Patch NetScaler, then check your subprocessors

When the Cyber Centre updates the same alert twice inside a week, that usually means the situation on the ground is moving rather than the paperwork. If you have a NetScaler in front of anything, patch it and then go looking for signs it was already touched, because applying an update does not undo access somebody already has. I have seen enough internet-facing appliances during assessments to say this plainly: the gateway is the part of the stack that gets owned, and it is almost never the part anyone has an owner for.

This is the shape of incident that most damages a B2B vendor, because the people harmed are your customer's people and your customer has to tell them. Pull your subprocessor list this week and read what your own contracts actually commit you to when one of your vendors is the one that gets hit, including how many hours you have to notify and who signs the notice. Most of the Canadian teams I work with can produce the list, and very few can produce the notification clock from memory.

If you shipped an AI feature in the last year, it probably got a lighter design review than the rest of your product, and the credentials behind it are probably broader than they need to be. Treat the agent runtime as an untrusted execution environment: separate account, scoped role, no long-lived keys sitting where the model can see them. US buyers have started adding agent questions to their security questionnaires, and "we use Bedrock" is not an answer to any of them.

Police action against this crowd reads well and changes very little about your exposure, as the week after the arrest demonstrated. ShinyHunters makes its money pulling customer records out of SaaS platforms and connected business applications, which is a precise description of what your production database holds. The control that matters is boring and unglamorous: tight scoping on OAuth integrations, detection on bulk export, and an honest answer to how much data one compromised support account can pull.

Fintech readers will recognise this because their own customers run the same cycle, and it is why enterprise security reviewers now ask to see the exception list rather than the clean scan. An exception with a named owner, a stated compensating control and a date that has not moved twice is defensible in a SOC 2 audit and in a buyer call. One that has rolled over three quarters tells the reviewer something about your engineering culture, and it is never the thing you wanted it to say.