Agentic attacks, a CA slip, and quantum questions
Free weekly email
This went to subscribers on November 10. Get the next one.
One email every Tuesday: what changed in security and compliance that week, and what it means if you sell to enterprise buyers.
Free. Unsubscribe in one click, and replies reach Jacob directly. Read the latest issue or browse the archive.
Two breaches this week landed at companies whose whole business is trust, which is a useful reminder that buyers do not care how security-serious you are on paper. There is also new joint guidance that is going to turn up in your next vendor questionnaire, and a legal argument worth reading before your next incident. Five things, with what I make of each.
Chainalysis says every user's credentials were exposed
Source: The Hacker News
Chainalysis disclosed that an October intrusion, which it described as using offensive agentic techniques, exposed names, usernames, password hashes and live tokens for all of its users. The company removed access to Reactor and Data Solutions while it investigated. It has said it has no evidence that investigations data was accessed.
The detail I would focus on is live tokens, not password hashes. If an attacker holds valid session tokens, a password reset email accomplishes nothing, and most of the fintech products I test have no tested way to invalidate every session at once. Build that switch and pull it in a tabletop before you need it in anger, because pulling product access the way Chainalysis did is only an option if you have the plumbing for it.
DigiCert exposed an internal system after a server migration
Source: BleepingComputer
DigiCert says an internal business system was reachable from the internet when it was not meant to be, following a server migration. Someone created an unauthorized account on it. Customer information and identity documents were exposed.
This is a change management failure at a certificate authority, which tells you something about how ordinary the failure mode is. Your SOC 2 auditor will ask whether infrastructure changes are reviewed and whether you know what is publicly exposed, and the honest answer at most companies your size is that someone eyeballs it. An external attack surface scan running on a schedule, with a ticket when something new appears, closes this gap for very little money.
The argument that breach counsel gets sued next
Source: DataBreaches.net
Mark Rasch lays out a scenario where a breached company's outside counsel coordinates the forensic investigation, advises on notification timing and disclosure, and is later named as a defendant alongside the company when affected individuals sue. The piece treats law firms running breach response as a plausible next target for plaintiffs.
Running forensics under privilege is standard practice and I understand why. The cost shows up when the technical findings stay locked in a legal workflow and never reach the engineers who have to fix the thing, which I have watched happen. Decide now, while nothing is on fire, who gets the forensic detail and how remediation work gets tracked, because that decision made during an incident will be made badly.
CISA publishes the post-quantum questions your buyers will reuse
Source: CISA
CISA, Australia's ACSC and the NSA released joint guidance plus a quick-reference list of questions organizations can ask vendors about readiness for post-quantum cryptography. The material frames the transition around the eventual risk that cryptographically relevant quantum computers pose to public-key cryptography.
Nobody is breaking your TLS this quarter, so treat this as a sales problem rather than an engineering emergency. Lists like this get copied straight into enterprise vendor questionnaires, and a large US financial buyer will ask you about crypto agility long before it matters technically. Spend an afternoon building an inventory of where you use public-key crypto and write a short, honest statement of your plan, and you will be ahead of most of your competitors on that question.
AI governance budgets are up and nobody feels more in control
Source: Help Net Security
DNSFilter's shadow AI report found 74.5% of respondents had a larger security budget than a year earlier, with 40.3% naming AI security and governance as the destination for the next incremental dollar and 25.5% naming cloud security. The report ties the priority to how much access employees hand to AI tools.
It is a vendor survey, so hold the percentages loosely, though the direction matches what I see in questionnaires coming back from US buyers. Those buyers are asking which AI services touch customer data, whether they are subprocessors, and what stops an engineer from pasting production data into a chat window. An AI use policy with a maintained list of approved tools and some evidence of enforcement answers all three, and buying a governance product before you have written the policy gets the order backwards.
Quiet week for regulators, noisy one for anyone whose vendors were in the headlines. I will be watching whether the agentic attack framing holds up as more detail comes out of the Chainalysis investigation.
Jacob
Free weekly email
Get the next issue on Tuesday
One email a week from Jacob Masse: the security and compliance stories that changed something that week, and what each one means if you sell software to enterprise buyers. Five stories, a take on each, five minutes to read.
Free. Unsubscribe in one click, and replies reach Jacob directly.