Defender's Corner

A year-long study by security awareness platform Pistachio sent 2.47 million simulated phishing emails to 123,000 employees across 1,200 organisations, and found that click rate — the metric most phishing training programmes are judged on — tells only part of the story, according to SecurityWeek.

What actually matters is what happens after the click: 30% of tech and IT workers clicked at least once, and nearly 20% of construction employees handed over credentials after clicking. A click with no credential submission creates no real breach.

What you should do: If your organisation runs phishing simulations, push for reporting that tracks credential submission and suspicious-email reporting rates alongside clicks. If you're an individual, the habit worth building is simple: before entering a password anywhere, check the URL bar first.

An API key (a credential that lets one piece of software authenticate with another) left in a public code repository is a gift to attackers. Bots scan public repositories constantly, and the majority of exposed keys remain active long after they are found.

A security researcher has proposed an open standard called ORKS (Open Revocable Key Standard), detailed at Security Week, that would allow anyone who finds a leaked key to destroy it immediately by submitting it to a revocation endpoint — no account or authentication required.

The standard is not yet widely adopted, but the underlying lesson is actionable right now: if your team uses API keys, set a reminder to rotate them on a schedule and audit whether any have been committed to public repositories using a tool like GitHub Secret Scanning.

The UK's National Cyber Security Centre (NCSC) has published a guide on shadow AI — the use of AI tools that employees adopt without their employer's knowledge or approval, according to the NCSC blog.

One survey cited in the piece found that 71% of employees use AI tools their employer has not approved. The risk is straightforward: when you paste work data into a consumer AI service, that data may be stored, retained, or used to train the service — outside any security controls your organisation has in place.

The NCSC's advice is practical: before using any AI tool for a work task, ask whether it is on your employer's approved list. If you are not sure, ask. If no approved option exists for your needs, raise it with your IT or security team rather than improvising. The goal is not to stop using AI — it is to use it without handing your company's sensitive data to an unknown third party.

HaveIBeenPwned is a free service that tells you whether your email address or phone number has appeared in a known data breach. It is run by respected security researcher Troy Hunt and is widely trusted.

With 8.8 million records from the Manchester Airports Group breach now in its database, this is a good moment to check. Go to haveibeenpwned.com, enter your email address, and see which breaches it appears in. You can also set up free alerts so you are notified automatically if your details appear in future leaks.

If your email is listed, update passwords on affected accounts and switch on two-factor authentication (a second verification step beyond your password) wherever it is offered.

Anthropic has warned Claude users that infostealer malware — software that quietly copies saved passwords, browser cookies, and login credentials — was used to hijack accounts and drain usage limits, according to SecurityWeek. The malware arrives via unofficial downloads or fake apps, not through Claude itself.

If your Claude usage limits appeared to drain without you doing anything, that is a warning sign. Anthropic has signed out affected sessions and removed saved payment methods as a precaution.

The practical step: run a full scan with Malwarebytes — a free, widely trusted tool — before re-adding any payment details to Claude or any other service. Then change your passwords for any accounts that were logged in on the affected device. This applies whether or not you use Claude: infostealers target every saved credential on your machine.

The UK's National Cyber Security Centre has issued a warning about increased attacks on operational technology (OT) systems — the industrial software and hardware that runs power grids, water treatment, and manufacturing, according to the NCSC advisory.

Their first recommendation applies to everyone, not just industrial operators: know what you have exposed to the internet.

For home and small business users, the practical version is this: log into your router's admin panel and check which devices are reachable from outside your network. Most routers have a "port forwarding" or "exposed services" section. If you see something you did not intentionally open up — a printer, a camera, a server — close it.

If you manage any internet-connected device for work, change its default password today. Default credentials are the first thing attackers try, and they work more often than anyone should be comfortable admitting.

WhatsApp has rolled out several security improvements worth enabling now, according to Security Week.

Two-step verification (2SV — a second layer of protection beyond your SIM card) has been upgraded from a six-digit PIN to a full password that can include letters, numbers, and special characters. Longer and more complex is better. Go to Settings → Account → Two-step verification and update yours.

Passkeys (a login method that replaces passwords with a cryptographic key stored on your device) can now be added in multiples, which is useful if you switch between iOS and Android. Android users also get a new caller context feature that shows the country and any shared group membership for unknown callers — a quiet but useful tool against number-spoofing scammers.

The Uber fine (covered below) is a useful reminder that EU law gives individuals the right to challenge automated decisions — and similar rights exist in the UK, Canada and California under their respective data protection laws.

If a company tells you that an automated system has denied you a service, suspended an account, or made a significant decision about you, you can ask for a human review. In the EU and UK, this right is explicit under GDPR and UK GDPR. To exercise it, contact the company in writing, reference "automated decision-making," and request that a person reviews the outcome.

It will not always work quickly. But companies that ignore such requests face exactly the kind of regulatory attention Uber just received. Know the right exists — it is worth using.

Anthropic — the company behind the Claude family of AI models — has expanded a programme called Project Glasswing, which gives security teams access to its most capable AI model, Mythos 5, according to Security Week. It has also launched a $35 million fund to help open source projects find and fix vulnerabilities.

For most readers, the practical takeaway is this: Claude Security, available now in public beta for Claude Enterprise users, can scan your codebase, flag vulnerabilities with severity ratings, and suggest fixes — with a human required to approve anything before it deploys.

If your organisation uses Claude Enterprise, check whether Claude Security is enabled for your team. If you maintain open source software, the Defender Advantage Fund (0xDAF) is worth looking into for grant support.

Email filters were built to catch known threats. AI-generated phishing emails are designed to look like normal business correspondence, personalised using public information from LinkedIn and company websites. A Harvard Business Review study found AI-crafted spear phishing (targeted, personalised phishing) hit a 54% click-through rate. Filters alone will not cut it.

The article from Bleeping Computer makes a useful point: assume some phishing will always reach the inbox. The better question is what you have in place once it does.

What you should do: Pair your email filter with endpoint detection software and identity monitoring. Enable multi-factor authentication on every account so that a stolen password alone cannot open the door. When in doubt about an email, call the sender directly using a number you already have.