The Hacker News | Expert Insights — Index Page

For a long time, the cybersecurity industry has framed social engineering as a psychological problem. We treat it as a battle of wits between a charismatic con artist and an unsuspecting employee. The prevailing wisdom says that if we just train our people to better identify scams or tear down malicious infrastructure slightly faster, we can stay ahead of scammers. But looking at the threat landscape from a purely threat-intelligence perspective tells us something entirely different: Modern social engineering is more than a psychological game. It's a highly optimized, industrialized deception economy. Attackers run campaigns like hyper-efficient businesses. They have Customer Acquisition Costs, operational budgets, and strict Return on Investment (ROI) targets. This is the part the industry doesn't like to sit with: If we want to truly break the social engineering attack chain , we have to stop focusing exclusively on building higher walls or executing reactive takedowns...

Enterprises are deploying AI agents faster than their identity security programs can keep pace with. Every agent that enters production carries inherited permissions, operates outside traditional IAM visibility, and makes consequential decisions without human sign-off at each step. What is agentic AI in identity security, who owns the risk it generates, and what controls actually work at scale: that's what this guide covers. Why AI Agent Risk Doesn't Behave Like Traditional Security Risk Most enterprise security models rest on a foundational assumption: a human initiates access, a policy evaluates that request, and a control either permits or denies it. AI agents break every link in that chain simultaneously. Understanding what agentic AI in identity security is requires moving beyond the surface-level observation that agents are "automated." Automation has existed in enterprise environments for decades. What makes agentic AI categorically different is autonom...

When I work on an incident, the first question I ask is almost never "what malware ran." It's "whose credentials did it use, and what was that account allowed to touch." Nine times out of ten, the interesting part of the story isn't the exploit. It's the access. The exploit gets you in the door. The privilege is what lets you walk through the building. For thirty years, that question had a human-shaped answer. A person clicked something, a person got phished, a person reused a password, an admin left a service account sitting on a domain controller with a password from 2014. The identity at the center of the incident belonged to somebody with a badge and a manager. That assumption is quietly dying, and most enterprises have not adjusted their controls to match. The actor on your network is increasingly not a person at all. It is a workload, a script, a bot, an API (application programming interface) client, and now an AI agent that can reason, plan...

Attackers prefer the path of least resistance. Why break in when you can log in? That is what makes working credentials so valuable. A leaked password, token, or API key does more than reveal sensitive data; it offers a way in. No vulnerability or privilege escalation chain necessary. If the credential is valid, the attacker can simply use it, and the session will look like ordinary activity. This shifts the questions from "where can attackers break in?" to "where do usable keys tend to accumulate? Increasingly, the answer is the developer laptop: one of the most instrumented machines most companies own, and one of the easiest places for credentials to go unnoticed. The endpoint is watched for malware, behavior, posture, and configuration. But a valid plaintext credential is something else: a door an attacker may not need to force. A fully patched fleet can still have usable keys scattered across its devices, enough to turn one foothold into something much larger....

Why Authentication Context Matters Most people think logging in is a small act. Type your password, type your code, tap a screen, scan a face, and move on. But to the systems on the other side, the method behind that moment can matter just as much as the fact that it happened at all. That is where two strangely named but surprisingly important identity concepts enter the story: OIDC's AMR and SAML 2.0's AuthnContext. They sound like the kind of acronyms that only standards committees could love, yet both were created to answer a deeply human question in digital form: How sure a system has to be before it trusts someone? The backstory starts with the internet growing up. Early online services often treated authentication as a light switch: either the user was in, or the user was out. But as online systems began handling payroll, health records, taxes, academic data, contracts, and financial approvals, that simple model started to crack. A login backed by a reused password is not ...

Cybersecurity is entering a new phase. It's one where the gap between awareness and operational execution is becoming the industry's biggest challenge. That's what stood out to me most after reviewing the results of the 2026 Bitdefender Cybersecurity Assessment , which found that organizations have never had greater insight into the risks they face, yet turning that understanding into meaningful action remains a persistent challenge. Nowhere is that gap more visible, in my view, than in how organizations handle breach transparency. We surveyed 1,200 IT and cybersecurity professionals across six countries: France, Germany, Italy, Singapore, the United Kingdom, and the United States. Respondents ranged from frontline employees to IT managers to CISOs, all working within organizations with 500 or more employees. A Governance Problem, Not an Attacker Problem One of the most troubling findings in our report is not about attacker behavior. It's about internal respons...

The most important cybersecurity impact of artificial intelligence is not that attackers can write better phishing emails or automate parts of their workflow. It is that AI is changing the speed, scale, and decision-making dynamics of cyberattacks.  That creates a problem many organizations have not yet fully confronted: most cyber governance and incident response models were designed for human-speed attacks.  For years, security teams operated under a familiar sequence. Detect suspicious activity. Investigate. Validate the threat. Escalate to leadership. Decide on containment. Communicate with stakeholders. That model still has value, but it assumes defenders have enough time to build confidence before taking material action.  AI-enabled attacks challenge that assumption.  Adversaries can now use AI to accelerate reconnaissance, generate highly personalized social engineering, modify malware, test payloads, summarize stolen data, identify vulnerabilities, a...