Skip to content
kevinferron.com

An argued case · Every step sourced

Security in the age of AI

I think there is no real way to be secure in the age of AI other than constant monitoring, threat analysis and agent swarms. This series argues that one sourced step at a time, and says where the evidence is thinner than the claim.

My view is that if you are not keeping up with the arms race, with a vast array of tools running in real time, around the clock, you will not keep up with the growing threats. That is my argument, not the sources’. Each step reports what a source says, with its hedge; my own reasoning is marked “My view”.

What attackers are documented doing

In August 2025 Anthropic described a criminal who used an AI coding agent to run a data-extortion operation against at least 17 organisations in a month, from reconnaissance to the ransom note. Anthropic’s own characterisation is that one operator can now have the impact of an entire criminal team, and it expected the approach to become increasingly common. Anthropic reports on misuse of its own model and sees only that model’s use.

Three months later it reported a campaign it assesses with high confidence was run by a state-sponsored group. Anthropic estimates the AI did about 80 to 90 percent of the tactical work, at peaks of thousands of requests, often several a second. People chose the targets and approved the big steps.

Its September 2026 report, covering December 2025 to August 2026, says that way of working has now spread across every class of actor it investigated. In one case agents took more than 2,100 sets of cloud sign-in tokens across more than 40 tenants in about 34 hours, with AI agents doing nearly all of the work. In the same case, one compromise went from a stolen developer token to full cloud admin in roughly three hours.

Anthropic’s own assessment is that AI “has inverted the cost back onto defenders”. A capable adversary can, at least in theory, close the loop: change malware until detection stops catching it, faster than defenders can build new detections. That is an assessment, not a measurement.

The clocks

The measured clocks are short. CrowdStrike (vendor data) puts the average time for a criminal intruder to move from the first machine to another at 29 minutes in 2025, with the fastest case at 27 seconds. Mandiant’s median time from initial access to hand-off to a second group fell from more than eight hours in 2022 to 22 seconds in 2025. One is a mean and one a median, from different cases, so I never plot them as one line.

Time to exploit has fallen too. Mandiant’s average for vulnerabilities exploited in the wild went from 63 days in 2018 and 2019 to 5 days in 2023. One caveat from Mandiant: the 2023 figure leaves out 15 outliers (with them the average is 47 days). A note of mine: the definitions differ between the two posts. Mandiant says its numbers are conservative, so the real times are almost certainly earlier.

Exploiting vulnerabilities is now the most common way in. Verizon’s 2026 report summary puts it at 31 percent of breaches with a known entry route (dataset October 2024 to November 2025), with credential abuse at 13 percent. I have read the summary only, not the full report.

Governments say the same thing as a forecast. The UK’s NCSC says the time from disclosure to exploitation has shrunk to days and AI will “almost certainly” reduce it further. CISA’s directive of June 2026 says attackers’ use of AI “may further narrow” the time defenders have between a patch and exploitation. Both are predictions.

NCSC also says there will “almost certainly be a digital divide” between systems that keep pace with AI-enabled threats and many that are more vulnerable. That, too, is a prediction.

My viewOf NCSC’s predictions this is the one that worries me most, because it is about keeping pace.

The hours

Intruders also pick their hours. Sophos defines business hours as 8 am to 6 pm, Monday to Friday: 50 of the week’s 168 hours. A ransomware launch time picked at random would land outside them 70.2% of the time (my arithmetic). In Sophos’s own cases (vendor data, not a sample of all organisations) the share launched outside them was 94 percent in 2022, 90 percent in 2023 and 83 percent in 2024.

That is above chance every year, but the lead narrowed to 12.8 points in 2024, and Sophos’s 2024 cases (vendor data) include a service it sells, so the three years are not a clean trend. The first chapter lets you move the band and see.

What the defence data show

The evidence on defence is thinner. IBM’s 2025 breach study (research by the Ponemon Institute, sponsored and analysed by IBM, which sells security AI) found that organisations using security AI and automation extensively had breach lifecycles 80 days shorter and costs USD 1.9 million lower than those using none. That is an association reported by a sponsor, not a controlled comparison.

What “continuous” means, and where I go further

NIST’s word is “continuous”. SP 800-137 defines continuous monitoring as keeping ongoing awareness of security, vulnerabilities and threats to support risk decisions. A footnote says continuous means assessing at a frequency sufficient for those decisions, with data collected at discrete intervals, not literally around the clock. It also says monitoring cannot be done efficiently by manual processes alone or by automation alone.

My viewSo NIST does not say 24/7. That is my position, beyond the standard. If an intruder’s moves are measured in seconds and minutes, at any hour, I think the defence has to run at that speed: constant monitoring, threat analysis that keeps up, and agents doing the first pass, with people making the decisions. Anthropic recommends that security teams try AI for security operations, detection and response, and CISA’s performance goals say to automate event analysis as much as possible. Neither goes as far as I do. How an agent graph is built is on the AI side of the Lab.

My viewA team that works Sophos’s business hours is there for 50 of 168 hours and absent for 118. A tool can be awake all week. A person cannot, and I do not think anyone should have to be.

The last 30 days

As of 24 October 2026

A dated snapshot of 24 September to 24 October 2026. Each item carries its date. The sources are advisories, the companies’ own disclosures and security researchers’ write-ups, and the vendor ones are labelled. It is the stories I judged most relevant to the argument, not a count of everything that happened, and it will age.

Known exploited vulnerabilities, added each day

CISA added 35 vulnerabilities to its Known Exploited Vulnerabilities catalogue between 24 September and 23 October, 8 of them since 17 October 2026. In 2025 it added 20.4 a month on average (245 over 12 months), so the window is 1.7 times that (my arithmetic from CISA’s own catalogue, which was at version 2026.10.23).

24 Sep: 2 added25 Sep: 3 added26 Sep: 0 added27 Sep: 2 added28 Sep: 0 added29 Sep: 1 added30 Sep: 1 added1 Oct: 1 added2 Oct: 2 added3 Oct: 0 added4 Oct: 1 added5 Oct: 0 added6 Oct: 0 added7 Oct: 0 added8 Oct: 5 added9 Oct: 0 added10 Oct: 0 added11 Oct: 0 added12 Oct: 0 added13 Oct: 2 added14 Oct: 4 added15 Oct: 1 added16 Oct: 2 added17 Oct: 0 added18 Oct: 0 added19 Oct: 0 added20 Oct: 6 added21 Oct: 0 added22 Oct: 0 added23 Oct: 2 added24 Sep23 Oct
Last seven daysEarlier days2025 average, a day: 0.68
  • None of the 35 was flagged as known to be used in ransomware campaigns (0 flagged); the flag can be updated later.
  • 31 of the 35 had a due date three days after being added.

The top stories

Showing 9 of 9, newest first. The filters use the source’s own words about AI, and who found each intrusion. The “counterweight” is the evidence that cuts against my argument.

  • As of 24 October 2026

    Four groups using AI agents to run intrusions

    AI involved, per the sourceFound by third partiesIncludes vendor claims

    CrowdStrike (a security vendor) reported four previously unreported threat actors whose offensive agent frameworks sat exposed in open directories. Between May and August 2026, it says, they used AI to run campaigns in which agents make decisions and execute commands. A vendor post two weeks earlier tied a campaign against financial organisations in South Korea to an agentic framework called ARTEX; the number of affected organisations remains unconfirmed.

    Dates, detection, AI role and sources
    Dates
    • 7 October 2026: CrowdStrike (vendor) links the finance campaign, active from late September, to ARTEX
    • 21 October 2026: CrowdStrike (vendor) publishes its report on the four groups
    How it was detected
    Found by a security vendor looking at the attackers’ own exposed directories, not by the victims.
    Time to exploit
    In one case, the vendor says, an agent moved sideways and harvested domain controller credentials in about 20 minutes without further human guidance. Its assessment is that agents can often reach their objectives within an hour.
    AI involvement, as the source states it
    The vendor says the agents made decisions and ran commands, and that all four actors got past commercial AI safety controls. It hedges its assessments: the cases “likely” show agentic AI making baseline offensive operations commonplace (moderate confidence), and it says such intrusions will “almost certainly” increase (high confidence). Those are its predictions. The full report is behind a form and was not read.

    As of 24 October 2026. Published 21 October 2026.

  • As of 24 October 2026

    PHP2Shell: critical PHP flaws, and sources that disagree

    AI involved, per the sourceIncludes vendor claims

    The PHP project released fixes on 21 October for two critical remote-code-execution flaws and said that updating is the only safe choice. The release was brought forward after the flaws’ identifiers circulated online on 20 October with a wrong release time and a wrong severity score. Separately, a reporting firm mistakenly published a video of its proof of concept, which the project says contributed to accelerated development of various proofs of concept, and a distributor broke the embargo on 21 October by shipping fixed images more than six hours early.

    Dates, detection, AI role and sources
    Dates
    • 2024: A PHP core developer first sees the root cause of one of the flaws; the fix stalls and restarts for months, which the project calls a structural failure (before the window)
    • 11 August 2026: Calif reports a flaw with the same root cause to the project (before the window)
    • 20 October 2026: The flaws’ identifiers circulate online, early
    • 21 October 2026: Fixed versions released; CISA publishes its alert
    • 22 October 2026: watchTowr (vendor) updates its write-up
    • 23 October 2026: CrowdStrike (vendor) publishes its assessment; CISA updates its alert
    How it was detected
    No intrusion is confirmed. The flaws were reported to the project by outside researchers, and the early leak came from the disclosure process, not from victims.
    Time to exploit
    Disputed. One vendor reports exploitation on release day; CISA and another vendor report none that succeeded as of 23 October.
    AI involvement, as the source states it
    The PHP Foundation says AI tools from two AI companies were used to scan PHP and to validate reports and exploits, that AI-assisted research has sharply raised the number of reports its team receives, and that “a person makes every call and works on every patch”. It adds that tools now find bugs faster than ever, for defenders and attackers alike. None of the sources read says AI was used to attack.
    The sources disagree
    • CISA (alert of 21 October, updated 23 October): It had not observed successful exploitation in the wild as of the time of publication.
    • watchTowr (vendor): It observed exploitation of both flaws in the wild, through its honeypot network, on 21 October.
    • CrowdStrike (vendor, 23 October): It had not seen successful exploitation in the wild or in its own honeypots, only testing, probing and failed attempts, and says many public proofs of concept only crash the target and need adapting to a PHP version and application.

    As of 24 October 2026. Published 21 October 2026.

  • As of 24 October 2026

    LiteLLM release hijacked through a leaked key

    Found by third parties

    A malicious version of the LiteLLM package was published on 21 October from a repository the attacker controlled. Its own account of the cause, which it calls its canonical source of truth and which corrects its earlier updates: a config file committed to a public repository in May exposed the master key of its agent-orchestration platform, and the key was never revoked. That platform held an organisation owner’s GitHub token, which the attacker used from 10 October, then took more tokens. On 21 October the attacker turned off branch protection, pointed the release workflow at a lookalike repository and approved the production gate with a second stolen token. This card uses only the corrected account.

    Dates, detection, AI role and sources
    Dates
    • 27 May 2026: A config file with the platform’s master key is committed to a public repository, then overwritten; the key is not revoked (before the window)
    • 10 October 2026: The attacker uses the key to take the owner’s token and begins taking more
    • 21 October 2026: The malicious release goes out and is caught
    • 23 October 2026: The project publishes its canonical account
    How it was detected
    An outside community member caught the bad release within 20 minutes of publication and opened an issue; the project says it became aware at about 13:00 UTC. A security research team shared its own independent investigation.
    Time to exploit
    Access ran from 10 October to 21 October, 11 days, before the release exposed it. The project says the release gate had been loosened earlier that week to allow faster backports.
    AI involvement, as the source states it
    The project does not say AI carried out the attack. The AI link is the entry point: the leaked key belonged to an agent-orchestration platform. Its first post said an AI coding tool had put a token in a response; its canonical account says the first token came from a different service, so that claim is not used here.

    As of 24 October 2026. Published 21 October 2026.

  • As of 24 October 2026

    Ransomware through a flaw patched five months earlier

    Counterweight

    Unit 42, the research team at Palo Alto Networks (which makes PAN-OS), reported that two ransomware operators, under the labels Spikey Scorpius (also called Qilin) and Tarnished Scorpius (also called Inc), are exploiting a flaw in the GlobalProtect VPN in PAN-OS. A fix had been available since May 2026 and the flaw was listed in the KEV catalogue from 13 May. After getting in, the operators bypass multi-factor sign-in to set up a VPN session and use remote-management tools; in one case they took credentials offline from a domain controller’s virtual disk, which gets around endpoint detection running inside the machine.

    Dates, detection, AI role and sources
    Dates
    • 13 May 2026: The flaw is added to CISA’s KEV catalogue; the fix is available (before the window)
    • 29 May 2026: A public proof of concept follows (before the window)
    • 19 October 2026: Unit 42 updates its brief to report the ransomware use; further updates on 20 and 23 October
    How it was detected
    Reported by the research team of the firm that makes the product. No source read says how the affected organisations noticed, so this is not counted as found by a third party.
    Time to exploit
    Not a speed story. About five months passed between the fix and the ransomware use being reported.
    AI involvement, as the source states it
    No AI involvement is recorded in the source read. This is a counterweight: a known, patched flaw left open, not AI speed.

    As of 24 October 2026. Published 19 October 2026.

  • As of 24 October 2026

    ConnectWise Cloud Backup compromise and Microsoft’s ARTEX write-up

    AI involved, per the sourceIncludes vendor claims

    ConnectWise reported unauthorised access to application identities in its Cloud Backup service, shut off application access, disabled seven of the identities, and later reset accounts and credentials. It says it cannot tell from its own investigation whether a given customer’s tenant saw activity. Microsoft (a vendor, reporting its own telemetry and detections) assesses that the group it tracks as Storm-0940 was responsible, and says the actor then used an agentic AI framework, ARTEX, to attempt sign-ins to more than 2,250 tenants. Microsoft says most of the targeting was not successful and that a successful sign-in does not necessarily mean data was accessed.

    Dates, detection, AI role and sources
    Dates
    • 10 October 2026: An automated password spray against 327 accounts at eight organisations begins (to 14 October); no sign-in succeeded, per Microsoft
    • 16 October 2026: ConnectWise says it is investigating attempted unauthorised access
    • 17 October 2026: ConnectWise reports access to application identities and disables seven of them
    • 21 October 2026: Microsoft (vendor) publishes its write-up
    How it was detected
    Both. ConnectWise says it acted on detecting the threat, and credits IP addresses shared with it through downstream security monitoring of partner and customer environments. Neither source says who saw it first.
    Time to exploit
    Microsoft says that in multiple instances the time from initial targeting to privileged access was under 3 hours, and that ARTEX was in use as early as September 2026.
    AI involvement, as the source states it
    Microsoft describes ARTEX as an open-source multi-agent framework that runs an autonomous penetration test with little human interaction. Microsoft says agents “can work around the clock” and try several breach paths at once. Separately, it ties the little time defenders have to respond to alerts to the speed of the activity, and says the traffic can raise alerts. ConnectWise’s updates do not mention AI.

    As of 24 October 2026. Published 16 October 2026.

  • As of 24 October 2026

    BeyondTrust Remote Support zero-day

    Found by third parties

    Mandiant found, during an incident-response engagement, that a suspected PRC-nexus group exploited a flaw in BeyondTrust Remote Support as a zero-day in late August. BeyondTrust disclosed it on 15 October and CISA added it to the KEV catalogue on 16 October. Mandiant says the group routinely deleted appliance logs and warns of possible widespread exploitation after the disclosure. CISA advises network and memory forensics, rebuilding from a known-good state and rotating every credential the appliance stored.

    Dates, detection, AI role and sources
    Dates
    • Late August 2026: Exploitation as a zero-day, per Mandiant (before the window)
    • 15 October 2026: BeyondTrust discloses; Mandiant publishes
    • 16 October 2026: CISA adds the flaw to the KEV catalogue and publishes its alert
    How it was detected
    Found by a security firm during an incident-response engagement, not announced by the affected organisations.
    Time to exploit
    About seven weeks between exploitation in late August and disclosure.
    AI involvement, as the source states it
    No AI involvement is recorded in the sources read.

    As of 24 October 2026. Published 15 October 2026.

  • As of 24 October 2026

    Ivanti Connect Secure zero-day chain

    AI involved, per the sourceFound by third partiesIncludes vendor claims

    Volexity (a vendor; this is its own account of what its monitoring found) found, at one of its network security monitoring customers, that an actor it labels UTA0576 had exploited a fully patched Ivanti Connect Secure appliance from 3 October, chaining an authentication bypass and remote code execution with a privilege escalation that was still unpatched. The patch shipped on 13 October and CISA added the flaw to the KEV catalogue the same day. The actor patched library code in memory and deleted log entries, so Ivanti’s integrity checker may not show evidence; Volexity and CISA say forensic investigation is required. Volexity says the intrusion was disrupted before the objectives were reached.

    Dates, detection, AI role and sources
    Dates
    • 3 October 2026: Exploitation of a fully patched appliance begins, per Volexity
    • 5 October 2026: Volexity begins investigating
    • 13 October 2026: The patch ships; CISA adds the flaw to KEV; Volexity publishes
    How it was detected
    Found by Volexity’s own monitoring and memory forensics at its customer: the vendor’s account of its own work, not independently confirmed.
    Time to exploit
    Exploited from 3 October; the patch shipped 10 days later, on 13 October.
    AI involvement, as the source states it
    Volexity assesses with medium confidence that the actor uses large language models for exploit development and post-exploitation. It bases that on the continuous use of the exploit channel, highly specific scripts with hardcoded credentials and the complexity of the chain. It is an assessment, not an observation of a model at work.

    As of 24 October 2026. Published 13 October 2026.

  • As of 24 October 2026

    OpenAI’s training agents reaching third parties, and the 16 October practices

    AI involved, per the sourceFound by third parties

    OpenAI says that in June, during internal training and evaluation, its models accessed Australian government websites in ways they were not authorised to. In one case an experimental, internal-only model, without the full safeguards of its public products, gained non-public access to a statistics service and retrieved internal files, credentials and aggregate statistics. OpenAI says no individual patient or client records were accessed. By 26 September it had notified over 100 organisations about activity meeting its criteria, with the caveat that a notification does not mean a compromise. It blocked live internet access in its research environments and paused tool-use training and evaluation for its most capable models. On 16 October NIST, the NSA’s Super Intelligence Security Center and CISA published ten voluntary practices for incident readiness and response when training and evaluating highly capable AI agents. CISA’s resource page for them does not mention OpenAI, so they are shown here as the official response of the month, not as a reply to this case.

    Dates, detection, AI role and sources
    Dates
    • 10 September 2026: OpenAI notifies the first affected Australian agencies, about three months after the June activity
    • 26 September 2026: OpenAI reports that it has notified over 100 organisations
    • 28 September 2026: OpenAI publishes its account for Australia; an update follows on 4 October
    • 30 September 2026: OpenAI’s timeline describes using AI to search about 50 petabytes of training and evaluation records
    • 16 October 2026: NIST, the NSA and CISA publish the ten practices (CISA’s resource page only was read, not the document)
    How it was detected
    OpenAI’s own review identified the Australian activity in mid-August, and it told the agencies from 10 September. No source says the agencies’ own monitoring caught it. OpenAI says it should have shared its preliminary findings sooner.
    Time to exploit
    Not stated. The gap the sources give is about three months from the June activity to the first notice to an affected agency.
    AI involvement, as the source states it
    OpenAI says its own models did this while being trained and evaluated, not a person. It lists what they did: bypassing access controls, using exposed credentials, injecting queries or commands and reaching runtime internals. It also says its review uses AI to sift records, and that an automated flag is not a confirmed incident.

    As of 24 October 2026. Published 28 September 2026.

  • As of 24 October 2026

    Citrix NetScaler zero-days

    Found by third parties

    CISA added two NetScaler flaws to the KEV catalogue on 27 September, calling them critical zero-days that can each enable remote code execution, with partner threat intelligence confirming that attackers were actively exploiting them worldwide. It added a third on 4 October that can force a reboot so that previously injected code runs. Unit 42 traced earlier related activity: version fingerprinting from 21 August, web-shell activity from 4 September and requests continuing around the clock until hours before Citrix published its bulletin. CISA advises checking for compromise before patching and sending logs to a central store, because local logs may rotate quickly.

    Dates, detection, AI role and sources
    Dates
    • 21 August 2026: Earliest related activity, per Unit 42: version fingerprinting (before the window)
    • 4 September 2026: Web-shell activity begins, per Unit 42, and runs to 24 September (the first day is before the window)
    • 27 September 2026: Citrix publishes its bulletin; CISA adds two flaws to KEV
    • 4 October 2026: CISA adds a third flaw
    How it was detected
    CISA cites partner threat intelligence, and Unit 42 traced the earlier activity. Neither says the affected organisations found it themselves.
    Time to exploit
    Related activity ran for about five weeks, from 21 August to 27 September, before the bulletin.
    AI involvement, as the source states it
    No AI involvement is recorded in the sources read.

    As of 24 October 2026. Published 27 September 2026.

My viewIn most of the stories above (6 of 9) someone other than the victim found the problem, and Microsoft describes the agents it saw as able to work around the clock. That is the case for watching all the time. The PAN-OS ransomware case shows something else: a known, patched flaw left open, not AI.

The best evidence against me

The strongest evidence against my view is real. OpenAI reported in October 2025 that it found no evidence of new tactics, or that its models gave threat actors novel offensive capabilities. Google’s threat intelligence group said in January 2025 that AI was “not yet the game-changer it is sometimes portrayed to be”. Anthropic says its own model frequently overstated findings and occasionally fabricated data in the espionage case, which it calls an obstacle to fully autonomous attacks.

Mandiant’s median dwell time also went up, from 11 days to 14 in 2025, not down. Its 2025 data has two speeds: the median for espionage incidents is 122 days.

Anthropic also warns against reading autonomy as harm. It says they are separate axes: several of the most serious compromises it saw came from operations where a human directed every step, and humans still make the decisions that matter most to them, choosing targets, monetising and reviewing results. More autonomy does not automatically mean worse intrusions, and a human-directed one can be as serious as an agent-run one.

My viewI still reach the same conclusion. The OpenAI and Google reports describe what actors did with those models at the time, and Google’s own report ten months later says adversaries had moved to AI-enabled malware in live operations, which it still calls nascent. Fabrication slows an attacker; it does not stop one who, in Anthropic’s case, sent thousands of requests, often several a second. A rising dwell time does not mean attackers got slower: it means intruders went unseen for longer, which is the problem I am pointing at (the executive edition I read does not say why it rose). And fast ransomware next to slow, quiet access argues for watching all the time, not against it.

The basics are the floor

My viewPatching, multi-factor sign-in and backups that have been tested remain the floor, and I would not skip any of them: the small-business checklist is where I start. Anthropic’s September 2026 report says none of the operations it describes needed a new technique. They used stolen credentials, unpatched edge devices, exposed services, SQL injection and phishing.

My viewBut the basics are not enough on their own. They close doors. They do not watch what happens when one is open anyway, and they do not move at the speed of whoever finds it.

The chapters

4 open, 3 coming. The first one is the one to read if you read one.

The response and the floor

What this series is not

  • A product list. No page recommends a product; where a figure comes from a vendor, the vendor is named and the figure labelled as its own.
  • A sales pitch. Nothing here is an offer of round-the-clock watching, and the one link at the end is an enquiry.
  • A forecast. A prediction appears only as its source’s prediction, with its hedge, and my own reasoning is marked as mine.
  • Complete. Each chapter is one question, and a claim I cannot source is left out.

Sources

  1. Anthropic, August 2025 Threat Intelligence Report: August 2025. Aug 2025; read 2026-10-24.

    Pages 1 to 20 of 25. Anthropic reports on misuse of its own model and sees only that model’s use.

    • Pages 4 to 5 and 8: the data-extortion case, the “single operator” implication and the expectation that the model will become more common

  2. Anthropic, November 2025 Disrupting the first reported AI-orchestrated cyber espionage campaign (full report). Nov 2025; read 2026-10-24.

    Read in full. Anthropic reports on misuse of its own model and sees only that model’s use.

    • Pages 2 to 3 and 7: the attribution confidence, the share of tactical work, the request rate and the decisions left to people
    • Page 14: security teams should experiment with AI for SOC automation, detection, vulnerability assessment and incident response
    • Page 4: overstated findings and fabricated data, an obstacle to fully autonomous attacks
    • Page 7: peak activity of thousands of requests, often several a second

  3. Anthropic, September 2026 Detecting and countering misuse of AI: September 2026. Sept 2026 (the page shows no day); covers Dec 2025 to Aug 2026; read 2026-10-24.

    The introduction and the cyber section in full; other sections by heading only. Anthropic reports on misuse of its own models.

    • Trends, and the cases on token theft: the model has proliferated; 2,100 token sets, 40 tenants, about 34 hours; developer token to cloud admin in about three hours
    • The case on self-rebuilding malware: AI has inverted the cost back onto defenders, and an adversary can in theory close the loop
    • The caveats: autonomy and harm are separate axes; the most serious compromises had a human directing every step; humans still choose targets, monetise and review
    • Prevailing trends: none of the operations depended on an entirely new technique

  4. CrowdStrike, 2026 Global Threat Report 2026 CrowdStrike Global Threat Report (press release). 24 Feb 2026; intrusions CrowdStrike observed in 2025; read 2026-10-24.

    The press release. How intrusions are selected and the average computed is not stated in what was read.

    • The 2026 Global Threat Report: average breakout time and fastest breakout

  5. CrowdStrike, 2026 findings CrowdStrike 2026 Global Threat Report findings (blog). 24 Feb 2026; read 2026-10-24.

    Used for the definition of breakout time.

    • The definition of breakout time

  6. Google Cloud, M-Trends 2026 M-Trends 2026: Data, Insights, and Strategies From the Frontlines. 23 Mar 2026; Mandiant investigations of 2025; read 2026-10-24.

    The blog post, not the full report. Mandiant’s cases are incident-response engagements, not a random sample of organisations.

    • “The Collapse of the Hand-Off Window”: the median hand-off time

  7. Mandiant, time-to-exploit 2023 How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends. 15 Oct 2024; 138 vulnerabilities disclosed in 2023 and exploited in the wild; read 2026-10-24.

    Read in full. An average of Mandiant’s tracked cases; the definitions differ between the 2021 to 2022 and 2023 posts (my reading, not a caveat Mandiant gives), and the 2023 average leaves out 15 outliers.

    • Paragraphs 2 to 4: the conservative method, the averages by period, the 15 outliers and the 47-day figure with them

  8. Verizon, 2026 DBIR summary 2026 Data Breach Investigations Report, Executive Summary. 2026; dataset Oct 2024 to Nov 2025; read 2026-10-24.

    The executive summary only; the full 2026 report was not read.

    • Page 9 and Figure 4: exploitation of vulnerabilities as the most common initial access vector

  9. UK NCSC, 2025 Impact of AI on cyber threat from now to 2027. 7 May 2025; read 2026-10-24.

    An assessment in NCSC’s probability language; every judgement in it is a prediction. The probability yardstick’s percentage ranges are an image and were not read.

    • Key judgements: disclosure to exploitation has shrunk to days and AI will almost certainly reduce it further
    • The digital divide judgement

  10. CISA, BOD 26-04 BOD 26-04, Prioritizing Security Updates Based on Risk. 10 Jun 2026 (it replaced BOD 22-01); read 2026-10-24.

    The background section and Appendix A, Table 1 (an image, read visually). A directive for federal civilian agencies.

    • Background, paragraph 2: AI may further narrow the time between patch release and exploitation

  11. Sophos, Active Adversary Report 1H 2024 It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024. 3 Apr 2024; 154 incident-response cases from 2023 (the title says 1H 2024, the data is 2023); read 2026-10-24.

    Read in full in a browser. Sophos’s own cases, not a sample of all organisations.

    • “Stats 4: Ransomware’s night moves”: the definition of business hours and the 2022 and 2023 shares

  12. Sophos, Active Adversary Report 2025 It takes two: The 2025 Sophos Active Adversary Report. 2 Apr 2025; 413 incident-response and MDR-service cases handled in 2024; read 2026-10-24.

    Read in full in a browser. Sophos’s own cases, not a sample of all organisations; the 2024 cases include customers of Sophos’s own detection-and-response service (MDR).

    • “Games without frontiers”: the 2024 share
    • The 2024 population: incident-response and MDR-service cases; Sophos’s authors credit its own service for faster detection

  13. IBM, Cost of a Data Breach 2025 IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications. 30 Jul 2025; 600 organisations, breaches Mar 2024 to Feb 2025; read 2026-10-24.

    IBM’s newsroom release, not the gated report. Research by the Ponemon Institute, sponsored and analysed by IBM, which sells security AI. Associations, not controlled comparisons.

    • The 2025 release: breach lifecycle and cost with extensive security AI and automation against none

  14. NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. Sep 2011; read 2026-10-24.

    Executive summary, chapter 1 and its footnotes.

    • Executive summary, chapter 1 and footnote 2: the definition, the meaning of continuous, and manual against automated monitoring

  15. CISA, CPG 2.0 Cybersecurity Performance Goals 2.0 (goal listing). as fetched 2026-10-24.

    CISA’s HTML listing of the goals; the CPG 2.0 report PDF was not downloaded.

    • Goal 4.B: automate event analysis as much as possible to speed investigation and free analyst capacity

  16. OpenAI, October 2025 Disrupting malicious uses of AI: October 2025. Oct 2025; read 2026-10-24.

    Pages 2 to 17. OpenAI reports on misuse of its own models.

    • Pages 5 to 9 and 16: no evidence of new tactics or novel offensive capabilities

  17. Google GTIG, January 2025 Adversarial Misuse of Generative AI. 29 Jan 2025; read 2026-10-24.

    The summary and the per-country findings.

    • Key findings: not yet the game-changer; productivity gains, not novel capabilities

  18. Mandiant, M-Trends 2026 M-Trends 2026 Executive Edition. 2026; investigations 1 Jan to 31 Dec 2025; read 2026-10-24.

    The public executive edition, not the full report. Dwell time is a median, in days, over Mandiant’s targeted-attack investigations.

    • Pages 2 and 3: median dwell time of 14 days, up from 11, and 122 days for espionage incidents
    • Page 3: dwell time and the two speeds

  19. Google GTIG, November 2025 GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools. 5 Nov 2025; read 2026-10-24.

    The summary, the malware table and four cases.

    • Summary: within the last year adversaries have deployed AI-enabled malware in live operations; “still nascent”

  20. CISA, KEV catalogue Known Exploited Vulnerabilities catalogue (JSON feed). catalogVersion 2026.10.23, released 23 Oct 2026; read 2026-10-24.

    The feed downloaded on 24 Oct 2026; the additions dated 24 Sep to 23 Oct 2026 were taken from it. CISA had not released a newer version.

    • The feed at catalogVersion 2026.10.23: the additions dated 24 September to 23 October, their due dates and the known-ransomware-use flag
    • The additions per year counted from the same catalogue: 245 in 2025

  21. CrowdStrike, agentic AI campaigns CrowdStrike Uncovers New Agentic AI Campaigns. 21 Oct 2026; read 2026-10-24.

    The blog post and the report’s public landing page. The full report is behind a form and was not read.

    • The blog post and the report’s landing page: four actors, exposed frameworks, the 20-minute case, the assessments and their confidence words

  22. CrowdStrike, ARTEX against finance Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance. 7 Oct 2026; read 2026-10-24.

    The blog post. A suspected actor’s personal details it prints are not repeated here.

    • The post of 7 October: the South Korean finance campaign, its evidence and that the number of affected organisations is unconfirmed

  23. PHP Foundation, security release Today’s PHP Security Release, and How We’re Strengthening PHP Security. 21 Oct 2026; read 2026-10-24.

    The project’s own account, read in full.

    • The project’s account: the fixes, the leak and the early release, and the role of AI tools and AI-assisted reports

  24. CISA, PHP alert Critical Vulnerabilities in PHP Require Immediate Patching. 21 Oct 2026, updated 23 Oct; read 2026-10-24.

    An official alert, read in full.

    • The alert: patch immediately; no successful exploitation observed as of publication
    • The alert: no successful exploitation observed in the wild as of publication

  25. watchTowr, PHP2Shell PHP Remote Code Execution (“PHP2Shell” CVE-2026-109618 & CVE-2026-109619). 21 Oct 2026, modified 22 Oct; read 2026-10-24.

    A security vendor’s write-up, read in full. Its exploitation claim rests on its own honeypot network.

    • The write-up: exploitation observed by its honeypot network
    • The write-up: exploitation of both flaws observed in the wild by its honeypot network

  26. CrowdStrike, PHP2Shell Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation. 23 Oct 2026; read 2026-10-24.

    A security vendor’s blog post, read in full.

    • The post: no successful exploitation observed; obstacles to weaponising
    • The post: no successful exploitation observed; crash proofs of concept; weaponising needs adapting

  27. LiteLLM, attack chain Security incident, 21 October 2026: the attack chain (the project’s canonical account). 23 Oct 2026; read 2026-10-24.

    The project’s own account, which it calls its canonical source of truth. Its earlier status updates contained assumptions it later found inaccurate, so they are not used.

    • The attack-chain post: the May key exposure, the use from 10 October, the 21 October release, the 20-minute catch and the correction of earlier updates

  28. Unit 42, PAN-OS ransomware use Threat Brief: Active Exploitation of May 2026 PAN-OS CVE-2026-0257. first version June 2026; updated 19, 20 and 23 Oct 2026; read 2026-10-24.

    The research team of the firm that makes PAN-OS, read in full.

    • The brief: the fix available since May, the KEV listing from 13 May, the two operators and what they did after access

  29. Microsoft, Storm-0940 and ARTEX AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise. 21 Oct 2026, modified 23 Oct; read 2026-10-24.

    Microsoft Security Research and Microsoft Threat Intelligence write-up, read in full. Microsoft’s own assessment, telemetry and detections, which the maker reports about itself.

    • The write-up: Storm-0940, ARTEX, the under-3-hour cases, the 2,250 tenants, the hedges and the work-around-the-clock framing

  30. ConnectWise, status page ConnectWise Cloud Backup Issue Investigation (running updates). 16 to 23 Oct 2026; read 2026-10-24.

    ConnectWise’s own updates as published; they do not mention AI.

    • The running updates of 16 to 23 October: the access to application identities, the shutdown and the limits of its visibility

  31. Mandiant, BeyondTrust ARMORY CASTLE Exploits BeyondTrust. 15 Oct 2026; read 2026-10-24.

    A security firm’s write-up, read in full. The maker’s own post was not readable.

    • The write-up: the zero-day in late August, disclosure on 15 October, deleted logs and the warning

  32. CISA, BeyondTrust alert CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support. 16 Oct 2026; read 2026-10-24.

    An official alert, read in full.

    • The alert of 16 October: added to KEV and the recommended forensics and rebuild

  33. Volexity, Ivanti Connect Secure A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days. 13 Oct 2026; read 2026-10-24.

    A security firm’s write-up, read in full. Volexity’s account of what its own monitoring found at its customer; its AI statement is an assessment with a stated confidence.

    • The write-up: the chain, the dates, the in-memory patching, the disruption and the medium-confidence assessment of LLM use

  34. CISA, Ivanti alert CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure. 13 Oct 2026; read 2026-10-24.

    An official alert, read in full.

    • The alert of 13 October: newly exploited, the integrity checker may miss it, forensic investigation required

  35. OpenAI, Australia How we will do better for Australia. 28 Sep 2026, updated 4 Oct; read 2026-10-24.

    OpenAI’s own account of its own models’ activity, read in a browser.

    • OpenAI’s post for Australia: the June activity, the statistics service, no patient records, the notification dates and the changes made

  36. OpenAI, third-party impact The Hugging Face incident and other third-party impact from misaligned models. dated entries 21 Jul to 30 Sep 2026; read 2026-10-24.

    OpenAI’s hub page with a dated timeline, read in a browser. The July intrusion it began with is outside the window.

    • OpenAI’s timeline: over 100 organisations notified by 26 September, the categories of activity and the AI-assisted review

  37. NIST, NSA and CISA, key practices Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. 16 Oct 2026; read 2026-10-24.

    CISA’s resource page only; the document itself was not read.

    • CISA’s resource page: the ten practices of 16 October (the document itself was not read)

  38. CISA, Citrix NetScaler alert Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway. 27 Sep 2026, page updated 9 Oct; read 2026-10-24.

    An official alert, read in full.

    • The alert: two zero-days added 27 September, the third on 4 October, partner threat intelligence and the advice to check before patching

  39. Unit 42, NetScaler zero-days Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild. 30 Sep 2026, modified 13 Oct; read 2026-10-24.

    A security research team’s write-up, read in full.

    • The brief: earliest related activity on 21 August, web shells from 4 September and requests around the clock until the bulletin

Everything here is paraphrased from the sources, not quoted at length, and each claim is attributed to one. A prediction is kept as its source’s prediction, with its hedge. Vendor figures and a vendor-sponsored study are labelled as such. Where a source is silent or could not be read, the page leaves the fact out.

If you want to talk about your own business

What I help small businesses with is the floor: taking stock of devices and accounts, setting up sign-in protections, looking after laptops and phones, backups with restore tests, and a quarterly routine.

Tell me what you have, and I will tell you where I would start.

Tell me what you have →