{"id":6154,"date":"2026-10-25T09:44:21","date_gmt":"2026-10-25T14:44:21","guid":{"rendered":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=6154"},"modified":"2026-10-25T09:44:21","modified_gmt":"2026-10-25T14:44:21","slug":"the-ciso-brief-october-25-2026","status":"publish","type":"post","link":"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=6154","title":{"rendered":"The CISO Brief \u2014 October 25, 2026"},"content":{"rendered":"<style>\n.single .entry-title,\n.single .entry-header .entry-title,\n.single .post-title,\n.single header.entry-header h1,\n.single h1.entry-title,\n.single .page-title,\n.post-template-default h1.entry-title,\n.post-template-default .entry-header,\narticle .entry-header,\narticle .entry-title { display: none !important; }\n.single .entry-header { margin: 0 !important; padding: 0 !important; }\n.single .entry-content { margin-top: 0 !important; padding-top: 0 !important; }\n<\/style>\n<table role=\"presentation\" class=\"wrapper\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\">\n<tr>\n<td align=\"center\">\n<table role=\"presentation\" class=\"container\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"680\">\n<p>        <!-- Banner --><\/p>\n<tr>\n<td class=\"banner\" style=\"background-color:#0f172a;background:linear-gradient(135deg,#0f172a 0%,#1e3a8a 55%,#2563eb 100%);padding:36px 32px;color:#ffffff;\">\n<p class=\"date\" style=\"color:#ffffff !important;\">October 25, 2026 &middot; Weekly Edition<\/p>\n<h1 style=\"color:#ffffff !important;\">The CISO Brief<\/h1>\n<p class=\"tagline\" style=\"color:#ffffff !important;\">This was the week weak security got a price tag. Moody&rsquo;s says unpatched flaws will raise borrowing costs, insurers report fewer but far larger claims, and Kroll finds most breach victims were hit through a supplier. Microsoft told customers to treat AI agents like insiders while a survey shows agent permissions outrunning anyone&rsquo;s ability to audit them. Boards say they are ready, CIOs say AI is not yet paying off, large firms are hiring heads of AI security, and London wants AI near misses reported. A PHP scare showed how short the patch window has become.<\/p>\n<\/td>\n<\/tr>\n<p>        <!-- At a glance --><\/p>\n<tr>\n<td class=\"content\">\n<h2>This week at a glance<\/h2>\n<p>Three different institutions put a number on weak security this week. Moody&rsquo;s Ratings warned that AI-accelerated attacks will raise borrowing costs for companies that cannot defend themselves, and found that 60% of about 9,500 issuers it examined had at least one unpatched known exploited vulnerability, with a median of nearly three months to fix one. The insurance market&rsquo;s figures show large companies filing fewer cyber claims but much bigger ones: an average of $4.4 million in 2025, double the year before. And Kroll found that 69% of last year&rsquo;s breach victims were hit through a third party, most often a technology supplier. The PHP vulnerabilities that sent site owners scrambling to patch or go offline showed how little time the next disclosure may leave.<\/p>\n<p>The agent problem moved from theory to product. Microsoft launched controls built on the premise that AI agents should be treated like insider threats, and its Defender can now spot up to 60 kinds of agent that employees bring to work. A survey of 1,100 IT and security leaders finds 70% now let AI take actions that needed human approval a year ago, while only 49% can audit every action an agent takes. Gartner&rsquo;s 2027 trends list puts AI agent identity on the agenda and predicts a quarter of enterprise breaches will trace to agent abuse by 2028.<\/p>\n<p>Leadership is catching up unevenly. BDO&rsquo;s directors say their boards have the frameworks for AI and cyber oversight, but only 36% are very confident they have the skills. Gartner finds just 13% of CIOs getting significant value from AI, and only 21% have governance for the agents that 71% plan to deploy within a year. A head of AI security role now exists at 65% of the largest firms, AI security postings are growing, and a Barracuda report says AI is already cutting security jobs at junior and senior levels alike. In London, the FCA wants firms to report AI failures and near misses, and the Lords take up the Cyber Security and Resilience Bill on Monday. JFrog shipped DevGovOps capabilities that attach signed compliance evidence to every release, aimed at DORA and the Cyber Resilience Act.<\/p>\n<p>            <!-- Watch list --><\/p>\n<div class=\"watchlist\">\n<h2>On our watch list<\/h2>\n<ul>\n<li><strong>Whether lenders start asking about patch times.<\/strong> Moody&rsquo;s says weak defences will increasingly show up in borrowing costs. The first rating action or credit commentary that cites a company&rsquo;s cyber posture would turn this from a warning into a finance-team question; SANS&rsquo;s Rob Lee is not yet convinced it will touch ratings.<\/li>\n<li><strong>What the Lords do with AI reporting on Monday, 26 October.<\/strong> Report stage of the Cyber Security and Resilience Bill includes backbench amendments that would make frontier-model developers notify affected regulated organisations, and would let operators report near misses voluntarily without added liability. Whether either survives is the signal for UK essential-service operators.<\/li>\n<li><strong>Whether the FCA defines &ldquo;AI near miss&rdquo;.<\/strong> Its chief data officer wants significant AI failures and near misses reported under existing incident rules, but the regulator did not answer questions on what counts. A consultation paper or Dear CEO letter would turn a speech into an obligation for UK financial firms.<\/li>\n<li><strong>How fast Microsoft&rsquo;s agent controls are adopted, and copied.<\/strong> Guardian Agents and Defender&rsquo;s agent discovery set an expectation that security teams can list the agents in their estate. Watch for rival platforms shipping equivalent agent inventories, and for auditors starting to ask for one.<\/li>\n<li><strong>Whether claim sizes keep climbing.<\/strong> Large-company claims averaged $4.4 million in 2025, up 586% since 2021, even as frequency fell. Renewal terms over the next two quarters will show whether insurers price that severity in, and whether supplier-driven incidents get carved out.<\/li>\n<li><strong>What the PHP aftermath shows about patch windows.<\/strong> Exploitation attempts reached millions within days, and some were seen before disclosure. Post-incident reports on how long sites stayed exposed will tell you whether &ldquo;days, if not hours&rdquo; is already the real patch target for public-facing systems.<\/li>\n<li><strong>Who owns AI security in your peer group.<\/strong> IANS finds CISOs are the primary owner of AI governance at only 7% of large organisations, behind chief AI officers at 22%. Watch for whether new heads of AI security report to the CISO or around them.<\/li>\n<li><strong>Whether AI-driven security job cuts show up in the hiring data.<\/strong> Barracuda&rsquo;s respondents report cuts at every level, while the SANS tracker shows AI security engineering, red-team and GRC postings growing. Next month&rsquo;s postings will show whether the market is shrinking or re-shaping.<\/li>\n<li><strong>How federal agencies handle the DeepSeek removal deadline.<\/strong> Agencies have 60 days to remove DeepSeek products, including third-party tools built on its models. The exemption requests filed with CISA, and any contractor flow-down, will show how deep the model supply chain question goes for vendors that sell to government.<\/li>\n<li><strong>Whether the next PHP-scale disclosure lands within weeks.<\/strong> Cloudflare&rsquo;s chief executive says his company knows of several other severe vulnerabilities in critical software and expects a couple of years of weekly scares as AI speeds up discovery. A second internet-wide emergency patch before year-end would confirm that the PHP week was the new normal, not an outlier.<\/li>\n<li><strong>Whether data centres become a critical-infrastructure sector.<\/strong> The top Democrat on the House Intelligence Committee said there is &ldquo;no question&rdquo; they will be. A formal designation would bring sector-specific obligations for anyone operating, or relying on, AI data centre capacity.<\/li>\n<\/ul><\/div>\n<p>            <!-- Topic map --><\/p>\n<div class=\"topic-map\">\n              <img decoding=\"async\" src=\"https:\/\/www.cybersecurityinstitute.com\/blog\/wp-content\/uploads\/2026\/10\/topic-map-ciso-2026-10-25.png\" alt=\"Topic map of this week&rsquo;s CISO Brief themes\" loading=\"eager\"><\/p>\n<p class=\"caption\">This week&rsquo;s topic map &mdash; the CISO at the centre, tied to boards, CIOs and CFOs through AI governance and AI cost; AI agents link Microsoft&rsquo;s Guardian Agents, insider risk, agent permissions and agent identity; Moody&rsquo;s, the NAIC and Kroll price weak defences through patch speed, claims and third-party breaches, with the PHP flaws on the patch-speed axis; London&rsquo;s near-miss reporting push connects to signed compliance evidence and DORA.<\/p>\n<p>              <!-- INTERACTIVE_MAP_LINK_START --><\/p>\n<p style=\"margin:10px 0 0;text-align:center;\"><a href=\"https:\/\/www.cybersecurityinstitute.com\/blog\/?p=6153\" target=\"_blank\" rel=\"noopener\" style=\"display:inline-block;padding:8px 18px;background-color:#0f172a;color:#ffffff !important;text-decoration:none;border-radius:6px;font-size:13px;font-weight:600;\">View interactive topic map &rarr;<\/a><\/p>\n<p><!-- INTERACTIVE_MAP_LINK_END -->\n            <\/div>\n<p>            <!-- Article index --><\/p>\n<h2>Article index<\/h2>\n<h3>AI agents inside the enterprise<\/h3>\n<div class=\"cluster-intro\">Microsoft tells customers to treat agents like insiders, a survey shows agent permissions growing faster than anyone can audit them, and Gartner puts AI agent identity on its 2027 trends list.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>1. <a href=\"https:\/\/techcrunch.com\/2026\/10\/19\/microsoft-says-ai-agents-are-like-insider-threats-as-frontier-models-cant-be-trusted\/?ref=blog.contextvidhya.com\">Microsoft says AI agents are like insider threats as &#39;frontier models can&#39;t be trusted&#39;<\/a><\/td>\n<td class=\"src\">TechCrunch<\/td>\n<td class=\"dt\">Oct 19, 2026<\/td>\n<\/tr>\n<tr>\n<td>2. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/22\/ai-agent-permissions-security\/\">AI agent permissions are outrunning security<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Oct 22, 2026<\/td>\n<\/tr>\n<tr>\n<td>3. <a href=\"https:\/\/www.networkworld.com\/article\/4238030\/gartners-top-tech-trends-for-2027-expand-and-constrain-ai-capabilities.html\">Gartner&#39;s top 10 strategic technology trends for 2027 expand and constrain AI capabilities<\/a><\/td>\n<td class=\"src\">Network World<\/td>\n<td class=\"dt\">Oct 20, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Boards, CIOs and the AI bill<\/h3>\n<div class=\"cluster-intro\">Directors say they are ready; CIOs say AI is not yet paying off; CFOs are still reading AI costs off the invoice.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>4. <a href=\"https:\/\/www.cybersecuritydive.com\/news\/corporate-boards-cybersecurity-ai-oversight-bdo\/833350\/\">Boards confident on cybersecurity, AI oversight, but tech changes outpace readiness<\/a><\/td>\n<td class=\"src\">Cybersecurity Dive<\/td>\n<td class=\"dt\">Oct 19, 2026<\/td>\n<\/tr>\n<tr>\n<td>5. <a href=\"https:\/\/www.informationweek.com\/responsible-ai\/gartner-cios-must-balance-ai-value-with-risk-and-fast\">Gartner: CIOs must balance AI value with risk \u2014 and fast<\/a><\/td>\n<td class=\"src\">InformationWeek<\/td>\n<td class=\"dt\">Oct 19, 2026<\/td>\n<\/tr>\n<tr>\n<td>6. <a href=\"https:\/\/www.techtarget.com\/it-strategy\/news\/366652527\/CIOs-walk-AI-tightrope-as-CEOs-demand-innovation\">CIOs walk AI tightrope as CEOs demand innovation<\/a><\/td>\n<td class=\"src\">TechTarget<\/td>\n<td class=\"dt\">Oct 21, 2026<\/td>\n<\/tr>\n<tr>\n<td>7. <a href=\"https:\/\/www.techtarget.com\/it-strategy\/news\/366652678\/AI-cost-controls-lag-as-CFOs-influence-grows-Deloitte-finds\">AI cost controls lag as CFOs&#39; influence grows, Deloitte finds<\/a><\/td>\n<td class=\"src\">TechTarget<\/td>\n<td class=\"dt\">Oct 23, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Risk gets a price<\/h3>\n<div class=\"cluster-intro\">A ratings agency, the insurance market and a breach-response firm all put numbers on weak defences, and a PHP scare shows how fast the patch clock now runs.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>8. <a href=\"https:\/\/www.techtarget.com\/cybersecurity\/news\/366652364\/AI-will-drive-up-credit-cost-of-weak-cyberdefenses-says-Moodys\">AI will drive up credit cost of weak cyberdefenses, says Moody&#39;s<\/a><\/td>\n<td class=\"src\">TechTarget<\/td>\n<td class=\"dt\">Oct 21, 2026<\/td>\n<\/tr>\n<tr>\n<td>9. <a href=\"https:\/\/www.cybersecuritydive.com\/news\/cybersecurity-insurance-market-ai-supply-chain\/833841\/\">Large businesses&#39; cybersecurity insurance claims are now less frequent but more expensive<\/a><\/td>\n<td class=\"src\">Cybersecurity Dive<\/td>\n<td class=\"dt\">Oct 23, 2026<\/td>\n<\/tr>\n<tr>\n<td>10. <a href=\"https:\/\/www.infosecurity-magazine.com\/news\/tech-third-party-breach-victims\/\">Attacks on Tech Firms Behind Most Third-Party Data Breach Victims<\/a><\/td>\n<td class=\"src\">Infosecurity Magazine<\/td>\n<td class=\"dt\">Oct 23, 2026<\/td>\n<\/tr>\n<tr>\n<td>11. <a href=\"https:\/\/techcrunch.com\/2026\/10\/24\/will-ai-expose-the-rickety-infrastructure-of-the-internet\/?ref=refetch.io\">Will AI expose the rickety infrastructure of the internet?<\/a><\/td>\n<td class=\"src\">TechCrunch<\/td>\n<td class=\"dt\">Oct 24, 2026<\/td>\n<\/tr>\n<tr>\n<td>12. <a href=\"https:\/\/www.pcgamer.com\/software\/security\/every-single-week-its-going-to-feel-like-the-sky-is-falling-cloudflare-ceo-says-strap-in-for-a-couple-years-of-ai-powered-internet-security-mayhem\/\">&#39;Every single week it&#39;s going to feel like the sky is falling&#39;: Cloudflare CEO says strap in for &#39;a couple years&#39; of AI-powered internet security mayhem<\/a><\/td>\n<td class=\"src\">PC Gamer<\/td>\n<td class=\"dt\">Oct 23, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Who leads AI security, and who gets hired<\/h3>\n<div class=\"cluster-intro\">Large firms are creating a head of AI security role, AI security postings are growing, and AI is already cutting security jobs at every level.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>13. <a href=\"https:\/\/www.infosecurity-magazine.com\/news\/head-ai-security-roles\/\">Head of AI Security Roles Surge in Large Organizations<\/a><\/td>\n<td class=\"src\">Infosecurity Magazine<\/td>\n<td class=\"dt\">Oct 20, 2026<\/td>\n<\/tr>\n<tr>\n<td>14. <a href=\"https:\/\/www.cybersecuritydive.com\/news\/ai-security-jobs-hiring-sans-tracker\/833465\/\">AI security hiring focuses on red-teaming, SOC orchestration and governance<\/a><\/td>\n<td class=\"src\">Cybersecurity Dive<\/td>\n<td class=\"dt\">Oct 20, 2026<\/td>\n<\/tr>\n<tr>\n<td>15. <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/23\/barracuda-cybersecurity-career-development-report\/?ref=feedbagel.com\">AI is taking cybersecurity jobs at junior and experienced levels alike<\/a><\/td>\n<td class=\"src\">Help Net Security<\/td>\n<td class=\"dt\">Oct 23, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Regulation, reporting and audit evidence<\/h3>\n<div class=\"cluster-intro\">London wants AI near misses reported, Washington bans DeepSeek from federal systems and drafts help against model distillation, data centres head for critical-infrastructure status, and audit evidence moves into the release pipeline.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>16. <a href=\"https:\/\/www.csoonline.com\/article\/4238124\/enterprises-should-report-ai-breaches-and-near-misses-says-uk-financial-regulator.html\">Enterprises should report AI breaches and &#39;near misses,&#39; says UK financial regulator<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Oct 20, 2026<\/td>\n<\/tr>\n<tr>\n<td>17. <a href=\"https:\/\/www.parliament.uk\/business\/news\/2026\/october-2026\/cyber-security-and-resilience-network-and-information-systems-bill-undergoes-further-scrutiny-in-the-lords\">Cyber Security and Resilience (Network and Information Systems) Bill undergoes further scrutiny in the Lords<\/a><\/td>\n<td class=\"src\">UK Parliament<\/td>\n<td class=\"dt\">Oct 23, 2026<\/td>\n<\/tr>\n<tr>\n<td>18. <a href=\"https:\/\/www.csoonline.com\/article\/4238149\/us-bans-deepseek-across-federal-agencies-putting-ai-supply-chains-under-scrutiny-2.html\">US bans DeepSeek across federal agencies, putting AI supply chains under scrutiny<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Oct 20, 2026<\/td>\n<\/tr>\n<tr>\n<td>19. <a href=\"https:\/\/cyberscoop.com\/bipartisan-bill-combat-ai-distillation-attacks-nist\/\">Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber<\/a><\/td>\n<td class=\"src\">CyberScoop<\/td>\n<td class=\"dt\">Oct 22, 2026<\/td>\n<\/tr>\n<tr>\n<td>20. <a href=\"https:\/\/www.nextgov.com\/artificial-intelligence\/2026\/10\/no-question-data-centers-will-be-considered-critical-infrastructure-top-house-intel-dem-says\/416746\/\">&#39;No question&#39; data centers will be considered critical infrastructure, top House intel Dem says<\/a><\/td>\n<td class=\"src\">Nextgov\/FCW<\/td>\n<td class=\"dt\">Oct 21, 2026<\/td>\n<\/tr>\n<tr>\n<td>21. <a href=\"https:\/\/www.nextgov.com\/cybersecurity\/2026\/10\/cisa-vulnerability-response-chief-departing-agency-after-nearly-six-years\/416786\/\">CISA vulnerability response chief departing agency after nearly six years<\/a><\/td>\n<td class=\"src\">Nextgov\/FCW<\/td>\n<td class=\"dt\">Oct 23, 2026<\/td>\n<\/tr>\n<tr>\n<td>22. <a href=\"https:\/\/jfrog.com\/press-room\/jfrog-ends-the-audit-scramble-delivers-new-devgovops-capabilities-with-signed-compliance-evidence-for-every-release-without-slowing-development\/\">JFrog Ends the Audit Scramble: Delivers New DevGovOps Capabilities with Signed Compliance Evidence for Every Release, without Slowing Development<\/a><\/td>\n<td class=\"src\">JFrog<\/td>\n<td class=\"dt\">Oct 21, 2026<\/td>\n<\/tr>\n<\/table>\n<h3>Foundational reading: governing agents and the AI budget<\/h3>\n<div class=\"cluster-intro\">Longer reads on agent governance, autonomy creep, when to stop an AI project, who owns AI, why tokenomics misleads, cloud repatriation, always-on notetakers, and the week the internet patched PHP. One is written by a cloud-provider executive; all are editorial.<\/div>\n<table class=\"index-table\">\n<tr>\n<th>Article<\/th>\n<th>Source<\/th>\n<th>Published<\/th>\n<\/tr>\n<tr>\n<td>23. <a href=\"https:\/\/www.cio.com\/article\/4237146\/closing-the-agent-governance-gap.html\">Closing the agent governance gap<\/a><\/td>\n<td class=\"src\">CIO<\/td>\n<td class=\"dt\">Oct 20, 2026<\/td>\n<\/tr>\n<tr>\n<td>24. <a href=\"https:\/\/www.cio.com\/article\/4235704\/autonomy-creep-how-ai-quietly-gains-more-authority-than-cios-intend.html\">Autonomy creep: how AI quietly gains more authority than CIOs intend<\/a><\/td>\n<td class=\"src\">CIO<\/td>\n<td class=\"dt\">Oct 21, 2026<\/td>\n<\/tr>\n<tr>\n<td>25. <a href=\"https:\/\/www.informationweek.com\/responsible-ai\/cios-winning-the-ai-race-know-when-to-slow-down\">CIOs winning the AI race know when to slow down<\/a><\/td>\n<td class=\"src\">InformationWeek<\/td>\n<td class=\"dt\">Oct 21, 2026<\/td>\n<\/tr>\n<tr>\n<td>26. <a href=\"https:\/\/www.techtarget.com\/ai\/tip\/Who-should-claim-AI-leadership-in-the-enterprise\">Who should claim AI leadership in the enterprise?<\/a><\/td>\n<td class=\"src\">TechTarget<\/td>\n<td class=\"dt\">Oct 22, 2026<\/td>\n<\/tr>\n<tr>\n<td>27. <a href=\"https:\/\/www.cio.com\/article\/4238094\/ai-tokenomics-is-a-trap-cios-should-avoid-it-at-all-costs.html\">AI &#39;Tokenomics&#39; is a trap. CIOs should avoid it at all costs.<\/a><\/td>\n<td class=\"src\">CIO<\/td>\n<td class=\"dt\">Oct 23, 2026<\/td>\n<\/tr>\n<tr>\n<td>28. <a href=\"https:\/\/www.techtarget.com\/cybersecurity\/feature\/Cloud-repatriation-What-CISOs-need-to-know\">Cloud repatriation: What CISOs need to know<\/a><\/td>\n<td class=\"src\">TechTarget<\/td>\n<td class=\"dt\">Oct 20, 2026<\/td>\n<\/tr>\n<tr>\n<td>29. <a href=\"https:\/\/www.csoonline.com\/article\/4239372\/the-ai-notetaker-risk-is-now-an-everywhere-problem.html\">The AI notetaker risk is now an everywhere problem<\/a><\/td>\n<td class=\"src\">CSO Online<\/td>\n<td class=\"dt\">Oct 23, 2026<\/td>\n<\/tr>\n<tr>\n<td>30. <a href=\"https:\/\/www.transformernews.ai\/p\/php-flaw-cyberpocalypse-is-here-sort-of\">The cyberpocalypse is here \u2014 sort of<\/a><\/td>\n<td class=\"src\">Transformer<\/td>\n<td class=\"dt\">Oct 23, 2026<\/td>\n<\/tr>\n<\/table>\n<p>            <!-- Detailed write-ups --><\/p>\n<h2>Detailed write-ups<\/h2>\n<div class=\"article\">\n<h4>1. Microsoft says to treat AI agents like insiders<\/h4>\n<p class=\"meta\">TechCrunch &middot; Help Net Security &middot; CIO &middot; October 19&ndash;22, 2026<\/p>\n<p>Microsoft launched a set of enterprise controls on Monday built on a blunt premise: AI agents should be handled like potential insider threats, because the frontier models behind them cannot simply be trusted. The headline feature, Guardian Agents, monitors the agents a company uses, and extends the Project Perception work Microsoft announced in June. Microsoft Defender&rsquo;s new agent detection can find up to 60 types of agent that employees bring into the workplace, including coding agents. TechCrunch&rsquo;s Julie Bort notes the irony that the leading labs are Microsoft partners, and that Microsoft also sells the products that answer the problem it describes. Chief executive Satya Nadella set out the principle in a blog post earlier this month: &ldquo;we need to separate the supply of intelligence from the authority over it.&rdquo;<\/p>\n<p>The survey data says that separation has not happened yet. Help Net Security&rsquo;s Mirko Zorz reports a survey of 1,100 IT and security decision-makers in which 70% now let AI make decisions and take actions that would have needed human approval a year ago. Three in four had at least one AI-related security issue or warning sign in the past year; about a quarter each saw an agent connect to a system without security approval, reach data it should not have, or take an unapproved action. Roughly three in ten would let an agent run a security investigation or change production with nobody checking. Eighty-four per cent say they can see how AI systems reach data, but only 49% can audit every action an agent takes, and 62% deployed AI tools before the safeguards. Defining what an agent is allowed to do ranked last among the controls respondents chose. &ldquo;If you can&rsquo;t name who owns an agent, it shouldn&rsquo;t be in production,&rdquo; said Illumio&rsquo;s Raghu Nandakumara.<\/p>\n<p>Two CIO pieces describe the mechanics. Pat Brans calls it autonomy creep: agents gain authority through added permissions, newly connected systems and quietly removed approvals rather than through one deliberate decision, and reviewers who see reliable output stop scrutinising it. The fix is to enforce limits outside the model, with short-lived, task-based credentials, continuous access reviews and a named owner for every agent; as RSA&rsquo;s Jim Taylor puts it, &ldquo;Model-level guardrails are necessary, but not sufficient.&rdquo; In a contributed column, an AWS executive argues for a full inventory of agents, runtime oversight rather than pre-deployment checks alone, and scoping each agent like a temporary employee. The common thread for a CISO: agents belong in the identity and insider-risk programme, with owners and audit trails, before they belong in production.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/techcrunch.com\/2026\/10\/19\/microsoft-says-ai-agents-are-like-insider-threats-as-frontier-models-cant-be-trusted\/?ref=blog.contextvidhya.com\">TechCrunch (Microsoft says AI agents are like insider th\u2026)<\/a> &middot; <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/22\/ai-agent-permissions-security\/\">Help Net Security (AI agent permissions are outrunning security)<\/a> &middot; <a href=\"https:\/\/www.cio.com\/article\/4237146\/closing-the-agent-governance-gap.html\">CIO (Closing the agent governance gap)<\/a> &middot; <a href=\"https:\/\/www.cio.com\/article\/4235704\/autonomy-creep-how-ai-quietly-gains-more-authority-than-cios-intend.html\">CIO (Autonomy creep: how AI quietly gains more au\u2026)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>2. Boards say they are ready; CIOs say AI is not paying off yet<\/h4>\n<p class=\"meta\">Cybersecurity Dive &middot; InformationWeek &middot; TechTarget &middot; October 19&ndash;21, 2026<\/p>\n<p>BDO surveyed more than 200 US directors in June, and Cybersecurity Dive&rsquo;s Eric Geller reports a confident picture with soft spots. Eighty per cent say their board has a clear governance framework for overseeing AI adoption and cyber risk, and 88% trust executives to manage evolving cyber risk. But only 36% are very confident the board itself has the skills to oversee AI, cybersecurity and data governance, and 15% are not confident at all. Fifty-seven per cent rank accelerating AI and cyber change among their biggest concerns for the next six to 12 months, ahead of trade policy and geopolitics. Forty-five per cent say cybersecurity and data protection is a skill the board most needs, up from 35% last year, yet about a quarter say growing agendas have pushed cyber and AI oversight down the list. &ldquo;Boards today are being asked to oversee a growing number of interconnected risks and opportunities,&rdquo; said BDO&rsquo;s Amy Rojik.<\/p>\n<p>Gartner&rsquo;s CIO survey of more than 2,000 IT executives, presented at its Orlando Symposium and reported by InformationWeek&rsquo;s Kelsey Ziser, shows the gap between activity and return. AI spending has risen 18-fold in two years, but only 13% of CIOs report significant or transformational value. Only 21% have governance for agentic AI, while 71% plan to deploy it within 12 months; 1% have bought AI insurance and 34% are considering it. &ldquo;It&rsquo;s not possible to create value faster than AI can create risk in that situation,&rdquo; said Gartner&rsquo;s Kristin Moyer, who recommends an AI governance platform as a system of record, run jointly with finance and legal.<\/p>\n<p>The best performers know when to stop. Only 11% of respondents set stopping points at both the pilot and production stages; CIOs with rules for when a pilot should not advance were 2.3 times as likely to be in the top group, and those with policies for retiring low-value AI 2.6 times as likely. The average organisation went from 10 AI use cases in 2024 to 42 a year later. &ldquo;We are getting very good at launching AI,&rdquo; said Gartner&rsquo;s Alicia Mullery. &ldquo;We are not good at stopping AI.&rdquo; TechTarget&rsquo;s interviews with executives land in the same place: move fast on internal automation, but send customer-facing agent actions such as emailing a client or moving money to a person for approval. For security leaders, a kill-and-retire process for AI is a governance control, not just a cost one.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.cybersecuritydive.com\/news\/corporate-boards-cybersecurity-ai-oversight-bdo\/833350\/\">Cybersecurity Dive (Boards confident on cybersecurity, AI oversi\u2026)<\/a> &middot; <a href=\"https:\/\/www.informationweek.com\/responsible-ai\/gartner-cios-must-balance-ai-value-with-risk-and-fast\">InformationWeek (Gartner: CIOs must balance AI value with ris\u2026)<\/a> &middot; <a href=\"https:\/\/www.informationweek.com\/responsible-ai\/cios-winning-the-ai-race-know-when-to-slow-down\">InformationWeek (CIOs winning the AI race know when to slow d\u2026)<\/a> &middot; <a href=\"https:\/\/www.techtarget.com\/it-strategy\/news\/366652527\/CIOs-walk-AI-tightrope-as-CEOs-demand-innovation\">TechTarget (CIOs walk AI tightrope as CEOs demand innova\u2026)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>3. Moody&rsquo;s: weak defences will cost you at the lender<\/h4>\n<p class=\"meta\">TechTarget &middot; October 21, 2026<\/p>\n<p>Moody&rsquo;s Ratings warned this week that weak cyber defences will increasingly raise organisations&rsquo; borrowing costs as offensive AI speeds up attacks. TechTarget&rsquo;s Alissa Irei reports that the agency expects attacks to become more automated and persistent, driven by falling compute costs and capable open-weight models, so the gap between a well-defended and a poorly defended issuer becomes a credit question rather than only an operational one.<\/p>\n<p>The baseline is not encouraging. Moody&rsquo;s analysed about 9,500 rated issuers and found that 60% had at least one unpatched known exploited vulnerability on their networks, and the median time to remediate one was nearly three months. Experts quoted in the piece argue that defenders facing frontier-level AI will need to patch public-facing assets within days, if not hours. The Cloud Security Alliance&rsquo;s Rich Mogull recommends treating vulnerability management as a continuous, DevOps-style discipline he calls &ldquo;VulnOps&rdquo;.<\/p>\n<p>Not everyone expects ratings to move soon. &ldquo;I don&rsquo;t know if it&rsquo;s going to affect credit ratings,&rdquo; said SANS&rsquo;s Rob Lee. But his colleague Chris Cochran offers the useful framing for a board: describe cyber risk in terms of the revenue-generating systems an attack would take down and how long the business could afford to lose them. If your finance team talks to rating agencies or lenders, give them your known-exploited remediation time before they are asked for it.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.techtarget.com\/cybersecurity\/news\/366652364\/AI-will-drive-up-credit-cost-of-weak-cyberdefenses-says-Moodys\">TechTarget (AI will drive up credit cost of weak cyberde\u2026)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>4. Fewer, bigger claims, and breaches that start at a supplier<\/h4>\n<p class=\"meta\">Cybersecurity Dive &middot; Infosecurity Magazine &middot; October 23, 2026<\/p>\n<p>The National Association of Insurance Commissioners&rsquo; annual look at the cyber insurance market, reported by Eric Geller, shows a market that has nearly tripled in direct written premium since 2020 and a claims picture that is shifting in shape. For businesses with at least $1 billion in revenue, the average 2025 claim was $4.4 million, double 2024 and up 586% since 2021, even as frequency fell to 10 claims per 100 policies from 15. Mid-market firms&rsquo; average claim rose 23% to $759,000, while small firms&rsquo; fell from $215,000 to $142,000. &ldquo;Cyber risk is evolving at the pace of machines,&rdquo; the report says, while organisational remediation still moves at human speed.<\/p>\n<p>Kroll&rsquo;s latest data, reported by Infosecurity&rsquo;s James Coker, suggests where much of that severity comes from. Sixty-nine per cent of data breach victims in the year to June 2026 were affected through a third-party breach, and 79% of those had their data accessed after a technology company was compromised. Technology firms accounted for 60% of all breach victims but only 6% of the breach incidents Kroll observed, because one compromised supplier exposes many customers; finance and professional services led incidents at 20% each. &ldquo;One incident can reach businesses and individuals who have never dealt directly with the company where the compromise began,&rdquo; said Kroll&rsquo;s Denyl Green.<\/p>\n<p>Kroll sells breach response, so its numbers reflect the cases it sees. Read together, though, the two reports point the same way: the expensive event is increasingly the one that arrives through a technology supplier. That makes supplier tiering, contractual notification terms and a tested plan for a vendor-side compromise as important to the renewal conversation as your own controls.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.cybersecuritydive.com\/news\/cybersecurity-insurance-market-ai-supply-chain\/833841\/\">Cybersecurity Dive (Large businesses&#39; cybersecurity insurance cl\u2026)<\/a> &middot; <a href=\"https:\/\/www.infosecurity-magazine.com\/news\/tech-third-party-breach-victims\/\">Infosecurity Magazine (Attacks on Tech Firms Behind Most Third-Part\u2026)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>5. Who leads AI security, and who gets hired<\/h4>\n<p class=\"meta\">Infosecurity Magazine &middot; Cybersecurity Dive &middot; Help Net Security &middot; October 20&ndash;23, 2026<\/p>\n<p>A head of AI security role now exists at 65% of organisations with more than $10 billion in revenue, according to IANS and executive search firm Artico Search, reported by Infosecurity&rsquo;s James Coker. In 18% of those firms it is a dedicated position; in 47% it is combined with another leadership job. It is far rarer below that size: 9% of $1&ndash;10 billion firms and 6% of companies under $1 billion. The striking number is who owns AI governance: CISOs are the primary owner at only 7% of large organisations, 11% of medium and 26% of small ones, while chief AI officers lead at 22% of large firms. Between 14% and 19% in each tier say no single executive is accountable. &ldquo;The growth of AI is creating a premium for leaders who can bridge technical security, risk and compliance,&rdquo; said Artico&rsquo;s Steve Martano.<\/p>\n<p>Below the leadership tier, a new SANS tracker of public postings, reported by Cybersecurity Dive&rsquo;s Eric Geller, counted more than 850 open AI and machine-learning security engineer jobs in mid-September at a median advertised salary of $140,000, nearly 100 AI red-team roles at $124,000, and about 430 AI governance, risk and compliance leads at $146,000, plus smaller numbers of AI SOC orchestrators and AI supply chain security engineers. &ldquo;Nearly every large enterprise is deploying AI, and most are doing it without dedicated AI security staff,&rdquo; SANS said.<\/p>\n<p>At the same time, AI is shrinking teams. Barracuda&rsquo;s career development report, covered by Help Net Security, finds 56% of respondents have seen security workforce cuts tied to AI, split evenly between entry-level and more senior roles, while almost all report skills gaps, with AI risk the most common. Half say their teams must support growing digital operations with no more resources. For CISOs the message is two-sided: decide whether AI security reports to you before someone else decides, and protect the junior pipeline that tomorrow&rsquo;s senior staff come from.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.infosecurity-magazine.com\/news\/head-ai-security-roles\/\">Infosecurity Magazine (Head of AI Security Roles Surge in Large Org\u2026)<\/a> &middot; <a href=\"https:\/\/www.cybersecuritydive.com\/news\/ai-security-jobs-hiring-sans-tracker\/833465\/\">Cybersecurity Dive (AI security hiring focuses on red-teaming, S\u2026)<\/a> &middot; <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/23\/barracuda-cybersecurity-career-development-report\/?ref=feedbagel.com\">Help Net Security (AI is taking cybersecurity jobs at junior an\u2026)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>6. London wants AI near misses reported<\/h4>\n<p class=\"meta\">CSO Online &middot; UK Parliament &middot; October 20&ndash;23, 2026<\/p>\n<p>The UK Financial Conduct Authority&rsquo;s chief data officer, Jessica Rusu, told a Bloomberg policy audience on Monday that firms should have to report serious AI failures and close calls. &ldquo;Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses,&rdquo; she said. CSO&rsquo;s Evan Schuman reports the FCA did not answer questions on how it would define those terms. Gartner&rsquo;s Nader Henein noted that European central banks and the European Systemic Risk Board have recently raised the cyber risk level for frontier models to &ldquo;severe&rdquo;.<\/p>\n<p>Critics see two problems. Malwarebytes&rsquo; Pieter Arntz warned the approach could become a &ldquo;paper tiger&rdquo; if penalties are weak, and Noah Kenney of Digital 520 pointed out that a near-miss duty can reward the firms with the weakest monitoring, since they will find fewer events to report.<\/p>\n<p>The wider UK vehicle is the Cyber Security and Resilience (Network and Information Systems) Bill, which returns to the House of Lords for report stage on Monday, 26 October. It strengthens cyber duties for providers of essential services such as healthcare, water and energy, brings in additional sectors including data centres and managed service providers, updates incident reporting to an initial notice within 24 hours and a full report within 72, and gives the government powers to direct organisations on national-security grounds. Backbench amendments tabled for report stage would require frontier-model developers to notify regulated organisations whose systems their models have breached, and let operators report near misses voluntarily without increasing their liability. For UK financial and essential-service operators, a working definition of an AI near miss, and a way to detect one, is worth having before either route makes it mandatory.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/www.csoonline.com\/article\/4238124\/enterprises-should-report-ai-breaches-and-near-misses-says-uk-financial-regulator.html\">CSO Online (Enterprises should report AI breaches and &#39;n\u2026)<\/a> &middot; <a href=\"https:\/\/www.parliament.uk\/business\/news\/2026\/october-2026\/cyber-security-and-resilience-network-and-information-systems-bill-undergoes-further-scrutiny-in-the-lords\">UK Parliament (Cyber Security and Resilience (Network and I\u2026)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>7. JFrog moves audit evidence into the release pipeline<\/h4>\n<p class=\"meta\">JFrog &middot; October 21, 2026<\/p>\n<p>JFrog used its swampUP Europe event in Barcelona to announce DevGovOps capabilities aimed at a familiar CISO pain point: the scramble to assemble evidence when auditors or regulators ask how a release was controlled. The centrepiece is an out-of-the-box DORA compliance framework of pre-mapped policy-as-code controls covering ICT change management, source and component integrity, vulnerability and patch management, resilience testing and incident management, which customers switch on rather than build. Repository-level policies let governance vary by an artifact&rsquo;s purpose, sensitivity or lifecycle stage.<\/p>\n<p>The more novel piece is AI Verification Policies: teams write policies in plain language, a language model evaluates each release against them, and every evaluation produces signed proof of compliance &mdash; for example, confirming that each pull request maps to its original ticket. For the EU Cyber Resilience Act, JFrog&rsquo;s AppTrust monitors released components for vulnerabilities, generates a standards-based SBOM for each release and keeps scanning and remediation records attached to it, supporting the act&rsquo;s 24-hour early-warning and 72-hour notification duties; CRA fines can reach &euro;15 million or 2.5% of global turnover. The DORA framework and AI Verification Policies are available now. &ldquo;Regulations now demand more controls and visibility, backed up by evidence for every release,&rdquo; said JFrog co-founder and CTO Yoav Landman.<\/p>\n<p>Strategically, the shift is from compliance as a periodic project to compliance as a property of each release. JFrog cites survey figures showing 59% of companies regularly compromise on compliance under business pressure. Whatever tooling you use, the question for the CISO is the same: if a regulator asked tomorrow for the control evidence behind last month&rsquo;s production releases, could you produce it without a war room?<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/jfrog.com\/press-room\/jfrog-ends-the-audit-scramble-delivers-new-devgovops-capabilities-with-signed-compliance-evidence-for-every-release-without-slowing-development\/\">JFrog (JFrog Ends the Audit Scramble: Delivers New\u2026)<\/a><\/p>\n<\/p><\/div>\n<div class=\"article\">\n<h4>8. The PHP scare: a preview of the AI-speed patch window<\/h4>\n<p class=\"meta\">TechCrunch &middot; Transformer &middot; PC Gamer &middot; October 23&ndash;24, 2026<\/p>\n<p>This week&rsquo;s PHP vulnerabilities were the clearest live demonstration yet of what security leaders have been warned about all year. Site owners were told to patch immediately or take their sites offline; government websites and the Internet Archive went dark to patch, Transformer reports, and details leaked before fixes were out. On TechCrunch&rsquo;s weekly discussion, Kirsten Korosec estimated that PHP-based content management systems such as WordPress and Drupal run about 70% of websites, and the flaw had sat in PHP for decades. Cloudflare&rsquo;s chief executive said attempted exploitation had reached millions, and Amazon&rsquo;s threat intelligence team saw attempts on its honeypots before public disclosure.<\/p>\n<p>AI was part of the story at both ends. Transformer says the flaws were found through OpenAI&rsquo;s vulnerability-discovery programmes, which gave critical-infrastructure providers more than two months to fix them before disclosure, and that OpenAI also reported a separate Node.js flaw patched the same week. TechCrunch&rsquo;s correction says human researchers found the PHP bugs and used AI to exploit them. Either way, the cycle from discovery to working exploit to mass scanning is now measured in days. &ldquo;Feels like March 1, 2020 for Cyber,&rdquo; former OpenAI executive Joshua Achiam wrote. TechCrunch&rsquo;s Sean O&rsquo;Kane was blunter about the web itself: &ldquo;it is held together with glue and dreams.&rdquo; Cloudflare chief executive Matthew Prince told Reuters, as reported by PC Gamer, to expect incidents like this regularly as language models speed up bug discovery, and said Cloudflare knows of several other severe vulnerabilities in critical software. &ldquo;I think we&rsquo;re going to have a couple years where every single week it&rsquo;s going to feel like the sky is falling,&rdquo; he said, though he expects software to become more secure over time as the flaws are found and fixed.<\/p>\n<p>For a CISO the lessons are practical. Know where PHP and other ubiquitous runtimes sit in your estate, including in vendor-hosted marketing sites. Pre-agree who can take a public-facing system offline when a fix is not yet available. And measure your real time to patch internet-facing assets, because this week it had to be shorter than Moody&rsquo;s three-month median by a wide margin.<\/p>\n<p style=\"font-size:13px;color:#6b7280;margin:0;\">Sources: <a href=\"https:\/\/techcrunch.com\/2026\/10\/24\/will-ai-expose-the-rickety-infrastructure-of-the-internet\/?ref=refetch.io\">TechCrunch (Will AI expose the rickety infrastructure of\u2026)<\/a> &middot; <a href=\"https:\/\/www.transformernews.ai\/p\/php-flaw-cyberpocalypse-is-here-sort-of\">Transformer (The cyberpocalypse is here \u2014 sort of)<\/a> &middot; <a href=\"https:\/\/www.pcgamer.com\/software\/security\/every-single-week-its-going-to-feel-like-the-sky-is-falling-cloudflare-ceo-says-strap-in-for-a-couple-years-of-ai-powered-internet-security-mayhem\/\">PC Gamer (&#39;Every single week it&#39;s going to feel like t\u2026)<\/a><\/p>\n<\/p><\/div>\n<p>            <!-- Calls to action --><\/p>\n<div class=\"watchlist\">\n<h2>Calls to action<\/h2>\n<ul>\n<li><strong>Build an agent inventory with owners.<\/strong> List every AI agent in production and in employees&rsquo; hands, name an accountable owner for each, and retire any agent nobody will claim.<\/li>\n<li><strong>Make every agent action auditable.<\/strong> Only 49% of organisations can audit every action an agent takes. Log agent actions under their own identities and route high-impact actions, such as production changes or payments, to a person for approval.<\/li>\n<li><strong>Replace standing agent permissions with short-lived ones.<\/strong> Issue task-scoped, expiring credentials and add agents to your quarterly access reviews so autonomy cannot creep in unnoticed.<\/li>\n<li><strong>Measure your time to fix known exploited flaws.<\/strong> Moody&rsquo;s found a median of nearly three months. Report your own figure for internet-facing systems to the board and finance team, and set a target in days.<\/li>\n<li><strong>Pre-authorise taking a public site offline.<\/strong> The PHP disclosure left some owners choosing between patching and going dark. Decide now who can make that call, and for which systems, when no fix exists yet.<\/li>\n<li><strong>Tier your technology suppliers by blast radius.<\/strong> Most breach victims were hit through a third party. Identify the suppliers whose compromise would expose your data and confirm their notification terms before renewal.<\/li>\n<li><strong>Write a working definition of an AI near miss.<\/strong> UK financial and essential-service operators should not wait for the FCA or Parliament: define what you would log, who reviews it and how you would report it.<\/li>\n<li><strong>Test your release-evidence trail.<\/strong> Pick last month&rsquo;s production releases and ask how long it would take to show an auditor the controls, scans and approvals behind each. If the answer is a war room, automate the evidence capture.<\/li>\n<li><strong>Settle who owns AI security.<\/strong> Agree with your CEO whether a head of AI security reports to the CISO, and protect entry-level security roles in 2027 planning so the talent pipeline survives automation.<\/li>\n<\/ul><\/div>\n<p>            <!-- QUOTE_OF_THE_WEEK_START --><\/p>\n<div style=\"margin:24px 0 10px 0;padding:18px 22px;border-left:4px solid #ca8a04;background:#fefce8;border-radius:0 8px 8px 0;\">\n<p style=\"margin:0 0 6px 0;font-size:12px;font-weight:700;letter-spacing:0.08em;text-transform:uppercase;color:#854d0e;\">Quote of the week<\/p>\n<p style=\"margin:0;font-size:16px;line-height:1.55;font-style:italic;color:#1f2937;\">&ldquo;A ratings agency now says unpatched flaws will raise your borrowing costs. Congratulations: your vulnerability backlog finally has an interest rate, and it compounds faster than the patches.&rdquo;<\/p>\n<p style=\"margin:8px 0 0 0;font-size:13px;color:#6b7280;\">&mdash; The Newshunter desk<\/p>\n<\/p><\/div>\n<p>            <!-- QUOTE_OF_THE_WEEK_END --><\/p>\n<\/td>\n<\/tr>\n<p>        <!-- Footer --><\/p>\n<tr>\n<td class=\"footer\">\n<p class=\"brand\">The CISO Brief<\/p>\n<p>A weekly intelligence bulletin from Security Radar LLC.<br \/>\n            Curated by Paul Davis &middot; <a href=\"mailto:paul.davis@security-radar.com\">paul.davis@security-radar.com<\/a><\/p>\n<p>&copy; 2026 Security Radar LLC. All rights reserved.<\/p>\n<p>Article titles and summaries are excerpted for review and commentary; all linked articles remain the copyright of their respective publishers and authors.<\/p>\n<p>*|LIST:ADDRESS|*<\/p>\n<p><a href=\"*|ARCHIVE|*\">View this email in your browser<\/a> &middot; <a href=\"*|UNSUB|*\">Unsubscribe<\/a><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>October 25, 2026 &middot; Weekly Edition The CISO Brief This was the week weak security got a price tag. Moody&rsquo;s says unpatched flaws will raise borrowing costs, insurers report fewer but far larger claims, and Kroll finds most breach victims were hit through a supplier. Microsoft told customers to treat&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,12,42],"tags":[],"class_list":["post-6154","post","type-post","status-publish","format-standard","hentry","category-editorial","category-regulations","category-security-industry-news"],"_links":{"self":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6154","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6154"}],"version-history":[{"count":1,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6154\/revisions"}],"predecessor-version":[{"id":6177,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/6154\/revisions\/6177"}],"wp:attachment":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6154"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6154"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6154"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}