Archive for September 10, 2025

40% Alerts Ignored, 57% Rules Suppressed + The Alert Breaking Point Reached Says New Report

Posted in Commentary on September 10, 2025 by itnerd

SOCs don’t struggle with visibility anymore; they’re buried in it. This report from Prophet Security puts hard numbers behind what many in the field already see: the alert problem has reached breaking point, and AI is being applied first where it matters most triage, investigation, and tuning. It captures both the urgency and the practical direction of where SecOps is heading.

A few of the findings from the research survey include:

  • Average of 960 alerts generated daily
  • 40% of which are never investigated
  • 57% companies suppress detection rules
  • 55% use AI for alert triage & investigations.

The 30+ page report includes responses from a mix of CISOs, SecOps VP/Directors, SIRT/Threat Mgrs, and SOC analysts/engineers across a variety of industry segments at organization sizes ranging from 1000+ to more than 20,000+.   The report is divided into three main areas: The Alert Problem, The Pain in Organizations and the AI SOC Shift. 

The report is more than a collection of statistics, its serves as a call to action with insights to arm security teams with guidance to navigate another transformative era in security. With recent incidents such as the Palo Alto data breach, teams who implement AI in the SOC are better prepared to focus their skills/time on proactive threat hunting and investigations.

You can read the report here: https://www.prophetsecurity.ai/ai-soc-adoption-trends

Leave a comment »

ServiceNow supercharges AI adoption for enterprises with secure, scalable AI platform 

Posted in Commentary with tags on September 10, 2025 by itnerd

ServiceNow today unveiled its new Zurich platform release. This release delivers breakthrough innovations with faster multi-agentic AI development, enterprise-wide AI platform security capabilities, and reimagined workflows. New intelligent developer tools enable secure vibe coding with natural language to help turn employees into high-velocity builders and creators and lower the barrier to app creation. Built-in security capabilities, including ServiceNow Vault Console and Machine Identity Console, natively secure sensitive data across workflows and govern integrations to help organizations scale agentic AI and innovations with confidence. The introduction of autonomous workflows turns data into action through agentic playbooks, uniquely offering the flexibility to apply AI and human input in workflows where and when it’s needed for greater control and efficiency. 

Enterprise leaders are racing to move beyond table-stakes AI implementations to unlock transformative, tangible results. According to Gartner®, “By 2029, over 60% of enterprises will adopt AI agent development platforms to automate complex workflows previously requiring human coordination.” The ServiceNow AI Platform delivers this transformational promise across the enterprise and underpins a new era of highly efficient human-AI collaboration. 

Vibe coding meets enterprise scale 

According to Gartner®, “Agentic AI features will be near ubiquitous, embedded in software, platforms and applications, transforming user experiences and workflows.” The introduction of ServiceNow Build Agent and developer sandbox provides resources for employees to work with AI more efficiently, conversationally, and at scale to solve real problems in every corner of the business. 

  • Build Agent is a breakthrough for enterprise app creation—bringing vibe coding to the rigor of the ServiceNow AI Platform. In seconds, employees can turn an idea into a production-ready application by asking in natural language. Say, “Create an onboarding app that assigns tasks to HR, IT, and Facilities,” and Build Agent handles the rest—design, build, logic, integrations, testing, and industry-leading governance included. What sets it apart is enterprise discipline: every app comes with audit trails, security, and compliance built in. Developers and citizen creators alike get the speed of AI with the confidence of enterprise-grade control, in a streamlined interface. 
  • Developer sandbox empowers developers to build better applications, faster, while maintaining the highest standards of quality. Sandboxes provide isolated environments within a single instance, so multiple teams can collaborate, build, and test new features without conflicts, and rapid scale doesn’t come at the cost of control. Teams can version, iterate, and deliver without waiting in line for developer resources. Developers can safely experiment with vibe coding, test AI-powered workflows, and resolve version control issues before changes go live. This reduces rework, shortens feedback loops, and helps teams ship higher-quality applications rapidly with lower risk. 

Security that enables AI strategy 

As enterprises adopt autonomous workflows powered by agentic AI, securing how these systems access data and communicate across environments is essential. Zurich introduces new built-in AI platform security capabilities to make it easier to protect sensitive information, govern integrations, and manage growing AI footprints. 

  • The new ServiceNow Vault Console provides a guided experience to discover, classify, and protect sensitive data across workflows. For example, an admin managing customer service operations can now identify personal data across tickets, apply different types of protection policies, and track compliance activity. The console also offers recommendations for protecting newly discovered sensitive data, along with customizable dashboards to monitor key metrics. What used to require manual configuration across multiple tools can now be managed in one place, with intelligent insights and a streamlined experience. 
  • Machine Identity Console addresses the need for integration security with enterprise-grade authentication and authorization, delivering control over bots and APIs head on. As the ServiceNow AI Platform scales, every API connection, including those from AI agents, introduces another identity to manage and determine what it can access. This console gives platform teams visibility into all inbound API integrations using machine identities such as service accounts and keys, flags outdated or weak authentication methods, and provides clear steps to strengthen security. If an integration is using basic authentication or hasn’t been active in 100 days, the console spots it and helps resolve it. 

Without built-in security and trust, scaling AI comes with risk. These new security features in Zurich build upon ServiceNow’s AI Control Tower, announced in May 2025, which provides enterprise-wide visibility, embedded compliance, and end-to-end lifecycle governance for agentic AI systems. By centralizing oversight of every AI agent, model, and workflow—native or third-party—the AI Control Tower ensures organizations can scale AI with confidence, aligning innovation with enterprise-grade security and trust. 

Turn data into outcomes with autonomous workflows 

As organizations rapidly scale AI, they face the added challenge of delivering solutions consistently, reliably, and responsibly. Enterprises need the right guardrails, full visibility, and strong governance to achieve service delivery, or they risk eroding trust and slowing results. ServiceNow’s AI Platform does all this in a single platform, setting a new standard for how organizations can create autonomous workflows to turn data into action and AI into measurable business impact. 

  • Agentic playbooks from ServiceNow bring people, automation, and AI together seamlessly, powering autonomous workflows. A traditional playbook is a structured sequence of automated steps based on predefined business rules and processes—ideal for ensuring consistency, efficiency, and trust. Agentic playbooks amplify this model by embedding AI into the trusted framework. AI agents eliminate manual effort, completing tasks in seconds and accelerating execution. This frees employees to focus on higher-value work where human judgment matters most. For example, in a credit card support situation, an agentic playbook can guide an AI agent to verify someone’s identity, freeze the card, send a replacement and notify the customer while allowing a human agent to step in as necessary. The result: governed, efficient, and trusted work—supercharged by AI to deliver faster, smarter outcomes. 
  • The ServiceNow Zurich platform release also seamlessly combines Process and Task Mining insights within a unified platform. These new capabilities give organizations an end-to-end understanding of how work gets done—revealing where human expertise is essential, and where AI agents can deliver the greatest impact. With process intelligence built directly into the platform, customers can move seamlessly from insight to action—streamlining operations, applying AI where it matters most, and accelerating real business outcomes without the complexity of disconnected legacy tools. 

Availability 

All features announced today as part of the ServiceNow Zurich platform release are generally available and can be found in the ServiceNow Store. 

Leave a comment »

DH2i Brings Mission-Critical HA Capability to the Table for SQL Server 2025-Backed AI Applications

Posted in Commentary with tags on September 10, 2025 by itnerd

 DH2i recently announced the upcoming release of its flagship DxEnterprise software’s full readiness for public preview release of Microsoft SQL Server 2025. Designed with today’s and the future’s AI-driven, dynamic businesses in mind, this update gives both customers and channel partners the power to tackle next-gen workloads with unmatched flexibility, reliability, and ease.

With this release, DxEnterprise not only continues its tradition of seamless high availability and disaster recovery (HA/DR) across Windows, Linux, and Kubernetes, but also delivers full readiness for public preview release of SQL Server 2025 including advanced AI and scalability features. This includes maintaining high availability for databases support embeddings and function as vector stores. This ideally positions DH2i channel partners to guide customers through modernization initiatives, deploy end-to-end resilient infrastructures, and elevate their standing as strategic advisors offering the most innovative data management solutions available.

With DxEnterprise’s support for the public preview release of SQL Server 2025, enterprise end customers can now confidently build and run AI apps in development environments across any mix of infrastructure, including on-prem, cloud, hybrid, and Kubernetes environments. Once SQL Server 2025 is GA, customers will be able to take this capability straight to their mission-critical production environments. This release removes longstanding roadblocks related to deploying SQL Server Availability Groups (AGs) in containers, maintaining HA for vector databases, and scaling securely with the latest platform innovations. It enables organizations to embrace modern workloads like Retrieval Augmented Generation (RAG) and operational AI with the assurance of continuous uptime, simplified failover, and seamless integration with their existing HA/DR strategies. In short, enterprises can now modernize faster, innovate more freely, and meet aggressive AI and digital transformation goals, while maintaining the rock-solid reliability their businesses demand.

Key updates include:

  • SQL Server 2025 Ready – Ensures compatibility with the AI-ready, mission-critical RDBMS reimagined for the cloud and fabric era
  • Vector Database HA Support – Unlocks reliable deployment of AI applications with embedded semantic search, vector indexes, and RAG pipelines
  • DH2i DxOperator Enhancements – One of the most efficient Kubernetes-native SQL Server Availability Group deployment methods – now fully aligned with SQL Server 2025’s peak performance ambitions
  • AG HA for Kubernetes – This solution provides fully automated failover for SQL Server AGs on Kubernetes

With AI workloads becoming the new norm and the push toward containerization and hybrid infrastructure accelerating, DxEnterprise’s new capabilities will empower organizations to not only keep up, but lead.

1 Comment »

A Perspective On National Insider Threat Awareness Month

Posted in Commentary on September 10, 2025 by itnerd

This is National Insider Threat Awareness Month. Here’s what this is about:

First held in 2019, NITAM is an annual, month-long campaign during September that brings together thousands of U.S. security professionals and policy makers from government and industry, located in 25 countries around the globe, to educate government and industry about the risks posed by insider threats and the role of insider threat programs.

Craig Birch, Principal Technologist for Cayosoft has this perspective:

As we observe National Insider Threat Awareness Month, it’s crucial to recognize that insider threats extend far beyond malicious actors within our organizations. A significant and often overlooked category of insider risk emerges from the very people tasked with protecting our systems: IT administrators whose everyday actions can unintentionally create serious security and operational vulnerabilities.

There’s a real issue related to privileged group membership changes. Every day, administrative actions can unintentionally create serious security and operational risks. For example, an IT admin might temporarily disable multi-factor authentication (MFA) for a user under pressure to complete a critical task.

 If that exclusion is forgotten, the account becomes a weak point, vulnerable to phishing and potentially granting attackers access to sensitive applications.While not malicious in intent, these everyday admin changes are a form of insider-driven risk, arising not from attackers, but from human error, pressure, or incomplete understanding of the impact of a configuration change.

Similarly, small configuration changes in tools like Intune can have wide-ranging effects. Accidentally disabling encryption, for instance, could leave every corporate laptop unprotected, exposing the business to data theft if devices are lost or stolen.

These scenarios highlight how tenant-level settings and quick band-aid fixes, even when well-intentioned, can either: Weaken the security posture by introducing vulnerabilities, or create operational risks by over-restricting access and disrupting business processes.

To address this issue, organizations should implement continuous monitoring and automated controls around privileged group membership and administrative configuration changes. To reduce this risk, enterprises should:

  • Enforce policy guardrails to ensure critical security requirements cannot be disabled without approval.
  • Enable continuous visibility through deployment of monitoring and alerting tools that detect and report privileged group membership changes in real time.
  • Automate recovery through automated rollback or policy enforcement to rapidly restore secure defaults when unauthorized or risky changes occur.
  • Educate administrators through ongoing training to help IT staff understand the broader security implications of everyday admin actions.

Now is a good time to look at your environment and make sure that you don’t get pwned by an insider.

Leave a comment »

Plex Warns Users To Reset Their Passwords ASAP

Posted in Commentary with tags on September 10, 2025 by itnerd

I posted a guest post yesterday that media streaming platform Plex is warning customers to reset passwords after suffering a data breach in which a hacker was able to steal customer authentication data from one of its databases. Related to this, Martin Jartelius, CTO at Outpost24, provided the following comment:

“In situations like this, the safest approach is to automatically invalidate all user passwords and force a reset. While this prioritizes security and privacy over usability and business convenience, it’s often the best way to minimize risk.

The biggest concern is for people who reuse the same password across multiple sites. Even if Plex passwords were securely hashed, weak or reused credentials may eventually be cracked and then exploited in password spraying attacks elsewhere. Users should not only reset their Plex password but also change it anywhere else it may have been used.”

Consider this a today a today problem. If you have a Plex account, you should take measure to protect yourself now.

Leave a comment »

Wayne Memorial Hospital Pwned… A Year Ago

Posted in Commentary with tags on September 10, 2025 by itnerd

Georgia-based Wayne Memorial Hospital says it suffered a May 2024 data breach and has notified 163,440 people whose SSNs, credit cards and medical records were compromised.

Here’s the filing: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a180a42c-3998-4208-a65a-aa095d7166fb.html

Lidia López, Senior Threat Intelligence Analyst at cybersecurity company Outpost24, commented:

“The hospital has not confirmed the threat actor’s identity, but Monti claimed responsibility and threatened to leak data by July 8, 2024. Monti is a ransomware group that emerged in mid-2022 and operates a double-extortion model: encrypting files while exfiltrating data for publication on its Data Leak Site (DLS). 

The ransomware group has primarily targeted government, transportation, technology, and healthcare sectors, with prior healthcare victims including Spine West and Excelsior Orthopaedics. Historically, Monti has abused edge vulnerabilities and VMware ESXi servers, reusing portions of Conti’s tooling before shifting to a newer Linux encryptor. The DLS is currently offline, with the last victim listed on May 8, 2025. Given the Wayne Memorial breach exposed Social Security numbers, payment cards, and medical records, patients now face long-term risks of identity theft, medical fraud, and targeted scams.”

This is another hack that won’t end well for their victims. There will be secondary attacks that will go after these victims, and it will cost those victims. This is not a good situation. What even worse is that this happened over a year ago. Which means that the bad guys have had a head start.

Leave a comment »

Retailers Face Rising Threat of AI-Powered Email Scams, New Report From Valimail Warns

Posted in Commentary with tags on September 10, 2025 by itnerd

As phishing scams become more sophisticated and harder to detect, a new analysis from Valimail, the leading provider of email authentication and anti-impersonation solutions, reveals that retail brands are among the top targets. They are increasingly attacked not only for fraud, but for brand impersonation campaigns that erode consumer trust and open the door to disinformation.

In the past year alone, Valimail blocked over 123 million suspicious emails, highlighting the scale of attempted brand abuse aimed at customers’ inboxes. These are no longer the clunky, obvious attacks of the past. They’re clean and well-crafted, designed to replicate the tone, design and cadence of trusted retail brands. The goal is often to get customers to click, share credentials or even unknowingly spread misinformation.

While many retailers have taken steps to implement email authentication protocols the report shows that significant gaps remain:

  • Even though 95% of retail domains have a DMARC record in place, many aren’t enforcing it. Nearly 30% still use a policy that effectively does nothing.
  • 6% don’t receive any reporting at all, leaving them blind to how their domains are being used or misused.
  • If new sender authentication requirements from Gmail, Yahoo! and Outlook were fully enforced today, 3 million retail emails would be blocked for failing compliance.
  • Despite these gaps, the report notes a 40% year over year increase in BMI adoption in the retail sector – a sign that more brands are looking to protect both security and visual trust in the inbox.

Valimail’s findings underscore a key shift: email security is no longer just about fraud prevention – it’s brand protection. In an era when AI can mimic tone, logos and layouts with alarming accuracy, authentication tools like DMARC and BMI are among the few tools that give brands control over who can send on their behalf.

Valimail offers free resources for organizations to check the protection status of their email domains through the Valimail Domain Checker, allows companies to explore and provides DMARC reporting visibility through its Monitor solution.

The full “2025 Winning (and Keeping) Shopper Trust – The Retail Email Threat You Can’t See” report can be accessed here.

Leave a comment »

Guest Post: When Europe’s GPS Goes Dark: The Urgent Cybersecurity Crisis Inside EU Institutions

Posted in Commentary with tags on September 10, 2025 by itnerd

The EU’s top official, European Commission’s president Ursula von der Leyen, was on her way to Bulgaria when a suspected Russian attack forced her plane to land without essential navigation tools. 

This harrowing episode was no accident but what officials suspect to be a deliberate act of Russian interference – an electronic attack targeting critical infrastructure in the heart of the European Union.

This incident exposes not only the elevated state of geopolitical hostility but also the cybersecurity weaknesses within EU institutions themselves.

According to the research by the Business Digital Index, or BDI, the EU’s cybersecurity defenses resemble an office where nearly half the doors are unlocked, passwords are scrawled on sticky notes, and the alarm system is known to be broken but left unfixed.  The BDI findings reveal the reality that EU institutions may not be robustly prepared to withstand or respond effectively to high-impact cyber-physical attacks like GPS jamming.

The researchers looked at 75 EU institutions and found that none got an A or B for cybersecurity efforts. 35% got the lowest grade, an F. The problems are especially clear with basic security: in the F-rated institutions, 85% of employees reused passwords that had already been breached. In C-rated ones, only 8% did this. SSL/TLS configuration issues were identified in 100% of F-rated institutions. 

These findings point to very real – and these days accelerated by AI – risks for phishing, malware, and stolen data. Attackers can now do such things as mimicking colleagues using deepfake technology, and deploying malware that adapts in real time to avoid detection. Needless to say that these potential threats can result in financial loss, reputational damage, and regulatory penalties for EU organizations. 

The EU’s main response to growing cyber threats has been to add more rules in order to improve cybersecurity. But the data shows that just having rules isn’t enough. Despite these new rules, nearly half (46%) of the EU’s lowest-rated organizations have already suffered data breaches.

I believe that the real problem is that leaders aren’t acting urgently or taking responsibility. For example, almost all D-rated and F-rated institutions had insecure hosting environments. Domains vulnerable to email spoofing were found in every C-rated organization and in 96% of D-rated and F-rated ones.

The EU needs to do more than merely add more rules and formally follow them. It needs to make sure leaders are held responsible for breaches. That means executives should have part of their pay tied to cybersecurity results. It also means having real, independent security checks with actual consequences for failure. The Transport sector is doing a little better than others, and the EU should learn from that.

Some might argue that more rules will solve the problem, or that it’s just too big to fix in a short amount of time. But the numbers tell a different story: the institutions with the worst track records are the same ones that don’t pay attention to basic security practices such as using strong and uncompromised passwords. At the end of the day, this comes down to leadership.

Given that cyber threats keep on evolving and the geopolitical situation isn’t exactly what we want it to be, the risks are really high. Every day the EU waits, it puts sensitive data, economic stability, and public trust at risk. If the EU wants to be a leader in digital governance, it needs to make cybersecurity a top priority for executives, invest in training, and hold leaders to account.

If nothing changes, the next headline won’t be about bad grades or landing with paper maps. It might be about a real crisis that rules can’t fix. The question now is whether the EU will act in time.

ABOUT THE AUTHOR

Jurgita Lapienytė is the Editor-in-Chief at Cybernews, where she leads a team of journalists and security experts that uncover cyber threats through research, testing, and data-driven reporting. With a career spanning over 15 years, she has reported on major global events, including the 2008 financial crisis and the 2015 Paris terror attacks, and has driven transparency through investigative journalism. A passionate advocate for cybersecurity awareness and women in tech, Jurgita has interviewed leading cybersecurity figures and amplifies underrepresented voices in the industry. She’s recognized as the Cybersecurity Journalist of the Year and featured in Top Cyber News Magazine’s 40 Under 40 in Cybersecurity. Jurgita has been quoted internationally – by the BBC, Metro UK,  The Epoch Times, Extra Bladet, Computer Bild, and more. 

Leave a comment »