The Hacker News | Expert Insights

When I work on an incident, the first question I ask is almost never "what malware ran." It's "whose credentials did it use, and what was that account allowed to touch." Nine times out of ten, the interesting part of the story isn't the exploit. It's the access. The exploit gets you in the door. The privilege is what lets you walk through the building. For thirty years, that question had a human-shaped answer. A person clicked something, a person got phished, a person reused a password, an admin left a service account sitting on a domain controller with a password from 2014. The identity at the center of the incident belonged to somebody with a badge and a manager. That assumption is quietly dying, and most enterprises have not adjusted their controls to match. The actor on your network is increasingly not a person at all. It is a workload, a script, a bot, an API (application programming interface) client, and now an AI agent that can reason, plan...

Attackers prefer the path of least resistance. Why break in when you can log in? That is what makes working credentials so valuable. A leaked password, token, or API key does more than reveal sensitive data; it offers a way in. No vulnerability or privilege escalation chain necessary. If the credential is valid, the attacker can simply use it, and the session will look like ordinary activity. This shifts the questions from "where can attackers break in?" to "where do usable keys tend to accumulate? Increasingly, the answer is the developer laptop: one of the most instrumented machines most companies own, and one of the easiest places for credentials to go unnoticed. The endpoint is watched for malware, behavior, posture, and configuration. But a valid plaintext credential is something else: a door an attacker may not need to force. A fully patched fleet can still have usable keys scattered across its devices, enough to turn one foothold into something much larger....

Why Authentication Context Matters Most people think logging in is a small act. Type your password, type your code, tap a screen, scan a face, and move on. But to the systems on the other side, the method behind that moment can matter just as much as the fact that it happened at all. That is where two strangely named but surprisingly important identity concepts enter the story: OIDC’s AMR and SAML 2.0’s AuthnContext. They sound like the kind of acronyms that only standards committees could love, yet both were created to answer a deeply human question in digital form: How sure a system has to be before it trusts someone? The backstory starts with the internet growing up. Early online services often treated authentication as a light switch: either the user was in, or the user was out. But as online systems began handling payroll, health records, taxes, academic data, contracts, and financial approvals, that simple model started to crack. A login backed by a reused password is not ...

Cybersecurity is entering a new phase. It's one where the gap between awareness and operational execution is becoming the industry's biggest challenge. That's what stood out to me most after reviewing the results of the 2026 Bitdefender Cybersecurity Assessment , which found that organizations have never had greater insight into the risks they face, yet turning that understanding into meaningful action remains a persistent challenge. Nowhere is that gap more visible, in my view, than in how organizations handle breach transparency. We surveyed 1,200 IT and cybersecurity professionals across six countries: France, Germany, Italy, Singapore, the United Kingdom, and the United States. Respondents ranged from frontline employees to IT managers to CISOs, all working within organizations with 500 or more employees. A Governance Problem, Not an Attacker Problem One of the most troubling findings in our report is not about attacker behavior. It's about internal respons...

The most important cybersecurity impact of artificial intelligence is not that attackers can write better phishing emails or automate parts of their workflow. It is that AI is changing the speed, scale, and decision-making dynamics of cyberattacks.  That creates a problem many organizations have not yet fully confronted: most cyber governance and incident response models were designed for human-speed attacks.  For years, security teams operated under a familiar sequence. Detect suspicious activity. Investigate. Validate the threat. Escalate to leadership. Decide on containment. Communicate with stakeholders. That model still has value, but it assumes defenders have enough time to build confidence before taking material action.  AI-enabled attacks challenge that assumption.  Adversaries can now use AI to accelerate reconnaissance, generate highly personalized social engineering, modify malware, test payloads, summarize stolen data, identify vulnerabilities, a...

For years, our industry has treated “blocking” as the gold standard. If the email didn’t land, if the malware didn’t execute, if the alert fired in the SIEM, we called it a win. That mindset made sense in a world where most attacks came through a handful of familiar doors. But AI has changed the game. We’re not dealing with hobbyists sending out clumsy phishing attacks anymore. Modern adversaries are running multi‑channel, AI‑assisted businesses at machine speed. And if all you’re doing is blocking at the edge, you’re not really defending. You’re just delaying. Generative AI has made it trivial to spin up highly personalized, multi‑step social engineering campaigns that operate simultaneously across email, collaboration apps, mobile, social media, and paid media. The result is a social engineering attack chain : a sequence of stages designed to manufacture trust, erode judgment, and bypass brittle controls. You don’t beat that by tuning another filter. You have to disrupt the at...

Modern attacks are not primarily defeating infrastructure. They are inheriting trust. Identity Did Not Become Important. It Became Infrastructure. Security teams still talk about identity as though it is one security discipline among many, sitting beside endpoint protection, cloud security, network defense, and vulnerability management. That framing no longer reflects how modern enterprises actually operate. Modern business environments run on identity, delegated trust, cloud roles, automation pipelines, APIs, machine permissions, and continuously exchanged credentials. Users authenticate into SaaS platforms that the organization does not own. Workloads assume permissions that nobody provisions manually. Services trust other services built across years of acquisitions, migrations, technical debt, and operational compromise. The enterprise is no longer running on infrastructure alone. It is running on identity. Attackers recognized this shift before many defenders did. That i...

Launching a ransomware attack used to take real effort. Now, thanks to AI, almost anyone can launch a sophisticated attack, which changes the game for everyone responsible for protecting businesses. Reconnaissance that once took hours now takes minutes. Phishing emails that used to require careful crafting can now be generated at scale and sent to hundreds of targets simultaneously. IBM's 2025 Cost of a Data Breach Report found that AI reduced the time required to create phishing emails from 16 hours to just 5 minutes. For MSPs managing dozens or hundreds of clients, and for internal IT teams holding the line across an entire organization, understanding how AI is changing ransomware is key to staying ahead of the threat and minimizing disruption when attacks occur. The attack that starts in the inbox Before attackers can encrypt files or demand a ransom, they first need a way into the organization. One of the easiest ways to get that access is by tricking someone into cli...