Outpost24 Research Finds Infostealer Malware Affected 72% of Organizations With Exposed Credentials

Posted in Commentary with tags on November 3, 2026 by itnerd

Outpost24 today released its 2026 Credential Exposure Benchmark Report. Its researchers analyzed 31.5 million unique exposed credentials linked to 4,824 organizations across five industries in the United States and Europe, first detected between September 1, 2025, and September 1, 2026. The report finds that 72% of those organizations had staff or customer credentials identified in infostealer malware logs during that period.

Around 30.7 million of the credentials, roughly 97%, came from breach dumps and combolists, large collections of leaked logins that criminals compile and share. The remaining 844,000, under 3%, were stolen from infected devices by infostealer malware and are far more likely to reflect recent theft. Of the organizations analyzed, 41% had at least one infostealer-sourced credential on a staff email address, suggesting malware on a device used for work. A further 31% had malware-stolen credentials only on customer accounts.

The research found that exposure varies far more by industry than by location. Consumer Goods and Services had the most exposed credentials, 498 at the typical organization, almost all belonging to customers. Business Services ranked fourth on total credentials but first on staff exposure, with 47% of organizations holding a malware-stolen staff credential. Financial Services had the highest share of organizations with at least one infostealer-sourced credential, at 77%.

The typical European organization had 22% more exposed credentials than its US counterpart, 224 compared with 184. The share stolen by malware was similar in both.

Of the six European regions, the Nordics had the highest exposure, with 358 credentials at the typical organization, and the most credentials stolen by infostealers. The UK and Ireland had the highest share stolen by malware, at 2.7%. Spain had the lowest exposure, at 133 credentials at the typical organization. The highest combination of industry and region in Europe was Consumer Goods and Services in Benelux, at 1,285 credentials for the typical organization.

The report recommends prioritizing credentials stolen by infostealers and investigating the wider compromise, rather than simply resetting the affected password. For staff credentials, security teams should investigate the associated user and device, including whether other passwords or session cookies were stolen, and revoke active sessions. For customer credentials, organizations should secure affected accounts through password resets, additional verification and fraud monitoring.

The report revisits the 2024 campaign against Snowflake customers, in which attackers used stolen credentials to log in to accounts without multi-factor authentication. It also points to Meta, which disclosed in October 2026 that attackers had reached some of its GitHub repositories using a single employee’s stolen credentials.

The full report is available at http://outpost24.com/resources/2026-credential-exposure-benchmark-report/.

Leave a comment »

Hackers use agentic AI to target more than 200 organizations in 11 days

Posted in Commentary with tags on November 3, 2026 by itnerd

Hacking group Vapor Panda used an agentic AI penetration-testing framework called ARTEX to target more than 200 organizations across at least 14 countries in just 11 days, according to new CrowdStrike research.

The campaign began October 17 and targeted government ministries, defense agencies, semiconductor manufacturers, pharmaceutical companies, financial institutions and telecommunications providers.

CrowdStrike confirmed post-exploitation activity at nine organizations and said approximately 70% of targets were confirmed compromised or showed evidence supporting a successful intrusion.

The attackers combined ARTEX with DeepSeek and another commercial large language model to automate reconnaissance, exploit vulnerabilities, steal credentials and move laterally across networks.

CrowdStrike observed activity occurring as frequently as every 10 seconds, with the framework capable of exceeding 1,500 commands per hour compared with approximately 40 commands per hour during traditional human-operated intrusions. Human operators continued directing the AI agents, including instructing them to identify systems without endpoint security software.

John Strand, Owner, Black Hills Information Security

“This is the future. I strongly believe that within the next three months, the type of attack documented by CrowdStrike is going to become the new normal.

“OpenAI models and attack frameworks are readily available. What a lot of people don’t understand is that you can carry out these types of attacks with commodity hardware. You don’t need a massive data center. It might be slower, but it can still be done. And I think threat actors have absolutely started recognizing that.

“Everybody needs to be prepared. Reduce your external attack surface as much as possible, and use deception throughout your environment to establish tripwires. Give yourself a way to detect attackers when they get past your other defenses.”

ㅤ

Ryan McCurdy, Vice President of Marketing, Liquibase

“The speed and scale at which attackers can now operate is unlike anything we’ve seen before.

“A single operator can direct AI agents to execute more than 1,500 commands an hour, targeting multiple organizations at once. That’s a very different threat environment than what most security teams were built to handle.

“Companies have spent years building security processes that depend on people reviewing activity, identifying risks, and intervening when something goes wrong. Those processes weren’t designed for machines operating at this speed.

“And the challenge isn’t limited to attackers. As companies give AI agents more responsibility across software development and IT operations, they need to rethink where and how controls are enforced.

“Human oversight will still be important, but it can’t be the only line of defense. Organizations need policies that are enforced automatically, before an agent can make a change that puts critical systems at risk.”

ㅤI don’t know how many times I will say this. But if you aren’t defending against AI, you are screwed.

Leave a comment »

More Fridges Pwned In Cybereattack

Posted in Commentary with tags on November 3, 2026 by itnerd

I recently posted this story on French commercial fridges being hacked. Consider that your two minute warning because if you didn’t heed it, it’s now going to get worse for you. A lot worse:

A hacking attack on European supermarkets spread across the continent on Monday, hitting fridges and freezers from Sweden to Belgium and forcing stores to throw away food in an incident that echoed a similar ‌attack in France last month.

The attack, which raised temperatures in refrigerator and freezer units at dozens of stores, hit supermarket groups Ahold Delhaize and Colruyt in Belgium and Luxembourg, as well as Swedish grocers ICA and Coop. Furniture-to-meatballs retailer Ikea also saw at least one store affected.

“Everything is destroyed,” Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters during a visit to the store on Monday, adding the attack occurred at 2 a.m., but was only noticed hours later.

“There has been a cyberattack and all our freezers reached 50 degrees [Celsius].”

A ​spokesperson for privately held ICA said the company was aware that a “limited number of stores were affected by ​an incident overnight, which impacted their refrigeration and freezer systems.”

Face it. Commercial fridges are critical infrastructure. Thus they need to be treated as such. Because clearly they are targets of threat actors. Now this could be teens, or they could be nation states. Who knows? Who cares? The fact is that these devices should not be Internet exposed. Which would make them inaccessible to threat actors. And there is a limited amount of time to fix this because clearly this problem is getting worse and not better.

UPDATE: Commentary has come in. Starting with Waseem Ahmed, Head of Engineering, Secure.com

“If these are cyber-attacks, as suspected, the common thread looks like remotely reachable controllers, not a fridge fault. French authorities named specific refrigeration controllers, researchers found thousands reachable from the internet, and one expert said many ran default passwords. Some older models no longer get security updates. The latest wave is still being confirmed, so I wouldn’t point at one vendor or one flaw today.

“Three checks to run before the week ends. #1 – List every controller your stores run, with model and firmware. #2 – Pull the management screens off the public internet and put remote access behind a VPN. #3 – Change every shared password, including the ones your refrigeration contractor uses.

“Then add temperature alarms that don’t depend on the controller being alarmed, because attackers in France reportedly lengthened defrost cycles and delayed the warnings.

“Food safety now sits on gap that nobody on the security team owns. That gap is the real story, and it is fixable.”

ㅤ

Joshua Marpet, Senior Product Security Consultant, Finite State

“In the wake of at least two waves of successful attacks against the infrastructure supporting food distribution, we have to assume that there will be others.

“That being said, this is not a moment to panic. This is a moment to reassess. And a moment to prepare. This is the moment we examine all of the devices in our infrastructure and determine which we prioritize as essential or not. This is the moment we insist that the suppliers of those essential connected devices supply us with software bills of materials, and cryptographic bills of materials at the very least.

“If you’re in a critical infrastructure industry, this is the moment that determines whether you’re on the front page of the Wall Street Journal for all the wrong reasons.

“How are you validating and verifying that every connected device in your infrastructure has been made as safe as you can get it? I’m not saying 100% safe. There’s no such thing. But after the French attack on refrigeration cases, why didn’t the parent companies of the supermarkets in Sweden in Belgium and everywhere else, not examine their systems?

“Putting our heads in the sand is no longer a viable strategy.

“Either follow the European Union cyber resilience act and get the manufacturer of your devices to handle the testing and the assurance, or contract with a third-party to make sure the devices you’re using are the right ones.”

ㅤ

Damon Small, Board Member, Xcape, Inc.

“Supermarkets across several European countries are experiencing widespread refrigeration system disruptions following another wave of suspected cyberattacks. Stores in Sweden, Belgium, Luxembourg and Ireland have reported sudden increases in refrigerator and freezer temperatures, resulting in significant food losses and temporary closures.

“These incidents highlight a fundamental cybersecurity principle: just because something can be connected to the Internet doesn’t mean it should be. Commercial refrigeration systems must be protected with the same diligence as any other operational technology (OT). Remote access, where necessary, should be restricted to secure connections such as VPNs and protected by strong identification and authentication mechanisms.

“More importantly, this is not the first wave of these attacks, and it certainly won’t be the last. Manufacturers and operators of these systems should act immediately to review their security configurations, restrict unnecessary Internet exposure and strengthen access controls. Waiting for another incident is not an acceptable security strategy. There will be another round, and the consequences could be even more significant.”

ㅤ

John Strand, Owner, Black Hills Information Security

“When we look back at 2026 years from now, we’re going to remember it as the year the refrigerator was on fire instead of the dumpster.

“Do we really need refrigerators connected to the internet at all times? Sometimes I think that maybe, just possibly, and I’m just throwing this out there, things might be a little too connected.

“But the real security issue is what happens when you combine IoT and embedded devices with a SaaS provider and centralized management. You have devices that often don’t have EDR or a patching plan, and then you tie them into a portal that can control a whole bunch of them.

“Attackers can go after the individual device, or they can compromise one SaaS portal and potentially gain access to multiple devices. That’s how a problem with one system can turn into widespread disruption.”

Leave a comment »

Two critical Langflow flaws let anyone on the internet take over AI agent servers. And the affected version logs everyone in as admin by default

Posted in Commentary with tags on November 3, 2026 by itnerd

IBM disclosed two critical flaws last week in Langflow, the open-source tool companies use to build AI agents. Both are rated 9.8 and let an attacker with no account take over the server, one through Langflow’s MCP endpoint. Every version through 1.12.8 is affected, and that version logs users in as admin by default. CISA already lists six earlier Langflow flaws as exploited.

Arti Raman, CEO and founder of the AI governance platform Portal26, says most companies don’t even know where Langflow is running. Here’s her take:

“Langflow is the kind of tool that spreads inside a company before security knows it exists. A developer or data team spins it up to build an AI agent, connects it to a few internal systems and API keys, and it quietly becomes part of how the business runs. Now there are two critical flaws that let anyone on the internet take over those servers without an account, and the affected version signs users in as an administrator by default. CISA has already confirmed attackers exploiting six earlier Langflow vulnerabilities, so organizations should expect these to be targeted quickly too. The first problem most security teams will hit is that they can’t say where Langflow is running, who set it up, or what data and credentials it has access to. That’s the gap AI governance has to close. Companies need an inventory of every AI tool and agent platform in use, sanctioned or not, along with visibility into what each one is connected to, so that when the next critical advisory drops, finding and patching the exposure takes hours instead of weeks.”

Besides patching all the things, everyone needs to close the gap when it comes to vulnerabilities like this. And fast.

Leave a comment »

AI is changing how hackers operate. Are defenders keeping up?

Posted in Commentary with tags on November 3, 2026 by itnerd

Two new reports from Kaspersky and CrowdStrike point to a concerning shift in how hackers are using AI: agents are now helping carry out real-world intrusions, from navigating compromised networks to harvesting credentials and escalating privileges. Which of course is bad.

Kevin Surace, CEO, TokenCore

“What CrowdStrike is documenting is an important turning point. AI is no longer simply helping attackers write code or craft better phishing emails. It is beginning to operate inside compromised environments, make decisions, move laterally, harvest credentials and escalate privileges on its own.

“That makes identity compromise dramatically more dangerous.

“In one of the cases CrowdStrike studied, an AI agent moved laterally to a domain controller and harvested credentials in roughly 20 minutes without additional human direction. In another, the AI discovered exposed credentials, obtained an identity and access management token, escalated to cluster administrator privileges and then extracted additional database credentials.

This changes the economics and speed of cybercrime. A stolen identity used to give one hacker a foothold. Increasingly, that same identity can give an autonomous agent a foothold, and that agent can operate continuously, explore the environment, find additional identities and privileges and determine its next move at machine speed.

“The report makes another point that should concern every CISO. CrowdStrike found that engineering sophistication was not necessarily the limiting factor. Even relatively low skill attackers were able to conduct successful intrusions using agentic AI. CrowdStrike concluded that token budget, rather than attacker skill, may increasingly become the constraint on scale.

So the security question is changing. It is no longer enough to ask whether someone has the correct password, MFA approval or passkey attack. Organizations have to know whether the person behind a privileged action is actually the authorized human.

“In an agentic world, identity has to become a hard security boundary. For critical access, privilege escalation and consequential actions, enterprises will increasingly need cryptographic authentication tied to the legitimate application and a physical biometric from the authorized person.

“AI is making sophisticated cyber operations faster, cheaper and accessible to far more attackers. That means a compromised identity is becoming more valuable than ever. If attackers can automate nearly everything that happens after they get inside, then preventing them from becoming a trusted user in the first place becomes one of the most important defenses we have.”

John Strand, Owner, Black Hills Information Security ()

“I believe what we’re seeing is the new normal. This is the evolution of cyberattacks, and organizations need to stop treating it as an aberration.

“For years, security has leaned on the idea that you don’t have to be the fastest person running from the bear. You just have to be faster than the slowest person. Well, now the bear has a jetpack and an AK-47, and it attacks indiscriminately.

“When organizations start treating swarms of AI agents and their relentless persistence as the new normal, it should fundamentally change how they defend themselves.

“I’ve been telling every organization I talk to the same thing. Invest in cyber deception. Put tripwires in place. Then reduce your attack surface as much as possible. If an externally exposed service isn’t required, firewall it off or disconnect it. That applies even if it has no known critical vulnerabilities.

“Don’t give attackers any more room to get into your organization than you absolutely have to.”

Jacob Krell, Sr. Director: Secure AI Solutions & Cybersecurity, Suzu Labs

“Kaspersky caught attackers running CyberStrikeAI, an open-source framework where a large language model (LLM) on the command-and-control (C2) server writes the commands while the implant on the victim’s machine just runs them. Education targets in Latin America and Africa went from a compromised SQL Server to domain administrator in three to four days, with final exfiltration under an hour. CrowdStrike separately identified four new threat actors using AI agents, including one that harvested domain controller credentials in about twenty minutes with no human involved.

“The architecture is what makes this productizable. All the intelligence lives on the attacker’s server, so the implant holds nothing worth seizing. Ransomware-as-a-Service (RaaS) proved buyers with crypto and no skills will rent an intrusion stack, and agentic frameworks remove the last labor input, the operator who knows which command comes next.

“My prediction is the pairing. Darknet listings will bundle a CyberStrikeAI-style harness with an uncensored model running on the seller’s hardware, sold for cryptocurrency. The customer brings a target. The seller brings the model that decides the commands. That is the hacking-as-a-service evolution I think we will begin to see.”

Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security

“What strikes me about these reports isn’t that AI has invented some revolutionary new form of hacking. Much of the underlying tradecraft is familiar: reconnaissance, credential access, privilege escalation, lateral movement, and data collection. We’ve been testing these techniques for decades.


“What’s changing is how attackers orchestrate them. AI is moving beyond helping write phishing emails or generate scripts toward interpreting results, selecting tools, and coordinating subsequent actions. That can reduce the hands-on effort required to execute familiar attack workflows, although we should be careful about claiming specific speed improvements without comparable human-led testing.


“Having spent time in penetration testing, full-scope adversary emulation, and security operations roles, I see an equally important question for defenders: If attackers are using AI to accelerate traditional tradecraft, why aren’t we applying those same capabilities to continuously test, challenge, and improve our defenses?


“The opportunity isn’t simply to automate penetration testing. It’s to bring offensive testing and defensive operations closer together through continuous purple teaming: emulate realistic attack paths, observe what our controls detect, identify the gaps, remediate them, and independently verify the results.

“Of course, there’s a certain irony in attackers adopting automation while defenders are still scheduling the next quarterly security assessment. The attackers apparently didn’t get the calendar invitation.


“AI doesn’t eliminate the need for experienced security professionals. It amplifies what they can accomplish, provided we maintain appropriate authorization, operational boundaries, and independent verification.

“The real advantage won’t be long simply to whoever automates attacks fastest. It will belong to those who can turn that same speed into measurable improvements in detection, containment, and remediation.”

The question is not if you should defend against AI. It’s when. Because if you don’t you will get pwned. It is that simple.

Leave a comment »

Polygraf AI and Carahsoft Partner to Help Public Sector Organizations Adopt AI While Maintaining Control Over Sensitive Data, Operational Risk and Compliance Requirements

Posted in Commentary with tags , on November 2, 2026 by itnerd

Polygraf AI and Carahsoft Technology Corp. today announced a partnership. Under the agreement, Carahsoft will serve as Polygraf AI’s Master Government Aggregator®, making the company’s AI security and governance solutions available to the Public Sector through Carahsoft’s reseller partners and NASA Solutions for Enterprise-Wide Procurement (SEWP) V, The Interlocal Purchasing System (TIPS) and OMNIA Partners contracts.

Polygraf AI offers AI security, data governance and sensitive-information protection solutions designed to help organizations adopt AI while maintaining control over data, security and compliance. Its AI Behavioral Control (AiBC) Plane applies real-time policy enforcement across AI interactions, endpoints, documents, email, collaboration tools and virtual meetings, helping organizations identify and protect sensitive information before it is transmitted, shared or processed by AI systems. Polygraf AI’s solutions include controls for AI prompts and outputs, sensitive-data discovery and redaction, AI-use monitoring, audit logging and detection of AI-generated and synthetic content. The platform can be deployed on-premise, in private cloud, at the edge or in air-gapped environments to support organizations with stringent data-residency and operational-control requirements.

Polygraf AI provides Public Sector organizations with capabilities to support the controlled adoption of generative AI while helping protect sensitive Government information. Its solutions can help agencies govern the use of public and private AI models, safeguard personally identifiable and other regulated information, monitor AI activity, secure virtual meetings and identify and redact sensitive content in documents and files. Through these capabilities, Polygraf AI provides an AI-specific security and governance layer that can integrate with existing technology environments and help Public Sector organizations expand the use of AI while maintaining established requirements for data protection and oversight.

Polygraf’s AI security and governance solutions are available through Carahsoft’s SEWP V contracts NNG15SC03B and NNG15SC27B, TIPS Contract #220105 and OMNIA Partners Contract #R240303. For more information, contact the Carahsoft Team at (703) 871-8548 or Polygraf@carahsoft.com; or learn more about Polygraf’s solutions here.

Leave a comment »

The $6.3 Bill Binance ownership failure & 3 Qs CEOs must ask

Posted in Commentary with tags on November 2, 2026 by itnerd

Binance lost about $6.3 billion in a single burst, the largest crypto theft on record. The early finding points to a compromised engineer laptop that reached an internal service able to submit withdrawals, which means the transactions looked authorized at every checkpoint they passed.

The failure wasn’t a missing tool. It was that nobody owned the whole path from a developer machine to a withdrawal. So nobody tested it, fixed it, and tested it again.

Waseem Ahmed, Head of Engineering, Secure.com:

“The $6.3 Billion Binance hack Is a wake-up Call:  the traditional security model needs to change.

“Most of the money left in about 20 minutes. That is the detail security teams should sit with. Binance’s investigation is still open. Early reports pointed to a compromised DevOps machine, but the company has since said the attack involved additional breach points and was not simply one engineer’s permissions. The pattern is still familiar: an action can be technically authorised and still not be legitimate, and monitoring alone will not tell you the difference in time.

“Three questions worth asking this week. What could our most privileged developer identity reach if it were stolen? Would we see that use in minutes, not hours? Is there a human approval step before an irreversible transfer?

“The organisations that close this gap test their own attack paths continuously, and they decide in advance what gets contained automatically and what needs a person.”

Hopefully organizations wake up to the fact that to be fully protected from hacks, everything must be considered. Otherwise you get stories like this.

Leave a comment »

LinearB launches Agentic Studio to give enterprise engineering leaders and coding agents the context to ship better software faster

Posted in Commentary with tags on November 2, 2026 by itnerd

LinearB today launched Agentic Studio, a key part of the next generation of developer productivity platforms.

Historically, productivity platforms gave engineering leaders metrics. LinearB now turns everything happening across software delivery into context that people and agents can consume and act on. Engineering leaders ask questions in plain language and get answers and next steps. They define the context surface with role-based access built in, and AI assistants help extend that context and build metrics, artifacts and dashboards. Coding agents receive that context, so they understand their task and environment better and make smarter decisions.

Acting on that context matters more than ever. LinearB’s 2026 AI benchmarks, covering 2.7 million pull requests across more than 250 organizations, show that developers who use AI most heavily nearly doubled their merged pull requests year over year. Yet the software factory faces new problems. In LinearB’s 2026 Software Engineering Benchmarks Report, AI-assisted pull requests were 2.6 times larger than unassisted ones at the 75th percentile, and agent pull requests waited more than five times longer for review.

LinearB’s effort skill, now in early access, matches a coding agent’s effort to the task. It gauges a change’s business relevance, complexity and risk using the code quality in the area, recent service incidents and ownership history. Low risk changes use less effort and fewer tokens. Complex, risky or high priority changes get more effort and careful, tested edits. More skills are on the way, focused on accelerating downstream stages of the software factory, such as review and merge.

Kraken used LinearB’s MCP server with AI to find what was really slowing its code reviews. The answer wasn’t large changes. It was time zones and reviewer availability. Kraken cut review time at the 90th percentile by more than half in four months.

The Agentic Studio is available now to all LinearB customers. Agent skills are available in early access.

Why it matters now

Engineering leaders have more data than ever and less time to use it. Boards and CFOs now ask whether AI spend is paying off, and a dashboard full of numbers doesn’t answer that. At the same time, coding agents write more of the code, and they start every task knowing nothing about the codebase’s history.

Productivity platforms have always been good at measuring. The next step is turning what they measure into action. That means answers for the people running engineering, and context for the agents doing more of the work.

What LinearB does

LinearB collects data from across the software delivery lifecycle and makes it usable. It normalizes data from different Git and project management systems into one model, matches each engineer’s identities across tools, and links every change from ticket to release. It adds AI attribution and industry benchmarks, so leaders can tell whether a number is good or bad.

The engineering context layer delivers that knowledge to people and to agents.

Engineering leaders ask questions in plain language, like where delivery is stuck, how their developers are doing and whether AI is paying off. Instead of reading a chart, they get an answer and a next step. They can build their own metrics and pull the same context into AI tools like Claude through MCP.

Coding agents get the same context through MCP and agent skills. The first skill, now in early access, matches an agent’s effort to the task. It checks how complex and risky a change is, using the code’s rework rate, recent incidents and ownership history. Simple, low risk changes use less effort and fewer tokens. Complex or risky changes get more effort and careful, tested edits, which raises quality where it matters most. The skill works with any coding agent, and leaders can see how often agents were routed to low, medium and high effort.

The platform is built for the enterprise, with role based access and guardrails on what agents can do.

Journey and milestones

LinearB started by giving engineering leaders visibility into how their teams deliver software. Years of integration work across the software delivery lifecycle gave it one of the largest datasets on how engineering teams work. Its 2026 Software Engineering Benchmarks Report drew on more than 8.1 million pull requests from 4,800 engineering teams in 42 countries. As AI coding tools spread, LinearB added AI attribution and connected to more of the tools teams use.

In 2026, Gartner named LinearB a Leader in its first Magic Quadrant for Developer Productivity Insight Platforms, for both its ability to execute and its completeness of vision. Early customer response to the context layer is strong. The AI assistant and MCP access show the highest user retention of any features LinearB has released.

Market trends

LinearB’s 2026 AI benchmarks, built from 2.7 million pull requests and 83,000 developers across 253 engineering organizations between February and May 2026, show why measuring AI isn’t enough on its own. The teams pulling ahead are the ones acting on what they learn.

  • Heavy AI users are pulling away. The typical developer who uses AI on at least 75% of coding days merged 96% more pull requests per week than a year earlier. The typical developer using no AI merged 3.6% fewer.
  • Adoption is shallower than the hype suggests. Even at elite organizations, AI assists only 54% of pull requests.
  • Agents still need people. At the 90th percentile, autonomous agents open 4.7% of pull requests. At elite organizations, 79% of agent pull requests merge within 30 days, compared with 92% of human only pull requests. At fair organizations, agent yield drops to 37%. The likely reason is ownership. When no developer owns an agent’s pull request, it often never merges.
  • AI code review is the fastest win. Pull requests with an AI review merge at the highest rate of any type and lift yield by up to five percentage points.
  • AI costs are climbing fast at the top. Token spend at the 90th percentile reached $35.20 per developer per coding day, up nearly 75% in three months, while the median barely moved.

Engineering leaders already use LinearB to answer the questions their boards are asking about AI.

Forward-looking vision

The effort skill is the first in a library of agent skills. Each one turns LinearB’s context into an action an agent or a leader can take. Next, LinearB will focus on helping teams merge and govern AI generated code safely, and on cutting what engineering organizations spend on AI. The goal is the one productivity platforms have always promised, helping teams deliver better software faster. LinearB now does it by giving people answers and giving agents the context to act.

Leave a comment »

Datadobi Receives SOC 2 Type I Attestation from KPMG for Its Software Engineering, Quality, and Security Processes

Posted in Commentary with tags on November 2, 2026 by itnerd

Datadobi today announced that it has once again received its Service Organization Control (SOC) 2 Type I attestation covering its software engineering, quality assurance, security, operations, and support processes, following an independent audit by KPMG. Developed by the American Institute of Certified Public Accountants (AICPA), SOC 2 is a widely recognized framework for assessing how service organizations protect customer data. The attestation confirms that Datadobi’s internal controls and processes continue to meet the highest standards for the integrity, security, and confidentiality of customer data.

With unstructured data growing exponentially in recent years, the challenge of managing it is accelerating at an ever-increasing pace. IT and business organizations are moving data for system upgrades, to take advantage of the cloud, for cost or compliance reasons, and to prepare data for AI, analytics, and research. The race to get unstructured data ready for AI raises the stakes further: data feeding AI models, retrieval pipelines, and agents must be complete, uncorrupted, and properly governed, because errors or exposures at this stage are amplified in every output that follows. Throughout these processes, data integrity must be protected against human and machine error as well as malicious attacks. That puts the spotlight not only on the software organizations rely on to manage their data, but on the engineering, security, and operational discipline of the vendor behind it.

The SOC 2 Type I report reaffirms Datadobi’s company-wide commitment to data integrity, security, and software quality, giving organizations confidence that the data they move, manage, and prepare for AI is handled under rigorous, independently audited controls. It provides an in-depth look at the internal controls and processes that govern how Datadobi builds, tests, releases, and supports its software, including:

Secure, Defensive Software Engineering

A defensive engineering methodology is embedded across Datadobi’s software development lifecycle. All code is deployed following a four-eyes principle, and every code change is peer reviewed and passes extensive automated testing before it is included in a release. An agile release methodology means Datadobi’s software can be adapted quickly to customer-specific needs or interoperability challenges, without compromising quality or control.

Independent Quality Assurance (QA) Function

Datadobi maintains a QA function that operates independently of development to verify the quality of every release. If an issue is identified in a customer environment, it is investigated, and a software patch is provided to resolve it. A root cause analysis then determines whether any process, test, or architectural change is needed, so that lessons learned feed back into how all Datadobi software is built.

Risk Assessment and Governance

Datadobi applies a formal risk-control matrix across the business to evaluate risks and the controls in place to mitigate them. The matrix is regularly reviewed by Datadobi’s management and product management teams, ensuring security and data protection remain leadership priorities embedded in day-to-day operations.

Training, Support, and Customer Guidance

Datadobi trains customers and partners to use its software effectively in complex, multi-vendor environments and supports them at every stage of a project, from planning and pre-cutover testing to dry runs, cutover, and verification. Customers also have access to an extensive knowledge base of storage interoperability guidance and best practices, along with chain-of-custody reporting that documents how their data has been handled.

To learn more about Datadobi’s service commitments and obtain the available SOC 2 Type I report, visit https://datadobi.com/kpmg/

Leave a comment »

Florida DOE data breach potentially exposes SSNs of 4.9 million people

Posted in Commentary with tags on November 1, 2026 by itnerd

The Florida Department of Education (FLDOE) has disclosed a cybersecurity breach potentially affecting approximately 4.9 million people.

The incident involved unauthorized access to the state’s Florida Student Financial Aid website, exposing personally identifiable information, including Social Security numbers. Department staff discovered the breach on October 19.

Officials believe the breach was limited to the financial aid website but warned that certain online services may experience temporary disruptions during recovery.

The https://www.floridastudentfinancialaidsg.org/ website read: “This site is currently under maintenance and will be available soon. We apologize for the inconvenience.”

The department confirmed that existing financial aid, tuition payments and eligibility for scholarships, grants and student loans will not be affected.

Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:

“I never get used to hearing about incidents like this. It seems we barely finish discussing one breach before another reminds us how much sensitive information people are required to entrust to the systems they depend on.

“Florida estimates that approximately 4.9 million people may be affected. That number is preliminary, but even as an estimate, it’s substantial. From a security perspective, you prepare for the potential scope while allowing the investigation to establish what happened. The department has not publicly identified the intrusion method, so it’s important not to speculate about how the attackers gained access or which controls may have failed.

“What concerns me is the information potentially involved and what could happen to it afterward. Social Security numbers, dates of birth, addresses, and other personal identifiers can be combined with information from other sources to facilitate identity theft, synthetic identity fraud, or highly targeted social engineering. Those are potential downstream risks, not confirmed consequences of this incident. Unfortunately, personal information doesn’t come with an expiration date simply because a breach investigation has concluded.

“Having spent decades building, defending, and testing systems, I believe we must look beyond restoring operations and ask whether we’re adequately protecting the trust people place in these services. That means minimizing unnecessary sensitive data, limiting access, and continuously validating whether security controls work.

“It’s reassuring that officials say financial aid and eligibility will not be affected. But the larger issue is that people often have little practical choice about providing sensitive information to obtain essential services. They shouldn’t have to become cybersecurity experts to protect themselves afterward.

“An organization may recover its systems in weeks, but the people whose information was exposed could be dealing with the consequences for years. That’s the part of these incidents we cannot afford to normalize.”

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock

“Student financial aid systems hold three high-value data categories. Identity information, financial records, and household income data are all on the table here.

“For other state education departments, this is the time to confirm whether anyone has pentested these portals the way an attacker would, and if not, kick that off now so they can patch the exploitable vulnerabilities before someone else finds them. Public sector web applications accumulate technical debt faster than they get security review, and the ones holding Social Security numbers deserve a different level of scrutiny.”

ㅤ

John Strand, Owner, Black Hills Information Security

“These types of breaches are heartbreaking to me. Usually, the organization shuts the site down for a while and offers credit monitoring to the victims. But people may not understand the full extent of the damage until much later, when their personally identifiable information is used to open fraudulent accounts in their name.

“The impact doesn’t necessarily show up right away. For some victims, the identity theft and financial damage could surface years down the line.”

ㅤBreaches are very bad. And this one will be no different for those who are affected. Organizations need to keep that in mind as these breaches affect more than just the organization in question.

Leave a comment »

« Older Entries