AI vs. AI – How Cybercriminals Are Weaponizing Generative AI, and What Security Leaders Must Do

There is a speeding train hurtling down the tracks which is unstoppable, persistent, and accelerating faster than anyone predicted. We all have three choices- be on it, be under it, or stand by and watch it pass us by.  AI and automation are reshaping the battlefield, and cyber criminals are already exploiting these tools to launch attacks at machine speed. From AI-powered phishing and deepfake fraud to autonomous malware that evolves on its own, we are witnessing a new era where traditional security defenses are rapidly becoming obsolete.

According to the World Economic Forum, while 66% of organizations acknowledge that AI will significantly impact cybersecurity, only 37% have established processes to evaluate the security of AI tools before deploying them. This massive gap highlights a critical oversight of whether businesses are integrating AI-driven solutions into their security stacks but are still failing to assess their vulnerabilities. 

Security leaders must decide- Will they adapt and harness AI to fight back, or will they be left scrambling as AI-driven cyber threats overwhelm them? This isn’t just another phase in cybersecurity, it’s an arms race- AI vs. AI. Attackers are using AI to craft undetectable phishing scams, generate deepfake fraud, and automate hacking. The question isn’t whether your organization will be targeted, but whether you’ll be ready when it happens.

So, the choice is clear- Will you board the train, or will it run you over?

The Rise of AI-Driven Cyber Threats

Now, AI-powered phishing emails are grammatically perfect, highly personalized, and nearly indistinguishable from legitimate messages. Attackers leverage AI chatbots to engage victims in real-time, increasing success rates. Meanwhile, deepfake technology enables real-time impersonation of executives and public figures, allowing fraudsters to authorize transactions, manipulate stock prices, and spread misinformation with hyper-realistic voice and video forgeries.

Malware development has also evolved beyond manual coding. AI now enables cybercriminals to generate self-mutating malware that bypasses antivirus software and endpoint protection. Instead of deploying a single attack, AI tests multiple variations in real-time, ensuring at least one version evades detection.

Despite these escalating threats, many organizations remain vulnerable. Legacy security systems struggle to detect AI-generated attacks, while even well-trained employees fall victim to AI-enhanced phishing and deepfake scams. Traditional authentication methods are increasingly unreliable, highlighting the urgent need for AI-driven detection tools to counteract evolving cyber threats. Without proactive AI security measures, organizations risk being outpaced in the AI-driven cyber arms race.

The AI-Powered Security Strategy

To combat AI-driven cyber threats, security leaders must embrace AI as part of their defensive strategy. A proactive, AI-driven security framework can help organizations predict, detect, and neutralize AI-powered attacks before they cause damage.

•AI-Driven Threat Intelligence- Anticipating Attacks Before They Happen

Security teams must shift from a reactive security model to a predictive one, leveraging AI-driven threat intelligence to identify emerging threats before they strike. AI can analyze massive datasets in real time, detecting patterns and anomalies that indicate potential cyberattacks.

By integrating AI-powered analytics, security teams can anticipate and neutralize attacks proactively rather than responding after the damage is done.

•Automated Irregularity Detection- Spotting the Subtle Signs of AI-Generated Attacks

Traditional security systems struggle to detect AI-powered cyberattacks because they don’t match known threat signatures. AI-powered anomaly detection systems, however, can identify suspicious behavior in real time.

For example, AI can flag an unusual login attempt from an employee who appears to be in two different locations within minutes, indicating a potential credential compromise. By continuously learning from user behavior, AI-driven security systems can detect subtle anomalies that indicate an attack.

•Combative AI- Fighting AI With AI

To counter AI-powered threats, organizations must leverage adversarial AI—AI models designed to detect and disrupt malicious AI-generated attacks. By training AI systems to recognize AI-generated phishing attempts, deepfake fraud, and evolving malware, enterprises can stay one step ahead of cybercriminals.

Combative AI works by introducing deceptive signals that mislead malicious AI models, disrupting cybercriminal operations before they reach their targets.

Employing AI for Cybersecurity Dominance

AI is both a powerful tool and a formidable threat in the cybersecurity landscape. To stay ahead, security leaders should embrace AI-driven threat intelligence, automate anomaly detection, and deploy adversarial AI techniques. The future of cybersecurity is about defending against AI and using AI to outthink and overcome attackers in the security arms race.

By leveraging AI to its fullest potential, organizations can turn the tide against AI-powered cybercrime and secure their digital assets in an increasingly automated world.

 

The post AI vs. AI – How Cybercriminals Are Weaponizing Generative AI, and What Security Leaders Must Do appeared first on Cybersecurity Insiders.

February 20, 2025 at 07:00PM

Read More

The Human Factor: How Eliminating Human Vulnerabilities Can Stop Social Engineering Fraud

Fraud is becoming more sophisticated, targeting companies with increased precision, especially in two critical areas: Accounts Payable (AP) and Payment Processes.  Both jobs with vendor-facing roles, these employees are prime targets due to their access to funds and ability to approve or modify payments.  

A couple of factors exacerbate the issue. First, these businesses continue to rely on security tools and financial controls that are not only siloed but lack the contextual data needed to detect and prevent these sophisticated attacks, which, according to the FBI, cost organizations $1.5 million each on average (source: FBI). 

Next, attackers have upped their tactics in a few key ways:

• They have begun infiltrating businesses from multiple angles, including through vendor accounts, where they leverage layers far beyond the organization’s day-to-day visibility (those people they interact with regularly).
• They are creating more sophisticated capabilities for evading security and setting off new risk thresholds, which include the greatest threat to payments today: social engineering.  

Cybersecurity’s Biggest Threat

Social engineering, which includes deepfakes, is the most prevalent form of attack. Research found that 90% of cyberattacks in 2024 involved social engineering tactics. And it’s not just about frequency. Through the power of AI, these attacks are becoming increasingly more costly.  In its Digital Fraud: The Case for Change report, Deloitte states that the “rapid expansion of AI and GenAI tools provides the resources for bad actors to scale their attacks, both on the financial institutions and directly to their customers.” The report says that “the proliferation of GenAI tools could enable fraud losses to reach US$40 billion in the United States by 2027, up from US$12.3 billion in 2023.”

The Lifecycle of Fraud: How Social Engineering Exploits Each Stage

When it comes to fighting back, a key element is to understand the many ways attacks are coming at your business. Here are examples.

Deepfake Impersonations:  Fraudsters frequently leverage deepfake impersonations to craft emails, videos, and other communication that convincingly appear to be from senior executives of Financial Times Stock Exchange (FTSE) companies. The goal of these efforts is to convince the employee to transfer substantial funds. While these attacks can impersonate people on all levels, selecting more senior executives is far more effective since employees naturally trust leadership and are often inclined to bypass standard review protocols for what looks like significant matters. The FBI’s Internet Crime Complaint Center (IC3) reported $2.95 billion in losses from BEC scams in 2023.

To turn up the heat on these attacks, fraudsters often add a layer of pressure. They might claim a payment is overdue or tied to a critical deadline, such as finalizing an acquisition. In extreme cases, they may threaten disciplinary action or other penalties to push employees into bypassing established protocols. This tactic preys on the human desire to avoid conflict or negative repercussions, especially when the request comes from a high-ranking authority.

AI-Generated Phishing: Attackers leverage AI to gather and analyze vast data about their targets. This includes information from social media profiles, public records, and leaked data from breaches. As a result, cybercriminals can understand the target’s behavior, preferences, and potential vulnerabilities. From there, they can craft highly personalized and convincing phishing emails that not only mirror the person’s writing style but leverage other details, such as a recent event, making them more effective and harder to detect. And these aren’t one-off campaigns. Thousands of these messages can be sent out simultaneously, targeting an extensive audience.

Fake Invoices in Payment Initiation: The payment lifecycle begins with the initiation when a vendor submits an invoice for goods or services rendered. As mentioned earlier, larger businesses have small teams processing large piles of invoices every day. For many criminals, the initiation phase is the ideal time to launch a social engineering attack using vendor impersonation schemes. 

Here, fraudsters, posing as legitimate vendors, use fake invoices to initiate payments. Sometimes, they intercept genuine invoices, altering minor details such as bank account numbers or payment amounts, and resubmit them for processing. Thanks to small teams that are stretched thin, meticulous scrutiny is not an option, which is precisely why fraudulent invoices can slip through undetected, leading to significant financial losses.

Account Takeovers and Payment System Manipulation:  At the processing stage, fraudsters leverage stolen credentials obtained through phishing attacks or data breaches to gain unauthorized access to payment systems. Once inside, they impersonate legitimate users, modifying payment instructions or creating fraudulent transactions for work that was never done. In automated systems like Automated Clearing House (ACH) transfers, attackers may manipulate payment templates or schedules to redirect funds into their accounts. These subtle changes can often go unnoticed until the damage is done.

Strengthening Defenses: Combating Social Engineering at Every Stage

For businesses fighting back, here’s the first step: Stop viewing social engineering solely as an email security threat. These attacks extend far beyond email, infiltrating the entire payment process and targeting systems, workflows, and data across the organization. 

With this understanding, it’s time to implement a multi-layered defense strategy that addresses vulnerabilities across the payment lifecycle to protect against social engineering and other fraudulent tactics. Some key elements of this approach include:

• Comprehensive Contextual Insight: Seamlessly integrating email, payment, and vendor behavior data so that your team can detect irregular patterns across the entire process.
• Proactive Monitoring of High-Risk Roles: While everyone at a business can be a target, it’s vital that systems are actively monitoring and securing those roles with access to funds, such as finance, executives, and vendor-facing employees. 
• Adaptable AI-Driven Detection: Just as fraudsters are turning to AI, so should you. Start leveraging advanced AI tools to analyze patterns, detect anomalies, and recognize synthetic threats like deepfakes or real-time voice manipulation. These tools are not static. They continuously learn from new attack methods, enabling real-time identification and prevention of emerging threats. 

While forms of social engineering have existed for some time, the latest variety of attacks demonstrates an evolution in techniques that are unlike what came before. These methods will continue to evolve and leverage psychological manipulation to exploit weaknesses in the payment lifecycle. From fake invoices and account takeovers to executive impersonation and high-pressure tactics, these schemes are designed to capitalize on human error and trust to get their hands on your company’s money. 

But companies are not without recourse. Fighting back begins with understanding the vulnerabilities at each stage of the payments lifecycle and implementing a comprehensive defense strategy that includes key elements, such as comprehensive contextual insight, proactive monitoring of high-risk roles, and adaptable AI-driven detection. With the right approaches and innovative solutions, organizations can protect themselves from these sophisticated threats and whatever comes in the future.

__

Shai Gabay Bio

A visionary entrepreneur, Shai Gabay has always held a deep passion for cybersecurity and fintech, and over the course of his career, he has developed his expertise in both areas. Currently, Shai is a co-founder and the CEO of Trustmi, a leading end-to-end payment security platform founded in Israel in 2021. Prior to Trustmi, he was General Manager at Opera, VP of Product and Services at Cynet, CIO at Cyberbit and the CISO at Discount Bank.

Shai holds a Bachelor’s Degree from Shenkar College in software engineering, and also a Master’s degree in Business Administration and Management from Tel Aviv University.  Additionally, Shai was selected for the prestigious 1-year full scholarship executive excellence program at the Hoffman Kofman Foundation, a program tailored to outstanding alumni of IDF’s Elite Units. Through this program, he had the opportunity to study with prominent co-founders and leaders at renowned global tech companies and professors at elite universities.

 

 

The post The Human Factor: How Eliminating Human Vulnerabilities Can Stop Social Engineering Fraud appeared first on Cybersecurity Insiders.

February 20, 2025 at 06:24PM

Read More

State of Secure Network Access 2025

Exploring the Future of SASE, SSE, Zero Trust, and Hybrid Security Strategies

Overview

As organizations continue to manage increasingly sophisticated IT environments and widespread hybrid work models, the demand for secure, scalable network access remains a top priority. This 2025 Secure Network Access Report, based on insights from 411 IT leaders and cybersecurity professionals, explores the trends, challenges, and strategies that are shaping secure access today.

Key findings:

SASE Urgency Required: With 32% implementing, 31% evaluating, and 24% planning SASE adoption within the next year, momentum is building. However, with only 8% fully deployed, slow progress leaves organizations vulnerable, making it critical for distributed workforces to prioritize SASE for stronger security.

Remote Access as a Top Driver for SASE: 45% of participants identified secure remote and hybrid access for employees as their primary driver for adopting SASE solutions. This focus is vital, as 42% of respondents noted employees as the user group posing the greatest risk to business security. Traditional Virtual Private Networks (VPNs) often increase these risks, causing high latency, reduced performance, and inadequate security. SASE mitigates these issues with technologies like Software- Defined Wide Area Networks (SD-WAN), optimizing traffic flow and performance while ensuring secure, seamless access for remote and hybrid employees.

Zero Trust on the Rise: With 38% of organizations currently implementing Zero Trust and another 42% planning to do so within the next year, this security model has become a key focus for managing access in distributed environments and reducing insider threats.

Challenges in SASE Implementation: 48% of respondents pointed to integration with existing systems as the most significant barrier to adopting SASE. Policy management across different environments (44%) and user disruption during transitions (38%) were also identified as common challenges. Managed services help address these integration challenges by connecting existing infrastructure with SASE components, ensuring minimal disruption and faster time-to-value.

Leveraging MSSPs to Address Expertise Gaps: 47% of respondents cited lack of in-house expertise as the primary reason for turning to Managed Security Service Providers (MSSPs). Partnering with MSSPs can help streamline complex deployments like SASE, offering the expertise needed for seamless integration, improved network visibility, and reduced costs through a unified approach to security and performance.

This report provides in-depth analysis of these trends, alongside actionable recommendations for overcoming the challenges of SASE and Zero Trust implementation.

We extend our thanks to Hughes for supporting this critical research project. Their commitment to advancing secure access solutions has made this comprehensive analysis possible.

We hope that the insights provided in this report will guide your efforts to enhance security and protect your organization against evolving threats.

Holger Schulze

Founder, Cybersecurity Insiders

A Message from Hughes

Traditional IT approaches are a thing of the past as organizations navigate new and emerging technologies, workforce structures, and AI-driven cyber threats. In a world where the workforce is often distributed—and connected by cloud and other remote software solutions—securing a scalable network has never been more important. Cybersecurity as we know it is evolving, and we must evolve with it.

Thank you to all involved in this important research. As cybersecurity threats and technologies evolve, new partnerships and creative strategies will determine success and an organization’s ability to secure their workforce and safeguard their performance now and in the future.

Dan Rasmussen

SVP & GM, North America Enterprise Division, Hughes

Workforce Dynamics in a Hybrid World

The shift toward hybrid and remote models fundamentally impacts how cybersecurity strategies are deployed, particularly in securing network access, preventing insider threats, and managing distributed data environments.

With 63% of organizations now embracing a hybrid work model, maintaining secure access across a blend of remote and in-office environments has become increasingly critical. 19% of respondents operate fully remotely, further emphasizing the need for secure endpoint solutions and VPN alternatives.

Given the distributed nature of workforces, solutions like Security Service Edge (SSE) platforms offer layered protections, combining Zero Trust Network Access (ZTNA), Secure Web Gateway (SWG), and Cloud Access Security Brokers (CASB) to prevent data loss and ensure secure access. Managed Secure Access platforms are particularly valuable in simplifying these processes, providing centralized security management while ensuring high network performance.

Zero Trust Adoption: A Strategic Imperative

As organizations continue to face growing cyber threats, the adoption of Zero Trust security strategies has become increasingly critical for safeguarding networks, users, and data. Zero Trust, a framework that emphasizes continuous verification of identities and devices, has rapidly gained traction as a core security model for organizations aiming to reduce risk across their environments.

According to the survey, 42% of respondents are planning to implement Zero Trust within 12 months, showing that a significant number of organizations are in the early stages of their Zero Trust journey. 38% are currently implementing Zero Trust solutions, reflecting the urgency many organizations feel in transitioning to this security framework. The fact that 12% are still exploring Zero Trust concepts without concrete plans suggests that while awareness is high, some organizations are still evaluating how best to integrate these strategies into their infrastructure.

For organizations yet to adopt or fully implement Zero Trust, focusing on areas like Identity and Access Management (IAM), network micro-segmentation, and continuous monitoring can provide immediate security improvements. Leveraging integrated Zero Trust solutions through managed service providers can further streamline adoption and reduce the complexity of deployment, ensuring a smoother transition while addressing the most critical security gaps.

Securing Access to Critical Business Resources

As organizations continue to adopt cloud services and remote work, securing access to essential business resources has become one of the most pressing cybersecurity challenges. The survey asked which resources are most difficult to secure, underscoring the complexities of managing distributed infrastructures while maintaining consistent security.

The results show that 52% of respondents find remote network connectivity (e.g., VPNs) to be the most challenging to secure. This reflects the inadequacies of legacy VPNs in handling scalable and secure connections for dispersed teams as the backhauling of traffic to remote data centers introduces high latency and reduced performance, along with significant security vulnerabilities.

50% cited SaaS applications like Microsoft 365, highlighting the difficulty of enforcing data governance and access control across cloud-based services. Similarly, 49% noted the challenge of securing remote endpoints (e.g., laptops, mobile devices), emphasizing the risks associated with unmanaged devices operating outside of controlled environments.

Additionally, securing internal applications (46%) and cloud infrastructure (45%) remains complex as companies adopt hybrid cloud environments where security policies must span multiple platforms. To address these challenges, organizations should consider using flexible, scalable platforms that unify security across remote networks, SaaS, and endpoint devices. SASE platforms help eliminate the need for traditional VPNs, providing secure, direct access to cloud and on-prem applications through SDWAN and ZTNA, without compromising performance.

Managing Secure Access: Complexity and Visibility Gaps

As organizations scale their operations and embrace a mix of cloud, on-premises, and remote infrastructures, managing secure access has become more challenging.

The most pressing issue, reported by 23% of respondents, is the complexity of managing access policies across multiple platforms. This highlights the strain organizations face when trying to maintain consistency across fragmented systems. Similarly, 16% cited rising costs related to scaling capacity and bandwidth. Lack of visibility into user activity (14%) is another critical issue, as gaps in monitoring can leave organizations vulnerable to undetected threats, especially as cloud use grows.

Additional challenges include inflexible technologies that struggle to support mixed environments (11%) and excessive user privileges (10%), both of which can expose organizations to risks. Less frequently mentioned but still relevant concerns, like latency and integration issues, signal the persistent technical difficulties organizations face with legacy systems.

To address these challenges, organizations should turn to integrated platforms like SSE, which streamline policy enforcement across various environments and provide real-time visibility into user activities. Investing in cloud-native solutions with built-in scalability and adopting Zero Trust principles can significantly reduce complexity, ensuring security controls evolve alongside business needs. Additionally, focusing on technologies that provide granular user access control can help prevent privilege misuse while maintaining flexibility in policy enforcement.

Filling Strategic Gaps with MSSPs

The inherent challenges of cybersecurity threats and the rapid evolution of attack methods have left many organizations struggling to maintain sufficient in-house defense capabilities. This challenge drives the need for strategic partnerships with MSSPs, enabling companies to fill critical skill gaps and access advanced security solutions that would otherwise be beyond their internal capacity.

The survey shows that 47% of respondents identified lack of in-house expertise as a key reason for turning to MSSPs. This highlights a common issue: many organizations, despite their investment in cybersecurity, lack the deep, specialized skills needed to manage complex security tasks at scale.

In response, 46% of participants seek external access to specialized skills or expertise, recognizing that third-party providers can offer capabilities such as advanced threat detection and response that would be costly or impractical to build internally. Enhanced incident response capabilities (44%) and proactive threat detection (43%) were frequently cited, reflecting the importance of having robust, responsive measures in place to mitigate sophisticated attacks.

For security teams, leveraging MSSPs can provide much-needed flexibility and scale, enabling a stronger defense without overwhelming internal resources. However, organizations should look for providers that integrate seamlessly with their existing security architecture, offering proactive services such as threat intelligence and automated incident response. By doing so, they can enhance their security posture while maintaining agility and focusing on strategic initiatives.

 

Growing SASE Adoption and Urgency

As digital transformation accelerates and IT environments evolve, the need for a unified, cloud-centric approach to secure network access has intensified.

According to the survey, 32% of respondents are currently implementing SASE solutions, reflecting the growing momentum toward adopting this architecture. An additional 31% are currently evaluating SASE solutions. Combined with those planning to implement within the next year (24%), it’s critical that these organizations prioritize SASE solutions quickly in order to maintain security.

Despite strong interest, only 8% of organizations have fully implemented SASE, highlighting the complexity and gradual nature of this transition. This slow progress leaves organizations vulnerable as threat actors accelerate their tactics, striking with unprecedented speed and sophistication.

Given the growing adoption rate, organizations should focus on integrating SASE components, prioritizing technologies like ZTNA, SWG and Cloud Security Access Brokers (CASB) that provide immediate security benefits for cloud and remote work environments. Partnering with managed service providers that specialize in SASE deployment can further accelerate the process and help overcome integration challenges, allowing businesses to leverage the scalability, flexibility, and comprehensive security capabilities that SASE offers.

The Drivers Behind SASE Adoption

The survey reveals key factors driving the adoption of SASE solutions, which continue to gain traction as organizations modernize their security and networking infrastructures. 45% of respondents point to secure remote access for a distributed workforce as the leading driver, highlighting the ongoing need to safeguard access for remote and hybrid workers.

42% of respondents cite the need to enhance cloud security and visibility, showing that as businesses migrate to the cloud, maintaining control over data and securing access points remain significant challenges. Meanwhile, 40% express a desire to implement a Zero Trust security model and simplify their network and security architecture, indicating that organizations want to consolidate complex infrastructures and adopt continuous verification principles. Other notable factors include improving network performance (39%) and achieving cost savings through consolidation of tools (38%).

To capitalize on these drivers, organizations should focus on deploying SASE platforms that integrate Zero Trust principles with unified security across cloud and remote environments. By enhancing visibility and optimizing network performance, SASE offers a comprehensive approach that simplifies operations and strengthens security, making it essential for companies undergoing digital transformation.

Benefits Driving SASE Adoption

The survey results reveal a clear set of priorities driving organizations to adopt SASE solutions, reflecting the wide-ranging benefits that this architecture brings to both security and network management.

54% of respondents report an enhanced security posture, showing that organizations prioritize SASE’s ability to integrate security directly into the network, thereby reducing vulnerabilities. 52% value the simplified management of security and networking functions, reflecting SASE’s consolidation of tools and reduced complexity in managing hybrid infrastructures.

50% of respondents noted enhanced productivity and secure access for remote workforces as key benefits, underscoring the importance of seamless, secure access for distributed teams. Improved application performance and bandwidth optimization was highlighted by 49%, pointing to SASE’s ability to use SD-WAN for intelligent traffic routing.

Organizations can fully leverage these benefits by prioritizing SASE deployments that unify network and security functions, enhancing scalability and reducing operational overhead. This approach not only strengthens security but also supports productivity and optimizes network performance, aligning with broader digital transformation efforts.

Key Challenges in Implementing SASE

Organizations adopting SASE face a variety of challenges, especially as they attempt to integrate these solutions into their existing infrastructure. 48% of respondents identified integration with existing systems as their biggest challenge, underscoring the difficulty in aligning legacy infrastructure with modern, cloud-native architectures. 44% also reported struggles with policy management across multiple environments, reflecting the challenge of ensuring consistent security controls across on premises, cloud, and remote work settings.

Operational and transitional issues are also significant, with 38% concerned about user disruption during transition and 37% struggling to phase out legacy security tools. These challenges are further compounded by a lack of in-house expertise (37%), as many organizations don’t have the skill sets needed to effectively manage SASE deployments at scale.

To mitigate these issues, organizations should focus on identifying specific integration points where SASE can provide immediate value, such as enhancing cloud security visibility or improving remote access management. Partnering with SASE providers that offer built-in integration, APIs, and automation features can reduce the burden of policy management and limit downtime.

SASE Components Adoption

Understanding which components of SASE organizations are prioritizing offers valuable insight into how they are modernizing their security strategies. The key component, SD-WAN has been implemented or planned by 52% of respondents, highlighting its role in optimizing network performance for distributed environments. ZTNA follows closely at 49%, reflecting the importance of Zero Trust principles in securing remote access. 47% have adopted SWG, emphasizing the need for securing web traffic and enforcing policies.

FWaaS at 45% reflects a clear shift towards cloud-delivered security, while CASB (Cloud Access Security Broker) at 41% underscores the need for securing cloud applications more robustly.

To succeed in SASE implementation, organizations should focus on deploying high-impact components like SD-WAN and ZTNA first. Simplifying management by consolidating these services into integrated platforms will reduce complexity and improve scalability. Partnering with managed service providers that offer seamless integration can help ease the transition while ensuring ongoing optimization.

SASE Management Models

The decision of how to manage an SASE deployment often reflects an organization’s need to balance control with complexity and availability of skilled resources. 46% of respondents favor a co-managed approach with an MSP, indicating a common strategy of retaining oversight while leveraging external expertise for operational management. This model helps bridge internal capability gaps without fully relinquishing control over the infrastructure.

Meanwhile, 32% opt for fully managed SASE by an MSP, suggesting that many organizations prefer outsourcing to simplify their SASE deployment and management, especially those with limited resources. 16% manage SASE in-house, likely representing larger organizations with strong internal IT and security expertise.

Organizations should align their management model with their overall security strategy and internal resources. A co-managed approach provides flexibility, while outsourcing to MSPs ensures technical expertise and scalability, especially when internal teams are limited.

Key SASE Use Cases for Organizations

Understanding the most relevant use cases for SASE can help organizations prioritize deployment strategies based on their unique networking and security needs.

According to the survey, 52% of respondents consider secure remote and hybrid access for employees the most relevant use case, driven by the need to protect distributed workforces and access scenarios. Access and security for cloud applications ranked next at 47%, reflecting the increasing reliance on SaaS platforms and the growing importance of cloud security. Simplifying WAN infrastructure and management (45%) highlights the push to streamline network operations as organizations transition to SD-WAN.

Other key use cases include secure internet access (42%) and ZTNA (40%), both of which focus on securing user traffic and identities across network environments.

To fully leverage these use cases, organizations should deploy SASE solutions that address secure access for remote work, cloud services, and WAN management, ensuring seamless security and consistent policy enforcement across all IT environments.

SASE and SSE: Distinct Roles in Unified Security

Many cybersecurity professionals wonder how SASE and SSE differ, as both play critical roles in securing today’s complex, distributed environments.

SASE and SSE share common goals in modern cybersecurity architectures but differ in scope and focus. Both aim to unify and simplify security for distributed networks, yet while SASE encompasses networking and security functions, SSE focuses solely on the security side.

SASE

Combines security with network optimization by integrating technologies such as SDWAN and Zero Trust Network Access (ZTNA) with Secure Web Gateway (SWG), Firewallas-a-Service (FWaaS), and Cloud Access Security Broker (CASB) within a single, cloudnative framework. This approach enables organizations to secure remote access while ensuring optimal network performance.

SSE

As a subset of SASE, narrows the focus to security controls—specifically SWG, CASB, and ZTNA—without incorporating networking aspects like SD-WAN. SSE is ideal for organizations prioritizing security and access control, often working in tandem with existing network solutions.

In essence, SASE is suited for organizations needing a unified, end-to-end network and security approach, while SSE serves those focused on strengthening security postures in existing network frameworks. Both models help enforce Zero Trust principles and offer centralized management, enhancing scalability and control in cloud-centric, distributed environments.

SSE Adoption: A Path to Enhanced Security

Understanding the adoption of SSE offers insight into how organizations are securing cloud access and enforcing consistent security policies across increasingly distributed environments.

According to the survey, 41% of respondents are planning to implement SSE within 12 months, showing that many organizations are still in the evaluation or preparation phase. This suggests that while interest in SSE is high, full deployment remains a future priority for many. 33% are currently implementing SSE, indicating that a significant portion of organizations are actively transitioning to this model. Meanwhile, 18% have fully implemented SSE, reflecting that while adoption is underway, few have reached full maturity. Only 8% of respondents report having no plans to implement SSE, likely because they either have alternative solutions in place or are not yet ready to transition to cloud native security.

To accelerate SSE adoption, organizations should consider focusing on specific pain points, such as improving cloud security and ensuring visibility across hybrid work environments. A targeted approach that addresses immediate needs, such as securing remote access or optimizing application performance, can deliver quick wins and drive faster overall implementation. Additionally, aligning SSE deployment with existing business initiatives, like cloud migration or Zero Trust strategies, ensures that the transition integrates smoothly with ongoing projects without overwhelming internal teams.

Key Drivers for SSE Adoption

Identifying the primary reasons organizations are adopting SSE reveals the strategic benefits driving its implementation.

The survey shows that 55% of respondents prioritize enhanced cloud security and visibility as the top driver, reflecting the need to protect cloud environments where traditional security tools fall short. 48% are motivated by implementing Zero Trust strategies, emphasizing the importance of reducing insider threats and improving access control. Simplifying remote access for distributed workforces (45%) highlights the ongoing demand for secure, efficient access solutions.

Additional drivers include simplifying security management (44%) and enhancing scalability (39%), showing the need for flexible solutions that can grow with the business. Improving network performance (37%) and meeting compliance requirements (35%) also rank high, indicating SSE’s ability to reduce latency and enforce consistent security policies.

To address these drivers, organizations should focus on deploying SSE solutions that tackle their most immediate needs first, such as real-time data protection, cloud security, and efficient remote access.

SASE: Optimizing Secure Network Access

As digital transformation accelerates and IT landscapes evolve, the need for a unified, cloud-centric approach to secure network access has intensified. SASE, or Secure Access Service Edge, combines networking and security into a single, cloud-native framework, providing a comprehensive solution that addresses the needs of remote work, cloud migration, and increasingly distributed workforces.

What SASE Offers

SASE architectures bring together essential technologies—such as SD-WAN, Zero Trust Network Access (ZTNA), Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), and Firewall-as-a-Service (FWaaS)—into a cohesive security model designed to operate seamlessly across both cloud and on-premises environments. With strategically placed global points of presence (PoPs), SASE enables consistent and high-performance access to cloud resources and applications by minimizing latency and optimizing traffic flow.

Why SASE Matters

The traditional network security model, focused on perimeter defense, has been disrupted by the growth of hybrid workforces (implemented by 63% of organizations) and the adoption of cloud services. With SASE, remote users gain direct, secure access to applications and data without the need for inefficient traffic backhauling, allowing organizations to maintain control and enforce security policies wherever users and applications are located. Using a unified, cloud-based security infrastructure, SASE simplifies network management and reduces operational complexity by consolidating tools and eliminating redundant infrastructure.

SASE Benefits

1. Performance Optimization: SASE enhances application and network performance by routing traffic through distributed points of presence (PoPs), strategically located data centers, or nodes distributed globally. These PoPs act as on-ramps to cloud services, ensuring minimal latency and maximum efficiency, particularly for remote workers, regardless of their location.

2. Simplified Management: By converging security and networking in a single platform, SASE enables centralized policy control, visibility, and reporting across all environments.

3. Enhanced Security Posture: Integrating technologies like ZTNA, SWG, and CASB into the network enables real-time threat detection and response, ensuring that only trusted users can access sensitive resources.

4. Flexibility and Scalability: Cloud-based delivery provides elastic scalability, which adapts seamlessly to fluctuating bandwidth needs and offers resilience for expanding cloud environments.

5. Reduced Operational Burden: With a managed SASE approach, organizations can offload significant operational demands, focusing internal resources on strategic objectives rather than routine security management.

For organizations facing evolving network demands, SASE offers an adaptable, unified framework that bridges the gap between security and networking while optimizing access to cloud applications and internet services. This approach empowers security teams to enforce Zero Trust principles and simplifies the management of complex, distributed environments.

Next Steps: Best Practices for Secure Network Access

Securing network access across hybrid and cloud environments requires adopting an integrated, multifaceted technology strategy. The following best practices offer a streamlined approach to strengthen security while reducing complexity.

1.DEPLOY SASE FOR UNIFIED SECURITY

With 52% of organizations finding remote network connectivity challenging, SASE integrates key components like SD-WAN and ZTNA to secure remote and hybrid access. Focus on these core components to streamline operations while enhancing security.

2.SIMPLIFY POLICY MANAGEMENT

Managing access policies across multiple environments is a key issue for organizations. Simplify this process with platforms like SASE or SSE, which provide centralized management and realtime visibility.

3.ADOPT A ZERO TRUST SECURITY STRATEGY

Zero Trust continuously verifies users and devices, ensuring secure access. With 42% of organizations planning to implement Zero Trust soon, focus on implementing ZTNA to protect against unauthorized access.

4.ENHANCE CLOUD SECURITY

55% of respondents cited cloud security and visibility as a major driver for SSE. Tools like CASB enforce governance and protection for cloud apps, ensuring data security in distributed work environments.

5.INVEST IN SCALABILITY AND FLEXIBILITY

39% of respondents highlight the need for scalable security solutions. Cloud-based platforms such as SASE offer flexible, scalable security that adapts to growing infrastructures, improving both performance and security.

6.FOCUS ON COMPLIANCE

Meeting compliance needs is critical for 35% of organizations. Integrated platforms like SSE provide built-in compliance controls, helping align security with industry regulations and streamlining audits.

7.LEVERAGE MANAGED SECURITY SERVICES

47% of respondents rely on managed services due to in-house skill gaps. By partnering with MSSPs, organizations can benefit from SASE / SSE expertise, continuous monitoring, and expert threat detection, without overburdening internal teams.

These best practices help organizations address security challenges while supporting flexibility, scalability, and control across hybrid and cloud environments.

Conclusion

As organizations continue to adapt to the demands of increasingly distributed IT environments and heightened security challenges, the findings of this report underscore the critical importance of modern, integrated approaches such as SASE and SSE.

While interest and adoption rates are rising, the complexities of full implementation remain a hurdle. Strategic investments in scalable, cloud-native solutions, along with partnerships that bridge expertise gaps, will be essential in maintaining robust security postures.

By prioritizing flexible architectures and embracing Zero Trust principles, organizations can better position themselves to face evolving threats and ensure secure, seamless access across all environments.

Methodology and Demographics

This 2025 Secure Network Access Report is based on a comprehensive online survey of 411 cybersecurity professionals, conducted in November 2024, to gain deep insight into the latest trends, key challenges, and solutions for secure network access.

The survey utilized a methodology ensuring a diverse representation of respondents, from technical executives to IT security practitioners, across various industries and organization sizes. This approach ensures a holistic and balanced view of the network security landscape, capturing insights from different organizational perspectives.

__

About Hughes

Hughes Network Systems provides broadband equipment and services; managed services featuring smart, software-defined networking; and end-to-end network operation for millions of consumers, businesses, and governments worldwide.

As a Managed Security Service Provider (MSSP), we provide customers with comprehensive security coverage that protects, detects, and responds to modern threats. With an extensive networking background, Hughes Managed Cybersecurity Services provides businesses of all sizes with the convergence of network and security solutions they desire. Top brands in the restaurant, retail, franchise, grocery, c-store & retail petroleum, government, and healthcare industries rely on Hughes for managed network services. Our experience managing large networks gives us a unique advantage when it comes to cybersecurity. We know how to defend networks because we’ve been building customer networks for decades. Customers rely on our proven experience, leading innovation, and top tier customer service delivery.

There is a strong amount of synergy between our services, which include Managed SASE, Managed Detection and Response (MDR), Network Detection and Response (NDR), Ransomware & Zero-Day Prevention, and Unified Threat Management (UTM). Our customers also take advantage of our Managed Network Services, such as Wi-Fi, VoIP, Wireless 5G, Managed LEO, Digital Signage, and more.

Learn how Hughes Managed Cybersecurity can protect your business. Learn more www.hughes.com

__

Cybersecurity Insiders brings together 600,000+ IT security professionals and world-class technology vendors to facilitate smart problem-solving and collaboration in tackling today’s most critical cybersecurity challenges.

Our approach focuses on creating and curating unique content that educates and informs cybersecurity professionals about the latest cybersecurity trends, solutions, and best practices. From comprehensive research studies and unbiased product reviews to practical e-guides, engaging webinars, and educational articles – we are committed to providing resources that provide evidence-based answers to today’s complex cybersecurity challenges.

For more information: email us info@cybersecurity-insiders.com or visit cybersecurity-insiders.com

 

The post State of Secure Network Access 2025 appeared first on Cybersecurity Insiders.

February 20, 2025 at 05:30PM

Read More

Ghost Ransomware targeting Obsolete IT Systems

A joint report from the FBI and CISA has revealed that the Ghost Ransomware group has been targeting businesses running outdated hardware and software. Since 2021, the gang has victimized multiple organizations in over 70 countries, including China.

According to the report from the Multi-State Information Sharing and Analysis Center (MS-ISAC), the ransomware group frequently alters the file extensions of encrypted files and modifies the content of ransom notes. They also change the email addresses used for ransom communication, making it harder to trace their activities and link them to a particular group.

The group’s tactics evolve constantly. For instance, they may focus on attacking healthcare organizations one month, while targeting businesses in tech, education, and manufacturing sectors the next. Additionally, the Ghost Ransomware continuously rebrands itself, complicating efforts to attribute attacks to a specific malware variant. This shifting strategy also makes it challenging to access free decryption keys available online.

Over a four-year period, Ghost Ransomware has been associated with various other malware names, including Cring, Crypt3r, Phantom, Strike, Hello, Wickrme, HsHarada, and Rapture.

Businesses are urged to adopt a proactive approach to cybersecurity to defend against such threats, regardless of the malware or group responsible. Key recommendations include regular backups, timely patching of operating systems, upgrading firmware and software, implementing network segmentation, and enforcing multi-factor authentication (MFA) to protect against phishing attacks.

IT leaders such as CISOs, CTOs, and CFOs are encouraged to advocate for sufficient IT budgets to ensure their organizations can defend against emerging threats and vulnerabilities effectively.

The post Ghost Ransomware targeting Obsolete IT Systems appeared first on Cybersecurity Insiders.

February 20, 2025 at 10:24AM

Read More

INE Security’s Cybersecurity and IT Training Enhances Career Stability in Tech

Cary, North Carolina, February 19th, 2025, CyberNewsWire

2025 marks a time of unprecedented volatility in the technology job market. On one hand, dependence on technology is soaring. The growth of AI and machine learning is propelling a surge in new technologies, tactics, and ideas.

At the same time, organizations are trying to adapt to the changing dynamic. This has led to more job uncertainty, which the technology sector usually avoids. This year alone, roughly 7,000 jobs have been cut across dozens of tech giants, fueling growing concerns among industry professionals. 

As the technology job market weathers this volatility, INE Security, a global leader in networking and cybersecurity training, is highlighting its commitment to equipping IT professionals with the skills they need to thrive. INE focuses on practical training, certifications, and preparation. This helps networking and cybersecurity professionals succeed in a changing job market.

“Continuous learning and adaptation are more important than ever for individuals hoping to succeed in their networking and cybersecurity career,” said Dara Warn, CEO of INE Security. “It is vital that professionals maintain a continuous cycle of learning. Training gives learners the knowledge and skills they need to succeed. Hands-on practice helps them understand tasks better. Certifications show that they have learned well and prove their skill mastery.”

Key Benefits of INE’s Training and Certification Programs:

• Enhanced Employability: Executives, supervisors, and HR professionals are completely aligned in considering industry or professional certifications the most compelling during the hiring process, according to the Society for Human Resource Management (SHRM). 
• Practical Experience: The human element was involved in 68% of cybersecurity breaches in 2023 (Verizon’s 2024 Data Breach Investigations Report). Practical, hands-on experience and industry-recognized certifications validate the skills needed to minimize this risk. 
• Flexible Learning Paths: From foundational courses to advanced certifications, learners can tailor their education to career goals and market needs.

“With every technological advancement, the skill sets required to manage, secure, and innovate within these systems evolve,” added Warn. “INE Security’s commitment to updating our course materials and labs ensures that our students are always at the forefront of the industry. Our focus is on making them indispensable in their current roles and highly attractive to prospective employers. INE’s training programs are more than just skill-building—they are career lifelines for professionals affected by market disruptions. ”

For more information about how INE can help you stabilize your cybersecurity and networking career goals, users can visit www.ine.com.

For a limited time, access INE Security training and certifications for up to 50% off, including eJPT, eMAPT, eCTHP, eCIR, eCDFP, and ICCA. Bundle certifications with Premium training and save even more. 

About INE Security

INE Security is the premier provider of online networking and cybersecurity training and certification.

Harnessing a powerful hands-on lab platform, cutting-edge technology, a global video distribution network, and world-class instructors, INE Security is the top training choice for Fortune 500 companies worldwide for red-team and blue-team security training in business and for IT professionals looking to advance their careers. INE Security’s suite of learning paths offers an incomparable depth of expertise across cybersecurity and is committed to delivering advanced technical training while also lowering the barriers worldwide for those looking to enter and excel in an IT career.

Contact

Kathryn Brown
INE Security
kbrown@ine.com

The post INE Security’s Cybersecurity and IT Training Enhances Career Stability in Tech appeared first on Cybersecurity Insiders.

February 19, 2025 at 08:02PM

Read More

Ransomware attacks on Food and Agriculture sector could intensify

In the coming weeks, criminals using ransomware may target businesses within the Food & Agriculture sectors, with the severity of these cyberattacks likely to escalate, according to a report from the Food and Agriculture Information Sharing and Analysis Center (ISAC).

The report, titled “Farm to Table Ransomware Realities,” highlights that ransomware attacks surged by 27% in 2024, with 212 incidents reported, compared to 164 in 2023.

These malware attacks have put both customers and partners of affected companies at significant risk, severely impacting the agriculture industry. If the gap between supply and demand continues to widen, the United States could face shortages of consumables, potentially leading to an artificial famine due to the slowdown in supply chains caused by attack-related downtime.

Unpredictable weather patterns across the country are already disrupting the food supply chain, and digital attacks could exacerbate these issues.

Security experts note that a new ransomware group, RansomHub, emerged in 2024 and is targeting the food sector most aggressively. Linked to the notorious LockBit gang, RansomHub could cause serious damage if the IT infrastructure within the Food and Agriculture sectors isn’t properly upgraded.

ISAC also reported that the Akira ransomware group is targeting the nation’s consumable IT assets, exploiting vulnerabilities or flaws in software-based management systems.

Additionally, research from cybersecurity firm Huntress found that ransomware attackers typically take an average of 17 hours to encrypt systems after infiltrating IT networks. Some groups, however, can encrypt databases in just 4-6 hours. The timing of these attacks often depends on the criminals’ primary goal of making money with minimal effort.

With the aid of advanced AI tools, criminals are becoming more sophisticated. Huntress researchers warn that these technologies could reduce the detection and response times of security teams, making it even more challenging to combat ransomware threats effectively.

The post Ransomware attacks on Food and Agriculture sector could intensify appeared first on Cybersecurity Insiders.

February 19, 2025 at 11:11AM

Read More

Is quishing the new phishing? Protecting your business against the next threat vector

Since they first appeared in the 1990s, quick response (QR) codes have rapidly become intertwined in our daily lives. Used today for everything from ordering food to paying for parking or undertaking virtual tours at a museum exhibition, QR codes make it convenient and easy to access digital information using a smartphone camera. However, just as with any other widespread technology, it’s no surprise that cybercriminals have now begun to exploit them.

News stories about members of the public who have been scammed when they scanned a malicious QR code in public spaces are becoming commonplace. However, this type of fraud is relatively small compared to the more targeted types of cyber fraud now being directed at UK businesses.

As cybercriminals hone and evolve their phishing tactics, they have begun sending out emails with phony QR codes designed to trick people into providing sensitive information or downloading malware. With these so-called quishing attacks on the rise, organisations will need to take steps to counter this sophisticated new attack trend.

What is ‘quishing’ and what is it being used for?

QR phishing, or quishing, works like a standard phishing attack except that the malicious link is hidden in a QR code rather than a ‘click through’ email link. When the recipient scans the QR code with their phone or a QR code reader, they are re-directed to a malicious website that may request sensitive information or download malware. The QR code links used in quishing attacks can also initiate actions on a smartphone, including the composition and distribution of phishing emails to the user’s contacts. All of this further compromises the victim and the organisation they work with.

As with phishing attacks, quishing attacks use social engineering tactics to establish a degree of trust while impressing the need for urgent action. An email could feature an urgent message stating that an employee will be unable to access their data or applications unless they scan and confirm their identity. Alternatively, printed leaflets and brochures featuring offers that can be accessed with a quick scan of a QR code can be sent through to an organisation for distribution or collection from the front desk.

What’s prompting scammers and hackers to use quishing?

Cybercriminals have become adept at exploiting everyday tools to convince employees to reveal confidential information or execute fraudulent transactions and this new attack strategy is fast gaining in popularity for a number of reasons.

Interpreted as harmless images, digital QR codes are sometimes capable of bypassing a number of basic email scanners and firewalls. Added to this, users will typically scan QR codes using their own personal devices which will lack the enterprise cyber security tools that can detect potential compromises.

Cybercriminals also don’t really need to write complex code to deliver a QR code link. In some instances, they can simply stick a fake QR code over an existing piece of physical content.

Finally, the general public is so used to using phones on a day to day basis, most will think nothing of using a phone to scan a QR code and then log into services without feeling the need to exercise caution; people seem to see a phone as a safety blanket when it comes to security, one which is somehow immune to traditional attack vectors. 

A versatile attack method

Capable of being delivered via email, texts, WhatsApp messages, social media posts, and websites, as well as printed copy, the sheer versatility of QR codes is making them the attack vector of choice for a growing number of cybercriminals. 

In recent months, attackers have become increasingly inventive and are now perpetrating quishing attacks via video conferencing apps. They are also using attacker-in-the-middle/impersonation token attacks in a bid to outmanoeuvre multi-factor authentication techniques.

Aware that general knowledge or awareness around quishing attacks means that few employees will be on their guard, attackers are keen to leverage people’s inherent trust in QR codes to swerve cyber security defences and perpetrate their malevolent activities.

Key mitigation steps

Personnel across the enterprise need to be alerted to this new threat, and organisations need to deliver education and training on what quishing is and the importance of treating QR codes with the same degree of suspicion and caution as dubious looking email links. They should also be informed of the risks they face outside work, whenever they scan a QR code in a public place. Using a scanning app to preview a QR code link before accessing it is an essential precautionary step that will help prevent malicious QR codes from automatically downloading malware when scanned.

Organisations should also review their email filtering, URL filtering, and endpoint protection to ensure it is up to date and is capable of blocking phishing emails with suspect QR codes before they reach a recipient. Should a user open a malicious link, endpoint protection should ensure that QR codes are prevented from launching a malware attack and virus scanners and checkers can be used to identify and remove active or dormant malware.

To mitigate the risk of physical codes sent in the post, ensure that processes are in place to support anyone responsible for opening mail to report and check any mail received containing QR codes. Digital mailrooms should also have systems in place to spot potentially malicious QR codes.

As cybercriminals adapt their methods, organisations should review and adjust their defence strategies and make sure they deliver security training that ensures everyone stays vigilant. Doing so will enhance the ability of the organisation to withstand quishing attacks and prevent cybercriminals gaining direct access into the company’s systems.

The post Is quishing the new phishing? Protecting your business against the next threat vector appeared first on Cybersecurity Insiders.

February 19, 2025 at 10:53AM

Read More

The Rising Threat of Cybercrime: The Emergence of “Fraud-As-A-Service” (FaaS)

In recent years, cyber crime has evolved into a highly sophisticated and organized business model. One of the most alarming developments in this realm is the commercialization of cyber crime by criminal syndicates, who have coined the term “Fraud-As-A-Service” (FaaS) to describe their operations. This model offers a service-based approach, where cybercriminals provide fraudulent tools and resources to others, allowing a larger group of perpetrators to conduct widespread cyberattacks with relative ease. What makes this new phase of cybercrime even more concerning is the integration of cutting-edge technologies, including artificial intelligence (AI), to maximize the impact of these attacks.

A Growing Business: Cybercrime on a Global Scale

According to AU10TIX, an identity verification and risk management firm, the emergence of FaaS has led to an alarming rise in cybercrime activities. Many of these criminal enterprises are now backed by state-sponsored actors who provide financial support to perpetuate these fraudulent operations at a commercial level. The goal is to carry out cyberattacks on a large scale, with speed and precision. By leveraging commercial strategies and advanced technologies, these criminal gangs aim to disrupt economies, steal sensitive data, and cause widespread damage with unprecedented efficiency.

South East Asia: The Epicenter of Cybercrime Operations

Geographically, South East Asia has become a central hub for these cybercriminal activities. Among the countries in this region, Vietnam stands out as a leader in hosting and exporting cybercriminal operations. Following closely behind are Malaysia, the Philippines, and Indonesia, all of which have become key players in the world of cybercrime. This concentration of criminal gangs in South East Asia is largely attributed to the region’s thriving digital infrastructure and relatively low law enforcement resources when compared to more developed countries.

The Impact on Western Economies: The United States and the United Kingdom

While South East Asia serves as the operational epicenter, the countries most heavily impacted by these fraud syndicates are the United States and the United Kingdom. The primary reason for this is financial: cybercriminal gangs target these nations because of the lucrative international currencies they use. These currencies—such as the US dollar and the British pound—allow criminals to convert their ill-gotten gains into resources that further fuel their illegal operations. The sophistication of these attacks often involves stealing sensitive personal and financial information, making it a high-reward venture for the criminals involved.

The Role of Advanced Technology: AI, Bots, and Deepfakes

What sets modern cybercrime apart from previous forms of fraud is the use of advanced technology to enhance the effectiveness of these attacks. In recent months, AU10TIX has reported that cybercriminal groups have started employing AI-driven tools, including bots and deepfake technology, to increase the success rate of their fraudulent campaigns. Bots enable the automation of malicious tasks, such as phishing, data harvesting, and account takeovers, while deepfakes are being used to create highly realistic, fabricated content that deceives victims into believing they are interacting with legitimate sources. This technological advancement makes cybercrime operations more efficient and harder to detect, raising significant concerns for individuals and organizations alike.

The Dangers of Social Media: A Platform for Cybercrime Promotion

One of the most disturbing aspects of this new wave of cybercrime is how criminals are using social media platforms to advertise their fraudulent services and recruit new members. Platforms like Facebook, Twitter, and LinkedIn are increasingly being exploited by cybercriminals, who use these channels to reach large audiences and promote their scams. In some cases, they hack into the accounts of celebrities or high-profile individuals, using their names and faces to promote fraudulent schemes such as cryptocurrency scams. These scams often lure victims with promises of high returns, only to leave them with significant financial losses.

Additionally, cybercriminals are creating fake profiles and fabricated job offers to deceive innocent individuals. These job scams typically promise lucrative career opportunities, only to later involve the victim in illegal activities or coercing them into assisting with cybercrimes, all while keeping them unaware of the true nature of the operation. This tactic is particularly dangerous as it preys on vulnerable job seekers, leading them into the world of cybercrime without their knowledge.

Staying Vigilant: The Importance of Cybersecurity Awareness

Given the rapidly evolving landscape of cybercrime, it is more important than ever for individuals and organizations to stay vigilant and proactive in safeguarding their personal and professional information. Cybercrime syndicates are growing more sophisticated, and their ability to use AI, bots, and deepfake technology is making it increasingly difficult to detect fraud. The integration of these advanced technologies allows cybercriminals to carry out attacks on a mass scale with unprecedented accuracy, which means that everyone—from individuals to multinational corporations—must remain aware of the threat and take appropriate measures to protect themselves.

In light of these developments, it is crucial to adopt robust cybersecurity practices. This includes using strong, unique passwords, enabling two-factor authentication, and being cautious about the personal information shared on social media platforms. Regularly updating security software and being aware of common phishing tactics are also vital steps in preventing falling victim to these increasingly sophisticated scams.

As the threat of cybercrime continues to grow, the best defense is an informed and proactive approach. By understanding the methods and motivations behind these criminal activities, individuals and businesses can better prepare themselves to detect and prevent fraud before it occurs.

The post The Rising Threat of Cybercrime: The Emergence of “Fraud-As-A-Service” (FaaS) appeared first on Cybersecurity Insiders.

February 18, 2025 at 08:43PM

Read More

Intruder Enhances Free Vulnerability Intelligence Platform ‘Intel’ with AI-Generated CVE Descriptions

Intel by Intruder now uses AI to contextualize NVD descriptions, helping security teams assess risk faster.

Intruder, a leader in attack surface management, has launched AI-generated descriptions for Common Vulnerabilities and Exposures (CVEs) within its free vulnerability intelligence platform, Intel. This new feature enhances cybersecurity professionals’ ability to quickly understand and assess vulnerabilities, addressing a common pain point: the often vague and technical descriptions provided by the National Vulnerability Database (NVD).

With thousands of vulnerabilities published every year, security teams rely on NVD as a key resource for researching CVEs. However, NVD descriptions frequently lack clarity or context, making it difficult to determine potential impact at a glance. Intel’s AI summaries transform NVD descriptions into clear, concise, and actionable insights, helping teams assess and respond to risks faster.

“Vulnerability management is challenging enough without the added complexity of deciphering cryptic CVE descriptions,” said Chris Wallis, CEO & Founder of Intruder. “With Intel’s AI Overviews, we’re making it easier for security professionals to quickly gauge what a vulnerability is and decide what action to take.”

Additionally, Intruder’s in-house security experts manually review the AI descriptions of the most critical vulnerabilities. These expert-reviewed CVEs are clearly marked in Intel with a “Verified by Intruder” label.

Intel, which is completely free to use, already provides powerful features such as a real-time feed of trending CVEs, a unique hype score rated out of 100, and in-depth analysis from Intruder’s security team. The addition of AI-generated CVE descriptions further strengthens Intel’s value as a go-to resource for cybersecurity professionals.

Availability

The AI-generated CVE descriptions are available now within Intel at intel.intruder.io. Cybersecurity professionals can access Intel for free today.

For more information, users visit www.intruder.io or follow Intruder on LinkedIn and Twitter.

About Intruder

Intruder was founded in 2015 to solve the information overload crisis in vulnerability management. Its mission from day one has been to help divide the needles from the haystack, focusing on what matters, while ignoring the rest. Effective cyber security is about getting the basics right. Intruder helps do that, saving time on the easy stuff, so users can focus on the rest. It has been awarded multiple accolades, was selected for GCHQ’s Cyber Accelerator, and is now proud to have over 3,000 happy customers all over the world.

The post Intruder Enhances Free Vulnerability Intelligence Platform ‘Intel’ with AI-Generated CVE Descriptions appeared first on Cybersecurity Insiders.

February 18, 2025 at 07:00PM

Read More

AI Data Breach will surge by 2027 because of misuse of GenAI

Elon Musk, the CEO of Tesla and owner of Twitter (now X), has long expressed concerns about the potential dangers of Generative AI, even suggesting it could lead to a global “doomsday” scenario. His warnings are now gaining attention, as a recent report from Gartner highlights the growing risks associated with the rise of this technology.

The Gartner study predicts that by 2027, data breaches linked to AI usage will significantly increase. In fact, it anticipates that nearly 40% of all data breaches will be directly influenced by the rise of Generative AI. This alarming statistic signals a serious concern for both businesses and consumers, as data is an invaluable asset for nearly every organization today. All thanks to the advent of digitization and the idea that safeguarding this information will become exponentially harder due to AI-driven threats is troubling.

One of the key issues stems from the lack of regulation surrounding Generative AI technologies. Without proper oversight, AI applications will continue to operate in ways that are difficult to monitor and control, especially when it comes to data transfers. And countries like China, North Korea, Iran and Russia not only are a step ahead in using AI for cyber crime, but do not follow any norms when launching campaigns against adversaries.

In an effort to make business operations more transparent and efficient, companies may inadvertently leave their systems vulnerable to cyberattacks. Hackers could exploit these gaps, infiltrating AI tools and APIs that are often hosted in remote or unsecured locations. This could expose sensitive data and make it challenging for cybersecurity experts to protect valuable assets.

To combat these risks, experts are calling for the establishment of a universal set of standards to regulate the use of AI and data. Governments must act swiftly to introduce comprehensive laws that set clear guidelines for how AI technologies should be used, ensuring that they are deployed safely and responsibly.

Without such regulations, the potential for widespread data breaches resulting from AI will only continue to grow, with devastating consequences for businesses and individuals alike.

The post AI Data Breach will surge by 2027 because of misuse of GenAI appeared first on Cybersecurity Insiders.

February 18, 2025 at 11:00AM

Read More

Akira Ransomware is now targeting legacy servers of defunct companies

In a disturbing yet intriguing development, cyber criminals have once again demonstrated their capacity to target organizations with the sole aim of extracting valuable data. Historically, ransomware groups have been known to target active businesses, steal critical data, and encrypt it in an effort to extort a ransom from the company, usually with the expectation that the business head will pay to restore the stolen information. However, in a shocking twist, the infamous Akira Ransomware gang has recently exposed a surprising case on the dark web—one that has raised more questions than answers.

The gang has disclosed that it has obtained sensitive information from an Australian media company, Regency Media. What’s truly odd, however, is that the company, which had once been a key player in the industry, has been defunct since 2023.

Yes, you read that correctly: Regency Media has not been operational for over two years, and yet, its data has found its way onto the dark web. This raises an important question—why would cyber criminals go after a business that is no longer active, especially when there is no realistic chance of receiving any ransom?

Upon investigation, it appears that the criminals gained access to a trove of valuable data, which they have now leaked onto the dark web. This data dump includes non-disclosure agreements, sensitive personal information such as driver’s licenses, passport details, email addresses, and even contact information of staff and employees. Additionally, they have exposed financial records, including customer audit reports and other confidential financial data. The sheer volume of the stolen data is striking—approximately 16GB of sensitive information was obtained in the breach.

What makes this case even more puzzling is that Regency Media, the company in question, has not been operational for nearly two years. The business, once involved in the manufacturing of VCDs, cassettes, and tapes, ceased to exist as a functioning entity by July 2023. Given that the company has no operational capacity to pay a ransom, one might wonder what motivated the Akira gang to target them in the first place.

Initial investigations suggest that Regency Media may still be in possession of some older, proprietary data archives. These legacy servers, although no longer part of the company’s active infrastructure, may have been retained as archival repositories. However, it’s important to note that these servers likely have no connection to any ongoing business operations, making the breach even more unusual. Moreover, because Regency Media is no longer operational, the criminals’ chances of extorting money from the company are virtually nonexistent.

Some cybersecurity experts speculate that the breach may have occurred in 2023, around the time when Regency Media officially ceased operations. This would suggest that the hackers may have sat on the stolen data for a period of time before choosing to disclose it publicly. It’s not uncommon for sensitive or valuable data to circulate on the dark web for a while before being sold or released—often because there’s always demand for such data, even if the original business is no longer functioning.

The fact that Akira Ransomware leaked the data despite Regency Media being defunct demonstrates a crucial point: cyber criminals are primarily motivated by financial gain, and the identity or current operational status of the victimized company is irrelevant. Whether a business is active or no longer operational, the goal of these attackers remains the same—to profit from the stolen data, regardless of the collateral damage caused.

In the end, this incident serves as a stark reminder of the persistent and ever-evolving nature of cyber threats. Even companies that have long since shut their doors are not safe from data breaches, and the criminals responsible for these attacks will stop at nothing to exploit whatever sensitive information they can get their hands on.

The post Akira Ransomware is now targeting legacy servers of defunct companies appeared first on Cybersecurity Insiders.

February 17, 2025 at 08:34PM

Read More

Can Simulated Phishing Attacks Help in Training and Creating Awareness Among Employees?

In today’s digital age, phishing attacks have become one of the most prevalent threats to organizations. Cybercriminals are constantly devising new methods to deceive employees into sharing sensitive information, whether it be through emails, phone calls, or other communication channels. As these attacks continue to evolve, organizations must prioritize training their employees to recognize and respond to such threats. One of the most effective ways to achieve this is through simulated phishing attacks.

Simulated phishing attacks are controlled, mock versions of actual phishing attempts, designed to mimic the tactics and techniques cybercriminals use to deceive employees. These simulated attacks can be used as a part of broader security awareness programs to educate employees, test their vigilance, and ultimately improve the organization’s overall security posture. Here’s how simulated phishing attacks can play a key role in employee training and awareness.

1. Realistic Training Scenarios

The best way to learn is by experience, and simulated phishing attacks offer a practical approach to training employees. These exercises expose employees to real-life phishing attempts in a controlled environment, helping them to recognize malicious emails or suspicious links before they fall victim to a real attack. Unlike traditional theoretical training, simulated phishing mimics the urgency and trickery used by attackers, giving employees hands-on experience that improves their ability to identify future threats.

For instance, a simulated phishing attack could involve sending a fake email that appears to come from the organization’s IT department, urging employees to click on a link to reset their passwords. When an employee clicks on the link, they’re redirected to an educational page that explains the dangers of phishing and how to avoid falling for similar traps in the future. This method reinforces the lesson much more effectively than simply reading about phishing threats.

2. Raising Awareness and Reinforcing Best Practices

Phishing awareness isn’t just about identifying deceptive emails—it’s about fostering a broader understanding of cybersecurity best practices. Simulated phishing campaigns not only teach employees how to recognize phishing attempts but also reinforce key security behaviors such as verifying the sender’s email address, hovering over links to check their destination, and being cautious about unsolicited attachments or requests for sensitive information.

By repeatedly exposing employees to simulated attacks, organizations can make phishing awareness a part of their employees’ daily routine. Over time, these behaviors become ingrained in the workforce, leading to a security-conscious culture that helps prevent successful phishing attempts.

3. Identifying Knowledge Gaps and Vulnerabilities

One of the biggest advantages of running simulated phishing attacks is the ability to identify specific knowledge gaps among employees. Organizations can track which employees fall for simulated phishing attempts, the types of phishing schemes they are most susceptible to, and how long it takes for them to recognize a threat. This data can then be used to tailor future training programs to address the specific vulnerabilities within the organization.

For example, if a large number of employees fail to identify phishing emails related to password resets, the organization can target this weakness with additional training or simulations focused on this particular type of phishing attack. This personalized approach ensures that training is relevant and effective.

4. Reducing the Risk of Real-World Cyberattacks

The ultimate goal of simulated phishing attacks is to reduce the risk of successful cyberattacks. By creating awareness and enhancing employees’ ability to recognize phishing attempts, organizations can significantly lower the likelihood of falling victim to real attacks. Phishing remains one of the primary entry points for cybercriminals to gain access to sensitive data, install malware, or launch ransomware attacks. Through repeated exposure to simulated phishing, employees become better equipped to defend against these threats, minimizing the risk of security breaches.

Moreover, organizations that conduct regular simulated phishing campaigns demonstrate their commitment to cybersecurity. This proactive approach can also lead to increased trust from clients, partners, and stakeholders who are assured that the organization takes security seriously.

5. Continuous Improvement Through Feedback

Simulated phishing attacks also provide valuable feedback that can be used to refine security training programs. By analyzing how employees respond to simulated attacks, organizations can continuously improve their training materials and methods. Feedback can also be provided to employees on their responses to simulated attacks, allowing them to learn from their mistakes and strengthen their ability to detect phishing attempts in the future.

Conclusion

Simulated phishing attacks offer a powerful tool for training and creating awareness among employees about the dangers of phishing. By providing realistic, hands-on experience in a safe environment, these simulated attacks help employees understand the tactics used by cybercriminals and develop the skills to recognize and avoid phishing attempts. In addition, simulated phishing campaigns enable organizations to identify vulnerabilities and gaps in knowledge, allowing them to tailor training programs for maximum effectiveness.

Ultimately, simulated phishing attacks play a crucial role in fostering a security-aware culture, reducing the risk of cyberattacks, and ensuring that employees remain vigilant in the face of increasingly sophisticated phishing schemes. With cyber threats continuing to evolve, ongoing training and awareness are essential to safeguarding organizational data and maintaining strong defenses against cybercriminals.

The post Can Simulated Phishing Attacks Help in Training and Creating Awareness Among Employees? appeared first on Cybersecurity Insiders.

February 17, 2025 at 11:10AM

Read More