The pressure on security teams isn't easing. |
Today's news brings a massive insurance breach, university mail server attacks, AI trust challenges, and a reality check for social media age verification. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Nearly 7 Million Hit in Insurance Breach |
A cyberattack on AssuranceAmerica exposed the personal and insurance data of nearly 7 million people after attackers compromised an employee account. The exposed information may include names, contact details, insurance policy records, claims information, vehicle details, and driver's license numbers. |
AssuranceAmerica has since contained the incident, reset credentials, enhanced monitoring, and notified affected individuals.
Use phishing-resistant MFA and test incident response plans with phishing attack simulations. |
UK Launches Cyber Resilience Pledge |
UK organizations now have a 30/60/90-day roadmap for treating cybersecurity as a business risk, not just an IT issue. The voluntary Cyber Resilience Pledge calls on organizations to enroll in NCSC Early Warning, assess supplier Cyber Essentials coverage, and implement board-level cyber governance within 90 days. While not a regulatory requirement, the initiative could influence supplier requirements and procurement decisions, especially in critical sectors. For UK organizations, map the pledge's milestones against your current governance, supplier risk, and identity security programs to identify gaps before customers or board members ask for evidence. |
Age Verification Falls Flat in Australia |
Early testing found Australia's under-16 social media ban allowed users to register without proving their age, raising enforcement concerns. Relying on self-reported birthdates creates age assurance gaps and raises compliance, privacy, and reputational risks for platforms, advertisers, and regulators. As more countries consider similar restrictions, organizations should be watching whether layered verification methods can actually balance online safety with user privacy. If your organization relies on age-based access controls, regularly test your verification process using realistic bypass scenarios to identify weaknesses before regulators or threat actors do. |
|
|
|
What's the biggest obstacle to making age verification actually work? |
|
|
|
Yesterday's Pulse Check Results |
What's your biggest source code security concern? |
|
|
|
Security Tools You Can Use |
|
|
|
University Mail Servers Hit by Hackers |
Proofpoint uncovered a suspected China-aligned campaign exploiting Roundcube servers at U.S. and Canadian universities. Attackers used compromised mail servers to move deeper into university networks, targeting physics and engineering departments tied to national security research. |
The attacks combined Roundcube vulnerabilities, credential theft, webshells, and the VShell backdoor to evade detection and maintain persistent access.
Apply patches, monitor web server logs for exploitation attempts, and routinely scan for unauthorized webshells and unexpected administrative activity. |
Trust Slows Agentic Security Adoption |
Organizations are exploring AI agents for security operations but remain cautious about full autonomous decision-making in production.
Research from Strike48 found that while 84% of security leaders believe AI agents should handle Level 1 SOC tasks, only 36% have deployed them in production, largely because of concerns around trust, incomplete data, and unintended actions. Security teams are using AI for lower risk tasks like alert triage while maintaining human oversight for higher risk decisions.
Before granting AI agents production access, benchmark their recommendations against experienced analysts and require consistent, explainable results across repeated test scenarios. |
|
|
| How Well Are You Governing AI? |
AI is transforming how organizations operate, but as employees use AI with sensitive data and threat actors leverage AI to scale attacks, strong AI governance and secure usage practices have become essential. |
-
Establish AI governance by creating approved AI usage policies, classifying sensitive data, and requiring human review of AI-generated content before it is used for business decisions.
-
Protect accounts with phishing-resistant MFA and monitor for shadow AI usage across the organization.
-
Implement continuous third-party risk management (TPRM) to assess AI vendors on an ongoing basis, validate their security and data handling practices, and monitor for new risks as AI services and integrations evolve.
|
Reducing AI risk starts with clear governance, secure access controls, and continuous evaluation of both internal AI use and third-party AI services.
|
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
