Ransomware DataBreachToday.com

As AI Moves Onto the PC, the Bill Splits Across Cloud, Hardware and IT Budgets
Microsoft and Nvidia want more enterprise AI to run on the PC. That changes not just where inference happens, but who pays for it and who can see it. As cloud token costs give way to hardware, maintenance and security expenses, enterprises face new challenges in tracking total AI spending.

Identity Governance and Vulnerability Remediation Startups Draw Unexpected Suitors
Workday's buy of C1.ai, Cohere's purchase of Aisle and OpenAI's reported talks with Trail of Bits highlight how AI providers and enterprise software companies are expanding into cybersecurity, creating new startup exit opportunities while raising questions about competition and partner independence.

ConnectWise Supply-Chain Hack, Rogue AI Agents and Rising AI Token Costs
In this week's panel, four ISMG editors discussed the potentially far-reaching supply-chain attack involving ConnectWise, growing concerns over rogue AI agents, and Microsoft and Nvidia's push to bring AI processing back onto company hardware as enterprises grapple with rising token costs.

Netskope Exec Mike Anderson on Trust, Training and Change Management
AI adoption can unsettle employees who fear being replaced, even as leaders expect them to use new tools. Netskope CDIO Mike Anderson explains why CIOs should work with HR on communication, training and workflow changes, and where human judgment should remain in automated processes.

GPT-6.1 Sol Suppressed Alerts While GPT-6 Astra Removed Monitoring Integration
OpenAI disclosed two October incidents in which GPT-6 agents suppressed misalignment monitoring alerts and removed safety controls during coding tasks, exposing oversight weaknesses as researchers investigate why agents interpret routine instructions as permission to disable safeguards.

UK Proposes Crisis Powers Over Cable Operators and Up to 14 Years for Sabotage
Security analysts say Washington should update its 1888 undersea cable law after London proposed letting ministers direct cable operators in a crisis and imposing prison terms of up to 14 years for sabotage - though some doubt tougher penalties would deter Russia or China.

The C5ISR Imperative for Securing Critical Infrastructure Against Emerging Threats
As critical infrastructure becomes increasingly dependent on satellite communications and autonomous systems, cyberthreats and electromagnetic signals pose big risks. C5ISR-based security, multi-orbit connectivity and AI-driven detection can help strengthen resilience across the spectrum.

US Wants to Replace Legacy Systems But Asian Regulators Favor Containment Strategy
U.S. federal agencies have filed their post-quantum migration plans. The more consequential directive relates to legacy systems that can't be migrated. Organizations must prioritize them for replacement or decommissioning. So far, Asia-Pacific regulators haven't taken a similar stance.

Deal Would Broaden Datadog's Capabilities Across Cloud, Application and AI Security
Rising cloud security star Upwind finds itself at a crossroads. Down one path is a $300 million cash infusion from Bessemer Venture Partners. Down the other is a $4 billion sale to New York-based observability and security platform Datadog. Each path carries risks and opportunities.

Metr and Redwood Uncover Codex Safeguard Bypasses, OpenAI Says Flaws Now Patched
Third-party artificial intelligence safety evaluators found several vulnerabilities in OpenAI's monitoring system for its coding agents, showing how easy it is to bypass the monitoring. Metr and Redwood Research stress-tested OpenAI's internal misalignment monitoring system from July 21 to Aug. 11.

Microsoft Ties Storm-0940 to Automated Intrusions Across Hundreds of Targets
Microsoft linked the ConnectWise supply chain compromise to China-aligned Storm-0940, which used the open-source Artex agentic AI framework to automate credential attacks, abuse trusted cloud applications and attempt access to more than 2,250 customer tenants at machine speed.

Medical Testing Lab Told SEC Incident Likely Compromised 'Certain Patient Records'
Medical testing company Quest Diagnostics has told the U.S. Securities and Exchange Commission that it's responding to a cyber incident involving its Quanum LSM system, used by healthcare providers to place lab test orders, receive and look up lab results.

Dragos Has Learned That 'Free' Doesn't Always Mean 'Usable'
Dragos, a pioneer in the operational technology security market, and its new backer, consulting giant Accenture, are teaming up with the Sans Institute training provider and Elastic to offer $10 million worth of free OT cybersecurity support to small and rural utilities.

Test Projects Focus on AI-Enabled Drug Prescriptions, Physical Therapy Treatment
Utah has given the green light for three more healthcare technology companies to test out how their AI systems can safely provide services such as prescribing and refilling certain medications and providing AI-augmented physical therapy plans for specific health conditions.

eMudhra Says It Mistakenly Used Weak Certificates to Sign 8 Intermediary Certs
An Indian certificate authority revoked intermediate certificates after a researcher found it used a private encryption key that was only one byte in length, making it trivial for hackers to recover the key and issue their own fraudulent certs. The issue has the most salience for app developers.

Company Looks to Extend Its Cyber Resilience Roots Into Managed Detection Services
Former WatchGuard CEO Prakash Panjwani is leading Acronis' push to consolidate MSP security spending through open MDR and XDR integrations, AI-driven remediation and technician automation, with plans to expand adoption across 21,000 partners and define an acquisition strategy by early 2027.