Why Canadians Carry the Cost of Fraud

Posted in Commentary with tags on November 3, 2026 by itnerd

Canada’s biggest banks and telecom companies recently launched the Cross-Sector Anti-Fraud Exchange (CSAFE), a coalition to share confirmed fraud intelligence and reduce repeat scams. The same week, a UK scam victim recovered nearly $21,000 from her bank, while a Toronto resident hit by a nearly identical phone-and-courier scam received nothing. The article notes Canadian banks have no obligation to reimburse clients.

Together, the two stories raise a question for Canadian readers: if the money is rarely recovered after a scam, how well is fraud being stopped before it happens?

  • The coalition is a step forward in how banks and telcos work together, but it shares intelligence after fraud is confirmed. It does not by itself change how a customer’s identity, card or device is verified at the moment a scammer calls.
  • The Canadian Anti-Fraud Centre reports that Canadians lost about $351 million to fraud in the first half of 2026, and it estimates only 5% to 10% of fraud is reported. Bank investigator fraud, where scammers pose as bank staff, is among the top five categories by reported loss. It is the same scam pattern described in the UK-Canada comparison.
  • Banks and customers in Canada carry the risk differently from the UK. Prevention at the card, device and authentication layer therefore matters more, including stronger verification, fraud detection and secure payment technology.

Fraud prevention is a personal passion of mine. Therefore I encourage you all to read this and take action with your friends and family.

Leave a comment »

Fake LinkedIn Job Interview Leads to Binance Hack

Posted in Commentary with tags on November 3, 2026 by itnerd

Binance just confirmed attackers used LinkedIn to pose as recruiters, conduct fake interviews and send a malicious coding assignment to a Binance engineer’s work laptop – ultimately gaining access to systems tied to the company’s wallets. Commentary from Fortra cybersecurity experts below on the risks of using corporate devices for external assessments, controls around downloads, execution and permissions, and how one compromised developer environment can expose sensitive financial infrastructure.

.Gina Cardelli, Director of Platform and Threat Intelligence at Fortra

“My questions would be around the security controls surrounding that employee’s environments. An engineer seeking a new job downloaded a malicious coding assignment, giving attackers a foothold in a campaign that ultimately gained access to the company’s wallets. While using a work computer for an external coding assessment warrants its own scrutiny, the larger concern is how that compromise enabled access to other systems and sensitive financial infrastructure.”

Tyler Reguly, Associate Director, Security R&D at Fortra

“It has long been said that the cost of hiring a new employee is significantly higher than paying to retain an existing employee. It seems to for Binance, that cost was astronomically higher. In a world where quiet quitting exists, it should come as no surprise that employees are interviewing on company time. Organizations need to counter this with adequate controls in place. Particularly, controls around what can be downloaded and executed on a corporate laptop, as well as the permissions granted to the user. At the end of the day, Developer laptops are among the hardest devices in an organization to look down safely without being detrimental… organizations need to find the balance point.”

Rohan Gupta, CEO & Co-founder, Diopter

“Binance deserves credit for publishing a detailed timeline this quickly. The key moment came in Sep, when an engineer met on video with the CEO of a company that didn’t exist, trusted what he saw, and ran the code he was given. Everything technical that followed depended on that one conversation going the attacker’s way.

When Binance caught a tampered AI tool in Jun, it replaced the device and changed credentials, but new credentials couldn’t erase what the attacker had already learned about who was on the wallet team. Once attackers know who holds the keys, they often go after those people directly, and a recruiter’s pitch is one of the few approaches a target is likely to welcome without suspicion.

Expect more fake hiring processes aimed at engineers with privileged access, complete with fake executives on video calls. Security teams should treat recruiting outreach to those engineers as part of the attack surface and keep interview code off any machine near production. They should also confirm who’s on the other end of a video call before anyone acts on what was said. Binance says it’s increasing its investment in AI-enabled detection, and that detection has to run during the live conversation, before anything gets downloaded.”

The more that is learned about the Binance hack, the scarier it is. This should be required reading as clearly there’s lessons for everyone.

Leave a comment »

Critical Linux Flaw Exposes a Bigger Blind Spot in Connected Device Security

Posted in Commentary with tags on November 3, 2026 by itnerd

If you run Linux, you might want to pay attention to CVE-2026-98432. This is a critical Linux vulnerability that could allow remote attackers to take control of affected systems, is raising an important question for manufacturers of connected devices and industrial equipment: How do you protect products when you don’t necessarily know what’s running inside them?

Joshua Marpet, Sr. Product Security Consultant, Finite State:

“This is a significantly bad problem. This is a problem effectively anybody could take control of a Linux system that’s affected by this. And of course, that’s horribly bad.

“Assume a system which is taking readings from a power plant. Now you can’t trust those readings. And you may not even know that.

“Assume a system that controls a power plant. Now that system could be under hostile control. And you may not even know that you’re vulnerable.

“Because unless a manufacturer is tracking all of the code that they’ve ever written, and all of the versions of the firmware that they’ve ever written, with proper software bills of materials (SBOMs), and proper cryptographic bills of materials (CBOMs), and they’re tracking all of the potential threats and vulnerabilities (threat intelligence), they may never hear about the vulnerability, and they may never be able to tie the vulnerability to an older version of firmware that 100s of clients may still be running.

“And remember a manufacturer doesn’t really get paid to do all of these things with SBOMs and CBOMs and threat intelligence. They get paid to sell devices.

“So a lot of manufacturers never set these systems up to alert them to these problems.

“And realize there’s also a scale issue here. There’s a lot of manufacturers that have 50 people 100 people 150 people. There’s a lot of manufacturers that are still effectively small to medium business.  They may not even understand that they need to have threat intelligence, SBOMs, CBOMs. They may have no way to track which version of firmware clients are using to make sure that they’re updated properly.

“That’s just one side of this.

“Now let’s talk about the Linux side. Since this is a networking bug, Ubuntu hasn’t even decided to fix it. Last I checked, they hadn’t planned to.

“So now you’ve got something that is a bug in an underlying piece of software, the operating system. This isn’t in the application that company XYZ wrote to run on top of it. Are they even tracking that?

“This is a huge bug and vulnerability that’s falling through the cracks. This is a monstrous threat in an industry where threat in intelligence is not universally deployed. Or even close.

“Whose responsibility is it? If this was a cloud environment, there’s a shared responsibility model that clearly lays that out.  With connected devices oftentimes that’s not elucidated properly.

This is one where some people can patch their way out of this. But other people who run Linux who do not know that they run Linux, this is a real problem. And one that relies on the vendors to do the right thing. If they care.

Leave a comment »

Outpost24 Research Finds Infostealer Malware Affected 72% of Organizations With Exposed Credentials

Posted in Commentary with tags on November 3, 2026 by itnerd

Outpost24 today released its 2026 Credential Exposure Benchmark Report. Its researchers analyzed 31.5 million unique exposed credentials linked to 4,824 organizations across five industries in the United States and Europe, first detected between September 1, 2025, and September 1, 2026. The report finds that 72% of those organizations had staff or customer credentials identified in infostealer malware logs during that period.

Around 30.7 million of the credentials, roughly 97%, came from breach dumps and combolists, large collections of leaked logins that criminals compile and share. The remaining 844,000, under 3%, were stolen from infected devices by infostealer malware and are far more likely to reflect recent theft. Of the organizations analyzed, 41% had at least one infostealer-sourced credential on a staff email address, suggesting malware on a device used for work. A further 31% had malware-stolen credentials only on customer accounts.

The research found that exposure varies far more by industry than by location. Consumer Goods and Services had the most exposed credentials, 498 at the typical organization, almost all belonging to customers. Business Services ranked fourth on total credentials but first on staff exposure, with 47% of organizations holding a malware-stolen staff credential. Financial Services had the highest share of organizations with at least one infostealer-sourced credential, at 77%.

The typical European organization had 22% more exposed credentials than its US counterpart, 224 compared with 184. The share stolen by malware was similar in both.

Of the six European regions, the Nordics had the highest exposure, with 358 credentials at the typical organization, and the most credentials stolen by infostealers. The UK and Ireland had the highest share stolen by malware, at 2.7%. Spain had the lowest exposure, at 133 credentials at the typical organization. The highest combination of industry and region in Europe was Consumer Goods and Services in Benelux, at 1,285 credentials for the typical organization.

The report recommends prioritizing credentials stolen by infostealers and investigating the wider compromise, rather than simply resetting the affected password. For staff credentials, security teams should investigate the associated user and device, including whether other passwords or session cookies were stolen, and revoke active sessions. For customer credentials, organizations should secure affected accounts through password resets, additional verification and fraud monitoring.

The report revisits the 2024 campaign against Snowflake customers, in which attackers used stolen credentials to log in to accounts without multi-factor authentication. It also points to Meta, which disclosed in October 2026 that attackers had reached some of its GitHub repositories using a single employee’s stolen credentials.

The full report is available at http://outpost24.com/resources/2026-credential-exposure-benchmark-report/.

Leave a comment »

Hackers use agentic AI to target more than 200 organizations in 11 days

Posted in Commentary with tags on November 3, 2026 by itnerd

Hacking group Vapor Panda used an agentic AI penetration-testing framework called ARTEX to target more than 200 organizations across at least 14 countries in just 11 days, according to new CrowdStrike research.

The campaign began October 17 and targeted government ministries, defense agencies, semiconductor manufacturers, pharmaceutical companies, financial institutions and telecommunications providers.

CrowdStrike confirmed post-exploitation activity at nine organizations and said approximately 70% of targets were confirmed compromised or showed evidence supporting a successful intrusion.

The attackers combined ARTEX with DeepSeek and another commercial large language model to automate reconnaissance, exploit vulnerabilities, steal credentials and move laterally across networks.

CrowdStrike observed activity occurring as frequently as every 10 seconds, with the framework capable of exceeding 1,500 commands per hour compared with approximately 40 commands per hour during traditional human-operated intrusions. Human operators continued directing the AI agents, including instructing them to identify systems without endpoint security software.

John Strand, Owner, Black Hills Information Security

“This is the future. I strongly believe that within the next three months, the type of attack documented by CrowdStrike is going to become the new normal.

“OpenAI models and attack frameworks are readily available. What a lot of people don’t understand is that you can carry out these types of attacks with commodity hardware. You don’t need a massive data center. It might be slower, but it can still be done. And I think threat actors have absolutely started recognizing that.

“Everybody needs to be prepared. Reduce your external attack surface as much as possible, and use deception throughout your environment to establish tripwires. Give yourself a way to detect attackers when they get past your other defenses.”

ㅤ

Ryan McCurdy, Vice President of Marketing, Liquibase

“The speed and scale at which attackers can now operate is unlike anything we’ve seen before.

“A single operator can direct AI agents to execute more than 1,500 commands an hour, targeting multiple organizations at once. That’s a very different threat environment than what most security teams were built to handle.

“Companies have spent years building security processes that depend on people reviewing activity, identifying risks, and intervening when something goes wrong. Those processes weren’t designed for machines operating at this speed.

“And the challenge isn’t limited to attackers. As companies give AI agents more responsibility across software development and IT operations, they need to rethink where and how controls are enforced.

“Human oversight will still be important, but it can’t be the only line of defense. Organizations need policies that are enforced automatically, before an agent can make a change that puts critical systems at risk.”

ㅤI don’t know how many times I will say this. But if you aren’t defending against AI, you are screwed.

Leave a comment »

More Fridges Pwned In Cybereattack

Posted in Commentary with tags on November 3, 2026 by itnerd

I recently posted this story on French commercial fridges being hacked. Consider that your two minute warning because if you didn’t heed it, it’s now going to get worse for you. A lot worse:

A hacking attack on European supermarkets spread across the continent on Monday, hitting fridges and freezers from Sweden to Belgium and forcing stores to throw away food in an incident that echoed a similar ‌attack in France last month.

The attack, which raised temperatures in refrigerator and freezer units at dozens of stores, hit supermarket groups Ahold Delhaize and Colruyt in Belgium and Luxembourg, as well as Swedish grocers ICA and Coop. Furniture-to-meatballs retailer Ikea also saw at least one store affected.

“Everything is destroyed,” Engla Ingwall, sales manager at an ICA franchise store in Stockholm, told Reuters during a visit to the store on Monday, adding the attack occurred at 2 a.m., but was only noticed hours later.

“There has been a cyberattack and all our freezers reached 50 degrees [Celsius].”

A ​spokesperson for privately held ICA said the company was aware that a “limited number of stores were affected by ​an incident overnight, which impacted their refrigeration and freezer systems.”

Face it. Commercial fridges are critical infrastructure. Thus they need to be treated as such. Because clearly they are targets of threat actors. Now this could be teens, or they could be nation states. Who knows? Who cares? The fact is that these devices should not be Internet exposed. Which would make them inaccessible to threat actors. And there is a limited amount of time to fix this because clearly this problem is getting worse and not better.

UPDATE: Commentary has come in. Starting with Waseem Ahmed, Head of Engineering, Secure.com

“If these are cyber-attacks, as suspected, the common thread looks like remotely reachable controllers, not a fridge fault. French authorities named specific refrigeration controllers, researchers found thousands reachable from the internet, and one expert said many ran default passwords. Some older models no longer get security updates. The latest wave is still being confirmed, so I wouldn’t point at one vendor or one flaw today.

“Three checks to run before the week ends. #1 – List every controller your stores run, with model and firmware. #2 – Pull the management screens off the public internet and put remote access behind a VPN. #3 – Change every shared password, including the ones your refrigeration contractor uses.

“Then add temperature alarms that don’t depend on the controller being alarmed, because attackers in France reportedly lengthened defrost cycles and delayed the warnings.

“Food safety now sits on gap that nobody on the security team owns. That gap is the real story, and it is fixable.”

ㅤ

Joshua Marpet, Senior Product Security Consultant, Finite State

“In the wake of at least two waves of successful attacks against the infrastructure supporting food distribution, we have to assume that there will be others.

“That being said, this is not a moment to panic. This is a moment to reassess. And a moment to prepare. This is the moment we examine all of the devices in our infrastructure and determine which we prioritize as essential or not. This is the moment we insist that the suppliers of those essential connected devices supply us with software bills of materials, and cryptographic bills of materials at the very least.

“If you’re in a critical infrastructure industry, this is the moment that determines whether you’re on the front page of the Wall Street Journal for all the wrong reasons.

“How are you validating and verifying that every connected device in your infrastructure has been made as safe as you can get it? I’m not saying 100% safe. There’s no such thing. But after the French attack on refrigeration cases, why didn’t the parent companies of the supermarkets in Sweden in Belgium and everywhere else, not examine their systems?

“Putting our heads in the sand is no longer a viable strategy.

“Either follow the European Union cyber resilience act and get the manufacturer of your devices to handle the testing and the assurance, or contract with a third-party to make sure the devices you’re using are the right ones.”

ㅤ

Damon Small, Board Member, Xcape, Inc.

“Supermarkets across several European countries are experiencing widespread refrigeration system disruptions following another wave of suspected cyberattacks. Stores in Sweden, Belgium, Luxembourg and Ireland have reported sudden increases in refrigerator and freezer temperatures, resulting in significant food losses and temporary closures.

“These incidents highlight a fundamental cybersecurity principle: just because something can be connected to the Internet doesn’t mean it should be. Commercial refrigeration systems must be protected with the same diligence as any other operational technology (OT). Remote access, where necessary, should be restricted to secure connections such as VPNs and protected by strong identification and authentication mechanisms.

“More importantly, this is not the first wave of these attacks, and it certainly won’t be the last. Manufacturers and operators of these systems should act immediately to review their security configurations, restrict unnecessary Internet exposure and strengthen access controls. Waiting for another incident is not an acceptable security strategy. There will be another round, and the consequences could be even more significant.”

ㅤ

John Strand, Owner, Black Hills Information Security

“When we look back at 2026 years from now, we’re going to remember it as the year the refrigerator was on fire instead of the dumpster.

“Do we really need refrigerators connected to the internet at all times? Sometimes I think that maybe, just possibly, and I’m just throwing this out there, things might be a little too connected.

“But the real security issue is what happens when you combine IoT and embedded devices with a SaaS provider and centralized management. You have devices that often don’t have EDR or a patching plan, and then you tie them into a portal that can control a whole bunch of them.

“Attackers can go after the individual device, or they can compromise one SaaS portal and potentially gain access to multiple devices. That’s how a problem with one system can turn into widespread disruption.”

Leave a comment »

Two critical Langflow flaws let anyone on the internet take over AI agent servers. And the affected version logs everyone in as admin by default

Posted in Commentary with tags on November 3, 2026 by itnerd

IBM disclosed two critical flaws last week in Langflow, the open-source tool companies use to build AI agents. Both are rated 9.8 and let an attacker with no account take over the server, one through Langflow’s MCP endpoint. Every version through 1.12.8 is affected, and that version logs users in as admin by default. CISA already lists six earlier Langflow flaws as exploited.

Arti Raman, CEO and founder of the AI governance platform Portal26, says most companies don’t even know where Langflow is running. Here’s her take:

“Langflow is the kind of tool that spreads inside a company before security knows it exists. A developer or data team spins it up to build an AI agent, connects it to a few internal systems and API keys, and it quietly becomes part of how the business runs. Now there are two critical flaws that let anyone on the internet take over those servers without an account, and the affected version signs users in as an administrator by default. CISA has already confirmed attackers exploiting six earlier Langflow vulnerabilities, so organizations should expect these to be targeted quickly too. The first problem most security teams will hit is that they can’t say where Langflow is running, who set it up, or what data and credentials it has access to. That’s the gap AI governance has to close. Companies need an inventory of every AI tool and agent platform in use, sanctioned or not, along with visibility into what each one is connected to, so that when the next critical advisory drops, finding and patching the exposure takes hours instead of weeks.”

Besides patching all the things, everyone needs to close the gap when it comes to vulnerabilities like this. And fast.

Leave a comment »

AI is changing how hackers operate. Are defenders keeping up?

Posted in Commentary with tags on November 3, 2026 by itnerd

Two new reports from Kaspersky and CrowdStrike point to a concerning shift in how hackers are using AI: agents are now helping carry out real-world intrusions, from navigating compromised networks to harvesting credentials and escalating privileges. Which of course is bad.

Kevin Surace, CEO, TokenCore

“What CrowdStrike is documenting is an important turning point. AI is no longer simply helping attackers write code or craft better phishing emails. It is beginning to operate inside compromised environments, make decisions, move laterally, harvest credentials and escalate privileges on its own.

“That makes identity compromise dramatically more dangerous.

“In one of the cases CrowdStrike studied, an AI agent moved laterally to a domain controller and harvested credentials in roughly 20 minutes without additional human direction. In another, the AI discovered exposed credentials, obtained an identity and access management token, escalated to cluster administrator privileges and then extracted additional database credentials.

This changes the economics and speed of cybercrime. A stolen identity used to give one hacker a foothold. Increasingly, that same identity can give an autonomous agent a foothold, and that agent can operate continuously, explore the environment, find additional identities and privileges and determine its next move at machine speed.

“The report makes another point that should concern every CISO. CrowdStrike found that engineering sophistication was not necessarily the limiting factor. Even relatively low skill attackers were able to conduct successful intrusions using agentic AI. CrowdStrike concluded that token budget, rather than attacker skill, may increasingly become the constraint on scale.

So the security question is changing. It is no longer enough to ask whether someone has the correct password, MFA approval or passkey attack. Organizations have to know whether the person behind a privileged action is actually the authorized human.

“In an agentic world, identity has to become a hard security boundary. For critical access, privilege escalation and consequential actions, enterprises will increasingly need cryptographic authentication tied to the legitimate application and a physical biometric from the authorized person.

“AI is making sophisticated cyber operations faster, cheaper and accessible to far more attackers. That means a compromised identity is becoming more valuable than ever. If attackers can automate nearly everything that happens after they get inside, then preventing them from becoming a trusted user in the first place becomes one of the most important defenses we have.”

John Strand, Owner, Black Hills Information Security ()

“I believe what we’re seeing is the new normal. This is the evolution of cyberattacks, and organizations need to stop treating it as an aberration.

“For years, security has leaned on the idea that you don’t have to be the fastest person running from the bear. You just have to be faster than the slowest person. Well, now the bear has a jetpack and an AK-47, and it attacks indiscriminately.

“When organizations start treating swarms of AI agents and their relentless persistence as the new normal, it should fundamentally change how they defend themselves.

“I’ve been telling every organization I talk to the same thing. Invest in cyber deception. Put tripwires in place. Then reduce your attack surface as much as possible. If an externally exposed service isn’t required, firewall it off or disconnect it. That applies even if it has no known critical vulnerabilities.

“Don’t give attackers any more room to get into your organization than you absolutely have to.”

Jacob Krell, Sr. Director: Secure AI Solutions & Cybersecurity, Suzu Labs

“Kaspersky caught attackers running CyberStrikeAI, an open-source framework where a large language model (LLM) on the command-and-control (C2) server writes the commands while the implant on the victim’s machine just runs them. Education targets in Latin America and Africa went from a compromised SQL Server to domain administrator in three to four days, with final exfiltration under an hour. CrowdStrike separately identified four new threat actors using AI agents, including one that harvested domain controller credentials in about twenty minutes with no human involved.

“The architecture is what makes this productizable. All the intelligence lives on the attacker’s server, so the implant holds nothing worth seizing. Ransomware-as-a-Service (RaaS) proved buyers with crypto and no skills will rent an intrusion stack, and agentic frameworks remove the last labor input, the operator who knows which command comes next.

“My prediction is the pairing. Darknet listings will bundle a CyberStrikeAI-style harness with an uncensored model running on the seller’s hardware, sold for cryptocurrency. The customer brings a target. The seller brings the model that decides the commands. That is the hacking-as-a-service evolution I think we will begin to see.”

Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security

“What strikes me about these reports isn’t that AI has invented some revolutionary new form of hacking. Much of the underlying tradecraft is familiar: reconnaissance, credential access, privilege escalation, lateral movement, and data collection. We’ve been testing these techniques for decades.


“What’s changing is how attackers orchestrate them. AI is moving beyond helping write phishing emails or generate scripts toward interpreting results, selecting tools, and coordinating subsequent actions. That can reduce the hands-on effort required to execute familiar attack workflows, although we should be careful about claiming specific speed improvements without comparable human-led testing.


“Having spent time in penetration testing, full-scope adversary emulation, and security operations roles, I see an equally important question for defenders: If attackers are using AI to accelerate traditional tradecraft, why aren’t we applying those same capabilities to continuously test, challenge, and improve our defenses?


“The opportunity isn’t simply to automate penetration testing. It’s to bring offensive testing and defensive operations closer together through continuous purple teaming: emulate realistic attack paths, observe what our controls detect, identify the gaps, remediate them, and independently verify the results.

“Of course, there’s a certain irony in attackers adopting automation while defenders are still scheduling the next quarterly security assessment. The attackers apparently didn’t get the calendar invitation.


“AI doesn’t eliminate the need for experienced security professionals. It amplifies what they can accomplish, provided we maintain appropriate authorization, operational boundaries, and independent verification.

“The real advantage won’t be long simply to whoever automates attacks fastest. It will belong to those who can turn that same speed into measurable improvements in detection, containment, and remediation.”

The question is not if you should defend against AI. It’s when. Because if you don’t you will get pwned. It is that simple.

Leave a comment »

Polygraf AI and Carahsoft Partner to Help Public Sector Organizations Adopt AI While Maintaining Control Over Sensitive Data, Operational Risk and Compliance Requirements

Posted in Commentary with tags , on November 2, 2026 by itnerd

Polygraf AI and Carahsoft Technology Corp. today announced a partnership. Under the agreement, Carahsoft will serve as Polygraf AI’s Master Government Aggregator®, making the company’s AI security and governance solutions available to the Public Sector through Carahsoft’s reseller partners and NASA Solutions for Enterprise-Wide Procurement (SEWP) V, The Interlocal Purchasing System (TIPS) and OMNIA Partners contracts.

Polygraf AI offers AI security, data governance and sensitive-information protection solutions designed to help organizations adopt AI while maintaining control over data, security and compliance. Its AI Behavioral Control (AiBC) Plane applies real-time policy enforcement across AI interactions, endpoints, documents, email, collaboration tools and virtual meetings, helping organizations identify and protect sensitive information before it is transmitted, shared or processed by AI systems. Polygraf AI’s solutions include controls for AI prompts and outputs, sensitive-data discovery and redaction, AI-use monitoring, audit logging and detection of AI-generated and synthetic content. The platform can be deployed on-premise, in private cloud, at the edge or in air-gapped environments to support organizations with stringent data-residency and operational-control requirements.

Polygraf AI provides Public Sector organizations with capabilities to support the controlled adoption of generative AI while helping protect sensitive Government information. Its solutions can help agencies govern the use of public and private AI models, safeguard personally identifiable and other regulated information, monitor AI activity, secure virtual meetings and identify and redact sensitive content in documents and files. Through these capabilities, Polygraf AI provides an AI-specific security and governance layer that can integrate with existing technology environments and help Public Sector organizations expand the use of AI while maintaining established requirements for data protection and oversight.

Polygraf’s AI security and governance solutions are available through Carahsoft’s SEWP V contracts NNG15SC03B and NNG15SC27B, TIPS Contract #220105 and OMNIA Partners Contract #R240303. For more information, contact the Carahsoft Team at (703) 871-8548 or Polygraf@carahsoft.com; or learn more about Polygraf’s solutions here.

Leave a comment »

The $6.3 Bill Binance ownership failure & 3 Qs CEOs must ask

Posted in Commentary with tags on November 2, 2026 by itnerd

Binance lost about $6.3 billion in a single burst, the largest crypto theft on record. The early finding points to a compromised engineer laptop that reached an internal service able to submit withdrawals, which means the transactions looked authorized at every checkpoint they passed.

The failure wasn’t a missing tool. It was that nobody owned the whole path from a developer machine to a withdrawal. So nobody tested it, fixed it, and tested it again.

Waseem Ahmed, Head of Engineering, Secure.com:

“The $6.3 Billion Binance hack Is a wake-up Call:  the traditional security model needs to change.

“Most of the money left in about 20 minutes. That is the detail security teams should sit with. Binance’s investigation is still open. Early reports pointed to a compromised DevOps machine, but the company has since said the attack involved additional breach points and was not simply one engineer’s permissions. The pattern is still familiar: an action can be technically authorised and still not be legitimate, and monitoring alone will not tell you the difference in time.

“Three questions worth asking this week. What could our most privileged developer identity reach if it were stolen? Would we see that use in minutes, not hours? Is there a human approval step before an irreversible transfer?

“The organisations that close this gap test their own attack paths continuously, and they decide in advance what gets contained automatically and what needs a person.”

Hopefully organizations wake up to the fact that to be fully protected from hacks, everything must be considered. Otherwise you get stories like this.

Leave a comment »

« Older Entries