Review: Ekster Cardholder Pro For MagSafe & Ekster Tracker Card for MagSafe

Posted in Products with tags on October 17, 2026 by itnerd

I am a sucker for Ekster products. Quite simply they work and I will either default to them or come back to them when I have tried other options. An example is this:

This is the Ekster Cardholder Pro for MagSafe. And its reason for existence is to act as a wallet that I can slap onto my iPhone and take it with me on a bike ride or a cross country ski. It’s a pretty simile device that claims to hold 7 cards. Though through an add on that Ekster also sells it can be expanded to 17 cards. Frankly I have to assume that they mean 7 un-embossed cards as I have an embossed card (aka raised letters or numbers) which limited me to five cards. Since five cards was what I needed, it was fine for me. But it may not be fine for you. So buyer beware.

It has MagSafe magnets on both sides. But only one side can be used to attach the wallet to the phone as the magnets have different polarities. That I have to assume is for any accessories like a tracking card not to mention anything like cash clips or ten card expansions. It it made of 100% recycled aluminum and the mechanism that ejects the cards like this….:

…Can be cleaned and repaired. Those are quality of life things that matter to me. I got it in matte black because matte black is my thing. But it comes in many other colours.

As an aside, this works for Android users as well as Ekster also has stickers for Android as well as a tracking card for Android.

Now for the magnets. It was decently strong when used with my case. But it was a tad stronger with a naked iPhone. That means that your mileage may vary when it comes to magnet strength.

Now over the second half of this review which is the Ekster Tracker Card for MagSafe.

This is a thin tracker card that has Apple Find My compatibility via Bluetooth. Or put another way, if you want to treat it like an AirTag which means that you are using the Ultra Wideband functionality, this card won’t do it. But in my experiments, I found that the best shot of finding the card was if it was stationary. It can’t be constantly tracked if it is moving. But it is still trackable. It’s not a loud when it comes to generating an audible signal versus some other cards that I tried which are louder, but I had no issue hearing it. That said, I do wish it was louder so that there were no issues hearing it. Also, it only comes in black FYI.

When it comes to the MagSafe part, this is where it shines. The MagSafe connection to the Ekster wallet was extremely strong and wasn’t coming off unless you wanted to take it off. Or put another way, it would not come off in causal contact. It clearly was designed to not be flush with the Ekster wallet so that removal is easier. But part of me would have liked to see it flush to make it even harder to remove than it already is. But I can see why Ekster did that. Thus I am fine with it. And it fits my use case perfectly. Which is to toss it into my cycling jersey and go with my iPhone. Or to keep it in my pants pocket separate from my iPhone. Another thing to note is that there are MagSafe magnets on only one side which is the side that doesn’t say “Ekster.”

One thing that really needs to happen is that some sort of instructions need to be placed in the box. I say that because finding out how this card was charged required a search of the Internet which is a #fail. For the record, if you are using a MagSafe charger you put the side that says “Ekster” on the charger until it magnetically connects. You should see a really small white light start to blink. It is charged when the light goes to steady. All of this assumes that the card is paired with an iPhone. A charge lasts about five months which I have not tested, but I have not seen anything to the contrary. And I would suggest charging it before the first use to get the best results with it.

The only downside to this combo is the price. The wallet was $159 CDN which is far from cheap. And it is $79 CDN for the tracking card which is also far from cheap. But having used Ekster products in the past, they do last so you only buy this cardholder once. That is a very big win as far as I am concerned.

Leave a comment »

Guest Post: The ransomware industry scaled just fine without AI. Here’s what that tells your 2027 budget

Posted in Commentary with tags on October 16, 2026 by itnerd

By Waseem Ahmed, Head of Engineering, Secure.com

Summary

In April 2025, UK retailer Marks & Spencer lost about £300 million in profit to ransomware. The way in wasn’t clever. Someone phoned the help desk, posed as staff, and walked out with a password reset. No AI. Just an open door.

TL;DR:

Ransomware grew into a billion-dollar criminal industry years before modern AI tools existed. It still breaks in through the same plain doors: stolen passwords, unpatched systems facing the internet, and phishing. AI speeds up a few attacker tasks, but it doesn’t create the opening. So the smart budget move is plain. Pay to close the doors you already have, not to fight a robot attacker that isn’t hurting you.

Ransomware got big before AI showed up

Ransomware was already huge long before anyone typed a prompt into a chatbot.

In 2017, the WannaCry attack hit more than 300,000 computers across 150 countries in a matter of days. That was years before today’s AI tools reached the public, which only happened at the end of 2022.

By then, the business model was already built. Criminal groups rent out their ransomware to others, split the profits, and run their own support desks. One analysis of public attacks counted 277 ransomware gangs between 2015 and 2025, with 102 of them active in 2025 alone.

The trend keeps climbing. Verizon’s 2025 Data Breach Investigations Report found ransomware in 44% of all breaches, up from 32% the year before.

Timeline showing ransomware became a large criminal industry years before modern AI tools reached the public at the end of 2022.Ransomware · scale over time

The industry was built before AI arrived

Ransomware was already a global, organized business long before anyone typed a prompt into a chatbot. AI showed up late.

2017 – WannaCry goes worldwide – One attack hit more than 300,000 computers across 150 countries in days. No AI involved.

2019 to 2021 – The criminal economy matures – Ransomware as a service and data theft extortion become the standard playbook. Gangs rent tools and split profits.

Late 2022 – AI shows up here – Modern AI tools reach the public

Generative AI arrives after the industry is already built. It speeds up a few attacker tasks. It does not open the door.

2025 – Still climbing – Ransomware now shows up in 44% of all breaches, up from 32% a year earlier. The growth needed no AI.

(Sources: Verizon 2025 Data Breach Investigations Report; Mastercard ransomware trends analysis [2026]. Figures are directional.)

The doors attackers use are boring and known

Here is the part that should shape your budget. Attackers rarely need something new. They walk through doors you already know about.

Three openings show up year after year:

  • Stolen or weak passwords. Verizon’s 2025 report tied 22% of breaches to stolen credentials.
  • Unpatched systems facing the internet. The same report tied 20% of breaches to attackers exploiting a known software flaw, the fastest-growing way in.
  • Phishing and social engineering. About 16% of breaches started with a person being tricked.

Attackers love targeting the VPN and firewall. Verizon 2025 DBIR found attacks on VPNs and edge devices grew nearly eight times in a single year. The cyber insurer Coalition traced 58% of its ransomware claims to problems with these same perimeter devices.

Look back at that retailer. The door was a support desk that reset the wrong person’s password. Boring. Known. And it still cost hundreds of millions.

(Share of breaches source: Verizon 2025 DBIR. Each is a separate way in, so they do not add to 100%.)

Two additional stats worth noting:

  • ~8x  Jump in attacks on VPNs and edge devices in a single year.
  • 58% of ransomware claims traced to perimeter devices, per cyber insurer Coalition.

(Source: Coalition 2024 claims data. Figures are directional.)

So where does AI actually fit?

AI helps attackers, but it’s not a magic key.

Researchers who study real ransomware say AI speeds up small tasks. It writes smoother phishing messages. It helps a weak coder clean up buggy malware. In one case, it helped map a target network faster.

None of that opens a locked door. The attacker still needs a stolen password or an unpatched box to get in. The people who track these groups describe AI today as an accelerant, not a revolution.

This matters for spending. Many teams fear a clever AI attacker more than the plain threats sitting in front of them, a gap we covered in our look at what security leaders actually fear. That fear rarely matches where the money is actually lost.

What this means for budgets

If the doors are known, your budget should pay to close them first. Chasing AI threat hype before the basics is spending backward.

Fund the doors, not the hype: If the ways in are known, your budget should pay to close them first. Here is the order that stops the most ransomware per dollar.

1 – Identity and MFA: Make a stolen password useless. Turn on phishing resistant MFA and remove shared logins.

2 – Patch what faces the internet: Fix your VPN, firewall, and public servers first. That is where the exploits land.

3 – Know your attack surface: You cannot close a door you cannot see. Find every exposed system before an attacker does.

4 – Fast detection and response: Assume someone gets in. Catch the early moves and shut them down before files get locked.

5 – Tested backups – Keep copies attackers cannot reach, and practice restoring them.

6 – Supplier risk – Many attacks now ride in through an outside vendor. Put that door in the plan.

Every item is a door, a lock, or a guard. None of it is hype.

FAQs

Does AI make ransomware more dangerous?

 A little, but not the way the headlines suggest. AI helps attackers write better phishing and move a bit faster. It does not create the opening. The way in is still a stolen password or an unpatched system.

What is the number one way ransomware gets in?

 Known, avoidable weaknesses. Stolen credentials, unpatched internet-facing systems, and phishing lead the list every year. In the Sophos 2025 study, exploited vulnerabilities were the top root cause for the third year running, at 32% of attacks.

Should we budget to pay the ransom?

 Plan not to. Paying is getting less reliable, and the cleanup is the real cost. Sophos estimates the average recovery bill, excluding any ransom, at $1.53 million in 2025. Money spent on prevention and backups goes further than money set aside to pay a criminal.

Where should a small team start?

 Start with identity and your internet edge. Turn on strong MFA, remove shared accounts, and patch anything exposed to the internet. Those two moves close most of the common doors for the least money.

Does AI help defenders too?

 Yes, and this is the better use of it. AI can find your exposed doors before attackers do, and it can speed up detection and response so defenders catch an intrusion early. Used this way, AI pays for itself on defense, not on fear

How Secure.com can help

Secure.com runs governed AI teammates that work above the stack you already own, with your team approving anything that matters. The idea is simple. Attack your own defenses to find the open doors, harden them, and prove the fix.

The Red Teammate acts like the attacker. It hunts for the exposed VPNs, weak spots, and exploitable flaws that ransomware crews use before they find them.

Defensive teammates turn those findings into action, so a weakness becomes a fixed door instead of another line on a report.

The SOC Teammate watches for the early signs of an intrusion and helps shut it down fast, with a full record of every step.

Everything runs inside your rules. Your team sets the scope, approves the big actions, and keeps the audit trail.

You start with one teammate, go live in days, and hand your team back hundreds of hours a month of grunt work.

Attack. Harden. Prove. Repeat.

Leave a comment »

SOCRadar Launches New API Suite That Lets MSSPs Build or White-Label Threat Intelligence

Posted in Commentary with tags on October 16, 2026 by itnerd

SOCRadar announced a new dual-layered API suite that enables MSSPs to build or white label their own threat intelligence. They’ll now have the choice between complete multi-tenant, backend platform automation or raw threat intelligence ingestion to build their own proprietary features. This dual-layered approach allows partners to engage with SOCRadar’s technology in the exact way that suits their business model, whether they want to embed the technology into ready-made platform capabilities or harvest SOCRadar’s data to power their own proprietary tools.

Until now, MSSPs, technology vendors and large enterprises that wanted to embed threat intelligence into their own platforms had to choose between flexibility and speed and were faced with two competing constraints. If they wanted to build differentiated products on top of raw intelligence data, they were forced to accept pre-packaged, “black box” outputs that limited customization and innovation. If they needed a ready-made, white-label solution, they were stuck with manual, one-by-one provisioning, creating tenants, licenses, and configurations by hand, which didn’t scale as their client base grew.

SOCRadar’s new dual-layered API suite solves that limitation by bridging two critical capabilities into one unified suite:

  • The Multi-Tenant API provides a two-way, automated engine API that lets partners programmatically issue alarms, create and manage licenses, provision tenants, and configure settings at scale, without manual back-office work.
  • The Advanced API gives partners direct, raw-data access to underlying intelligence data so they can build their own features, models, and product experiences on top of it.

This dual approach allows partners to leverage SOCRadar’s technology to meet their specific needs and business model, including embedding the company’s ready-made platform capabilities or harvesting its data to power their own proprietary tools.

Leave a comment »

Withings wants you to pay $100 a year to sync a scale with Apple Health…. WTF?

Posted in Commentary with tags on October 16, 2026 by itnerd

In the most clearest cash grab ever, Withing who make scales that measure anything from heart rate to weight among other items have decided that if you created an account on or after October 13, 2026, you are required to pay a $99 Withings+ subscription to sync their scale data with Apple Health. If you have created an account before that, nothing changes for you. And once the company posted their official response, the rage from the Internet was evident. Here’s a few examples:

What an absolute trash decision they are making. I will never be buying a Withings product again nor will I ever be subscribing to anything. This is pure greed.

And:

I’ve been a Withings user for about 15 years now, recently bought a Body Fit, but honestly this absolutely disgusts me and I’m now actively looking at options to dump the lot. I’d rather support an honest company that actually cares about their users. Withings clearly don’t.

This is pure corporate greed and the epitome of ‘enshittification’ and I’m done with it.

And:

I’m gradually leaving Withings, enshittification is underway. I just need a good replacement for the smart scales.

And:

It’s only a matter of time before existing users are forced to use the subscription.

That last part is what catches my attention. This is going to migrate down to existing users if they feel that new users will comply with this. And what makes this worse is that this might ever violate Apple’s own guidelines:

That’s interesting. I for one want to see how this plays out because there’s the potential that Apple will smack these people down. But at the very least, users are revolting and Withings will have to figure this out to make users happy. Because they clearly are not happy.

Let’s see if Withings figures it out.

Leave a comment »

123456′ password linked to Denmark breach affecting 8.8 million

Posted in Commentary with tags on October 16, 2026 by itnerd

A hacker who accessed Denmark’s national population register, compromising information on approximately 8.8 million people, reportedly exploited an IT company’s account protected by the password “123456,” according to local media.

Yeah that’s pretty bad.

At least three accounts at the company, including an administrator account, reportedly used the same password. The attacker exploited the company’s legitimate access to the government database to obtain names, addresses and national identification numbers. Danish authorities are investigating the breach.

ㅤJohn Carberry, Solution Sleuth, Xcape, Inc.:

“Upstream vendor negligence remains an immediate route to enterprise regulatory liability, particularly when core citizen data is exposed through elementary authentication failures. This incident serves as an alarming case study in how foundational security neglect invites severe operational compromise. An external contractor accessed Denmark’s national population register using the trivial password “123456,” operating in an architecture that enforced neither password complexity standards nor multifactor authentication (MFA). Compounding the breakdown, the intrusion was not uncovered by defensive telemetry or behavioral monitoring, but rather through a billing surprise when an invoice revealed unusually high database activity during the unauthorized exfiltration. Although Danish public bodies and commercial partners are subject to both the EU General Data Protection Regulation (GDPR) and the national Danish Data Protection Act, it remains to be seen whether the independent supervisory authority, Datatilsynet, will levy meaningful financial penalties and binding injunctions against state-affiliated infrastructure. Ultimately, regulatory compliance frameworks mean nothing when basic identity hygiene is ignored and automated egress monitoring is nonexistent.”

“Critical Takeaways

  • Foundational identity hygiene failed at every level: Permitting the default password “123456” without enforced complexity requirements or mandatory MFA demonstrates an indefensible lack of baseline access controls.
  • Invoices are not intrusion detection systems: Discovering an active data exfiltration event through a billing anomaly underscores a dangerous absence of egress rate limiting and automated query monitoring.
  • Regulatory accountability faces an institutional test: While Datatilsynet wields statutory power under the GDPR and national law to impose penalties, holding public-sector infrastructure accountable will test the regulator’s enforcement independence.

“Mandating GDPR compliance on paper while allowing administrative passwords that belong on a cheap luggage lock is pure compliance theater.”

ㅤ

Phil Wylie, Senior Consultant & Evangelist, Suzu Labs:

“Cybersecurity can be complex, and there are countless security solutions and services available to help organizations protect themselves. But sometimes it’s the basics that make the biggest difference. Good security hygiene, including strong passwords, multifactor authentication, and limiting access to sensitive systems, can go a long way toward reducing risk.

“It’s hard to believe that in 2026 we’re still seeing passwords like ‘123456’ being used, especially on accounts with access to sensitive government data. Attackers don’t always need sophisticated exploits when basic security practices are overlooked.

“This incident also highlights the risks associated with third-party access. Organizations need to make sure their vendors are following security best practices because a weakness in a trusted partner’s environment can put millions of sensitive records at risk.”

ㅤ

John Strand, Owner, Black Hills Information Security:

“This is one of those stories where it’s very difficult to have a serious infosec hot take because it’s just ridiculous. We can talk about AI for defense, AI for offense, and all of the incredible advancements we’re making in computer security and vulnerability management, but all of that can be completely undone by a password of 1-2-3-4-5-6. The only thing I could think when I saw this story was, ‘That’s the same code I have on my luggage.’”

ㅤAll I have to say is “oh my God”.

Leave a comment »

NETGEAR launches PR30SG

Posted in Commentary with tags on October 15, 2026 by itnerd

NETGEAR introduces the PR30SG, a Dual WAN Security Gateway with cloud-delivered security controlled from NETGEAR Insight. Insight, NETGEAR’s cloud-based management platform, already serves NETGEAR switches and access points. Now, small and midsize enterprises, distributed branch sites, and the managed service providers (MSPs) that support them, can run networking and security from a single console. Each PR30SG includes its first year of security, so sites are protected from the day they go live.

Networking and security have historically been bought separately: a router from one vendor, security from another, each with its own console and its own bill. For lean IT teams, that means they end up with a security stack they don’t have time to manage. For MSPs, it means more tools to reconcile at every customer site. NETGEAR has been closing that gap by building security into its routers and managing it all from Insight.

The PR30SG takes that approach to smaller sites at a lower price point, with the first year of security included. The same security layer is also available as a license for the PR60X, so existing PR60X sites can add it without replacing hardware or scheduling an onsite visit. “Lean IT teams and branch offices have usually had to choose between an inexpensive router and a security stack they don’t have the budget or staff to run,” said Iphie Chen, Director of Product Management Enterprise at NETGEAR. “The PR30SG gives them cloud-delivered security, managed in Insight alongside their switches and access points.”

One platform for every site

Managed through NETGEAR Insight, the PR30SG gives administrators one view of alerts, policies, traffic and device health across locations. New units can be provisioned remotely, so a business or MSP can bring a site online without sending a technician. For MSPs, Insight multi-tenant management lets technicians oversee multiple customer networks from a single dashboard. Insight also connects to the PSA and RMM tools MSPs already use, including ConnectWise, NinjaRMM, Datto and Autotask.

Key features include:

  • Cloud-delivered security, first year included: web filtering keeps users away from malicious and restricted sites, and intrusion detection flags suspicious network behavior in real time. The license, powered by NETGEAR Exium, also covers SASE cloud security, which enforces access controls and firewall policies before traffic reaches the local network.
  • Zero-touch provisioning through NETGEAR Insight: ship a PR30SG to a new office or client site, power it on, and it pulls its configuration from the cloud. No one has to travel to set it up.
  • Dual WAN failover and load balancing: if one internet connection drops, the PR30SG switches to the backup automatically to keep applications and sites online. Both links can also share traffic.
  • Dedicated 2.5G WAN port: when a site’s ISP moves to multi-gigabit service, the PR30SG keeps up without a hardware swap or truck roll.
  • Modern VPNs built in: WireGuard and OpenVPN are supported natively alongside IPSec site-to-site and client-to-site VPN, with no third-party software or extra hardware per site.
  • Fanless design: no fan and no noise, so the PR30SG fits on a reception desk or in a wiring closet.
  • NDAA-compliant hardware: built in line with Section 889 requirements, so the PR30SG can deploy in healthcare, finance, education and government-adjacent environments where component origin matters.
  • Support included: every unit includes 90 days of free 24/7 phone support plus limited lifetime 24/7 online chat support. An optional Overdrive plan adds a 2-hour response SLA. The PR30SG also carries a limited lifetime hardware warranty.

Connectivity Warehouse, a Dallas-area networking solutions provider serving offices, healthcare facilities, warehouses and multi-site organizations, tested the PR30SG during NETGEAR’s beta program.

Availability

The PR30SG is available at an MSRP of $349.99 from October 27, 2026 in North America and from November 5, 2026 in EMEA and APAC. The price includes NETGEAR Exium cloud security for the first year, NETGEAR Insight cloud management, and 90 days of free 24/7 phone support plus limited lifetime 24/7 online chat support. PR60X customers can add the same security layer with a new license; contact NETGEAR sales to purchase one.

NETGEAR will cover the PR30SG and its approach to network security for small and medium enterprises and MSPs in a live webinar, “The moat is full of phish: How modern security protects a business without walls,” on October 20. Register at https://netgear.zoom.us/webinar/register/4017897634093/WN_iKxpN8D9T7qWcwV1CKtoKQ.

Leave a comment »

Hirudo Android RAT kills, replaces & runs banking apps

Posted in Commentary with tags on October 15, 2026 by itnerd

ThreatFabric has disclosed a new Android banking RAT called Hirudo that can replace legitimate banking apps with modified copies designed to manipulate their own security checks, including app-signing validation, Accessibility detection and Play Integrity responses.

Rather than simply stealing credentials or displaying overlays, Hirudo can make a compromised banking app appear trustworthy to itself and to controls that rely on signals generated on the device.

In response, mobile app security expert Ted Miracco, CEO of Approov, offers comments:

“Hirudo doesn’t break the bank’s defenses. The trojan deletes the genuine app, installs a copy signed with a public test key, and loads a hooking engine inside that app’s process. From then on that app asks Android who signed it and hears the right answer. It asks which accessibility services are running and hears none. Its Play Integrity request is routed through the attacker’s server and comes back clean.

“The conclusion is uncomfortable but simple: an app running on a phone you don’t control cannot be a witness in its own defense. Integrity signals have to be produced and judged somewhere the attacker can’t reach, tied to the session and to the specific payment, with revocation actually checked. ThreatFabric found the operators using a leaked keybox holding certificates Google had already revoked. A bank checking server-side would have caught that. A bank trusting the verdict on the handset could not.

“The uncomfortable part for the industry is that this engine isn’t bank-specific. It’s a reusable tool pointed at eight Indonesian apps today, with target lists in the code already naming five other countries.”

This is not a good development as I expect this to be repurposed to fit any use case. Which is bad for all of us.

Leave a comment »

Cyberattack on federal contractor disrupts DOT services

Posted in Commentary with tags on October 15, 2026 by itnerd

A cyberattack on government contractor Senture disrupted the Federal Motor Carrier Safety Administration’s (FMCSA) contact center, affecting telephone assistance for commercial truck drivers and operators using the agency’s new Motus registration system, according to Politico.

The FMCSA reported technical difficulties on October 6 and directed users to online support and chat services. The Department of Transportation confirmed that the attack brought down Senture’s network domain, including its phone capabilities.

The incident disrupted a service used to help trucking companies navigate federal registration requirements. DOT said FMCSA data was not compromised, and the incident remains under investigation. The attack’s cause and full scope have not been disclosed.

Seemant Sehgal, Founder & CEO, BreachLock:

“This attack is a reminder of how heavily federal services often depend on commercial vendors for the operational layer citizens actually interact with. When the help channel goes offline, the online self-service path is all that is left, even for questions that really need a real conversation. Federal agencies should proactively map which contractors operate the citizen-facing services, understand the dependencies underneath them, and stand up backup channels before the next incident takes a primary channel offline.”

ㅤ

Steven Swift, Managing Director, Suzu Labs:

“FMCSA experienced a partial outage as a result of a cyberattack. Phones went down, but online ticketing and chat functions remained up. Reports are that the attack was against Senture, a government contracting firm who provides managed IT services. A source close to the incident claimed that the attack was “AI powered” because it was able to probe systems quickly. But simply probing systems quickly is not unique to AI, attackers have long used scripts to automate large portions of attacks. Simply seeing systems probed quickly is only an indicator of automation, not of AI. Its an easy mistake to make for personnel who aren’t familiar with how these sorts of incidents typically work.

“That said, it doesn’t rule it out either. But we can only go off of what’s been released publicly. And at this time, it looks like they’re blaming AI as a convenient scapegoat, rather than because of any reliable indicators. We used to see organizations claim that their routine cyberattacks were from “highly skilled or nation state actors” in an attempt to deflect blame away from why the attack happened at all. These days, we also see AI added to that list. Most attacks happen because best practices aren’t being followed. While yes, its possible to do everything right and still experience a successful cyberattack, almost all of the cyberattacks occur because organizations had gaps that they should have fixed but didn’t.

“We don’t yet have much detail on this. Its unclear how much FMCSA or Senture intends to release publicly. Its common for organizations to limit what public statements they make in response to a cyberattack. Even if we get more, I wouldn’t expect a lot of details to be made public.”

ㅤ

John Carberry, Solution Sleuth, Xcape Inc.:

“A cyberattack disabling federal contractor Senture’s network domain directly disrupted commercial transportation compliance by knocking out telephone support for the Federal Motor Carrier Safety Administration’s (FMCSA) new Motus registration portal. While the Department of Transportation (DOT) confirmed that agency data was not compromised, the resulting outage demonstrates how third-party domain failures can swiftly paralyze frontline operations. Details are sparse for this specific incident, and without knowing the who and why of the DOT attack, forming a strong opinion is difficult at this time. However, considering that this incident comes on the heels of two other major attacks against the FBI and the Pentagon, it demonstrates a clear trend against federal entities and underscores the fragility of federal systems. For security leaders and agency executives, vendor risk management cannot end at data privacy checkboxes: agencies must enforce strict identity segmentation, mandate redundant communication pathways for mission-critical workflows, and contractually require verifiable business continuity plans that withstand complete contractor infrastructure outages.

“Critical Takeaways:

  • Operational disruption can cripple agency missions even when sensitive data remains uncompromised, proving that availability failures in the contractor supply chain are just as damaging as data breaches.
  • Viewed alongside recent security incidents at the FBI and the Pentagon, this attack reflects an escalating trend targeting federal infrastructure and highlights the systemic fragility of interconnected government dependencies.
  • Security leaders must architect layered defenses around third-party dependencies by enforcing strict network identity segmentation and establishing out-of-band operational fallbacks before a vendor domain collapses.

“When an entire contractor domain evaporates overnight, discovering that agency records are intact feels like finding your wallet inside a car that just got towed.”

This isn’t going to end well for anyone. I am calling it now.

Leave a comment »

ServiceNow introduces the third generation of its employee-centric AI harness so the workforce can build and use the AI their jobs demand

Posted in Commentary with tags on October 15, 2026 by itnerd

ServiceNow today announced major advances to ServiceNow EmployeeWorks that give employees the ability to build the AI agents their jobs demand. These agents can complete daily tasks without human intervention and enable deep persona-based work across critical business functions. Additionally, ToolSmith, a new agentic developer environment for ServiceNow EmployeeWorks, takes complex tool-building from days to minutes, securely and at enterprise scale.

ServiceNow EmployeeWorks is powered by a third-generation employee-centric AI harness, which provides employees with intelligent context, trusted decision making, and robust enterprise actions to orchestrate AI safely.

While enterprise AI investment is rising, most employees still can’t build the AI their job needs. IT backlogs, developer constraints, vendor lock-in, and fragmented tools mean that the people closest to the work—the ones who understand the problems best—can’t build AI solutions that take secure actions. ServiceNow EmployeeWorks helps change that.

Productivity Assistants: AI assistants for contextual persona-based work

Productivity Assistants are specialized AI assistants for contextual, nuanced, or persona-based work. These assistants run on the third-generation employee-centric AI harness, which combines reasoning, memory, and tool interoperability, so assistants can own deep research, long-running tasks, and cross-system and agent work with durable memory.

Non-coding employees can easily build the Productivity Assistants they need with admin-defined guardrails. They can tailor behavior, content, tools, and access. Pre-built assistants are also available.

HR Service Delivery: Productivity Assistants will be available for different ServiceNow products, starting with HR Service Delivery, extending service directly to managers for HR, talent, growth, and hiring.

  • Talent Insights Assistant surfaces candidate fit, hiring, and organizational talent insights directly to managers, powered by integrations with Findem and Phenom.
  • HR Business Partner Assistant handles HR needs, including approvals, case management, and employee programs, conversationally. HRBP Assistant acts as a digital twin to help scale HR teams.
  • Manager Assistant equips managers with timely coaching, insights, and team-performance visibility, unlocking information and capabilities that normally sit behind HR people and process.

ServiceNow EmployeeWorks: Two foundational productivity assistants are available out of the box, with the option to build more.

  • Research Assistant investigates complex questions across internal and external sources in real time, delivering personalized answers based on role and access through a rich artifact, document, or deck.
  • Calendaring Assistant integrates directly with calendar systems, serving as a smart scheduler that can decipher complex calendars, resolve conflicts, reserve rooms, add conferencing links, and more. It goes beyond typical calendar booking solutions by orchestrating nuanced requests like scheduling quarterly one-on-ones with an entire team on days that minimize disruption to project work or finding the least hectic day to bring together a team for a full day workshop.

Productivity Routines: Employees build their own agents for proactive work

For work that’s predictable and repeatable, employees can now build and deploy Productivity Routines that run proactively in the background, helping eliminate the need to manually repeat the same tasks continuously. They execute the same steps every time and deliver finished outcomes without human intervention.

For example, a sales leader can build a Prospecting Agent that can scan their calendar for upcoming account meetings, research the account via internal and external resources, and assemble a tailored asset or pitch that marries the company’s value props to the problems and pains experienced by the prospect – all before they sign on for the day.

Employees don’t need to understand backend systems, API integrations, or data models. They describe what they want to automate, select the tools they need, and deploy. This democratizes AI, shifting the power to automate from IT and into the hands of the people who understand the work best, with governance built in.

ToolSmith: Developers vibe code enterprise-grade AI tools in minutes

ToolSmith is a new agentic developer environment that builds any automation for ServiceNow EmployeeWorks AI assistants. Developers describe what they want to accomplish in natural language, and ToolSmith handles the end-to-end build of the tool. ToolSmith is trained on over 75,000 APIs. It aligns on a plan with developers, implements integrations following the best practices, and builds tools for AI agents that are optimized for token efficiency and reliability. If something breaks, it can pull the relevant logs and propose a fix. Developers can then test and refine all through the same conversational experience.

ToolSmith also identifies what to build next. It scans through logs to identify opportunities to fix, improve, or invent the next best workflow. What used to take weeks, now takes minutes.

Conversations API: ServiceNow EmployeeWorks everywhere employees work

With the new Conversations API, organizations can bring ServiceNow EmployeeWorks capabilities – including Productivity Assistants, Productivity Routines, and ToolSmith – directly into the tools employees already use, including custom internal applications, kiosks, and other AI applications.

One unified platform, available across every channel, with no rearchitecting required.

Availability:

Productivity Assistants, Productivity Routines, the employee-centric harness, ToolSmith and Conversations API are all in controlled availability today.

Leave a comment »

Burger King Japan Pwned

Posted in Commentary with tags on October 15, 2026 by itnerd

Burger King Japan today confirmed that it suffered a data breach that exposed about 11.18 million belonging to users. Which is of course bad. More info here: Burger King Japan Confirms Data Breach Exposing 11.18M User Records

Ensar Seker, CISO at cybersecurity company SOCRadar, provided the following comments:

“The risk extends beyond the initial breach. Names, dates of birth, email addresses and phone numbers can help criminals make fraudulent messages feel credible. An attacker could impersonate Burger King support, reference the breach and ask a customer to “secure” their account through a fake verification page. That is a plausible follow-on threat, rather than evidence that such a campaign has already occurred.

Even seemingly minor account details can strengthen the deception. Knowing whether someone used mobile ordering could help tailor a convincing message without knowing what they actually purchased. Customers should open the official app or website directly when checking security notices, and should never share passwords or verification codes with someone who contacts them.

For businesses, this reinforces why customer profile data deserves strong protection alongside credentials and payment information. Collecting less data, limiting access to member databases and detecting unusual bulk retrieval can reduce the impact of a compromise. Account recovery also needs protection: knowing a customer’s birthday or phone number should never be enough to establish their identity.”

I guess we see how the Japanese handle a breach like this. I for one can’t wait to see if there is a difference.

Leave a comment »

« Older Entries