Archive for May 29, 2025

85% of Canadian IT Leaders Say Security Must Evolve: Salesforce

Posted in Commentary with tags on May 29, 2025 by itnerd

Canadian IT security leaders are signalling a clear need for change, with 85% saying their current practices must evolve to keep pace with modern threats. According to Salesforce’s new State of IT Security report, many are turning to emerging technologies like agentic AI—solutions such as Agentforce—to support operations and strengthen defenses.

While 99% believe AI agents can improve at least one area of security, many remain cautious. Over half (61%) lack full confidence in deploying these tools with the right guardrails, and 56% say their data foundation isn’t ready to support agentic AI.

Still, adoption is growing. More than 41% of IT security teams in Canada are already using AI agents in day-to-day operations, with usage expected to rise. Encouragingly, 86% of security, privacy, and compliance leaders see AI agents as a source of new security opportunities.

As 78% of Canadian leaders predict AI-driven threats will soon outpace traditional defenses, getting data governance right is becoming a top priority for organizations looking to adopt AI securely and strategically.

You can read the report here.

Adidas Has Been Pwned Via A Third Party Hack

Posted in Commentary with tags on May 29, 2025 by itnerd

Adidas has confirmed a data breach stemming from a compromise of a third-party customer service provider. Hackers stole contact information of customers who had reached out to Adidas’ help desk. While no financial or password data was reportedly accessed, the breach raises concerns about supply chain vulnerabilities.

Andrew Obadiaru, CISO, Cobalt had this to say:

“This Adidas breach is yet another case of attackers taking the path of least resistance—third-party vendors with less mature defenses. In offensive security, these peripheral entry points are frequently the first tested during a campaign. And in retail, where customer engagement relies on sprawling digital ecosystems, vendors often fall outside the scope of proactive security testing. It’s no longer enough to harden your own walls—you must probe your supply chain with the same rigor. Otherwise, your vendors become the adversary’s open door.”

Wade Ellery, Field CTO, Radiant Logic follows with this:

“The Adidas breach puts a spotlight on the observability gap in third-party environments. While payment data may be safe, identity data—names, emails, contact history—still holds value in the attack chain. These are real identity artifacts, and they deserve the same level of scrutiny and visibility as any internal asset. Enterprises must rethink vendor oversight, ensuring that even external service layers feed into a unified observability framework. Without this, organizations risk flying blind where it matters most: at the seams between systems.”

Once again we see an example of a company getting pwned through no fault of their own. Other than the fact that they should consider holding third parties accountable for their security like the NHS recently did. Because it should be crystal clear by now that you’re only as secure as the companies that you work with.

Sage Scales Embedded Services to North America and Europe to Help Platform Partners Serve SMBs Better

Posted in Commentary with tags on May 29, 2025 by itnerd

Sage today announced the global expansion of Sage Embedded Services

Initially launched in the UK, Sage Embedded Services is now available across North America and Europe. enabling banks, fintechs, and software platforms to seamlessly build accounting capabilities directly into their products. This allows their small businesses and sole traders customers to save time, stay compliant, and make smarter business decisions. At the same time, it empowers platform partners to deliver branded accounting and related capabilities without the complexity or cost of developing their own solutions from scratch.

Sage Embedded Services aims to equip platform partners with capabilities that deepen customer engagement, drive loyalty, and unlock sustainable growth through enhanced user experiences.

The expansion responds to a growing demand from small businesses for simplified business management capabilities embedded directly into their ecosystem within the applications they already use in daily operations.  It enables access to key financial tools, like bookkeeping, reporting, and compliance, without switching platforms or disrupting existing workflows.

Why it matters for platform partners

Sage Embedded Services offers banks, fintechs, and software providers a powerful way to differentiate their offerings by embedding accounting and compliance tools directly into their own products. This enables partners to meet more of their customers’ day-to-day financial needs while delivering a unified, seamless experience.

For platform partners, this is a chance to:

  • Accelerate time to market with Sage’s headless APIs, reducing development time and lowering technical barriers to build and maintain.
  • Deliver tailored solutions with modular accounting capabilities, matching their specific customer needs.
  • Boost customer engagement by making their apps more useful, sticky, and central to daily workflows 
  • Unlock new revenue streams through monetizable, value-added features

Built for small businesses and the platform partner ecosystem

Sage Embedded Services is designed specifically for organisations that build digital products used by self-employed individuals and small businesses such as online banks, fintech providers, and industry specific software companies. The service is modular, allowing platform partners to directly embed:

  • Multi-dimensional general ledger
  • Real-time financial reporting
  • Customisable insights and analytics

Depending on the region, additional functionality such as carbon accounting, collaboration with accountants and more may be available.  Platform partners have complete control over how these accounting capabilities appear and function within their products, ensuring a seamless, brand-aligned experience for their customers, powered by Sage’s deep experience in bookkeeping, accounting and tax compliance.

Victoria’s Secret Has Been Pwned…. Website Down

Posted in Commentary with tags on May 29, 2025 by itnerd

Intimate clothing company Victoria’s Secret has taken it’s website down after apparently getting pwned. Though details aren’t clear how they got pwned.

Shares of Victoria’s Secret fell Wednesday after the lingerie company took down its US website, saying there was a prolonged “security incident.”

Shoppers visiting the website will see a black screen with the company’s statement rather than its usual selection of lingerie, sleepwear and other products.

The retailer has “identified and are taking steps to address a security incident,” according to a statement posted to its website. “We have taken down our website and some in store services as a precaution.”

It’s rare for a company of Victoria Secret’s size to have such a lengthy site-wide outage. While its physical retail stores remain open, revenue from online shopping is critical for Victoria’s Secret. The brand generated $2 billion in net sales from direct channels that include online shopping in 2024, or roughly a third of its annual sales.

Javvad Malik, Lead Security Awareness Advocate at KnowBe4has provided the following commentary:

“The recent security incident at Victoria’s Secret, following a string of attacks on other retailers, suggests a potentially coordinated campaign targeting the retail sector. While information remains limited at this point, suspending website functionality is not a decision organizations take lightly.”

“This event underscores the critical importance of fostering a robust security culture within organizations. In the retail sector, where customer trust is paramount, embedding security awareness across all levels of the business is crucial. This culture should emphasize not only technological defenses but also staff vigilance to act swiftly when threats are detected.”

Clearly threat actors attacking the retail sector is the new cool thing of the moment. Thus proving that nobody is safe and everyone needs to take every precaution possible to prevent themselves from getting pwned. Because in the case of Victoria’s Secret, this is likely to cost them millions of dollars.

ASUS Routers Are Being Pwned By The Thousands… Here’s What You Need To Know

Posted in Commentary with tags on May 29, 2025 by itnerd

 Security firm GreyNoise has reported that thousands of ASUS routers are being hit with a stealthy backdoor that can survive reboots and firmware updates. Making it really, really dangerous.

Here’s what you need to know via GreyNoise:

  • Thousands of ASUS routers are confirmed compromised, with the number steadily increasing. 
  • Attackers gain access using brute-force login attempts and authentication bypasses, including techniques not assigned CVEs. 
  • Attackers exploit CVE-2023-39780, a command injection flaw, to execute system commands.
  • They use legitimate ASUS features to:
    • Enable SSH access on a custom port (TCP/53282).
    • Insert attacker-controlled public key for remote access.
  • The backdoor is stored in non-volatile memory (NVRAM) and is therefore not removed during firmware upgrades or reboots. 
  • No malware is installed, and router logging is disabled to evade detection. 
  • The techniques used reflect long-term access planning and a high level of system knowledge. 

Besides all of that, there’s this little tidbit from GreyNoise:

Disclosure deferred as we coordinated the findings with government and industry partners.   

That implies but does not confirm that this is a nation state behind this attack. That isn’t good.

So how do you protect yourself? You need to check to see if you’re infected if you’re an ASUS user. GreyNoise recommends the following:

  • Check ASUS routers for SSH access on TCP/53282. 
  • Review the authorized_keys file for unauthorized entries.
  • Block access to these four IP addresses: 101.99.91.151, 101.99.94.173, 79.141.163.179, 111.90.146.237
  • If compromise is suspected, perform a full factory reset and reconfigure manually.

Personally, if you’re the least bit paranoid, or you discover that you’ve been pwned, I would just factory reset the router and reconfigure it manually. Also, I will note that ASUS has patched a lot of the vulnerabilities that these threat actors are using. Thus if you haven’t applied the latest firmware updates to your ASUS router, you should. But my advice would be to do that AFTER you confirm that you haven’t been pwned.

UPDATE: Wade Ellery, Field CTO, Radiant Logic had this comment:

“This is a textbook example of why identity observability and infrastructure hygiene need to converge. Even something as mundane as a router becomes a strategic asset once it gains long-term identity in a threat actor’s infrastructure. Organizations must treat devices as identities—tracked, verified, and assessed for risk just like users. Observability tools that focus solely on app layers or human actors will miss campaigns like this. Real-time identity-aware telemetry across all assets, including IoT and edge devices, is essential for reducing dwell time and ensuring true Zero Trust enforcement.”

Debbie Gordon, CEO and Founder, Cloud Range adds this:

“This campaign highlights a dangerous shift in attacker strategy—from quick hits to long-haul persistence. AyySSHush’s ability to survive factory resets and firmware updates is a wake-up call: edge devices like routers are no longer low-value targets. In our cyber training environments, we stress layered response—not just patching, but validating assumptions about device integrity and persistence. Too often, routers are treated as ‘set-and-forget’ systems. That mindset is outdated and risky. These devices are now prime footholds for stealthy, scalable attacks.”

Kyndryl Report: Why Most Businesses Are Not Yet Winning With AI

Posted in Commentary with tags on May 29, 2025 by itnerd

A new global study released today by Kyndryl found that only a small number of organizations have taken steps to align their workforce strategies with the growth of AI technology. Those that have done so have positioned themselves ahead in the race to deliver positive return on investments in the technology.

Based on a survey of more than 1,000 senior business and technology executives across 25 industries and eight geographies, Kyndryl’s first People Readiness Report reveals a striking gap between AI investment and workforce preparedness:

  • 95% of businesses have invested in AI
  • 71% of leaders say their workforces are not yet ready to successfully leverage the technology
  • 51% believe their organizations lack the skilled talent needed to manage AI
  • 45% of CEOs think most employees are resistant or even openly hostile to AI

Workforce readiness varies by industry. Businesses in Banking, Financial Services and Insurance report the highest levels of preparedness, while those in Healthcare report trailing behind.

Despite widespread attempts at implementation, most organizations are not currently benefiting from game-changing use cases that will drive new products and services for their customers. Generative AI tools are the most popular use case reported by those surveyed, yet only 4 in 10 leaders report using AI-powered insights to enhance decision-making or unlock growth for their business. Just one-fifth of leaders say the primary use case of AI at their organization is to develop new products and services for customers.

Yet this research also reveals that a small subset of AI Pacesetters has leveraged AI for business growth while addressing workforce readiness. They are making strategic workforce decisions and seeing benefits across their employee population. Pacesetters are uniquely addressing 3 key barriers that are inhibiting AI adoption, and they are seeing benefits from their actions across:

  1. Organizational change management: AI Pacesetters are three times more likely than others to report a fully implemented change management strategy for AI in the workplace.
  2. Lack of employee trust in AI: AI Pacesetters are 29% less likely to cite fears around AI affecting employee engagement.
  3. Skill gaps: AI Pacesetters are 67% more likely to agree that their organization has the tools and processes to accurately inventory the skills employees currently have. Four in 10 report no skills challenges at all.

Compared to CIOs and CTOs, CEOs are far more likely to say their organization is still in its early stages of AI, and two and a half times more likely to say their infrastructure is inadequate to support it. This difference also extends to how they choose to solve AI-related workforce challenges and the individual skills they believe their organization needs to be successful. CEOs are far more likely to turn to outside talent rather than upskilling their own employees.


To read the full report, visit Kyndryl’s People Readiness Report.

Unbound raises $4M to help enterprises embrace AI tools on their terms

Posted in Commentary with tags on May 29, 2025 by itnerd

Generative AI tools have become ubiquitous in the enterprise. Employees are using AI copilots to code, draft documents, brainstorm campaigns, and analyze data – often without IT’s knowledge or approval. As adoption spreads from the bottom-up, companies are losing control over how sensitive information is being handled, what models are being used, and who has access to what.

Unbound has raised $4 million to fix this. The oversubscribed seed round was led by Race Capital, with participation from Wayfinder Ventures, Y Combinator, Massive Tech Ventures and others include notable angel investors*. 

Unbound gives IT teams the visibility and controls they need to safely introduce and manage AI tools in the enterprise. Its AI Gateway plugs into commonly used tools – like Cursor, Roo, Cline or internal document copilots – and provides real-time protection, model routing, and usage analytics. From blocking sensitive information leakage to managing model costs and performance, Unbound helps organizations roll out AI on their terms.

The founding team brings deep experience in both enterprise security and infrastructure. CEO and co-founder Rajaram Srinivasan previously led data security products at Palo Alto Networks and Imperva, and earlier worked on SaaS security at the onset of the AI wave. He teamed up with Vignesh Subbiah, a seasoned engineer and former founding team member at Tophatter and Shogun, who scaled engineering teams and platforms from seed to growth stage. After working together at Adobe, the two reconnected to build a system that could meet the urgent security gaps emerging in the new AI stack.

The need became clear quickly. In the early days of GPT-3.5, teams were already sending sensitive prompts into AI tools without oversight – leaking secrets, exposing PII, and consuming costly licenses with no guardrails. Existing DLP tools either blocked the tool altogether or failed to adapt to newer AI workflows.

Unbound takes a different approach. It has already prevented the leakage of 100s of secret credentials – including passwords, API keys, and connection strings – as well as more than 500 instances of personally identifiable information such as customer names, phone numbers, and patient records. Rather than simply blocking prompts, Unbound redacts sensitive content in real time and reroutes high-risk requests to internal, open-source models hosted in the organization’s cloud. This ensures employees get their answers without ever seeing a security speed bump.

The platform also gives companies fine-grained control over model access and cost. Rather than buying a one-size-fits-all license, teams can allocate premium model access to high-stakes workflows – like engineers building core infrastructure – while routing lighter tasks, like content editing, to smaller open-source models. Mid-market customers using Unbound have already saved more than $10,000 annually on unnecessary AI seat licenses. And when new models outperform old ones – as with Gemini 2.5 recently overtaking Claude Sonnet for certain coding tasks – Unbound allows IT to roll them out incrementally, test their effectiveness, and swap them in without breaking employee workflows.

The product is already being used by a growing base of mid-market and enterprise customers across sectors including tech and healthcare. One customer, a leading tech company, recently used Unbound to safely introduce Gemini 2.5 into production AI tools for more than 100 engineers within the same week.

The market is shifting fast. What started as shadow IT is quickly becoming mission-critical infrastructure. Generative AI is embedded in everything from customer support to software engineering – but the tooling around it is still stuck in early-stage chaos. CIOs and CISOs are looking for ways to support AI adoption without compromising security or governance. Unbound is building that foundation.

Unbound is just getting started. The team plans to expand integrations across the AI ecosystem, deepen model routing capabilities, and support internal model orchestration for enterprises adopting open-source LLMs. Their mission is simple: to ensure every organization can embrace AI without losing control in the process.

* Other investors in the round included: Alpha Square Group, Northside Ventures, Liquid2, Pioneer Fund, Scale Asia Ventures, SBXI and notable angels including Ram Shriram (founding board member at Google), Dr. Trishan Panch (CSO LuminHealth), Dr. John Brownstein (Chief Innovation Officer, Boston Children’s hospital), Taro Fukuyama (CEO, Fond), Eli Brown (CEO, Guilded, acquired by Roblox), Chris Siakos (CEO Sinefa, acquired by Palo Alto Networks), Joe Vadakkan (CISO, Ex- CRO), Zain Rizavi (Cloudflare, Ridge VC), Finbarr Taylor (CEO, Shogun) alongside other silicon valley and cybersecurity veterans.

Unimed exposed 14M patient-doctor messages 

Posted in Commentary with tags on May 29, 2025 by itnerd

Cybernews has discovered a major data leak with the world’s largest healthcare cooperative, Unimed, exposing 14 million patient-doctor messages. The data included uploaded pictures, documents, and other personal information.

What details are involved in the Unimed data leak?

  • Uploaded pictures
  • Uploaded documents
  • Sent messages
  • Names
  • Phone numbers
  • Email addresses
  • Unimed card numbers

What are the potential dangers of this leak?

Healthcare data is highly valuable to cybercriminals, enabling identity theft, insurance fraud, phishing, and even blackmail. In this case, the breach was especially severe, as it could have allowed attackers to send, delete, or alter messages to users — opening the door to serious manipulation.

To read the full research report, please click here.

New Travel Research Report Identifies Over 5,000 Newly Registered Domains Scamming Travelers in Q1 2025

Posted in Commentary with tags on May 29, 2025 by itnerd

With Summer approaching in just a month, the travel season is starting to bloom. However, as we enter one of the busiest travel seasons yet, a surge in travel plans unfortunately is accompanied by a surge in security threat risks all the way from travel to hospitality scams and everything in between. 

The BforeAI threat research team at PreCrime Labs has released their latest research determining the level of travel-related scam activity being actively planned for the 2025 travel season targeting the travel and hospitality sector. Research identified over 5,000 newly registered travel-related domains and significant update activity to over 6,000 existing relevant domains in the first quarter of 2025.

Additionally, the research exposed several campaigns that targeted travel victims filled with special flight giveaways, websites threatening to expose companies, and scams associated with lodging. 

With holiday travel surges, organizations must address the threat landscape extending beyond the traditional booking scams and typosquatting attempts, that further can extend to unconventional job offers, crypto coins, and integration of AI.

You can read the research here.

IAM Maturity Lagging Across Most Organizations, GuidePoint Security Finds

Posted in Commentary with tags on May 29, 2025 by itnerd

A new report released today by GuidePoint Security, in partnership with the Ponemon Institute, found that most organizations are falling short in their Identity and Access Management (IAM) strategy—leaving them vulnerable to identity-based threats.

Although 75% of cyberattacks leveraged identity-based threats last year, GuidePoint Security’s State of Identity and Access Management (IAM) Maturity Report has unveiled that IAM remains under-prioritized compared to other IT security investments, with most organizations still in the early to mid-stages of IAM maturity. Only half of respondents rate their IAM tools as effective, and even fewer (44%) express high confidence in their ability to prevent identity-based incidents.

The report also highlights significant gaps in IAM technology, expertise and resources—factors that are stalling programmatic maturity and making it more difficult for organizations to secure identities across today’s complex environments.

Key findings from The State of Identity and Access Management (IAM) Maturity Report include:

  • IAM is underfunded and underdeveloped. Only 50% of respondents believe their IAM tools and investments are effective. Investments in IAM trail behind other security priorities.
  • Manual processes and expertise gaps are barriers to maturity. A lack of appropriate technologies (54%), in-house expertise (52%) and resources (45%) are cited as top challenges to achieving IAM maturity. Many organizations still rely on spreadsheets, scripts and other manual efforts.
  • IAM maturity is a path to enhanced security. A small group (23%) of organizations that have invested in automation and advanced IAM technologies report fewer security incidents and stronger identity controls. They lead in adopting biometric authentication, identity threat detection and integrated governance platforms.
  • IAM implementation is misaligned with security goals. Surprisingly, 45% of respondents say the primary driver for IAM investments is to improve user experience—not security.
  • There is a disconnect in program perception and reality. While most organizations report having policies in place or in development (83%), only 28% have these policies integrated into their IAM platforms.

The State of Identity and Access Management Maturity Report is based on responses from a comprehensive survey of 625 U.S.-based IT and IT security professionals involved in their organizations’ identity and access management program.

Click here to download The State of Identity and Access Management (IAM) Maturity, 2025