Daily Cyber & AI Briefing — 2026-04-28

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Transcript

Today’s cyber and AI risk landscape is defined by rapid change, persistent threats, and a growing gap between innovation and governance. Across industries, organizations are accelerating their adoption of AI, integrating it into business processes, customer engagement, and even critical infrastructure. Yet, as these technologies proliferate, so do the risks—many of which remain hidden beneath the surface.

Let’s start with a stark statistic from a recent Lenovo study: 70% of enterprise AI is currently uncontrolled. What does “uncontrolled” mean in this context? Essentially, these are AI systems and tools operating outside of formal governance frameworks. They might be embedded in third-party applications, spun up by business units without IT involvement, or even integrated by employees through shadow IT. The implications are significant. Without oversight, these AI assets can introduce data leakage risks, compliance violations, and operational inefficiencies. They can also drive up costs and slow down return on investment, as organizations struggle to manage and optimize what they can’t see.

For security and risk leaders, this is a call to action. Inventorying and monitoring all AI assets—whether internally developed, purchased, or hidden within third-party tools—must become a top priority. If organizations fail to address uncontrolled AI, they risk regulatory penalties, reputational damage, and the loss of trust among customers and partners. The message is clear: you can’t secure what you don’t know exists.

While organizations grapple with hidden AI, threat actors are evolving their tactics as well. One recent example is the Silver Fox malware campaign. This campaign stands out for its use of highly convincing phishing emails, masquerading as tax audit alerts or urgent software updates. The attackers are leveraging social engineering to bypass traditional email defenses, luring both individuals and organizations into downloading malicious payloads. The sophistication of these lures means that even well-trained users can be caught off guard.

The practical takeaway here is twofold. First, user awareness training remains essential, but it must be ongoing and adaptive to new threat vectors. Second, technical controls—such as advanced email filtering and rapid incident response capabilities—are critical to containing the damage when, inevitably, someone clicks. Silver Fox is a reminder that phishing campaigns continue to be a primary entry point for attackers, and that layered defenses are more important than ever.

But phishing isn’t the only game in town. Attackers are also exploiting technical vulnerabilities at a rapid pace. A newly discovered zero-click vulnerability in Windows, for example, allows attackers to bypass Microsoft Defender SmartScreen protections without any user interaction. This means malware can be delivered simply by visiting a compromised website or opening a malicious file—no clicks required. The risk of drive-by infections and targeted attacks increases significantly in this scenario.

For organizations, the response must be proactive. Patch management is critical—vulnerabilities like this are often exploited within days of disclosure. Monitoring for suspicious activity at the endpoint level, and deploying layered defenses that go beyond a single security control, can help reduce exposure to zero-day threats. The reality is that attackers are always looking for the path of least resistance, and zero-click exploits are among the most dangerous tools in their arsenal.

Visibility is a recurring theme in today’s risk environment, and it’s not just a technical issue. Recent research shows that two-thirds of UK organizations lack visibility into what their staff are sharing with AI systems. With the w

Transcript

SPEAKER_00 0:07

Grab your coffee or Red Bull or whatever your morning vice is, and this is your daily cyber and AI briefing, and I am your host, Michael Hoosh. The convergence of artificial intelligence and cyber risk is defining today's security landscape. As organizations accelerate their AI deployments, the absence of effective oversight and governance is creating a complex web of hidden risk, compliance exposures, and operational challenges. At the same time, threat actors are adapting rapidly, leveraging both technical vulnerabilities and social engineering to bypass even the most sophisticated defenses. The result is a dual challenge for security leaders, securing the proliferation of AI agents, many of which operate outside formal control, and defending against an evolving array of cyber threats. Let's start by examining the scale of uncontrolled AI in the enterprise. According to recent research from Lenovo, a staggering 70% of enterprise AI operates outside formal governance structures. This means that most AI systems in use today aren't properly inventoried, monitored, or subject to consistent policy. The implications are significant. Uncontrolled AI can lead to data leakage, compliance violations, and operational inefficiencies. These risks aren't just theoretical. They're already manifesting as organizations struggle to account for AI embedded in third-party tools, shadow IT, and even within sanctioned business processes. For CISOs and risk leaders, this highlights an urgent need to establish comprehensive inventories of all AI assets. It's not enough to focus solely on the high-profile internally developed models. AI is increasingly embedded in SaaS platforms, productivity tools, and third-party applications, often without explicit disclosure from vendors. Without visibility, organizations can't manage risk effectively, and they expose themselves to regulatory penalties and reputational harm if things go wrong. The challenge of uncontrolled AI is compounded by the growing phenomenon of shadow AI. This refers to AI systems or tools adopted by staff or third parties without the knowledge or approval of IT and security teams. Shadow AI can be as simple as an employee using a generative AI chatbot to draft sensitive documents, or as complex as a business unit integrating an external AI analytics tool into its workflow. The risks here are twofold. Sensitive data may be inadvertently exposed to external platforms, and organizations may fail to comply with data protection regulations that require strict control over information flows. Recent research from the UK underscores this point. Two-thirds of organizations there report lacking visibility into what staff are sharing with AI systems. With generative AI tools becoming ubiquitous, the risk of data leakage is real and growing. To address this, organizations should implement data loss prevention controls, establish clear AI usage policies, and deploy monitoring solutions that can flag potentially risky interactions with external AI platforms. The goal is to safeguard proprietary and regulated data while still enabling the productivity benefits that AI can deliver. Of course, the risks associated with AI aren't limited to governance and compliance. Threat actors are actively exploiting both technical and social vectors to compromise organizations. A recent example is the Silver Fox malware campaign, which leverages fake tax audit alerts and bogus software updates to deliver malicious payloads. The campaign uses highly convincing phishing emails to lure victims, bypassing traditional email defenses, and targeting both individuals and organizations. What makes Silver Fox particularly dangerous is its ability to blend technical sophistication with psychological manipulation, making it harder for users and automated systems alike to detect the threat. The practical implication for organizations is clear. User awareness training remains critical, but it's not enough on its own. Advanced email filtering, rapid incident response capabilities, and layered defenses are essential to mitigate the risk of credential theft and lateral movement within the network. Security teams need to be prepared to respond quickly to new malware campaigns and continuously update their defenses to keep pace with evolving tactics. Adding to the complexity, attackers are now exploiting zero-click vulnerabilities, flaws that can be triggered without any user interaction. A recent zero-click vulnerability in Windows, for example, allows attackers to bypass Microsoft Defender smart screen protections. This opens the door to drive-by malware infections and targeted attacks that can compromise endpoints without any action from the user. The risk here is heightened by the fact that traditional security awareness training and user controls offer no protection against these kinds of exploits. For security leaders, the response should focus on proactive vulnerability management. Patch management must be a top priority with organizations moving quickly to apply security updates as soon as they become available. In addition, layered endpoint defenses such as behavioral detection, application whitelisting, and network segmentation can help reduce the risk of successful exploitation. Monitoring for suspicious activity and maintaining robust incident response processes are also essential components of a comprehensive defense strategy. With the rapid expansion of AI across all sectors, new tools and frameworks are emerging to help organizations manage risk. Now Secure, for example, has launched a mobile app risk intelligence platform that identifies hidden AI components within third-party mobile apps. This is a critical development as many organizations rely on third-party software that may include undisclosed AI functionalities. These hidden components can introduce privacy and compliance risk, especially if they process sensitive data or interact with external systems. For risk leaders, this underscores the growing importance of supply chain security. It's no longer sufficient to trust vendor assurances. Organizations must vet all software for embedded AI functionalities and assess their impact on privacy and compliance. This requires a combination of technical tools, contractual controls, and ongoing monitoring to ensure that third-party risks are identified and managed effectively. The proliferation of autonomous AI agents, often referred to as agentic AI, is another area of growing concern. As organizations deploy multiple autonomous agents to automate business processes, the risk of fragmentation and loss of control increases. Gartner has outlined a six-step framework to manage AI agent sprawl, emphasizing the need to inventory all agents, define clear governance policies, and establish robust monitoring mechanisms. By adopting such frameworks, organizations can prevent the chaos that comes from unmanaged proliferation, reduce risk, and ensure that AI deployments remain aligned with business objectives. In response to enterprise demand for proof of AI system security, NSS Labs has released a new AI security test framework. This framework provides standardized, evidence-based assessments of AI robustness and risk, enabling organizations to validate vendor claims and demonstrate due diligence to stakeholders. For security executives, leveraging such frameworks is becoming an essential part of procurement and risk management, especially as regulators and customers increasingly expect tangible evidence of effective controls. Cloud environments add another layer of complexity. The Cloud Security Posture Management market is experiencing significant growth as organizations seek to address misconfigurations, compliance gaps, and AI-driven risks across multi-cloud deployments. Effective CSPM solutions provide the visibility and automation needed to enforce policy and remediate issues in real time. As cloud and AI adoption accelerate, risk leaders should evaluate CSPM capabilities as a core component of their broader governance strategies. Agentic AI is also making inroads in the advertising sector, with Tabula's launch of Realize Plus, an Agentic AI system that automates advertiser goal achievement and integrates with clawed skills. The expansion of Agentic AI capabilities raises new governance and security considerations, particularly around autonomous decision making and data handling. Organizations adopting agentic AI must assess the risks associated with increased autonomy and ensure that appropriate controls are in place to prevent unintended consequences. The charity sector offers a cautionary tale about the risks of rapid AI adoption without adequate governance. A recent report warns that charities are deploying AI faster than they can implement effective oversight, putting public trust and regulatory compliance at risk. This experience serves as a reminder for all organizations the pace of innovation must be matched by the development of robust governance frameworks. Failing to do so can undermine stakeholder confidence and invite scrutiny from regulators. Telecom organizations are also grappling with the challenge of balancing rapid AI-driven innovation with evolving compliance requirements. As AI is increasingly used for network optimization and customer engagement, the sector must address data privacy, security, and regulatory expectations. Security leaders in telecom must ensure that AI deployments are aligned with both business goals and compliance mandates, avoiding the temptation to prioritize speed over security. On the infrastructure front, the launch of a new sovereign cloud platform in Qatar, featuring integrated Agenic AI capabilities for energy, government, and financial institutions highlights the trend toward localized secure AI infrastructure. As more regions develop their own sovereign clouds, the need for region-specific governance and compliance frameworks becomes increasingly important. CISOs operating in regulated sectors or jurisdictions should monitor these initiatives for best practices and emerging standards that can inform their own strategies. Stepping back, several strategic implications emerge from these developments. First, uncontrolled and shadow AI present significant, often hidden risks that require urgent governance and monitoring. Organizations must develop the tools and processes needed to gain visibility and control over all AI assets, including those in third party and shadow IT environments. Second, the proliferation of agentic AI and autonomous agents demands new frameworks for oversight, inventory, and risk management. Without these, organizations risk losing control over critical business processes and exposing themselves to operational and compliance failures. Third, the evolving threat landscape, including sophisticated phishing, malware campaigns, and zero-day vulnerabilities, reinforces the need for layered defenses and rapid response capabilities. Security teams must be vigilant, continuously updating their defenses and educating users to recognize and respond to new attack vectors. Fourth, the complexity of cloud and mobile ecosystems combined with the risks posed by embedded AI and third-party software necessitates enhance supply chain security. Organizations must go beyond traditional vendor management, employing technical tools and contractual controls to identify and mitigate hidden risks. So, what matters most today for organizations navigating this landscape? Visibility and control over all AI assets is now a critical risk priority. This includes not just internally developed models, but also AI embedded in third-party and shadow IT environments. Without comprehensive visibility, effective risk management is impossible. New attack vectors such as zero-click vulnerabilities and sophisticated phishing campaigns require a combination of continuous user education and advanced technical controls. Security awareness training must be complemented by technical defenses that can detect and block threats before they reach users. Finally, demonstrating effective AI and cyber risk management is essential for regulatory compliance, stakeholder trust, and competitive differentiation. Organizations that can provide tangible evidence of robust controls will be better positioned to meet regulatory expectations, reassure customers and partners, and maintain operational resilience in the face of evolving threats. As AI adoption continues to accelerate, the gap between innovation and governance remains a critical area of concern. Security leaders must work proactively to close this gap, developing the frameworks, tools, and processes needed to manage risk without stifling innovation. The stakes are high, not just for compliance, but for the trust and resilience that underpin long-term success. That wraps up today's briefing. Stay vigilant, stay informed, and make sure your AI and cyber risk strategies are keeping pace with the evolving landscape. That's a wrap. Peeps, stay secure, stay sharp, and don't forget to hug your CISO.