Information Security Buzz

You probably know someone in cybersecurity who works incredibly hard, makes a real difference, and never gets the recognition they deserve.

The Security Serious Unsung Heroes Awards exist specifically for people like them, and nominations are now open for the tenth year running.

Running by Eskenzi PR and Marketing and supported by us here at Information Security Buzz, the awards celebrate UK cybersecurity professionals who go above and beyond.

For 2026, three new categories have been added: Cyber Scribe for the best blogs and newsletters, Voice of Security for podcasts and vodcasts, and Channel Champion for the unsung heroes of the channel.

Nominations are free, take just a few minutes, and close at 5pm on 16 September 2026. Nominees and their guests will be invited to a celebratory evening in London in October, timed to coincide with Cybersecurity Awareness Month.

If someone in your network has made your corner of the industry better this year, put their name forward.

More details: https://informationsecuritybuzz.com/10th-annual-security-serious-unsung-heroes/

AI is now writing, reviewing, and patching code. That's not a future prediction, it's already happening in pipelines across the industry. So who's actually responsible for making sure that code is secure?

For our July expert panel, we asked five security professionals to weigh in on one of the most pressing questions in software development right now, and the answers are worth reading carefully.

Hibberd (Consultants Like Us), Anastasios Arampatzis (Bora | Cybersecurity marketing), Chloé Messdaghi (Thornbridge Advisory), Ross Moore, & Javvad Malik (KnowBe4)

🔗 Read the full panel: https://informationsecuritybuzz.com/ai-is-writing-the-code-who-is-defending-it/

Expert Panel: AI Is Writing The Code. Who Is Defending It? Information Security Buzz experts to share their views on how AI is reshaping secure software development.

Bora | Cybersecurity marketing x Eskenzi PR and Marketing have a summer package for cybersecurity companies: research report, social posts, blogs in third-party publications, tier-1 press hits, and commentary opportunities, all done for you.

It's a limited offer with capacity for just 3 clients, and it expires 31 August 2026.

If your content pipeline slows down over summer and you want a push going into the second half of the year, this is worth a look.

Full details here: https://welcometobora.com/services-and-pricing/

Americans have gotten pretty good at ignoring spam calls. Eight in ten say they rarely or never answer numbers they don't recognise, and more than a quarter never pick up at all. That's a reasonable response to receiving an average of 16 spam calls a month.

The catch, according to new research from Cloaked, is that the same instinct is causing people to miss calls from doctors, hospitals, employers, pharmacies, and family emergencies. Two-thirds of the 1,000 Americans surveyed have missed an important call because they screened an unknown number.

Katherine Obermeyer, Consumer Education at Cloaked, says the mistake is treating phishing as an awareness problem. In 2026, she argues, it's an identity and infrastructure problem. AI can now mimic tone, timing, branding, and urgency well enough to fool a normal, alert person.

🔗 Read more: https://informationsecuritybuzz.com/americans-are-ignoring-scam-calls/

Americans Are Ignoring Scam Calls, But Phishing Emails Still Fool Many Americans are becoming more effective at avoiding spam calls and texts, but new research suggests that the strategy comes with an unexpected cost.

Sysdig researchers have documented what they believe is the first recorded case of an AI agent running a ransomware operation from start to finish, and it's worth paying attention to how it actually worked.

The operation, dubbed JADEPUFFER, began with the exploitation of an internet-facing Langflow instance via CVE-2025-3248, a missing-authentication vulnerability that allowed unauthenticated remote code ex*****on.

Experts Jacob Krell (Suzu Labs), Jim Sherlock (ProCircular), Noelle Murata (Xcape, Inc.), and Joshua Marpet (Finite State) share their insights.

🔗 Learn more: https://informationsecuritybuzz.com/first-documented-agentic-ransomware-operation/

Sysdig Uncovers First Documented Agentic Ransomware Operation Security researchers at Sysdig have documented what they believe is the first documented case of an AI agent running a ransomware operation from end to end.

AI can generate code faster than most software teams can absorb it.

A new white paper from code4thought, drawing on six in-depth conversations across security, product engineering, retail banking, regulated industry, and academic research, looks at what happens to software delivery when AI changes the speed of production but the processes around it stay human-paced.

Yiannis Kanellopoulos, founder and CEO of code4thought, introduces the concept of knowledge debt: code that reaches production without anyone fully understanding what it does. Unlike technical debt, this one starts the moment AI-generated output ships without comprehension behind it.

Read more: https://informationsecuritybuzz.com/ai-assisted-software-engineering/

AI-assisted Software Engineering Is Creating A New Delivery Paradox AI can generate code faster than most software organizations can absorb it. This should be a productivity breakthrough, but it also exposes a larger problem:

Your organisation probably has an AI governance policy. What it may not have is operational control over what your AI systems are actually doing at runtime.

That gap is getting harder to ignore. When an employee asks Microsoft 365 Copilot to summarise everything relevant before a leadership meeting, and the Copilot pulls files from sensitive HR folders, an unreleased earnings deck, and a confidential M&A workspace the employee technically had access to but rarely opened, the audit log attributes all of it to the human.

There is no separate signal for Copilot. The activity looks identical to the user doing it themselves.

Artyom Poghosyan, CEO and Co-Founder of Britive, writes about what it actually takes to secure agentic AI systems beyond governance frameworks and acceptable-use policies.

🔗 Learn more: https://informationsecuritybuzz.com/practitioner-framework-securing-agentic-systems/

From AI Hype To Operational Reality: A Practitioner’s Framework For Securing Agentic Systems AI governance lacks operational control. Teams must map specific agentic deployment models to runtime control points to secure autonomous workflows. Read more..

Machine identities now outnumber human users by ten to one in many organisations. Service accounts created on demand, API tokens spun up and never retired, AI agents accumulating access with no structured offboarding. Most IAM systems were never designed to track any of this at scale.

The result is a visibility problem that attackers understand well. Compromised credentials remain the top initial access vector in breaches, and when nobody has a clear picture of who or what has access to what, the window to catch something and contain it stretches considerably.

David Canellos, CEO of Axiad, writes about what it actually takes to close that gap. His argument is that quarterly access certifications and manual reviews create an appearance of control without surfacing the exposures that actually matter.

🔗 Learn more: https://informationsecuritybuzz.com/the-missing-link-in-cyber-resilience-bridging-the-identity-visibility-gap/

The Missing Link In Cyber Resilience: Bridging The Identity Visibility Gap The enterprise security perimeter didn't evolve; it dissolved, and what replaced it isn't a newer, stronger boundary. It's the absence of one.  Today's

Dutch police and the NCSC just shut down a botnet running across 17 million infected devices, with 200 controlling servers sitting inside the Netherlands.

Access was being sold for $5 a month in crypto. Good news: the infrastructure is down. Less good news: every one of those 17 million devices is still infected.

Denis Calderone (Suzu Labs) & Damon Small (Xcape, Inc.) share their insights!

🔗 Full story: https://informationsecuritybuzz.com/dutch-police-ncsc-take-down-major-botnet/

Dutch Police, NCSC Take Down Major Botnet A collaboration between the Dutch National Police and the National Cyber Security Centre (NCSC), has seen a large botnet being shut down.