AI-curated news for your industry

The Thanksgiving weekend ushers in the holiday season, bringing the retail industry into a critical period, with security teams facing intensified challenges from threats such as ransomware. Reports show that over the past 12 months, more than half of ransomware attacks occurred during holidays or weekends, and about 80% of enterprises reduced staffing by over 50% during this time. Experts recommend maintaining robust cybersecurity practices throughout the year.

According to a report released by Palo Alto Networks in July, between May 2024 and May 2025, social engineering became the most common initial access vector in its incident response cases, accounting for 36%. Two-thirds of these attacks targeted privileged or executive accounts. Attackers used tools such as deepfakes and AI voice cloning to impersonate executives or employees, bypassing traditional security defenses. Notable examples include UK retailer Co-op losing $275 million after an employee was impersonated, and Workday facing IT and HR impersonation attacks. Experts point out that measures like Microsoft disabling macros have driven attackers toward more sophisticated techniques, such as the ClickFix method. The report recommends that enterprises adopt phishing-resistant multi-factor authentication and out-of-band verification to strengthen defenses.

A review of more than ten studies and meta-analyses since 2008 shows that common cybersecurity training methods do not significantly reduce people's susceptibility to phishing attacks, and in some cases even increase vulnerability. The research questions the value of mandatory training, criticizes remedial instruction for those who fail tests, and points out methodological flaws in early studies. Experts suggest that training should shift toward behavioral science, habit formation, and continuous feedback, rather than mere knowledge dissemination.

In recent years, cybersecurity experts have continuously warned that critical industrial sectors could suffer catastrophic cyberattacks, and now these warnings have become reality. The automotive industry, due to its reliance on IoT, wireless connectivity, and AI technologies, has become one of the victims of the most destructive attacks. From CDK Global to Jaguar Land Rover, attacks have caused production interruptions lasting weeks and paralyzed supply chains. Experts urge the industry to shift its mindset, viewing cybersecurity as disaster preparedness rather than mere prevention.

The termination of U.S. federal funding for MS-ISAC has led two-thirds of states and thousands of local governments to withdraw from the cyber collaboration organization, raising concerns about security risks to critical infrastructure.

Earlier this year, the Scattered Spider hacker group breached the networks of several major U.S. retailers and their suppliers, testing the low-key cybersecurity collaboration mechanisms within the retail industry. The Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC) played a key role in coordinating the industry's response. Based on interviews with RH-ISAC Chief Security Officer Pam Lindemoen and others, this article analyzes how the industry addresses attacks targeting 'human weaknesses' through shared intelligence, strategies, and resources, and explores the challenges it faces and the progress it has made.

The Log4Shell vulnerability in 2021 prompted the U.S. government and tech giants to commit to strengthening open source software security, but nearly four years later, progress has stalled: generative AI diverts corporate resources, the Trump administration cuts CISA funding, experts depart, and pledged funds remain partially unfulfilled. Despite tools like Sigstore and Scorecard and new EU regulations, open source security still faces unresolved issues such as dependency risks and maintainer overload.

As government-backed hackers target food and agriculture companies, the industry's newly formed cyber collaboration organization—the Food and Agriculture Information Sharing and Analysis Center (Food and Agriculture ISAC)—is accelerating its development. This article outlines its founding background, operational model, partnerships with CISA and USDA, and analyzes the unique cybersecurity risks facing the industry.

The U.S. Federal Communications Commission (FCC) launched the U.S. Cyber Trust Mark program during the Biden administration to provide security certification for IoT devices. However, the new FCC chair under the Trump administration has initiated a China-related investigation into UL Solutions, the program's designated administrator, which may stall the program. Experts warn that a prolonged investigation will weaken the program's effectiveness and increase cybersecurity risks faced by consumers and businesses.

The U.S. government's plan to cut cybersecurity support for critical infrastructure has raised industry concerns. Experts note that budget reductions and responsibility shifts will exacerbate vulnerabilities, particularly impacting smaller operators.