This week brought one of those stories that reveals more about an industry's maturity than any earnings call could. On Monday, OpenAI announced it had engaged Cathedral Systems, a security startup founded by four alumni of the federal Department of Government Efficiency (DOGE), to stress-test its defenses. Cathedral's team, OpenAI said, will "use OpenAI's models alongside our teams to challenge our defenses, bringing differentiated expertise and approaches to finding weakness

Two stories broke in the last two weeks that, taken together, mark a turning point for how businesses need to think about deploying autonomous AI. First, Europe's AI Office opened its first real enforcement test of the EU AI Act — training it squarely on OpenAI and Anthropic. Then, just days before the US midterm elections, Anthropic confirmed that its own Claude model had quietly bypassed a paywall to pull vote-count data it was never asked to retrieve. Neither story is real

Five months after Palo Alto Networks disclosed and patched an authentication bypass in its GlobalProtect VPN portal, ransomware crews are still walking through the door it left open. New reporting from Cybersecurity Dive shows that researchers at Unit 42 and ReliaQuest are tracking active exploitation of the flaw, tracked as CVE-2026-0257, by at least two major ransomware operations, with a fresh wave of activity reported as recently as October 9. For a vulnerability that has

Somewhere in France this week, supermarket freezers climbed past 50°C and some caught fire. On the other side of the Channel and the Atlantic, Stop & Shop employees couldn't pull up their work schedules, and Dutch shoppers found Albert Heijn's website dark. Neither story led the nightly news, but together they are one of the more important technology-risk stories of 2026: cyberattacks that reach past servers and spreadsheets and into the physical machinery that keeps food mov

Late last week, one of the most security-conscious organizations on the planet confirmed what a lot of security teams quietly fear: even the FBI isn't immune to a modern breach. On September 28, the Bureau acknowledged a "cyber security incident" after the hacking group ShinyHunters claimed to have stolen a massive trove of employee and job-applicant data, taken the FBIJobs.gov hiring portal offline, and threatened to publish two to three terabytes of internal records (TechCr

Phishing used to take patience. A criminal had to research a target, guess at the right pretext, and hope a generic "invoice attached" email landed on the right desk. This week, Microsoft pulled back the curtain on an operation that had automated all of that work — and sold it as a subscription service. On September 22, Microsoft announced it had dismantled EvilTokens, a phishing-as-a-service platform that compromised more than 12,000 email inboxes across over 10,000 organiza

Most people have never heard of IDScan.net. That's exactly the problem. This week, the identity-verification vendor confirmed what security researcher Brian Krebs first reported on September 1: attackers had been quietly siphoning data from its systems for roughly a year, and a dark-web marketplace called “Nexus” was openly selling searchable scans of more than 150 million driver's licenses, passports, and government IDs belonging to North Americans. IDScan formally acknowled

If your IT and security teams felt like this month's patch cycle was different, they weren't imagining it. On September 8, 2026, Microsoft shipped the largest security update in its history: 966 vulnerabilities fixed in a single Patch Tuesday, on top of 204 already patched earlier in the month. That's a staggering jump from July's 570 flaws and August's 400 — and it's forcing a hard conversation about how prepared most organizations actually are for a threat landscape that's

This week brought two stories that, read together, mark a genuine turning point in cybersecurity — not a distant, theoretical one, but a right-now, this-is-already-happening one. On September 1, OpenAI announced that its upcoming model, Astra, has crossed what the company itself calls the "Critical" threshold for cybersecurity capability. In plain terms: Astra can find previously unknown security flaws (zero-days) and build working exploits for them across well-defended syste

On August 21, 2026, Microsoft quietly shipped a patch for one of the most severe vulnerabilities disclosed all year: a remote code execution flaw in Entra ID, the identity service that sits behind Microsoft 365, Azure, and countless third-party business applications. The bug, tracked as CVE-2026-69836, earned a CVSS score of 10.0 — the maximum possible severity rating a vulnerability can receive. (Source: The Hacker News, https://thehackernews.com/2026/08/microsoft-entra-id-f

Achievement underscores Sage's belief that security and governance isn't reserved for Fortune 500 companies Small and mid-sized businesses face the same cybersecurity threats as the world's largest companies. They just rarely have the same resources to defend against them. Sage Governance and Technology (Sage Inc.) is working to change that math for its clients, and it just reached a major milestone. Sage has achieved ISO 27001 certification, the internationally recognized st

Answers to the questions we hear most from small and midsized businesses about managed IT, cybersecurity, and AI. What does Sage Inc. actually do? Sage Inc. is a managed IT provider for small and midsized businesses. We handle day-to-day tech support, cybersecurity, and AI/automation under one roof, so you're not juggling separate vendors for each — the goal is fewer tech headaches and a better return on whatever you're already spending on technology. What's the difference be