Some threats arrive before anyone clicks. |
Today, I’m watching how flawed login checks and hidden AI instructions can open doors for threat actors. - Ken
Missed a newsletter? Read past issues here. | |
|
|
Here’s what you need to know: |
|
|
|
10 Million Taxpayer Records Allegedly Leaked in Philippines |
The Philippines’ Bureau of Internal Revenue is investigating claims that approximately 10 million individual taxpayer records were leaked. If confirmed, the data could help threat actors craft convincing fraudulent tax notices targeting finance teams and external accountants. |
My Take: I would check whether our payment and document-release procedures treat taxpayer details as proof of identity. Leaked information could undermine those checks without compromising an employee account. Verify unexpected tax requests through official channels before sharing sensitive documents or approving payments. |
SAP Closes Critical Code Execution and Authentication Gaps |
SAP’s November update patched four vulnerabilities that could enable code execution, impersonation, and unauthorized actions. All four have CVSS scores of 10.0 and SAP has not reported any exploitation at the time of publication.
My Take: I wouldn’t delay these patches based on existing MFA protection, because some flaws bypass authentication entirely. Patch exposed SAP components first and validate the fixes. |
Japan Puts $63 Million Behind Fight Against AI Cyberattacks |
Prime Minister Sanae Takaichi announced an emergency plan to create an AI team for vulnerability testing and attack simulations. The roughly $63 million plan also bolsters threat intelligence, incident response, and support for affected organizations.
My Take: I’d want Japan’s testing team to share attack methods alongside vulnerability findings so defenders can check whether their monitoring would catch the same activity. Run an authorized attack simulation, review which actions triggered alerts, and tune detection rules for missed activity. |
|
|
|
The identity system is the control plane for every critical business system. It’s the first place attackers hit, and one of the hardest to secure. Defenders need a continuous view of what changed, what matters, and what to do next. Meet Semperis Lightning, a single platform that helps you reduce identity attack risk and maintain business operations, even during cyber disruptions. • Gain visibility into identity exposures. • Detect and disrupt traditional and AI-driven attacks.
• Streamline incident response. With Lightning, you’ll amplify posture and readiness—and accelerate detection and response. Because when cyberattacks move at machine speed, your defenses must move faster. |
|
|
|
Samsung Patches Flaws Across Android and Galaxy |
Samsung’s November updates fix Galaxy software vulnerabilities and a critical Android flaw that could allow remote code execution without user interaction. Businesses should verify patch coverage across company-issued devices, since exposure and update availability vary by model and region. |
My Take: I would prioritize patching affected phones with access to sensitive data or privileged accounts, where a compromise could have the greatest business impact. Use your MDM to flag unsupported Galaxy phones, set replacement deadlines, and restrict their access to sensitive corporate data. |
Prompt Injection Tools Target AI Agents for $150 a Month |
Proofpoint researchers found threat actors advertising indirect prompt injection tools for about $150 a month. These tools embed malicious instructions in everyday content to trick AI agents into leaking data or taking unauthorized actions.
My Take: I see an important shift in what “opening” a message means, because an AI assistant may act on malicious content before an employee ever reads it. Limit agent permissions, require approval for sensitive actions, and test whether malicious content can trigger unauthorized tool calls. |
|
|
|
Can you spot unauthorized AI activity? |
AI threats range from AI-assisted fraud and impersonation to attacks that manipulate AI agents into exposing data or taking unauthorized actions. |
How to reduce risk from AI threats: |
- Establish AI governance with clear ownership, limited agent permissions, approved destinations, and human approval for sensitive actions.
-
Treat external content as untrusted data and enforce authorization controls outside the AI model.
- Monitor agent activity and test prompt injection defenses to verify that controls block unauthorized actions.
|
Start by reviewing permissions, destinations, and approvals for one sensitive AI workflow to reduce the risk of unauthorized actions. |
|
|
|
Security Tools You Can Use |
-
Explore how DSPM helps CISOs prioritize critical exposures, guide remediation, and measure risk reduction across cloud, on-premises, and hybrid environments. Read the Article
-
Build hands-on AI security skills for less — save 30% on TryHackMe with code TECHADVICE30.
-
Think like a hacker — master Web3 security, red teaming, and bug bounty skills with 86% off the Cybersecurity Mastermind Bundle.
|
| |
|
You control the next security investment. What gets funded first? |
|
|
|
Yesterday's Pulse Check Results |
Do you trust your bank to stop threat actors from stealing your money? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
