By Martin Kraemer, CISO Advisor at KnowBe4
In late September 2025, several European airports reported significant delays and flight cancellations due to issues with their check-in and passenger systems. Collin’s Aerospace, the vendor of the vMUSE check-in system, had been hit by a ransomware attack.
Collins Aerospace operates ARINC AviNet, a virtual environment that hosts their ARINC vMUSE ground system for customers. Attackers exploited vulnerabilities in the ground system and its proprietary network, resulting in significant operational delays, reputational damage, and a loss of passenger trust. It is believed that the attackers accessed the shared AviNet network and subsequently encrypted portions of the ARINC Multi-User System Environment (vMUSE).
Strategic Lessons for Executives
Despite comprehensive regulations like NIS2, most organizations significantly underestimate the security risks stemming from a lack of visibility into their vendors’ security posture. Vendor risk management is not merely a compliance checkbox but a strategic issue of resilience, as this incident demonstrates how a third-party ransomware attack can ripple across entire ecosystems.
The incident was likely a result of security negligence. Researchers discovered several outdated systems (IIS 8.5, Glassfish 2014, Oracle 2015, and end-of-life Cisco ASA devices) that presented predictable vulnerabilities for attackers. Legacy systems represent not just technical debt but also significant business continuity risks. Therefore, modernization programs and operational investments must be integrated.
The effort airports invest in continuity planning was evident as fallback procedures were successfully invoked. While fallback was available, it proved highly disruptive. Furthermore, when experts attempted to restore the software, they were re-infected, indicating the ransomware was still present on the system. This highlights that detection, response, and recovery must be considered as a holistic process.
The incident clearly underscores the need to elevate cyber risk to the board level. The outage affected passenger experience, operational continuity, and brand reputation.
Strategic Imperatives
Supply chain security requires visibility, not just assurances, to mitigate the ripple effects when a vendor is compromised. Security assurance from vendors must evolve beyond simple checkbox exercises to in-depth analysis of their practices and configurations. Merely documenting compliance with ISO 27001, NIST, and NIS2 will no longer suffice. As high-impact cyber-attacks persist, organizations, especially those in critical infrastructure, will demand greater visibility and transparency from their vendors. When it comes to maintaining a country’s operations, the focus must shift from minimizing liability to ensuring continuity.
In sectors where legacy systems are prevalent, rigorous legacy management is essential. For systems with unpatchable vulnerabilities, compensating controls must be implemented, and a phased retirement of high-risk systems must be planned. Legacy systems are common in critical infrastructure, often deemed essential for continued operations and complex to replace. Without proper monitoring and maintenance, outdated systems and missing patches, as seen in cases like Collin’s Aerospace, will expose an organization’s vulnerabilities.
Strengthening supply chain governance is a critical step forward. Organizations should map out dependencies, conduct joint exercises, and establish contractual obligations for security monitoring. Developing resilience by design is the optimal approach. Investments in redundancy, the development and testing of rapid recovery processes, and regular crisis simulations are valuable tools for organizational preparedness.
Conclusion
Organizations in critical infrastructure must immediately stop prioritizing liability reduction which compliance requirements often falsely are interpreted as. Instead, nation-states must incentivize business continuity and offer guidance and oversight to small and medium businesses that cannot afford to develop their own resilience functions. Incentives must be structured so that organizations perceive expensive cybersecurity investments as worthwhile, leading to greater risk reduction and fewer losses.
This approach is crucial for improving supply chain risk management in critical infrastructure, where adversaries are likely to exploit weaknesses. Policymakers must advocate for stronger regulatory oversight and shared responsibility models, particularly in aviation. Executives must view cybersecurity as a strategic business enabler, rather than a technical afterthought.

















Google and Spotify alumni launch Epiminds with $6.6M to build marketing teams for the AI era
Posted in Commentary with tags Epiminds on October 14, 2025 by itnerdBrilliant marketers are still buried in dashboards, spending more time on reports and clicks than on strategy and creativity. Epiminds was created to solve this problem. The company, founded by Swedish entrepreneurs Elias Malm and Mo Elkhidir, today announced its public launch from stealth alongside $6.6 million in funding led by Lightspeed Venture Partners with participation from EWOR, Entourage, and high-profile angels including the former CMO of Booking.com. In just twelve weeks from ideation, Epiminds already signed major agencies that manage over 240 brands in their platform.
Agencies today are squeezed from both sides: clients demand more transparency, faster reporting, and measurable ROI – all with smaller budgets. Inside agency walls, insights are scattered across platforms, making decisions slow or reliant on gut instinct, while the rapid rise of AI creates uncertainty about which tools to adopt and how to scale capacity sustainably. The traditional fixes – hiring more specialists, layering on dashboards and optimizers, or making reactive choices once problems surface – only raise costs and complexity without solving the underlying inefficiency. Worse, they don’t prepare agencies for where the future of marketing is heading. Epiminds solves each of these problems, and more.
The company creates advanced multi-agent AI systems that agencies can train and evolve over time. At the core is Lucy, an AI marketing manager that leads a dynamic team of more than 20 specialized agents working together across reporting, optimizations, budget pacing, bidding and creatives. Agencies can onboard a client in less than 30 seconds and instantly get an AI-powered marketing team capable of running campaigns from A to Z. Lucy and her team doesn’t just surface insights but executes them, learns each agency’s playbooks, and proactively monitors accounts to flag risks before they hurt performance.
“Marketers are under more pressure than ever to do more with less ,” said Mo Elkhidir, Co-Founder of Epiminds. “Lucy and her team take on the busywork so that marketing talent can do their best work. This is not about replacing creativity; it’s about giving it room to flourish.”
The vision was born out of the founders’ own frustrations. Malm, who ran an agency and later worked at Google leading agency partnerships across the Nordics, saw firsthand how talented teams were stuck in inefficient processes. Elkhidir, a Sudanese-born machine learning expert who led technical teams at Spotify and Kry, spent years researching multi-agent systems, teaching AI agents to collaborate to solve complex tasks. The spark came during a weekend project simulating Sweden’s 10.8 million citizens in AI, each with hundreds of attributes. When they discovered that 23,400 of them were marketers, the idea crystallized: an AI-powered marketing workforce that could free real marketers to focus on strategy and creative impact.
The impact is already visible. Agencies using Epiminds report faster onboarding, better performance, less wasted spend, and teams that can shift focus back to creativity and strategy. The dynamic multi-agent system seamlessly handles everything from everyday tasks like reporting and pacing to advanced capabilities such as audits, creative analysis, competitive insights, and strategic planning. By connecting insights to action across platforms, Lucy enables a 10x increase in output without adding headcount.
The timing is crucial in filling a big market gap. Legacy dashboards and optimization tools remain siloed, requiring heavy manual work. Point AI tools solve one-off problems but fail to orchestrate the bigger picture. Epiminds’ multi-agent approach creates an integrated, adaptive system that continuously learns and improves.
After just twelve weeks of joining EWOR, which has a a 0.1% application success rate, Epiminds signed major agencies managing over 240 brands on their platform.
Looking ahead, Epiminds plans to expand Lucy’s capabilities across more integrations, increase level of autonomy, and self-improving capabilities. Each new feature strengthens the entire system, creating a network effect where every agency benefits from smarter, more capable AI.
Leave a comment »