The lines between attacker, defender, and AI are getting blurry. |
Today’s news brings private sector hacking, autonomous attacks, AI-powered intrusion tactics, and a new way to measure your threat hunting program for the board. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Cybersecurity Firms Get a New Offensive Role |
A national security memorandum is creating a path for vetted U.S. cybersecurity firms to conduct government-supervised operations against foreign cybercriminals. Participating firms could conduct surveillance and disruptive cyber operations against criminal infrastructure, subject to federal approval and oversight. |
For security leaders, key questions around attribution, collateral damage, retaliation, liability, and threat intelligence use may remain unresolved until formal operating procedures are issued. Review threat intelligence sharing agreements now for provisions covering government access, downstream operational use, indemnification, and liability. |
Taiwan Government Hit by AI-Driven Cyberattack |
Taiwanese officials detected a cyberattack in which AI agents mapped government systems, identified vulnerabilities, and adapted tactics to bypass defenses.
Dream researchers said up to eight AI agents operated simultaneously, compromising at least 85 government accounts and stealing more than 2,500 personnel records. Researchers did not formally attribute the attack, but it demonstrates how agentic AI can automate intrusions and adapt to defensive controls with limited human involvement.
Test whether your detection rules flag rapid, coordinated reconnaissance and repeated tactic changes across multiple systems. |
Threat Actors Deploy AI Across Attack Chains |
Threat actors are using AI beyond just phishing and malware to steal credentials, navigate networks, troubleshoot attacks, and identify high-value targets.
Gambit Security documented three operations using Claude Code, OpenAI Codex, and DeepSeek, including one that collected 2,975 validated credentials from 1,742 hosts. The findings show how AI can accelerate attacker decision-making and adaptation, giving defenders less time to detect and contain intrusions.
Run an attack simulation focused on credential theft and rapid lateral movement, then measure how quickly your team can detect compromised credentials, revoke access, and isolate critical systems. |
|
|
|
Security tools block 69% of attacks. An attacker already inside the network gets stopped only 37% of the time. Those numbers come from 338 million attack simulations that organizations ran in their own production environments. Your industry's numbers are in the Blue Report 2026. |
|
|
|
Hidden Prompts Put Enterprise AI Agents at Risk |
Threat actors are selling tools that hide malicious instructions in content processed by AI systems. Proofpoint researchers found that indirect prompt injection (IDPI) could manipulate AI agents during routine tasks without requiring user interaction. |
While widespread exploitation remains limited, emerging IDPI tools on underground markets pose a growing risk.
Create a test calendar invite or document containing a benign hidden instruction and verify whether your AI agents ignore it, log the attempt, and require human approval before taking sensitive actions. |
Boards Need Better Threat Hunting Metrics |
Security leaders may overstate threat hunting effectiveness to boards by tracking maturity and hunt volume instead of actual adversary coverage. A mature SOC can still have visibility gaps across identity, SaaS, cloud, and other attack vectors.
Pairing maturity with MITRE ATT&CK coverage and hunt-to-detection metrics provides a clearer measure of actual defensive capability. Before your next board update, calculate what percentage of ATT&CK techniques relevant to your threat profile have validated hunting or detection coverage. |
|
|
|
Is Your Threat Hunting Effective? |
Threat hunting enables security teams to proactively identify adversary activity that bypasses automated detection, reducing attacker dwell time and limiting opportunities for lateral movement and persistence. |
How to strengthen your threat hunting: |
-
Start with a clear hypothesis and prioritize MITRE ATT&CK techniques that pose the greatest risk to your organization.
- Correlate telemetry across multiple data sources and look beyond known indicators to uncover hidden attacker activity.
-
Convert successful hunts into recurring detections and track validated ATT&CK coverage instead of hunt volume alone.
|
Threat hunting should translate into measurable detection coverage, faster identification of adversary activity, and fewer exploitable gaps across the attack surface. |
|
|
|
Security Tools You Can Use |
|
|
|
If private cybersecurity firms are allowed to hack back, how far should they be allowed to go? |
|
|
|
Yesterday's Pulse Check Results |
AI Code Confidence Meter: How much do you trust what AI writes? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
