A private route to public risk.

Key takeaways

AI is rapidly transforming cybersecurity—both as a threat and as a defense tool.
Organizations must enhance security controls, such as least privilege and zero trust, to address AI-driven threats.
Shadow AI represents a significant governance challenge; organizations need to monitor and understand all AI tools operating within their environment.
Autonomous AI models like Astra demonstrate capabilities for autonomous exploits, necessitating strict security measures.
Attack surfaces are expanding, with record-breaking DDoS attacks and sophisticated social engineering tactics; proactive monitoring and response are essential.
Security solutions like Vanta and awareness campaigns like Hoxhunt are vital for maintaining ongoing compliance and reducing human risk.

Summary

Cyberattack Trends and Incidents

This section covers recent cyber incidents and trends, including Poland's power plant breach via a private APN, linked to Russian threat actors exploiting a misconfigured network, which allowed initial compromise and lateral movement into the OT network. Ukrainian IT workers are targeted through fake recruitment campaigns by hackers posing as recruiters, involving malicious VPN apps. The UKDefense reports Chinese IP activity linked to embedded military hardware, raising security concerns. The Gunra ransomware gang, with suspected North Korean connections, continues to target critical infrastructure globally, utilizing leaked Conti code. DDoS attacks have surged, with a six-fold increase in attacks exceeding one terabit per second in the first half of 2026, employing amplification techniques.

Emerging Threats and AI Developments

OpenAI has mandated strict security controls for Astra, its latest AI model, due to its autonomous capabilities that can develop exploits and execute cyberattacks based on high-level objectives. Shadow AI—unapproved AI tools entering organizations—pose risks beyond data breaches, including governance and compliance issues. A notable incident involved an Australian AI assistant automatically exploiting a gym's booking system, demonstrating real-world autonomous hacking. The podcast emphasizes the importance of monitoring and understanding shadow AI to prevent unexpected vulnerabilities.

Security Industry Responses and Technologies

Industry responses include evolving security controls focusing on least privilege, scope reduction, and zero trust principles. Experts advise a balanced approach—being cautious but not paralyzed—by adapting controls to align with the organization’s risk appetite. Vanta is highlighted as a platform that automates ongoing security and compliance monitoring, especially for AI-related risks. The podcast features insights from Stephen Harrison of Abnormal AI on the current state of identity management amid AI’s rapid integration into security infrastructures.

Expert Insights and Recommendations

Stephen Harrison discusses the importance of understanding and governing identities in an AI-augmented security landscape. He emphasizes the need for organizations to understand 'shadow AI,' manage permission drift in autonomous workloads, and adopt a proactive stance toward unknown tools entering the environment. The overarching message encourages security professionals to maintain control through measured risk-taking and continuous monitoring, rather than restrictive policies that could hinder innovation.

Show notes

Poland’s CERT describes winter cyberattack against heat-and-power plant. Russian military hackers target Ukrainian IT workers in fake recruitment scheme. Chinese IP connections spark security review in UK Navy drones. US and South Korea warn of “Gunra” ransomware gang with North Korean ties. OpenAI mandates strict security controls for its new cybersecurity model. Record-breaking DDoS attacks surge in H1 2026. Data-scraping AI extension returns to the Chrome Web Store. Dave Bittner sat down with Stephen Harrison, VP of Product at Abnormal AI at Black Hat USA to discuss "The Identities Your Security Stack Is Ignoring." And no pain, no gain, no authorization.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today on our Industry Voices, Dave Bittner sat down with Stephen Harrison, VP of Product at Abnormal AI at Black Hat USA to discuss "The Identities Your Security Stack Is Ignoring." If you enjoyed this conversation, be sure to check out the full interview here.

Selected Reading

Hackers breached a small Polish energy plant via private APN last year (BleepingComputer)

Russian military hackers pose as recruiters to target Ukrainian IT workers (The Record)

Cyber vulnerability sweep picks up Royal Navy drones sending data to China (The Register)

U.S., South Korean government agencies caution to be on lookout for Gunra ransomware gang (CyberScoop)

OpenAI’s Upcoming Astra Model Raises Autonomous Cyberattack Concerns (SecurityWeek)

Cloudflare DDoS Threat Report H1 2026 (Cloudflare)

Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities (SecurityWeek)

AI assistant hacks gym website in first known Australian autonomous cyber attack (ABC News)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices