Global Microsoft 365 Outage Disrupts Businesses & Government Services
The global Microsoft 365 outage that began on November 12, 2026, caused widespread disruption for businesses and government organizations relying on services like Outlook, Teams, and Copilot. Microsoft attributed the downtime to infrastructure and configuration issues rather than a cyberattack, noting that server failures triggered automated re-routing that overwhelmed the remaining systems. Even though patches provided some improvement, the incident left countless organizations unable to send emails, manage identity protocols, or access essential shared documents. This failure highlighted the operational risks of heavy cloud dependency on a single technology provider. Government agencies, police forces, airlines, and corporations all faced severe operational hurdles, proving that standard business continuity plans are ineffective if they are stored on the very platforms experiencing the outage. The event underscores the critical need for robust operational resilience. Organizations are advised to map their exact cloud dependencies, establish alternative communication channels, and conduct tabletop exercises to test their true readiness for prolonged service disruptions before they occur.
Define Your Business’s Operational Technology Before Attackers Do It For You
Recent hacks on supermarket refrigeration systems reveal a serious problem: many companies do not know which equipment actually runs their business, but attackers certainly do. Operational technology is not limited to heavy factory machinery. It includes any physical system that halts operations if it stops working, such as an MRI machine in a hospital or a trading system in a financial firm. This is completely different from standard connected devices like smart thermostats or security cameras, which might cause annoyance if they fail but do not stop revenue. The real danger is not just that these critical systems have software flaws. The danger is that companies are leaving them directly exposed to the open internet. This is a basic failure, not an advanced attack. Today, attackers use automated tools and artificial intelligence to easily find and exploit these exposed systems. Instead of looking for complicated new software, companies need to focus on simple fundamentals. You must identify exactly what equipment keeps your business running, understand the true risks, remove unnecessary internet access, and apply standard security controls before the next incident occurs.
An AI kill switch isn’t enough. Build a fallback plan
The article argues that an AI “kill switch” is necessary but insufficient because organizations also need a practical way to keep business processes running after an AI agent is stopped. Recent AI outages and an incident involving autonomous agents inside Hugging Face illustrate two sides of the problem: AI can become unavailable when needed or continue operating when it should stop. In either case, an emergency shutdown becomes difficult if teams have not planned what happens next. The author recommends designing the fallback before deploying the AI system. Every agent workflow should have a clearly defined off-state covering new, queued, and unfinished work, with an identified alternative such as a human queue or rule-based process. Shutdown controls should operate independently of the agent, while checkpoints should make it possible to understand and reverse incomplete actions. Organizations should also impose tighter limits during degraded operations and regularly test the handoff to fallback processes. The central message is simple: resilience depends not merely on being able to stop AI safely, but on ensuring the business can continue operating without it.
AI tears through legacy TCP/IP stacks, exposing vulnerabilities across critical infrastructure, OT and IoT devices
A recent report by Forescout Research demonstrates how artificial intelligence is dramatically accelerating the discovery of software vulnerabilities, fundamentally shifting the economics of cybersecurity. By using widely available AI models, researchers reduced the time needed to analyze foundational networking software from nine months to just ninety hours. The system successfully uncovered nearly one hundred vulnerabilities across commonly used networking stacks, including sixty six previously unknown issues. Remarkably, the entire automated analysis cost under one thousand dollars. While this efficiency highlights how AI can empower security teams, it also severely lowers the barrier to entry for potential attackers. The findings are particularly concerning for critical infrastructure, medical devices, and operational technology, which frequently rely on these shared components. Because many of these embedded systems are aging legacy devices that are difficult or impossible to update, a single flaw can expose a massive supply chain to serious risks. Consequently, experts advise organizations to focus on practical risk containment rather than waiting for software patches. This approach includes isolating unpatchable equipment, reducing unnecessary network exposure, and prioritizing mitigation strategies based directly on actual operational impacts.
Cloud reports measure the wrong thing
The article critiques recent cloud industry reports, pointing out that while they accurately capture the rising complexity and costs associated with modern cloud computing and artificial intelligence, their conclusions are often skewed by inherent biases. Many vendor funded surveys frequently frame the increased spending on governance, financial operations teams, and hybrid cloud setups as signs of strategic maturity or the dawn of a new era focused on value. However, the author argues that these management structures are often just expensive bandages meant to cover up poor initial architecture, mounting technical debt, or unplanned expansions, rather than serving as deliberate, well planned strategies. While adding new dashboards and governance tools can certainly help highlight financial waste, these tools cannot fix fundamentally flawed system designs or workloads that were placed in the wrong environment to begin with. Furthermore, the survey data driving these industry narratives is typically drawn directly from cloud professionals and sponsored by vendors, creating a predictable echo chamber that prescribes buying more management tools instead of investing in better foundational engineering. Ultimately, achieving real success requires strict architectural discipline instead of just applying better accounting overlays.
Cyber Resilience Act: Due Diligence Obligations For Third-party Components
The EU Cyber Resilience Act (CRA) makes manufacturers responsible for the cybersecurity of an entire product with digital elements, including third-party hardware, software, open-source components, and certain connected services. Manufacturers cannot simply rely on supplier assurances. They must carry out risk-based due diligence when integrating components, with the depth of review reflecting each component’s security risk. Measures can include checking CE marking where applicable, reviewing security-update practices, examining known vulnerabilities, and conducting additional testing. Legacy and open-source components remain permitted, but manufacturers must ensure they do not weaken the final product. The CRA also requires manufacturers that discover vulnerabilities in integrated components to notify upstream manufacturers or maintainers and share fixes they develop where required. These responsibilities have important contractual consequences. Supplier agreements may increasingly need clear provisions covering secure development, vulnerability management, security updates, incident notification, documentation, testing, and cooperation with regulators. The article concludes that standard compliance clauses are unlikely to be sufficient: manufacturers will need stronger evidence and contractual assurance that suppliers can support continued CRA compliance throughout a product’s lifecycle.
How one AI agent exposed five critical enterprise security gaps
When non-technical employees build AI agents to automate daily tasks, they often bypass traditional security measures, creating dangerous blind spots for organizations. A recent analysis explores a realistic scenario where an accounts worker creates an AI tool to process invoices between an email inbox, an enterprise resource planning system, and a messaging platform. Because the agent relies on a mix of personal API keys and persistent access grants, the security team has no visibility into its existence. This lack of oversight sets the stage for a critical failure when a malicious email tricks the agent into altering vendor payment details. The incident highlights five distinct security gaps that companies must address. First, organizations need to understand how mixed credentials obscure activity logs. Second, they must treat all external inputs as potential commands that could manipulate the agent. Third, baseline behavior monitoring is essential to catch abnormal actions, like an agent writing data for the first time. Finally, companies must implement strict credential expiry policies and ensure they can safely pause compromised agents to preserve evidence. By addressing these fundamental flaws, organizations can safely embrace automation without adding unnecessary risk.
AI Won’t Save Your Culture. It Will Expose It: Part I: When Intelligence Is Cheap, Judgment Becomes Priceless
The rapid adoption of artificial intelligence does not replace the need for a strong organizational risk culture; rather, it makes human judgment more vital than ever. When an AI model generates an unexpected output or a shadow application leaks data late at night, it is not a policy binder that determines how the issue is handled, but the psychological safety and culture of the team. As the risk landscape becomes increasingly volatile and complex, security leaders and executives are overwhelmed by machine-generated alerts and dashboards. In this environment, AI can process vast amounts of data at incredible speeds, but it cannot decide what risks an organization should tolerate or translate technical vulnerabilities into clear business decisions. Consequently, the roles of human leaders are shifting toward critical thinking, effective communication across departments, and constructively challenging automated conclusions. Because AI often presents answers with a false sense of authority, experienced professionals must rely on their judgment to separate meaningful signals from digital noise. Ultimately, AI might accelerate workflows and analysis, but human courage and culture remain the true safeguards of enterprise stability.
Attackers in Binance Breach Targeted Known Weakness, Missing Controls
The article examines how attackers exploited weaknesses in Binance’s security controls to steal billions of dollars in cryptocurrency, showing how quickly a compromise can turn into a major loss. The attackers first compromised developer systems, gaining signing privileges that allowed them to create pre-signed authorizations. They then abused Ethereum’s EIP-7702 smart-account mechanism to install malicious “sweeper” code that could continue transferring funds even after Binance restricted withdrawals and hot-wallet services. Binance detected unusual activity within minutes, but the malicious authorization remained active for about four hours. The incident highlights why crypto firms need protection beyond monitoring blockchain transactions. Security teams should closely control developer identities, credentials, signing systems, repositories, cloud environments, and transaction authority. They also need mechanisms for quickly revoking privileges, pausing transfers, isolating wallets, and stopping wallet refills. These measures should be tested regularly rather than first relied upon during an attack. The broader lesson is that cryptocurrency security depends on detecting suspicious activity early, limiting who and what can authorize transactions, and having rehearsed containment procedures that can operate quickly when normal controls are bypassed.
When Your Email Goes Down, Does Your Incident Response Go With It?
When a major platform like Microsoft 365 experiences an outage, it exposes a critical vulnerability in most corporate incident response strategies: the tools required to manage the crisis are often hosted on the exact network that just went down. A recent outage proved that simply maintaining an alternative communication method, such as a phone tree or an external messaging app, is not enough to sustain an effective response. While these fallback options keep people talking, they fail to provide the structured playbooks, task assignments, and timestamped decision logs necessary for proper incident management and regulatory compliance. Even without malicious intent behind an outage, the resulting confusion and backlog of unscreened messages create prime opportunities for attackers to strike. To truly protect the organization, security teams must establish a dedicated, out-of-band incident response platform that operates independently from the primary corporate stack. This ensures that when the main system fails, responders can still orchestrate their workflow, track obligations, and maintain clear command without missing critical regulatory deadlines or losing essential evidence of their actions.
_Dzmitry_Skazau_Alamy.jpg?width=1280&auto=webp&quality=80&disable=upscale)
