AI is moving fast and so are the risks. |
Today’s stories cover an AI executive order, software supply chain threats, phishing tied to the World Cup, and patch gaps.
Tell us what content you want to see on TechRepublic by taking this quick survey. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Trump Executive Order for AI Security Reviews |
President Trump signed an executive order creating a voluntary AI security review framework. The framework aims to address concerns that advanced AI models could accelerate vulnerability discovery, exploit development, and cyberattacks. |
CISA, the NSA, and other agencies will help identify high-risk AI models for voluntary review as the government seeks to balance innovation with security.
Treat AI tools like any other technology by requiring security reviews, maintain an approved AI inventory, and regularly test for prompt injection, data leakage, and misuse scenarios before expanding adoption. |
FIFA World Cup Domains Spark Phishing Concerns |
Cybercriminals are ramping up preparations for the 2026 FIFA World Cup, registering thousands of FIFA-related domains as global interest in the tournament accelerates.
CSC researchers identified more than 65,000 FIFA-related domain registrations since 2022, with activity surging around key tournament milestones such as team announcements and ticket sales. While some registrations may be legit, others support phishing, ticket fraud, travel scams, and counterfeit merchandise campaigns.
Add event-related keywords, brand names, and executive names to your domain monitoring program before major launches or public events to identify lookalike registrations before they can be weaponized. |
CSA Flags Growing AI Patch Gap |
Organizations continue to be breached through known vulnerabilities, according to a new Cloud Security Alliance report. The report found that 80% of organizations experienced an application security incident involving a known vulnerability in the past year, yet only 9% can remediate critical flaws within 24 hours. As AI accelerates vulnerability discovery and exploit development, security teams face increasing pressure to prioritize remediation while gaining better visibility into AI-powered systems running in production.
Create an automated workflow that immediately flags critical vulnerabilities with active exploitation or public proof-of-concept code, then pair it with virtual patching controls to reduce exposure while permanent fixes are deployed. |
|
|
|
The biggest challenge for AI security is... |
|
|
|
Yesterday's Pulse Check Results |
Browser Security Showdown: Who should own the risk? |
|
|
|
Security Tools You Can Use |
|
|
|
JFrog Warns of AI Supply Chain Attacks |
JFrog found that AI is expanding software supply chain attack opportunities.
They identified nearly 500 malicious AI models in public repositories and a 451% increase in malicious npm packages during 2025. |
The findings suggest attackers are increasingly targeting AI tools, developer environments, and software supply chains while many organizations continue to struggle with shadow AI, governance and securing AI-generated code. Add AI models, developer extensions, and coding assistants to your software asset inventory and require automated security scanning before they are allowed into development or CI/CD environments. |
AI Exposes Gaps in Recovery Readiness |
AI is forcing security teams to rethink cyber resilience as attacks move faster and response windows shrink. Brandon Willitts of Everpure said AI is amplifying existing weaknesses and helping attackers move from compromise to impact in as little as 15 to 30 minutes. The findings reinforce that recovery planning must keep pace with detection and response capabilities.
Schedule regular recovery exercises that simulate credential-based attacks and require teams to restore critical systems from immutable backups. |
|
|
|
No matter your size, Vanta helps you automate compliance, manage risk, and prove trust continuously—all from a single, agentic platform. • Close deals faster by responding to security questionnaires in minutes, not days • Stay audit-ready year-round with continuous monitoring across 400+ integrations
• Automate compliance for SOC 2, ISO 27001, GDPR, HIPAA and more Over 16,000 companies around the globe trust Vanta. Watch the demo on your own time. Start anytime. |
|
|
|
How prepared are you for the next disruption? |
Vendor outages have shown how third-party service disruptions can impact business operations. Cyber resilience helps organizations prepare for these moments by improving recovery readiness, reducing downtime, and keeping critical services running when unexpected incidents occur. |
How to strengthen your cyber resilience: |
-
Strengthen recovery readiness by using immutable backups and regularly testing backup restoration processes to ensure critical data can be recovered when needed.
-
Improve response capabilities by testing incident response plans and conducting recovery exercises that simulate cyberattacks, outages, and other operational disruptions.
-
Reduce overall risk by implementing phishing-resistant MFA, continuous monitoring and simplifying tech stacks to limit attack paths and improve visibility.
|
Cyber resilience helps reduce operational risk when security incidents or third-party outages occur. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
