AI Adoption is rising, yet Readiness is falling

Posted in Commentary with tags on November 10, 2026 by itnerd

Kyndryl today released the findings from its third annual Readiness Report, revealing a widening divide between the returns organizations are seeing from AI and their readiness to manage the risks and demands that come with it.

While 64% of leaders report positive returns on AI investments, up 10 points from 2025, average readiness across external risks fell seven points to 24%. The steepest declines were in readiness for cyber threats and competitive disruption, as AI puts new pressure on business models, technology foundations and how organizations operate.

This year’s report captures the attitudes and actions of 3,700 senior business leaders across 21 countries. The data shows a dichotomy: while organizations are racing to deliver returns on significant AI investments, they simultaneously feel ill-equipped to navigate the implications for the AI era.

The report shows how organizations are making progress and adapting their AI strategies:

  • Significantly fewer describe themselves as in the experimentation phase compared to a year ago (-13 points from 2025, to 49%)
  • Nearly half (48%) substantially changed their AI strategies this year, with implications across tech, people and governance
  • About a quarter (24%) saw an AI investment fail, and 21% canceled a major AI initiative

The transition from experimentation to broader, sustained adoption remains uneven, particularly in the workforce and talent. Organizations have further to go in adapting how people work:

  • Just 27% have formally updated roles and responsibilities around AI
  • 29% have fully implemented change management for AI adoption at their organizations
  • Those who have done both are 28 points more likely to be completely ready for their AI implementation, and are 8 points more likely to report positive ROI on their AI investments

Additional findings in the report include:

Security concerns drive down confidence

For the third year in a row, security concerns topped the list of external risks, and this year contributed most to the overall decline in readiness. Just 26% of firms said they were completely ready for cyberattacks, a drop of 11 points from last year. Three in four leaders say AI helps their organizations identify threats faster, even as confidence in their ability to respond to cyberattacks has declined.

Concern about AI challenges established business models

The second-largest drop in readiness came from leaders’ concerns about competitive disruptions outside of their industry (-10 points from 2025, to 23%). The finding comes as AI agents and other new technologies are being deployed to erode established industry boundaries, and leaders described both challenges of adopting new technologies and questioning established products and business models.

Retailers, for instance, are weighing how to benefit from AI shopping assistants without forfeiting direct customer relationships; software companies face questions about SaaS models as AI rebalances the build-versus-buy equation; and financial institutions are challenged by emerging lending models.

Leaders put a premium on sovereignty, but action remains limited

The research also captures how leaders are considering digital sovereignty in a year marked by greater actions by governments, most visibly in the European Union. Notably, leaders in the EU are slightly less likely to have taken sovereignty-related actions compared to those in the rest of the world. It also captures the trade-offs organizations may need to make: 68% say solutions offering full operational control, should they need it, are worth a premium of 10% or more, and 60% say greater control is worth slower deployment and adoption of advanced capabilities.

Modernized infrastructure isn’t necessarily AI-ready

For the third year in a row, leaders said upgrading their IT infrastructure was the number one action their organizations are taking to mitigate external risks, and 71% rate their infrastructure as mostly or fully modernized. Yet two-thirds of CIOs surveyed think their technology foundations need significant re-architecture before being fully ready for AI at scale. Leaders are also making a distinction between a modern IT estate and one ready for the increased demands of artificial intelligence.

Read the Kyndryl Readiness Report.

Guardsquare Acquisitions Help Teams Ship High-Value Mobile Apps Faster and More Reliably

Posted in Commentary with tags , , on November 10, 2026 by itnerd

Guardsquare today announced the acquisitions of Runway, a mobile release management platform, and Bugfender, a remote logging and crash-reporting provider. As AI-powered attacks increase the speed and sophistication of mobile threats, Guardsquare is expanding its capabilities to ensure development teams have the necessary tools to keep pace with growing demands. The acquisitions add release management and crash analytics to Guardsquare’s established mobile security expertise, helping teams accelerate delivery, optimize app performance, and reduce operational complexity.

The growing demand for frequent mobile app updates, coupled with heightened expectations for quality and reliability, is making release management increasingly complex. Runway brings the entire mobile release process into one shared view, giving Android and iOS teams a complete picture of readiness, progress, and health. Once an app is live, Bugfender captures logs and crash data from devices in the field, helping developers pinpoint and resolve hard-to-reproduce issues.

With the addition of Runway and Bugfender, Guardsquare is empowering development teams to accelerate delivery, optimize application health, and achieve the highest level of mobile application security.

For more information, visit www.runway.team and www.bugfender.com.

Iran Suspected in Fridge, Cold Chain Attacks

Posted in Commentary with tags , on November 10, 2026 by itnerd

The WSJ is among outlets reporting Iran Suspected in Fridge Hacks following an address Monday by French Foreign Minister Jean-Noël Barrot at a G-7 meeting in Paris, who promised retribution for the hack, which has so far hit more than 700 French stores

In response, Matt Wyckhouse, CEO and Founder of Finite State and an expert on IoT and connected device security, offers perspective on the “vulnpocalypse” now apparently underway.

“France’s attribution of the refrigeration attacks to an Iran-linked group (which Iran refutes) shows the asymmetric power of targeting connected devices. A simple weakness in a seemingly ordinary controller can give an attacker the ability to cause physical disruption, and when that weakness exists across thousands of devices, the consequences can be catastrophic. These aren’t just refrigerators: connected devices support our food supply, hospitals, energy systems and other essential services. We have a lot of work to do to understand and strengthen the security of the devices we depend on, and to make sure fixes actually reach equipment already in use.”

While I have to wonder why fridges need to be connected to the Internet at all times, I have to ask if there is going to be a response to this. Otherwise being named as a source is kind of meaningless.

CData Appoints James Rochette as CFO and June Yang to its Board of Directors

Posted in Commentary with tags on November 10, 2026 by itnerd

CData today announced the appointment of James Rochette as Chief Financial Officer and June Yang to its Board of Directors. Rochette brings more than 30 years of finance and operating experience across private equity-backed and publicly traded technology companies, while Yang brings deep expertise in AI, cloud and data infrastructure from her leadership roles at Google Cloud and VMware.

The appointments follow the launch of CData Connect AI Gateway, which gives agents and individuals governed access to data across hundreds of enterprise systems, as enterprises put AI agents to work in production. Rochette will lead CData’s global finance organization and partner with the CEO and board on value creation, capital allocation and the company’s next stage of growth, while Yang will contribute her experience building and scaling enterprise AI and cloud platforms to guide the company’s direction.

Rochette most recently served as CFO of Anaqua, a leading intellectual property management software platform, through its sale from Astorg to Nordic Capital. Previously, he spent five years as CFO of Orolia, where he played a key role in the company’s sale from Eurazeo to strategic buyer Safran. He has served as CFO of two private equity-backed businesses through full investment cycles spanning value creation, M&A and successful exits. Rochette holds a master’s degree in finance from ISG Institut Supérieur de Gestion. Originally from France, he has lived in the United States for more than 10 years and is based in Washington, D.C.

June Yang is a technology executive with experience in AI, cloud, and data infrastructure. She was previously Vice President of Products & Design, Cloud AI and Industry Solutions at Google Cloud, where she led AI product strategy and helped enterprises put AI  into production. Before Google, she held leadership roles at VMware in cloud platforms and emerging technologies.

Latest Lumen Report: Cyber Threats Are Moving Faster, Bouncing Back Stronger

Posted in Commentary with tags on November 10, 2026 by itnerd

Lumen Technologies today released its CISO Update to the 2026 Lumen Defender Threatscape Report, showing that trends identified earlier this year have accelerated: threat actors are moving faster, operating at greater scale and quickly rebuilding after disruption. In one example, attackers began targeting a newly disclosed vulnerability within 24 hours, and more than 100 attack servers were involved within 72 hours.

The new report is based on intelligence from Black Lotus Labs, Lumen’s threat research and intelligence team, which monitors activity across Lumen’s internet backbone.

Among the report’s findings:

  • AI and automation reduce the time between vulnerability discovery and
    exploitation.
    Over three weeks, Black Lotus Labs observed a campaign launch more than 65 million attacks against more than 10,000 Fortinet devices using AI tools to automate the intrusions. With this persistent pace, even a temporary misconfiguration could lead to compromise.
  • Constant pressure has become the norm. In the first half of 2026, Black Lotus Labs detected nearly 4,000 brute force attacks and exploit scanners per day on average. They were aimed at firewalls, VPNs and other internet-connected equipment, showing attackers care more about whether a device is exposed than who owns it.
  • Criminal infrastructure is becoming regenerative. Activity linked to potential proxy-device recruitment quadrupled during the first half of the year, showing how home devices like phones and streaming boxes help replenish attackers’ stores. Additionally, IPIdea rebuilt its proxy network to nearly 112% of its previous size less
    than six months after a disruption effort.
  • Backbone visibility is designed to reveal attacker activity before public vulnerability disclosures. Black Lotus Labs observed infrastructure tied to a recent exploitation campaign more than three weeks before the vulnerability was publicly identified, helping researchers spot activity before traditional endpoint alerts or vendor disclosures.

These findings are part of a wider pattern: that established threats are becoming faster, broader and more persistent, as AI and automation shorten the path from finding a weakness to exploiting it.

Black Lotus Labs and Network Visibility

With visibility into 99% of public IPv4 addresses and hundreds of billions of daily network observations, Black Lotus Labs leverages Lumen’s position as the operator of the world’s most deeply peered network. With this, they can identify threats three to 21 days sooner than other threat feeds and help disrupt malicious activity before it reaches intended targets.

Black Lotus Labs combines this network visibility, AI-powered analytics, automation and multidisciplinary expertise to turn internet-scale data into actionable threat intelligence that helps organizations stay ahead of rapidly evolving threats.

The full report is available at 2026 Threatscape Report | Lumen Technologies.

Finite State Raises $27 Million to Help Device Makers Fight the ‘Vulnpocalypse’ with AI-Powered Product Security

Posted in Commentary with tags on November 10, 2026 by itnerd

Finite State today announced a $27 million Series C funding round led by private funds managed by The O.H.I.O. Fund, with participation from CIBC Innovation Banking, Energy Impact Partners, Energize Capital, and National Grid Partners to continue its mission to secure the world’s connected devices.

Finite State’s AI-driven product security platform analyzes the software and firmware inside finished devices, giving manufacturers visibility into the products they build and sell, from vehicles and medical devices to industrial equipment, consumer electronics and critical utility infrastructure. The platform uncovers both known and zero-day vulnerabilities and guides manufacturers in fixing the exploitable ones before attackers strike, making everyday life safer and more secure.

The new capital will expand Finite State’s already global operations, deepen its presence across key international markets, and accelerate development of the platform’s autonomous capabilities. These investments will enable more manufacturers around the world to uncover the gap between the software they plan to ship and what actually runs in the finished device, and to continuously identify and mitigate security risks across increasingly complex software supply chains.

The funding comes at a turning point for product security. In October, AI-powered research uncovered critical flaws in some of the world’s most widely used software, including a vulnerability in the PHP programming language that underpins much of the web, in a surge security leaders have dubbed the “Vulnpocalypse.” AI has shrunk the time it takes to find a flaw and turn it into an attack from weeks to days, and sometimes hours. Connected devices are especially exposed: a single flaw in a shared open source component can sit inside millions of shipped products that are hard to inventory and slow to patch. For manufacturers, the urgent question is no longer whether a vulnerability exists. It is which of their products contain it.

In parallel, regulators worldwide now expect connected products to be secure by design, with security built in and demonstrated before a device ships rather than added after it reaches the market. The EU Cyber Resilience Act, FDA premarket cybersecurity requirements, UNECE R155 and R156 for vehicles, and IEC 62443 for industrial systems all place the burden of proof on the manufacturer, and the cost of falling short includes blocked market access, recalls, and liability.

Meeting that standard is difficult because modern connected products are assembled, not written from scratch. A single device can contain open source libraries, third-party components, and legacy code from many suppliers, and what ships in the finished firmware often differs from what the source code and bill of materials describe. Manufacturers cannot secure what they cannot see.

Finite State customers span the world’s critical infrastructure and connected device ecosystem—from national power grids and a U.S. national security research laboratory to global automakers, life-saving medical devices, and the connected hardware running inside homes, hospitals, and factories worldwide. With the IoT security market projected to reach $80.3 billion by 2031,[1] Finite State’s growing international customer base reflects a challenge that increasingly transcends borders: manufacturers must understand exactly what software is inside their products, whether it can be exploited, and what they need to do about it.

Among its latest honors, Finite State was named to the 2026 Inc. 5000, an annual ranking of the fastest-growing private companies in America, and chosen as a finalist in SiliconANGLE’s prestigious 2026 TechForward Awards in the Security category.

Deepfake fraud has cost almost $4 billion worldwide since 2020

Posted in Commentary with tags on November 10, 2026 by itnerd

Deepfake incidents reached 809 in the first three quarters of 2026, a 24% increase on the 651 recorded in the same period of 2025, according to new Surfshark research. At that pace, 2026 will surpass last year’s record of 970 incidents, with reported losses already at $972 million for the year to date.

Every quarter of 2026 so far has exceeded its 2025 equivalent: incidents rose 47% in the first quarter, 23% in the second, and 3% in the third. Across the most recent 12-month period (2025 Q4 through 2026 Q3), losses reached $2.24 billion, 55% higher than the $1.44 billion recorded across the previous four quarters.

The 2026 figures sit atop a steep multi-year climb. Surfshark identified 2,430 deepfake incidents in total between January 2020 and September 2026, with nearly 90% of them occurring from 2024 onwards. Cumulative fraud losses across the full period total $3.91 billion, of which 98% occurred from 2024 onwards, when popular generative AI tools gained popularity.

More info here: Deepfake fraud statistics: $3.91B lost since 2020

AI coding agents expose thousands of passwords and credentials on GitHub

Posted in Commentary with tags on November 9, 2026 by itnerd

New research from Apiiro uncovered 2,539 exposed credentials across 1,994 public GitHub repositories, including database passwords, cloud API keys, authentication tokens and SSH logins. Researchers identified 63 affected organizations, including startups, software vendors and IT services firms.

The exposure stems largely from Anthropic’s Claude Code, which can save approved commands, including embedded passwords and credentials, in local configuration files when developers select “Yes, and don’t ask again.” Those files can subsequently be committed to public repositories.

Researchers found that Claude coauthored commits involving exposed credentials in 539 repositories, while conventional secret-scanning tools failed to identify some of the leaks. Among the exposed credentials were production database passwords, an administrative cloud API key and credentials associated with a medical records application. Apiiro also found secrets lingering in repository histories, AI agent transcripts and memory files.

Seemant Sehgal, Founder & CEO, BreachLock

“A ‘don’t ask again’ prompt is a decision to write a credential into a file, and many developers clicking it likely don’t know that file exists. Once it lands in a repository, it sits in a place many secret scanners were never built to check, which appears to be why some of these leaks slipped through. Apiiro found Claude coauthored commits in 539 of these repositories, and it also found secrets in agent transcripts and memory files that almost no one audits. I spent years on the buying side of security budgets, and I never saw a line item for the config file an AI agent writes on a developer’s behalf. Any of these credentials that were never rotated let someone log in to a production database with no exploit required.”

ㅤ

Ryan McCurdy, Vice President of Marketing, Liquibase

“What’s concerning is how easily a routine development task can create a security exposure. A developer approves a command to save time, the AI agent retains credentials as part of that approval, and those credentials can eventually end up in a public repository. Nobody intended to expose them but the workflow made it possible.

“As AI agents become more involved in software development, organizations need to recognize that source code isn’t the only thing they need to secure. Agent configuration files, transcripts, and execution histories can contain sensitive information, and traditional security checks may not catch everything.

“The consequences become particularly serious when those credentials provide access to production databases. An exposed password isn’t just a data security issue if it also gives someone permission to modify or delete critical information. Organizations need to limit those permissions and establish independent controls over changes to production systems.”

ㅤ

John Strand, Owner, Black Hills Information Security

“What I find really exciting about these stories of AI embedding API keys and passwords in publicly accessible repositories is that this is exactly what humans do. We’ve been doing it for years. If you ask an AI agent, ‘Why did you hardcode these API keys and put them in a public GitHub repository?’ it’s going to look right back at us and say, ‘I learned it from you.'”

This again proves that AI can’t be trusted. Which means organizations have to make sure that they protect themselves accordingly.

DigiCert confirms customer data breach following 16-month security lapse

Posted in Commentary with tags on November 9, 2026 by itnerd

Certificate authority DigiCert has disclosed a data breach involving an internal business system that was inadvertently exposed to the internet for more than 16 months following a February 2025 network migration.

The system, previously restricted to VPN access, allowed an unauthorized user to create an account without multifactor authentication and access archived customer information. DigiCert discovered unauthorized accounts on June 18, 2026, but initially dismissed them as harmless because they weren’t assigned to an application.

Although the vulnerability was addressed on July 2, the company didn’t confirm until October 19 that customer records had been accessed between June 27 and July 2. Exposed information included names, business contact details and, for some customers, passports, driver’s licenses and other identity documents. The number of affected customers remains undisclosed.


Seemant Sehgal, Founder & CEO,
BreachLock

“A system that was behind a VPN for years and then sat on the open internet for 16 months tells you the migration checklist had no step that asked what else this change exposes. This is how most of these exposures start. No one re-verified reachability after the move, so the control everyone assumed was in place had quietly stopped existing. When unauthorized accounts are dismissed because they weren’t tied to an application, it means the team judged risk by what the account was assigned to rather than what it could reach. That is how an exposure turns into a confirmed records breach four months later.”

ㅤ

John Strand, Owner, Black Hills Information Security

“Whenever I see articles like this, I get uncomfortable with the way information trickles out from the vendor, bit by bit by bit. Sometimes we don’t get a cohesive understanding of what happened until months later. This breach feels like that.

“First, there was a breach, but nothing sensitive was affected. Then, there was a breach, but we took care of it. Now we’re hearing that the exposure lasted more than 16 months.

“That pattern makes me question whether the slow release of information is intentional. I can’t say what the vendor’s intent is, but dribbling out details can bury a story. Something that would have been a very large story if disclosed all at once starts small and grows through updates that attract less attention.

“The story gets old. Writers and reporters end up covering what looks like the same incident again and again, even when the new information materially changes our understanding of it. That concerns me, because this is starting to look like a much larger breach than was initially reported..

“It’s either that, or they are very incompetent.”

ㅤ

Sharon Hagi, CSO, Finite State:

“Certificate authorities are the root of trust for the connected world. Billions of devices rely on them to prove who they are (identity), to authenticate each other (authentication and key exchanage), and to accept only genuine firmware updates (digital signatures). When a CA’s security fails, the damage can reach every system that trusts it.

“DigiCert says certificate issuance was not affected, and that matters. But this was not a sophisticated attack. It was a basic operational failure: a system was exposed for 16 months, accounts could be created without MFA, and confirming the breach took four months. The stolen identity documents are the same ones used to validate certificate holders, which gives attackers material for impersonation and social engineering. The fact that a certificate authority fell short in this case, is the material concern.

“CAs sit at the top of the trust hierarchy. They have to be held to a higher standard than anyone else in ecosystem, and they have to meet it.”

This is way too long to notify humans that you got pwned. And you have to question if people are paying attention. Especialy 16 months later.

UK deploys military cyber hunt teams overseas to disrupt hackers before attacks

Posted in Commentary with tags on November 9, 2026 by itnerd

The UK military is deploying specialized cyber teams overseas to identify and disrupt hostile hackers before they can attack British defense networks, according to a new report from The Times.

Major General Mike Fayers, commander of the UK’s Defence Cyber and Electromagnetic Force, revealed that personnel are conducting forward-deployed operations across Europe and Asia with the consent of host nations. The force, comprising more than 700 military and civilian personnel, also searches Ministry of Defence networks for intruders and hidden malware that could be activated during a conflict.

Fayers warned that AI is accelerating cyberattacks, reducing the time available to respond to newly exploited vulnerabilities from days to minutes. The Ministry of Defence reported approximately 90,000 state-linked cyberattacks over the past two years, double the previous period.

Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security

“Waiting for an attacker to reach your network before looking for them is becoming an increasingly expensive strategy.

“What interests me about the UK’s approach isn’t simply deploying cyber teams overseas. It’s the recognition that effective defense increasingly requires understanding adversaries, their capabilities, and the paths they may take before an attack reaches its intended target.

“AI may compress attack timelines, but speed alone doesn’t determine the outcome. Visibility, preparation, intelligence, and tested security controls still matter.

“Organizations don’t need military cyber teams to adopt this mindset. They need proactive threat hunting, continuous offensive testing, and the discipline to validate complete attack paths rather than simply count vulnerabilities.

“The objective isn’t to win every game of cat and mouse. It’s to make sure the mouse doesn’t already have the keys to the house.”

ㅤ

Seemant Sehgal, Founder & CEO, BreachLock

“Forward hunting buys defenders time, and that time pays off only for those who already know which of their systems an attacker can reach. Behind the 90,000 attacks the MoD reported, the number that decides outcomes is how many found a path that already existed. When the response window shrinks from days to minutes, any weakness you have not already found and closed will be reached first.”

ㅤ

John Strand, Owner, Black Hills Information Security

“I think this kind of forward thinking from militaries around the world is absolutely essential. It also scares me. Both can be true.

“I’ll be one of the first people to say that militaries need offensive cyber capabilities. Full stop. If the NSA, NRO, CIA and, within its authorities, the FBI aren’t looking at how those capabilities fit into their missions, then what the hell are we paying them for?

“The UK is moving in this direction, and I think that’s necessary because our adversaries are already doing it. It’s disturbing to see countries tie their own hands while their adversaries are willing to do whatever they want. There is no scenario where simply hoping the other side shows restraint works out.

“But we also have to talk about escalation. As with almost any military option, cyber or kinetic, there is a risk that your actions trigger a response and that response drives the next escalation. There are going to be problems, and we need to be honest about them.

“You can hold both things in your head at the same time. You can recognize the danger of escalation and still understand the absolute necessity of having offensive capabilities.”

Maybe the US needs to take a page out of the UK playbook here? Just a thought?