a very bad week. That version still exists, of course, because cybercriminals love recycling old hits. But ransomware has changed significantly over the last year.

Vietnam has emerged as a cornerstone of the global digital economy, but this rapid digitization has come with a significant surge in sophisticated cyber threats. As the country transitions into a more mature technological landscape, the methods used to protect its most critical asset, the workforce, must also evolve. We are witnessing a pivotal move away from traditional, checkbox in-person training toward modern, automated and AI-driven digital resilience.

Researchers at Microsoft warn that phishing emails are still the top initial access vector, with more than 2 billion phishing threats detected each month during the second quarter of 2026.

Like many, the travel and tourism industry has undergone a radical digital transformation over the last few years. From AI-curated itineraries and biometric check-ins to interconnected booking engines and smart room tech, the modern “Digital Guest Journey” is more seamless than ever before. However, this rapid innovation has come at a steep price.

You cannot protect what you do not know exists. That statement has been true throughout the history of cybersecurity, but it has become even more important as organizations adopt new technologies and employees gain access to powerful AI tools. While many organizations focus on defending against external threats, they often overlook a growing problem much closer to home: devices, applications, and services operating within their environment that nobody knows about.

Threat actors are increasingly abusing trusted workflows to carry out attacks, according to a new report from Gen Digital. “ are not only sending malicious links or dropping malware,” the report says. “They are abusing context, sessions, workflows, brands, update systems, advertising platforms and delegated authority.