You can't protect what you can't see. |
That's the theme I'm seeing across today's headlines. From devices to brand reputations, major problems often begin before anyone notices. - Ken
Missed a newsletter? Read past issues here. |
|
|
|
Here’s what you need to know: |
|
|
| Arara Breach Exposes 77 Million Email Addresses |
A cyberattack on Japanese email provider Arara Message may have exposed 77 million email addresses. Threat actors also reportedly used the platform to send up to 7.13 million phishing emails impersonating credit card companies. |
My Take: Security teams can't rely on SPF, DKIM, and DMARC alone to identify malicious messages when attackers control an authorized sender.
Review third-party email access, rotate compromised API keys, and monitor for unusual sending activity. |
Google Takes Down 1.3 Million-Device Android Botnet |
Google disrupted the XCPE botnet, which reportedly compromised more than 1.3 million Android devices. The infections stemmed from a firmware backdoor allegedly installed by manufacturer Videostrong Technology.
My Take: I think this exposes a gap in how organizations evaluate connected devices before allowing them onto corporate networks. Security teams often assess hardware based on functionality and vendor reputation, but neither guarantees the integrity of preinstalled firmware. Verify firmware integrity and conduct third-party risk assessments. |
Thousands of Storage Devices Missing at UK Spy Agency |
Britain's GCHQ cannot account for thousands of storage devices that may contain classified intelligence. The agency blames inadequate asset tracking, raising concerns about potential exposure of sensitive information.
My Take: Without records linking devices to their data classifications, security teams may struggle to determine whether breach notifications are required or which information is at risk. Track device ownership and data classifications, conduct regular inventory audits, and investigate missing assets. |
|
|
|
Where do you start with agent security?
An AI agent on a developer’s laptop can open files, run commands, and use tools connected to other systems. What can it reach, and whose credentials is it using?
On Tuesday, November 17 at 11 AM Eastern, Security Researcher Tyler Holmwood gives a live introduction to agent security. He’ll explain how an agent turns a request into work on a machine, how and why that work can go wrong, and which controls you already own can limit the consequences.
Save your seat. The recording goes to everyone who registers. |
|
|
|
Hackers Hijack AI Accounts, Rack Up $100K Daily Bills |
Cybercriminals are stealing and reselling enterprise AI access, leaving some businesses with over $100,000 in daily charges. Google researchers uncovered LLM Mixers that use stolen API credentials to access AI models through legitimate business accounts. |
My Take: AI billing spikes could signal credential compromise, but finance teams may not recognize the threat. I'd have security and finance share usage data and set thresholds for investigating unusual charges. Set AI spending alerts, restrict API key access, scan for exposed credentials, and rotate compromised keys. |
Scammers Weaponize Social Media to Damage Brands |
Cybercriminals exploit news and social media to spread misinformation that damages brand reputations without breaching systems. By distorting legitimate information or impersonating trusted sources, attackers can undermine consumer trust before organizations can respond. My Take: I think the challenge is knowing when misinformation warrants a public response. Reacting too quickly can amplify false claims, while waiting too long allows them to spread. Use brand monitoring tools to detect fraudulent claims, establish escalation procedures, and prepare factual responses that direct customers to verified information. |
|
|
|
Is Your IT Asset Inventory Accurate? |
Effective IT asset management helps organizations track devices, identify vulnerabilities, and reduce security risks. |
How to strengthen your IT asset management: |
- Maintain a centralized inventory of hardware and software, tracking ownership, locations, and asset lifecycles.
-
Use IT asset management tools to automate device discovery, identify unmanaged assets, and monitor outdated systems.
- Conduct regular asset audits, investigate discrepancies, and restrict removable media access to protect sensitive data.
|
IT leaders should establish clear asset ownership and escalation procedures so missing or compromised devices can be investigated before they create broader exposure. |
|
|
|
Security Tools You Can Use |
-
Trying to land your first GRC job? The Neuron Academy shows you how to build a simple AI risk register project to show hiring managers.
-
Think like a hacker — master Web3 security, red teaming, and bug bounty skills with 86% off the Cybersecurity Mastermind Bundle.
-
Protect your business from threats — get 30% off Bitdefender’s powerful cloud and on-premise protection today.
|
|
|
|
Asset Tracking Reality Check: Could you account for every device today? |
|
|
|
Yesterday's Pulse Check Results |
Freezers fail. Cyberattacks suspected. Where do you stand? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
