Zachs Investment Research leaks 12 million unsalted passwords, user names & more 

Posted in Commentary with tags on February 14, 2025 by itnerd

Zacks Investment Research (Zacks), stock performance assessment tool provider, had a leaked database added to Have I Been Pwned on Wednesday of this week that included 12 million unique records. HIBP confirmed that the file included 12 million unique:

  • Email addresses
  • IP addresses
  • Names
  • Passwords in the form of unsalted SHA-256 hashes
  • Phone numbers
  • Physical addresses
  • Usernames

Scammers and other threat actors will have “fun” with all that data…. At your expense if you’re on this list.

Lawrence Pingree, VP, Dispersive had this to say:

   “When leaks occur, it allows investigators to determine more quickly where they need to look to investigate. E.g. They normally know at least in theory where the data came from. The important thing is to have zero trust connectivity between systems, isolating them from lateral movements from compromised systems, limiting the blast radius of the breach. In this case, it is most likely an application layer attack or SQL injection into the application that resulted in the database exposure, but I am speculating based on the scenario.”

Jawahar Sivasankaran, President, Cyware follows with this:

   “Research shows that 72% of security professionals struggle with prioritizing vulnerabilities, delaying remediation efforts, and 17% of IT assets are invisible to vulnerability scans, leaving them exposed.

   “When it comes to cybersecurity, competing financial services organizations are better protected and more resilient when they work together. Joining sector-specific Information Sharing and Analysis Centers (ISACs) such as the Financial Services ISAC ( FS-ISAC) and operational collaboration frameworks that leverage public-private partnerships – gives financial services organizations new visibility into exploited vulns, threats the sector faces, data protection best practices, issues on emerging risks such as generative AI, and more efficient and effective threat intelligence management and proactive response strategies.”

Hopefully the 12 million people on this list have credit monitoring services in place. Because they’re going to need it.

Leave a comment »

Guest Post: Microsoft, SUSE, & DH2i: A Comprehensive Dream Team for HA SQL Server in the Cloud

Posted in Commentary with tags on February 14, 2025 by itnerd

By Josh Achtemeier

Our collaborations with technology partners over the years have been critical in engineering the most flexible and impactful software solutions for our customers. 

DH2i has worked in different capacities with Microsoft for years. We’ve maintained a collaborative, mutually-beneficial relationship that has fostered some massive advances in SQL Server high availability technology, especially in the Linux space. E.g. DH2i’s groundbreaking SQL Server Operator for Kubernetes has become Microsoft’s officially recommended SQL Server Operator, even receiving dedicated documentation articles within their SQL Server resource library. 

Over the last couple years, we have started working closely with the fantastic team over at SUSE as well—pioneering some powerful new solutions to facilitate SQL Server modernization with unparalleled ease. E.g. Take a look at this demo video featuring DxOperator and Rancher Prime to facilitate the easiest possible approach to a SQL Server Kubernetes deployment in AKS.  

From robust, certified platforms to meticulously developed Kubernetes orchestration and security technologies, SUSE provides perfectly complementary capabilities to enhance our existing solution stories with Microsoft. The functional possibilities and applications of our combined solution portfolios are wide-ranging, but this blog will focus on the ability of our three companies to unlock easy deployment of highly available SQL Server in the cloud with Microsoft Azure, SUSE Linux Enterprise Server (SLES), and DxEnterprise. 

A Full Suite of Services and Security for Cloud Databases 

Microsoft Azure: Azure is Microsoft’s public cloud platform, which provides a wide range of services, including computing, storage, networking, and database management. Azure supports various operating systems, including SUSE Linux Enterprise Server (SLES). 

SUSE Linux Enterprise Server: SUSE is an open-source software company that offers a range of products, including the SLES operating system. SLES is a popular choice for enterprise environments due to its stability, security, and scalability. 

DxEnterprise: DxEnterprise is Smart High Availability Clustering software developed by DH2i, which provides an easy-to-mange, flexible, secure, and highly available clustering framework for managing SQL Server databases on Windows, Linux, and Kubernetes.  

When used together, Azure, SLES, and DxEnterprise can provide a robust solution for deploying and managing highly available databases in the cloud. Here’s how they work together: 

  1. Azure as the cloud platform: Azure provides the underlying infrastructure for deploying and running SLES virtual machines (VMs) or containers. 
  2. SUSE Linux Enterprise Server: SLES is installed on Azure VMs or used as a container runtime, providing a stable and secure operating system environment for running databases. 
  3. DxEnterprise: DxEnterprise is deployed on top of SLES, providing a high availability framework that can manage multiple database instances across the Azure (and any mix of) infrastructure. 

The benefits of using Azure, SUSE, and DxEnterprise together include: 

  1. Scalability: Azure provides a scalable cloud infrastructure that can be effortlessly integrated with the DxEnterprise HA management framework, regardless of region or Availability Zone. 
  2. High availability: DxEnterprise ensures high availability of databases by providing real-time monitoring, load balancing, and automatic failover (for instances AND containers) to ensure that workloads are always running in their respective best execution venues. 
  3. Security: SLES provides a secure operating system environment, while DxEnterprise offers the additional capability of encrypted, app-level zero trust network access connections across any mix of clouds and infrastructure. 
  4. Simplified management: DxEnterprise simplifies high availability management by providing a unified platform for managing multiple database instances across Azure and any mix of infrastructure or platforms. 

Use Cases for the Azure, SLES, & DxEnterprise Solution Stack 

Some possible use cases for using Azure, SUSE, and DxEnterprise together include: 

  1. Database consolidation: Consolidate multiple databases into a single DxEnterprise high availability cluster running on SLES in Azure.
  2. Easy Multi-Site DR in the Cloud: If organizations need the real-time replication provided by Always-On Availability Groups (AGs), DxEnterprise can be used to easily stretch the AG across multiple Azure regions or availability zones, ensuring high availability and disaster recovery capabilities between sites.
  3. Cloud migration: Migrate on-premises databases to Azure using DxEnterprise and SLES, taking advantage of proprietary tools like DxEnterprise’s SQL Server Operator for Kubernetes.

For organizations looking to deploy highly available SQL Server in the cloud, it’s impossible to outdo the benefits provided by Azure cloud infrastructure and its tight, out-of-the-box integration with SQL Server. Microsoft and SUSE’s longstanding partnership has culminated in an incredibly stable and secure operating system environment with SUSE Linux Enterprise Server. And SLES provides a cost-effective platform that is inherently optimized for SQL Server workloads. Lastly, DxEnterprise delivers the perfect high availability solution to manage all your workloads across Azure—instances or containers—and easily unifies mixed infrastructure and multi-site deployments for disaster recovery. 

Together, Azure, SLES, and DxEnterprise provide the go-to solution stack for deploying and managing SQL Server databases in the cloud. Their close integration and robust management capabilities stand head and shoulders above the competition in terms of scalability, high availability, and security.

Check out other resources detailing Microsoft, SUSE, and DH2i’s continued collaborations below:

Leave a comment »

CISA issues Medical Advisory on Qardio Heart Health app

Posted in Commentary with tags on February 14, 2025 by itnerd

The CISA has just issued an ICS Medical Advisory alert on the Qardio Heart Health app for vulnerabilities that may result in exposure of private personal information to a cyber attacker, and that successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information, cause a denial-of-service condition, or other implications. All of which are bad.

George McGregor, VP, Approov had this to say:

   “This recent vulnerability shows once more that mobile apps are the weakest link in the healthcare ecosystem and that it’s not just consumer access to PHI that is the issue.

   “Medical practitioner apps are increasingly used from personal devices, outside the security provided by campus networks. In addition, mobile apps have become a key means of access and control for every new medical device.

   “This is why the upcoming HIPAA Security Rule (https://www.regulations.gov/document/HHS-OCR-2024-0020-0001) must be updated to explicitly target known mobile app attack surfaces and eliminate the risks to US Healthcare posed by the proliferation of Healthcare apps.”

Given how much we all have become reliant on apps to manage our health in some way, this is not good news. But at least there is some good news coming in the form of the HIPAA rule that is inbound. Hopefully that will make something like this an edge case.

Leave a comment »

Guest Post: The Privacy Trade-Off: Balancing Security and Convenience in Smart Homes

Posted in Commentary on February 14, 2025 by itnerd

Provided by Geonode

Smart homes are all the rage. Thermostats, cameras, voice assistants—they promise ease and security. But there’s a catch: privacy and security risks. Let’s break it down.

Convenience at a Price

Imagine controlling your lights or thermostat with a tap on your phone or a voice command. Sounds great, right? Devices like Amazon Alexa and Google Home make life smoother and more efficient. But these gadgets need data to function, and that data includes your daily routines and private conversations.

The Hidden Cost of Data

All this convenience comes at a cost. Your smart devices collect heaps of data, often stored in the cloud. This means you’re losing control over who sees your info. Companies might share it with third parties, sell it to advertisers, or even hand it over to the government. Not so smart, huh?

Security Vulnerabilities

And let’s talk about hacking. Many smart home devices aren’t as secure as you’d think. Weak passwords, outdated software, and insecure APIs are open doors for hackers. Think your home security system is impenetrable? High-profile breaches in devices like Ring and Nest suggest otherwise.

Legal Landscape

Lawmakers are catching on. The American Data Privacy and Protection Act (ADPPA) aims to give you rights to your data. You can access, correct, and delete it. Companies must limit data collection to what’s “reasonably necessary.” Sounds good, but enforcing these rules is another ballgame.

How to Protect Yourself

So, what can you do? Be smart about your smart home.

  1. Strong Passwords: Use unique, strong passwords for each device.
  2. Update Regularly: Keep your device firmware up to date.
  3. Know Your Rights: Familiarize yourself with privacy laws like the ADPPA.

Real-World Incidents

Data misuse in smart homes is real. From unauthorized data collection to hacking, your private moments could end up exposed. High-profile cases have shown how easily these devices can be compromised, underscoring the need for robust security measures.

Industry Responsibility

Manufacturers also have a role to play. They need to implement strong security protocols and be transparent about data usage. Compliance with standards like the Matter interoperability and security standard can help build trust and protect user data.

Consumer Awareness

Consumers must stay informed. Understand what data your devices collect and take steps to safeguard it. Use strong passwords, update regularly, and know your rights.

Josh Gordon, a technology infrastructure expert at Geonode, emphasizes the importance of robust privacy measures: “The key to balancing convenience and security lies in understanding the data flows and ensuring that access is secure and controlled.” Gordon’s insights align with the industry’s growing emphasis on data privacy and secure access solutions, reinforcing the critical need for consumers to stay vigilant.

By staying vigilant and informed, you can enjoy the perks of a smart home without sacrificing your privacy.

Leave a comment »

Romance Scam Losses Could Exceed $535 Billion

Posted in Commentary with tags on February 13, 2025 by itnerd

On the eve of Valentine’s Day, researchers at Comparitech, Chainalysis and Bitfender are highlighting the staggering losses to romance baiting or pig butchering observed.

Comparitech estimated that almost 60,000 US romance seekers fell victim to these scams in 2024, resulting in heartbreaking losses of approximately $697 million ($11,616/victim!).

More concerning is an AARP survey that estimated that 4% of Americans have fallen victim to these scams, equating to over 13 million individuals, which is about 3.6% of those officially reported. Researchers estimate the cumulative financial damage from romance scams could exceed $535 billion. 

Chloé Messdaghi, Founder founder of SustainCyber has this comment:

  “These romance scams and pig butchering operations are getting more aggressive and harder to spot. Scammers are weaponizing AI to create fake profiles, deepfake videos, and run chatbot-driven conversations that feel real—they know how to tap into emotions fast. 

   “We can’t keep placing the burden solely on individuals to ‘watch for red flags’ when those flags are increasingly invisible. Platforms need to step up with stronger fraud detection and identity verification, and financial institutions should be doing more to catch suspicious transaction patterns before people lose everything. This is a collective problem that requires a collective response—tech, finance, and policy all need to work together to protect people from being manipulated and financially gutted.”

Since a major part of what I do is scam related, I’ll offer up this story that I did earlier this week. While it’s not the whole solution, it’s a start in terms of protection from these scams.

Leave a comment »

RansomHub Has A Ransmware ExploitThat Leverages Microsoft And Palo Alto Vulnerabilities To Pwn You

Posted in Commentary with tags , on February 13, 2025 by itnerd

Researchers have uncovered a major ZeroLogon ransomware exploit that targets a critical vulnerability in Microsoft’s Active Directory that allows attackers to gain access to domain controllers without needing any credentials. It also targets a vulnerability in Palo Alto Networks firewall appliances running an outdated PAN-OS software. This exploit allowed attackers to execute arbitrary code with root privileges, bypassing authentication and gaining a foothold inside the network. Finally, the group behind this is RansomHub who are well known ransomware actors.

You can read details here.

Martin Jartelius, CISO at Outpost24, provided the following comments specifically related to the Microsoft part of this:

“The ZeroLogon vulnerability (CVE-2020-1472) continues to be a major concern, especially in Active Directory (AD) environments, which are often seen as a platform that “just works.” The vulnerability was patched by Microsoft in August 2020, but for the exploit to be effective, organizations must have either failed to patch or deliberately re-enabled insecure protocols in their Group Policy Objects (GPO). Enforcement of secure channels by AD controllers didn’t begin until Q1 2021, but since then, it has been actively enforced.

“It’s difficult to victim-blame when it comes to zero-day exploits or supply chain breaches, but when an organization is hit by a vulnerability that has been patched for over four years, it’s clear that someone within the team has knowingly taken on a significant risk. The kill chain doesn’t begin with this exploit—it starts with initial access. Organizations must focus on hardening their external attack surface and training staff to reduce the likelihood of breaches. Leaving systems unpatched or intentionally vulnerable is a serious security misstep.

“A critical point: if your domain controllers (DCs) are still running Windows Server 2008 R2 SP1 or earlier, this vulnerability remains unpatched unless you have an Extended Security Update (ESU) license, which only applies when running in Azure, not on-prem. While rare, we still encounter customers running unsupported versions of Windows. Active Directory, being the “keys to the kingdom,” must be regularly maintained and patched to avoid exposure to preventable exploits.

Finally, Windows Server 2012 and 2012 R2 will reach the final year of their ESU coverage in October 2026. Organizations should start planning upgrades now to ensure continued protection.

“The broader lesson is the importance of proactive patching, secure configurations, and ongoing risk management to avoid unnecessary exposure.”

Along with Martin’s advice, I would have a look at this if you are a Palo Alto customer and take immediate action if required. That way you limit your exposure.

Leave a comment »

Sage Intacct Further Advances AI for Finance Teams

Posted in Commentary with tags on February 13, 2025 by itnerd

Sage today announced new innovative AI-driven tools and automation features for Sage Intacct. These latest enhancements help finance teams save time, get trusted insights faster, and focus on growth by simplifying compliance, enhancing decision-making, and improving operational efficiency.

Introduced into Sage Intacct in December 2024, Sage Copilot, a generative AI-assistant for accounting, has rapidly evolved with direct feedback from customers to deliver new AI-driven capabilities that enable finance teams to streamline critical workflows and improve month-end close efficiency. Now with features like Search Help, Variance Analysis and Close Assistant, Sage Copilot reduces administrative burdens, provides real-time insights, and simplifies financial management. With AI-powered analysis and proactive alerts, finance professionals save time, budget owners gain real-time spending insights, and accounting teams close the books more accurately and confidently.

Simplify Finance with AI and Automation

According to Sage’s report “AI: The opportunity for CFOs”, 86% of finance leaders have already incorporated AI into their operations, but only 49% use specialised AI solutions designed explicitly for finance. Despite this, more than three-quarters (77%) of finance leaders recognize AI as a partner that enhances job satisfaction and enables more strategic operations.

To address the increasing complexity of financial operations — where manual processes and data silos can slow decision-making, Sage is also expanding automation with the latest enhancements, including AP Automation with Purchasing. This helps finance teams reduce manual effort, improve accuracy, and gain contextual insights. With organizations already processing more than 24 million invoices, valued at over $10 billion and saving them 3-million hours, these latest advancements allow them to further focus on strategic goals, streamline complex workflows, and eliminate the bottlenecks. 

Sage Intacct Release 1 2025 Enhancements Include:

  • Sage Copilot Search Help: Bringing instant, conversational answers finance teams, Sage Copilot’s generative AI-powered search enables quick and precise answers to how-to questions. With natural language understanding, Sage Copilot interprets complex queries, understands Intacct-specific terminology, and delivers useful answers fast.
    • Availability: General availability with phased rollout to existing customers in UK & US
  • Sage Copilot Variance Analysis: Now generally available, Sage Copilot Variance Analysis provides accounting and budget owners with real-time insights into budget variances. It uncovers spending issues and potential inaccuracies throughout the month — without having to wait for the close. Budget owners receive variances with easy-to-consume graphs and natural language descriptions of drivers of the variances. It also saves accounting teams from needing to compile and distribute variances, freeing them for higher value tasks.
    • Availability: General availability with phased rollout to existing customers in UK & US
  • Sage Copilot Close Assistant: Offering an at-a-glance view of month-end close progress, Close Assistant provides real-time visibility into key close status across entities and subledgers, identifies incomplete tasks, simplifies navigation, and keeps everyone aligned throughout the close process.
    • Availability: Early Adopter in UK & US
  • AP Automation with Purchasing: Helping to reduce hours spent manually matching POs to invoices with scalable policies and automation, this extension helps finance teams manage all accounts payable and purchasing tasks in one unified platform. Eliminating the need to switch between multiple systems, AP Automation with Purchasing leverages AI and machine learning to ensure invoices are automatically matched to purchase orders, reducing errors and manual effort.
    • Availability: In all regions
  • Clinical eProcurement: Enhancing procurement workflows for large healthcare organizations with vendor punchout technology, this latest addition to Sage Intacct improves spend management and ensures compliance with procurement policies.
    • Availability: US from March
  • Revenue Management Enhancements: Simplifying compliance with ASC 606 and IFRS 15 standards, Sage Intacct Revenue Management automates complex revenue recognition processes at the push of a button. Now customers can bring their own billing solution when they migrate from another accounting platform to Sage Intacct. With support for more than 600 billing scenarios, Revenue Management can seamlessly integrate to third-party billing solutions, providing flexibility to customize workflows and generate accurate deferred revenue waterfalls and forecasts.
    • Availability: US, UK, AU, CA & ZA

Leave a comment »

Nikon Releases The NIKKOR Z 28-135mm f/4 PZ Power Zoom Lens

Posted in Commentary with tags on February 13, 2025 by itnerd

Today Nikon Canada Inc. announced the release of the NIKKOR Z 28-135mm f/4 PZ, a full-frame power zoom lens for the Nikon Z mount made especially for video professionals. Featuring a truly versatile focal range, a customizable power zoom function, precise manual controls and agile handling, this is the first dedicated NIKKOR Z lens that is designed to empower small-footprint productions and solo videographers with a lightweight cinematic tool that fulfills numerous roles.  

The first thing that grabs your attention is the appearance of this lens — the pronounced yellow ring around the bayonet and the bold typography on the barrel stand out, indicating its rightful place in a production environment. The NIKKOR Z 28-135mm f/4 PZ looks different than other NIKKOR Z lenses, incorporating an updated design and precise controls made to augment the workflow of cinematographers and videographers, with maximum flexibility. 

The NIKKOR Z 28-135mm f/4 PZ is a power zoom lens that spans many of the most commonly used focal lengths, from a wide 28mm for establishing shots, to 135mm for close-up/telephoto coverage. It also covers everything in between, from interviews to events, live or spot news, sports and more. The NIKKOR Z 28-135mm f/4 PZ gives videographers superior operability and functionality in situations that require agility, such as when shooting corporate content, documentaries, or on-location coverage, when reshoots just aren’t an option. 

The NIKKOR Z 28-135mm f/4 PZ offers precise control, letting the user smoothly zoom throughout the focal range, but also offers a choice of 11 different zoom speeds to match a specific creative style and vision. The lens is superbly balanced, minimizing shifts in the centre of gravity that occur with zooming. This lets the user shoot with confidence, even when constantly using the power zoom feature on a gimbal. The NIKKOR Z 28-135mm f/4 PZ also supports a variety of video accessories such as follow-focus controllers, matte boxes and more to help videographers capture the footage they want on location, as well as offering remote control capabilities using a computer or smartphone. 

Thanks to the superior NIKKOR Z optical performance, this lens enables users to capture beautiful full-frame, high-resolution 8K video. The lens uses Nikon’s best anti-reflection coating, a Meso Amorphous Coat, to significantly reduce ghosting and flares, while the optical formula is optimized for video with a design that minimizes focus breathing. Additionally, the inclusion of a stepping motor (STM) ensures fast and accurate autofocusing.

Primary Features of the NIKKOR Z 28-135mm f/4 PZ

  • The NIKKOR Z 28-135mm f/4 PZ supports a convenient 28-135mm range of focal lengths, allowing for a variety of compositions without changing lenses.
  • When used with the Nikon Z8/Z9, Hi-Res Zoom can be used for an angle of view equivalent to that of the 270mm focal length with 4K video recording. Additionally, from 135mm-270mm, the zoom is effectively parfocal.
  • The lens supports dynamic close-ups with a minimum focus distance of just 13.3 in (0.34 m) in the 28mm to 50mm range and 22.4 in (0.57 m) in the telephoto range. 
  • Zooming speed can be selected from 11 speeds and assigned to the zoom lever or one of the camera’s Fn buttons.
  • Zoom ring angle and direction of rotation can be customized to suit individual preferences.2
  • Synchro mode enables simultaneous optical zoom and Hi-Res Zoom using a single control with video recording.
  • Professional video accessories, including matte boxes and follow focus systems are supported.
  • Adoption of an internal zoom mechanism allows for comfortable zooming without concern for shifts in the centre of gravity that may upset the balance of the camera-lens setup, especially useful when using a gimbal.
  • Adoption of Meso Amorphous Coat, Nikon’s best anti-reflection coating, significantly reduces ghosts and flares.
  • Adoption of a stepping motor (STM) ensures fast and accurate autofocusing.
  • Optimized for video recording with a design that suppresses focus breathing.
  • Support for linear MF drive enables smooth focusing. 
  • Comes with a rectangular HB-116 lens hood that helps users control the amount of light entering the lens for less ghosting and flares. A filter adjustment window allows users to adjust circular polarizing and variable ND filters while the hood is attached. 
  • Zooming can be controlled remotely from a computer, smartphone, or tablet using NX Tether, SnapBridge, or NX Field.
  • Customizable L-Fn buttons are positioned on the side and top of the lens for convenient operation of assigned functions even when shooting in vertical (portrait) orientation. 
  • Nikon’s fluorine coat applied to the front lens element effectively repels dust, water droplets, grease, and dirt. 
  • Designed with consideration for dust and drip-resistance.

Price and Availability

The new NIKKOR Z 28-135mm f/4 PZ lens will be available in April 2025 for a manufacturer’s suggested retail price (MSRP) of $3,399.95. The lens will also be available as part of a bundle with the new RED KOMODO-X Z Mount camera. For more information on these products, please visit RED.com. For more information about the latest Nikon products, including the vast collection of NIKKOR Z lenses and the entire line of Z series cameras, please visit www.nikon.ca.

Leave a comment »

Palo Alto Networks Introduces Cortex Cloud

Posted in Commentary with tags on February 13, 2025 by itnerd

Palo Alto Networks is doubling down on cloud security with the introduction of Cortex® Cloud, the next version of Prisma Cloud, that natively brings together new releases of its best-in-class cloud detection and response (CDR) and industry-leading cloud native application protection platform (CNAPP) capabilities on the unified Cortex platform. The new solution, announced today, equips security teams with significant innovations powered by AI and automation that go beyond traditional “peace time” approaches to cloud security and stop attacks in real-time.

Unit 42® reports reveal that 80% of security exposures were found in cloud attack surfaces, with a 66% increase in threats targeting cloud environments. As cloud adoption and AI usage grow, Cortex Cloud unifies data, automates workflows, and applies AI-driven insights to reduce risk, prevent threats, and stop attacks in real time. Cortex Cloud is designed to ingest and analyze data from third-party tools to provide centralized visibility, AI-driven insights and end-to-end remediation across the entire cloud security ecosystem.

Cortex Cloud delivers on Palo Alto Networks platformization strategy by rearchitecting its cloud security solution on the AI-driven Cortex SecOps platform to deliver a powerful unified user experience with persona-driven dashboards and workflows. Cortex Cloud helps customers achieve superior protection at a significantly lower total cost of ownership and provides additional value and new features including:

  • Application security: Build secure apps and prevent issues in development before they become production issues that attackers can target. Cortex Cloud identifies and prioritizes issues across the entire development pipeline with end-to-end context across code, runtime, cloud and newly introduced third-party scanners.
  • Cloud posture: Improve multi-cloud risk management with new AI-powered prioritization, guided fixes to resolve multiple risks with a single action, and automated remediation. Additionally, Cortex Cloud delivers a single user experience with tight integration across all of Prisma Cloud’s cloud posture capabilities.
  • Cloud runtime: Stop attacks in real time. Cortex Cloud natively integrates the unified Cortex XDR agent, enriched with additional cloud data sources, to prevent threats with advanced analytics – as proven by industry-leading results in the most recent MITRE ATT&CK testing. Our new Cloud Runtime Security offering includes the world’s leading CNAPP capabilities at no additional cost, maximizing adoption of end-to-end cloud security on a single platform.
  • SOC: The preferred SOC platform for enterprise and cloud, expanding beyond what any SIEM can deliver. Cortex Cloud natively integrates cloud data, context and workflows within Cortex XSIAM to significantly reduce the mean time to respond (MTTR) to modern threats with a single, unified SecOps solution.

Customer Delivery

Existing Prisma Cloud customers will experience a seamless upgrade to Cortex Cloud, and will now experience the power of streamlined, real-time cloud security. Existing Cortex XSIAM customers who add Cortex Cloud gain the ability to seamlessly adopt CNAPP capabilities that are native-by-design on the world’s most complete AI-powered, enterprise-to-cloud SecOps platform. Cortex Cloud will be available to customers later in Q3 FY25.

Introducing Cortex Cloud Launch Partners

Eager to roll out the differentiated Cortex Cloud to customers are Palo Alto Networks’ esteemed integration partners: CyberCX, Deloitte, IBM and Orange Cyberdefense. Together with each partner, Palo Alto Networks will drive end-to-end SecOps transformation across enterprise and cloud environments, enabling organizations to achieve superior risk reduction, rapid threat prevention and streamlined operational efficiency.

To learn more about Cortex Cloud, the Cortex platform and how Palo Alto Networks is transforming cybersecurity through real-time security, read our blog and register for Cortex’s annual signature event, Symphony 2025.

Leave a comment »

Guest Post – AI in the Wrong Hands: How Unregulated Technology Could Fuel Cybercrime

Posted in Commentary with tags on February 13, 2025 by itnerd

By Aras Nazarovas

The recent AI summit in Paris pushed an optimistic vision of the technology’s potential, focusing on how AI can solve big problems in medicine, climate science, and beyond instead of prioritizing security. But the world can’t just be blissfully excited. It’s crucial to remember that AI is also a powerful tool for malicious actors – one that’s already being used in cyberattacks and could evolve into a much bigger threat.

Today, AI is being deployed to amplify cyberattacks in various ways. A study from the University of Cambridge showed how AI-driven cyberattacks are becoming more sophisticated. Attackers are increasingly using machine learning algorithms to automate phishing attacks, targeting individuals and organizations with highly personalized content. These AI-driven systems can analyze vast amounts of data – on social media profiles, browsing history, and even email patterns – to create convincing attacks that are harder to detect than traditional ones. 

AI tools lower the barrier to entry for cybercrime by enabling less experienced attackers to launch attacks they wouldn’t otherwise have the skills or knowledge to carry out. For instance, individuals who lack programming skills, can now simply ask AI tools like ChatGPT to write bots that automate the process of breaching servers. While these attacks may not be novel, they still increase the volume of potential threats companies need to defend against, draining the resources of already underfunded security teams. 

Striking the Right Balance Between Innovation and Security 

As AI tools become more embedded in business operations, the stakes grow even higher. For instance, KPMG’s recent survey of financial leaders revealed that 84% plan to increase their investments in generative AI (GenAI). 

While they and presumably other industries are in the process of accelerating  the adoption of AI tools, the World Economic Forum reports that nearly 47% of surveyed organizations have already noticed adversarial advances powered by GenAI as their primary concern, enabling more sophisticated and scalable attacks. Moreover, the same report states that only 37% of organizations have processes in place to assess the security of AI tools before deployment. 

Meanwhile, the EU’s AI Act, which aims to regulate high-risk AI systems, is being phased in over several years, with full implementation not expected until 2027. However, there is a growing debate in Europe about how to balance regulation with fostering innovation. During the Paris AI summit, French President Emmanuel Macron remarked that Europe might reduce regulatory burdens to allow AI to flourish in the region. 

This presents a potential challenge: while Europe struggles with over-regulation concerns, its wait-and-see approach might cause them to miss the boat as AI technology evolves at an incredible speed. By the time the AI Act is fully in place, we could be facing an entirely new wave of AI-powered cyberattacks, many beyond the scope of current regulations. 

So, what does this mean for cybersecurity if AI is regulated by a light-touch regulatory framework? While innovation is essential, the absence of security-focused regulation means AI tools are already in the hands of cybercriminals who can weaponize them with minimal oversight.

At the moment, the capacity of AI systems for automating and optimizing cyberattacks already extends far beyond aforementioned phishing. AI-powered tools can be used to exploit vulnerabilities in critical infrastructure systems, launch bigger Distributed Denial of Service (DDoS) attacks, or even manipulate financial markets. In 2023, the US Department of Homeland Security issued a warning that AI-powered systems could soon be capable of launching autonomous cyberattacks that are difficult to counteract using conventional defense mechanisms. Such threats present a security nightmare that policymakers can’t afford to ignore.

If AI systems evolve to the point where they can autonomously compromise digital infrastructure, we could see an escalation in both the frequency and severity of cyberattacks, potentially crippling global systems.

Cybersecurity Must Evolve – Now

Whether AI is robustly regulated or not, businesses should do more than a bare minimum for cybersecurity. First, it’s essential to invest in additional, AI-driven security tools rather than replacing existing ones with AI-powered solutions. While AI and machine learning can be incredibly useful for detecting and preventing attacks in real time, they can also make incorrect decisions. AI should serve as an additional resource to enhance cybersecurity efforts, not as a replacement for traditional tools. By analyzing patterns in network traffic, AI can identify anomalies that may signal a breach. As cyberattacks become more automated, AI can help security teams identify threats faster and more efficiently, allowing them to do more with the same amount of resources.

Another step is to start incorporating AI threat modeling into security protocols. AI can be leveraged to predict and prevent attacks. Security teams need to think like attackers, using AI to simulate how their systems might be breached and proactively patching those vulnerabilities before they can be exploited.

Finally, companies must invest in continuous training for their security teams. As AI-driven attacks evolve, it’s not enough to simply rely on firewalls and antivirus software. Security professionals need to be prepared to deal with more sophisticated, AI-powered threats. This includes staying ahead of trends, understanding how AI tools are being used against them, and developing strategies that go beyond traditional defenses.

Undoubtedly, AI has the potential to revolutionize cybersecurity and every other industry, but it also introduces a new wave of risks. While policymakers may be caught up in the AI race, cybersecurity professionals must act now. AI can be an ally in the fight against cybercrime and in enabling business operations, but it can also become an adversary if left unchecked. As we race toward a future shaped by AI, securing our systems against its darker side should be a top priority.

ABOUT THE EXPERT

Aras Nazarovas is an Information Security Researcher at Cybernews, a research-driven online publication. Aras specializes in cybersecurity and threat analysis. He investigates online services, malicious campaigns, and hardware security while compiling data on the most prevalent cybersecurity threats. Aras along with the Cybernews research team have uncovered significant online privacy and security issues impacting organizations and platforms such as NASA, Google Play, and PayPal. The Cybernews research team conducts over 7,000 investigations and publishes more than 600 studies annually, helping consumers and businesses better understand and mitigate data security risks. 

Previous Cybernews research: 

  1. Recently, Bob Dyachenko, a cybersecurity researcher and owner of SecurityDiscovery.com, and the Cybernews security research team discovered an unprotected Elasticsearch index, which contained a wide range of sensitive personal details related to the entire population of Georgia. 
  2. The team analyzed the new Pixel 9 Pro XL smartphone’s web traffic, and found that Google’s latest flagship smartphone frequently transmits private user data to the tech giant before any app is installed.
  3. The team revealed that a massive data leak at MC2 Data, a background check firm, affects one-third of the US population.
  4. The Cybernews security research team discovered that 50 most popular Android apps require 11 dangerous permissions on average.
  5. They revealed that two online PDF makers leaked tens of thousands of user documents, including passports, driving licenses, certificates, and other personal information uploaded by users.
  6. An analysis by Cybernews research discovered over a million publicly exposed secrets from over 58 thousand websites’ exposed environment (.env) files.
  7. The team revealed that Australia’s football governing body, Football Australia, has leaked secret keys potentially opening access to 127 buckets of data, including ticket buyers’ personal data and players’ contracts and documents.
  8. The Cybernews research team, in collaboration with cybersecurity researcher Bob Dyachenko, discovered a massive data leak containing information from numerous past breaches, comprising 12 terabytes of data and spanning over 26 billion records.
  9. The team analyzed NASA’s website, and discovered an open redirect vulnerability plaguing NASA’s Astrobiology website.
  10. The team investigated 30,000 Android Apps, and discovered that over half of them are leaking secrets that could have huge repercussions for both app developers and their customers.

Leave a comment »

« Older Entries
Newer Entries »