Your IR retainer says someone picks up in 2 to 4 hours. It doesn’t say they’ll know anything about your environment when they do. They have no idea where your logs live, what your IdP is, or which boxes run EDR. They learn it during the incident. You pay hourly while they learn. Prepaid hours run out fast. Then surge rates hit, often 50-150% higher, sometimes billed in 4-hour blocks. A 90-min call, billed as 4 hours. Crazy. The worst one: your retainer firm might not be on your insurer’s panel. You usually find that out mid-claim. Go read your retainer and your cyber policy side by side this week. Seriously. If you want to read more, check out the post in the next post>>>

Your next "breach" might be an AI agent with too much access, and your team could lose a week chasing an attacker who doesn’t exist. We wrote up how we’d lock this down>>>

Hot take: SOAR isn’t dead, but the "write a playbook for everything" idea kind of is Attackers using AI don’t run the same steps twice. Your playbook has no branch for that. And the average breakout is 29 min now, so nobody’s catching it by hand either Wrote about it here>>>>

AI incident or agentic incident? The answer changes what evidence you collect, who you notify, and whether your IR retainer covers you. We wrote about it in this blog post>>> #AIsecurity #incidentresponse

Your IR plan has a page for ransomware, insider threat, and BEC. Does it cover when your own AI agent deletes a production database? There’s no attacker, no malware, and nothing to alert on. 73% of CISOs are worried about AI agent risk. Only 30% say they’re ready>>>

Your AI agent "thinks" before it answers. Those reasoning blocks are encrypted. So they're safe, right? Researchers decoded 315,320 encrypted reasoning blocks from public AI agent logs and pulled out 704 secrets, API keys, and Passwords. How? By replaying the blocks into weaker, jailbroken models. If your agents see secrets, assume their logs contain them. Profero question: Where do your AI agent logs end up, and who can read them? 👀 Full breakdown in the first comment>>>

Imagine the first sign of a cyberattack isn't an alert. It's a temperature reading. At a food production plant, cold rooms started warming up. Engineers arrived expecting a broken compressor. Instead, they found that the refrigeration controllers had been reprogrammed. Safety limits were changed, the valves were pinned open, and the engineers' own credentials were changed, locking them out while the system failed. Meanwhile, on the plant's Windows servers, a wiper sat waiting, disguised as a Microsoft update. Profero question: Who owns security for your OT, and do they talk to your IT security team? 👀 Full report from our threat intel team in the first comment>>>