From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Cyberattacks

Billy Hurley

itbrew.com

Unlike your screenplay or novel labeled “Final_V5_revisions_USETHISONE_V2,” government authorities want a clear, conclusive document from organizations hosting operational technology—the “OT” hardware and software powering physical machinery in factories, power plants, and water-treatment facilities.

On Sept. 29, the US cyberagency CISA, the FBI, and the UK National Cyber Security Centre released joint guidance for OT professionals on how to create an up-to-date asset inventory known as a “definitive record.”

Consultants and security providers who spoke with IT Brew see the move as a must-do for a sector that has lagged behind its IT counterparts. As OT environments are increasingly equipped to conduct remote monitoring, analytics, and real-time inventory management, operational-tech practitioners may require a strengthening of their security skills.

“It’s not necessarily the fault of the operators up until that point. It’s just that they haven’t had that discipline because they didn’t really need to have that discipline necessarily,” Sean Arrowsmith, director of industrials at cybersecurity consultancy NCC Group, said.

Arrowsmith has entered facilities where the OT architecture, like every puzzle at an Airbnb, has missing pieces.

“That level of asset inventory that you might see in an IT environment doesn’t necessarily exist in OT in a lot of cases,” he said, referring to practices often present in enterprise IT scenarios, like scanning for on-network devices and listing assets in a centralized 

A Ponemon Institute survey of 1,056 global IT and security practitioners operating an OT environment, conducted in September 2023, found that 73% of respondents said their orgs “lack an authoritative OT asset inventory.”

However, OT security shows signs of improving, according to a July 2025 report from Fortinet, which found that 81% of orgs self-assessing their cybersecurity process in 2024 see their maturity level as 3 or 4 (out of a possible 4). At this level, “security activities and guidelines are documented, and at the highest level, security processes and tactics are also being improved through iterative feedback,” according to the report. The percentages are an increase from 2023 (72%) and 2022 (63%).

IT hasn’t necessarily been putting the inventory pieces together, either. A 2025 cybersecurity report, also conducted by Ponemon Institute, found that just 42% of 620 IT and cybersecurity practitioners surveyed say their organizations include an asset inventory program.

“definitive view” of an OT architecture

, according to the September guidance, includes five principles:

Defining processes for establishing and maintaining one

 For example, will you use passive monitoring tools to analyze network traffic?

Creating an OT information security management program

 Consider levels of criticality, exposure, and availability, the NCSC recommends.

What does the asset need to communicate with to perform its function? And what controls secure it? 

Practitioners should consider trust levels with external partners, as well as contractual obligations, according to the recent guidance.

Let’s say a vulnerability is announced on a turbine control or safety system. It helps to know if there are three or 300 of them on the factory floor. “Without a definitive record, you’re guessing,” Sean Tufts, field CTO for cyber-physical security company Claroty, told IT Brew.

In Q1 2025, OT cybersecurity company Dragos identified 708 global ransomware incidents impacting industrial entities—an increase from “approximately 600 incidents” documented in Q4 2024.

“The intensifying convergence of IT and OT further amplified operational impacts, causing IT disruptions to cascade into operational environments,” Dragos wrote in 

As IT and OT converge on the factory floor, Arrowsmith says IT and OT teams must come together as well—perhaps by finding IT security champions within OT engineering communities and bringing them into awareness training and security programs.

Fortinet’s 2025 report revealed that 66% of respondents expect increased regulation and security compliance requirements in five years or fewer.

As OT becomes a C-suite concern, the term definitive is important, Tufts said.

“Our CEOs, our CTOs, our CIOs are going to start asking: ‘What is our definitive record?’” he told IT Brew. “It will no longer be okay to say, ‘We’ll get back to you next week.’”

NCSC and CISA offer guidance on how OT can build a ‘definitive record’

Why an up-to-date system view is essential for operational-tech environments. 

Caroline Nihill

An attacker targeted Salesforce in a widespread data theft through Salesloft Drift, a cloud-based and AI-powered sales engagement platform that allows sales teams to integrate with Salesforce instances. The theft is believed to have begun as early as Aug. 8 until at least Aug. 18.

 that it is engaging with cybersecurity leaders like Mandiant and Coalition to help the investigation, support containment, and assist with remediation. The company recommended that Drift customers revoke the existing API key for connections to third-party applications and reconnect using a new key.

The threat actor reportedly used OAuth credentials, which lets users give permission to an application to interact with another application on behalf of them without giving a password, to pull data from Salesforce customer instances that include cases, accounts, users and opportunities.

Allen Tsai, the senior director for corporate communications at Salesforce, told IT Brew in an email that all official statements from the company in relation to the incident can be found on a 

“Per our last update, Salesforce has disabled all integrations between Salesforce and Salesloft technologies including the Drift app; organizations will not be able to connect to Salesforce via any Salesloft apps until further notice,” Tsai said. “Please note this issue did not stem from a vulnerability within the core Salesforce platform.”

A report from the Google Threat Intelligence Group (GTIG) examining the data theft found that the threat actor exported large volumes of data from various Salesforce instances through a systematic approach.

“GTIG assesses the primary intent of the threat actor is to harvest credentials,” the report stated. “After the data was exfiltrated, the actor searched through the data to look for secrets that could be potentially used to compromise victim environments.”

 asserting that there is no evidence of ongoing malicious activity related to the incident, but saw in initial findings that the attacker was attempting to steal credentials such as Amazon Web Services access keys, passwords, and Snowflake-related access tokens.

, detected a security issue in the application on Aug. 20. The company reported that it “proactively revoked connections between Drift and Salesforce” and asked “Drift admins to re-authenticate their Salesforce connection.”

Drift customers that have not integrated with Salesforce are not impacted by this security issue, the company said. GTIG, however, said in an update on Aug. 28 that new information showed the scope of the compromise may not be isolated to the Salesforce integration with Salesloft Drift “and impacts other integrations.”

In addition to Salesloft Drift’s most recent recommendations for customers affected or potentially affected,

GTIG recommended that organizations that may have been impacted should look for sensitive information in Salesforce objects and take action to revoke API keys, rotate credentials, and further investigate to see if the threat actor abused any secrets.

“Organizations using Drift integrated with Salesforce should consider their Salesforce data compromised and are urged to take immediate remediation steps,” GTIG said.

The law office of Lowenstein Sandler put out a 

 on Aug. 27 to share that potentially impacted customers could contact their IT team to find out if their company has a Salesforce integration with Drift’s application.

“Given the prevalence of AI integrations, we expect to see more breaches regarding vendors using AI-based technologies,” the release states.

GTIG also reported that there has been no evidence to indicate any impact to Google Cloud customers, but advised Salesloft Drift customers to review Salesforce objects for Google Cloud Platform account keys.

 that offers combined services that address data and AI assistance.

 in late July that Gmail attacks increased by 84% for email-delivered infostealers in 2024, a trend that “has only intensified in 2025.”

 that attackers are accessing Gmail accounts, helped significantly by compromised passwords. The company warned that most Gmail users have to change passwords to secure their accounts, but told Forbes it had not been affected by the Salesforce breach.

Salesloft Drift did not respond to a request for comment at the time of publication.

An illustration of a gloved hand coming out of a laptop screen holding a key

Salesloft Drift data breach exposes Salesforce customer data

Drift customers that have not integrated with Salesforce are not impacted by this security issue. 

Like a hurricane kicking off as a gentle breeze in the middle of the Atlantic, most cloud breaches start very small. All it takes is a bad actor stealing an identity or taking over a compromised endpoint such as a laptop, and suddenly an organization’s most valuable assets—often kept in a public or private cloud—are in danger.

Even worse, cloud intrusions increased by 136% during the first half of 2025 compared to all of 2024, according to CrowdStrike’s 2025 threat-hunting report. The cybersecurity organization attributed this to more threat actors understanding how to exploit cloud environments.

Cameron Sipes, the director of cloud security product marketing at SentinelOne, also pins the skyrocketing rate of intrusions on rising cloud adoption and the use of AI in cyberattacks.

“AI has rapidly expanded the attack service, very similar to what cloud did,” Sipes said. “It just introduced new surfaces that we haven’t had to think about before, and not only new surfaces but actually multiple layers.”

Crowdstrike’s senior vice president of counter adversary operations (CAO), Adam Meyers, said during a virtual media roundtable surrounding the release of Crowdstrike’s threat-hunting report that the significant increase in cloud intrusions was accompanied by adversaries deploying other innovative strategies such as operational relay box (ORB) networks to avoid detection while harvesting credentials.

“The cloud is an ideal target, it is huge, it has vast amounts of data,” Meyers said. “Oftentimes there’s misconfigurations within that cloud infrastructure which make it such an attractive target.”

Sipes predicted that cloud adoption could increase next year as even more organizations shift from on-premises databases to private and public clouds. With so much “crown jewel data,” the cloud is an attractive target.

“I joke that it feels like there’s a trend in our culture, in general, everything old is new again—old- fashioned is cool again,” Sipes said. “Apparently old bad guy tools are new again.”

The rise of AI, including LLMs, has provided attackers with a way to supercharge yesteryear’s cyberattack tools. Infostealers, or malware that quietly collects sensitive information from a device and sends it back to the bad actors, has returned as 

, a cloud-based info stealer that uses ChatGPT to summarize and enrich information faster and more efficiently.

Typosquatting, the practice of registering an intentionally misspelled domain name so it is just slightly different than a common URL, then using that domain for malware, has also returned in a new, cloud-centric fashion as slopsquatting.

, slopsquatting is when a programmer obtains software packages from an open-source repository, not realizing that a bad actor has labeled the packages to deceive them. The packages contain a command that acts as malware.

Along with efforts to attack cloud security using AI, threat actors are turning to ORB networks, a common tool of China-nexus threat actors to mesh networks together so that espionage operations are disguised.

Additionally, Meyers said that Crowdstrike has seen adversaries harvesting credentials and pivoting to the cloud control plane, which manages and controls a company’s cloud environment.

“They gain access to a legitimate credential and then that account perhaps has some cloud access, or they’re able to then escalate privilege to an account that has cloud access, which allows them to run commands on cloud,” Meyers said.

While fending off cloud intrusions can be tough, 

 that practitioners implement best practices, including strong authentication, employee awareness, and regular security assessments.

Sipes said, concerning prevention, “Cloud security needs to be proactive and reactive. What I mean by that is that core kind of [cloud security posture management] use case of reducing your attack surface.”

Providers should, according to Sipes, inventory cloud environments, check for cloud-native misconfigurations, ensure compliance, and proactively defend against intrusions.

On the reactive side, providers should implement a cloud workload protection platform that offers runtime security. “Bad guys will come knocking,” Sipes said. “When they do, do your cloud workloads themselves have the ability to autonomously detect, respond, and remediate threats?”

Cloud intrusions are up. Is AI to blame?

 CrowdStrike, in its latest threat-hunting report, found that cloud intrusions are up 136% so far this year. What’s driving the spike?

Brianna Monsanto

You have the right to remain silent...except when you are a major tech vendor, like Oracle, at the center of serious breach allegations, according to some cybersecurity professionals.

 after a threat actor by the alias of rose87168 claimed on BreachForums that it had six million records obtained from Oracle Cloud’s single sign-on (SSO) and lightweight directory access protocol (LDAP) systems for sale.

 supporting the breach allegations and a class-action lawsuit 

 the tech giant in the US District Court for the Western District of Texas in relation to the matter last week, Oracle largely declined to elaborate on or even confirm the incident at first. The tech giant previously told several publications, including 

, that the published credentials are not for Oracle Cloud and no breach has occurred.

 on April 2 that the vendor informed some customers that an attacker had gained access to a “legacy environment” that hadn’t been used in eight years, and that the FBI and CrowdStrike were investigating the incident. Oracle did not immediately respond to IT Brew’s requests for comment on the alleged breach.

 Oracle’s muted public response has left some, like Deepblue Cybersecurity founder and CEO Ofer Shaked, scratching their heads.

“What we hear from Oracle is, ‘We were not breached,’ over and over again…and the evidence says a completely different story,” Shaked said. “This gives me a feeling of a lack of trust.”

Shaked added that Oracle’s choice to seemingly remain mute as a malicious actor continues to sound off with the public is also peculiar.

“We see a lot of communication coming from the threat actor and zero communication from Oracle,” Shaked said. “I also find this a little bit odd.”

Nimrod Kozlovski, founder and CEO of Cytactic, a cyber crisis readiness and management startup, speculates that Oracle has chosen its course of action because it is unable to scope the full extent of the alleged attack. However, Kozlovski said that a lack of clear and transparent communication opens up the door for rumors to circulate.

“We have more speculations than actual facts of what has happened,” he said.

Kozlovski pointed out that organizations can actually win over the trust of customers when they exhibit good communication during an incident. He referenced 

, which underwent a supply-chain attack in 2019, as a good example of this. Sudhakar Ramakrishna, CEO of the targeted software company, 

 that the company had a customer retention rate of 97% last year.

 Some things are easier said than done. Kozlovski told us that it can be a “delicate dilemma” for organizations in a crisis to decide how best to proceed after discovering a potential security snafu in a way that appeases its stakeholders, while protecting the company from further damage or liability.

“Sometimes you need to decide if you’re better off in having the right messaging out there that would actually help you to protect your reputation,” Kozlovski said. “You might actually restrict some information or not disclose [it] because it might help you either for better investigation…or sometimes even in order to shield you from liability.”

 Oracle’s response to breach allegations can hurt it in the long run, experts warn

One CEO tells IT Brew that companies often face a “delicate dilemma” when deciding how to address alleged security incidents.

Tom McKay

The prevailing mood on the inbound Trump administration’s possible impact on Biden-era cybersecurity reforms? Uncertainty.

 countless regulations. Yet how far that will extend into the cybersecurity arena is unclear due to the huge variety of actors impacted, the number of key roles 

, and the perception that Trump’s stance on cybersecurity regulations is malleable, experts told IT Brew.

First things first—is CISA gonna be OK?

It’s hardly a secret that the Cybersecurity and Infrastructure Security Agency (CISA) had a rocky honeymoon with Trump.

” its founding director Chris Krebs, after Krebs accurately contested 

 during the 2020 elections. CISA’s current administrator, Jen Easterly, has announced she will 

“Unless the Constitution is just thrown out the window, this will be Trump’s last election,” Stephanie K. Pell, a fellow in governance studies at the Brookings Institution and senior editor at Lawfare, told IT Brew—so maybe Trump will swallow those past grievances.

mandate and its interpretations of its authority.

For example, a 2022 law called Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) created obligations that critical infrastructure entities report cyber incidents to CISA, but delegated many decisions to the agency—such as who’s subject to compulsory compliance. CISA’s current plan specifies 

 across 16 critical infrastructure sectors. Industry groups have pushed for a more 

On the other hand, Trump signed the law creating CISA in the first place and portrays himself as a 

“The incoming administration, no matter how business-friendly and innovation-friendly it is, it’s still going to be very concerned with that intersection of cybersecurity and national security,” Michael Bahar, legal partner and co-lead of global cybersecurity and congressional investigations at Eversheds Sutherland, told IT Brew.

CISA’s mission mainly involves partnership building and facilitating threat intelligence sharing, Pell said: “Presumably, those would be the kinds of things that a Trump administration wouldn’t be against.”

A recent Supreme Court ruling throwing out 

 to CISA’s interpretation of CIRCIA—although no case has materialized yet.

Biden-era reforms may be more vulnerable, though

Arcane federal rulemaking processes do mean Trump’s appointees will face obstacles peeling back reforms already in motion, according to Pell.

“Will they start out day one trying to identify every single rule-making process in existence?” Pell said. “I’m more comfortable saying we’re not going to see a new rush of regulatory efforts.”

Pell noted some nominees like proposed Federal Communications Commission chairman 

 have pledged to continue cybersecurity reforms. (Carr, for example, said he’d put “all hands on-deck” after receiving classified briefings on the extent of the 

 she did not want to transform CISA into a regulatory agency, and under her tenure the agency largely focused on public–private partnerships and voluntary initiatives. Near the end of her term, she noted 

 are moving in the wrong direction on nationwide vulnerabilities.

Rules and regulations with compulsory compliance—such as Securities and Exchange Commission rules requiring many publicly traded companies to 

 material cyberattacks—may fare differently.

“That’s one that will at least get rolled back, because the current version is very aggressive,” Bahar predicted.

The SEC rule has received major pushback from 

 like the Chamber of Commerce. Andy Lunsford, the CEO of breach management software developer BreachRX, told 

 via email that the number of reports filed so far indicates corporate compliance is “incredibly low.”

 on cybersecurity primarily target federal agencies, so some experts believe they may be more 

One area where Bahar sees the potential for advancement is federal data privacy law, as roughly 10 states either have their own laws or are working on them. California’s law, for example, is 

 in some respects as the European Union’s sweeping General Data Protection Regulation (GDPR).

 on cybersecurity because they specify the conditions and terms under which both public and private entities can collect and store sensitive data.

Circumstances are actually ripe for federal legislators to finally pass a data privacy law, Bahar said, because creating one set of standards that pre-empts stricter state ones is a “very business-friendly approach.”

Lawrence Gentilello, the CEO of consumer data removal firm Optery, said he anticipates more of the status quo.

“Every year or two people get really excited that there’s going to be a federal privacy law, and that still hasn’t happened,” Gentilello told IT Brew.

Former president, and current president-elect, Donald Trump descending the steps from a plane.

Cybersecurity policy experts on Trump’s second term: Your guess is as good as mine

Trump’s second term is likely to be anything but predictable, at least in terms of federal cybersecurity initiatives.

Human intelligence gathering isn’t typically a need-to-know skill in cybersecurity. But it is for Analyst1 Chief Security Strategist Jon DiMaggio, who befriended—and then doxxed—the leader of LockBit.

 how he spent years infiltrating the ransomware gang using numerous sock puppet accounts. After burning those personas in a January 2023 

 on his findings, DiMaggio was even able to keep up a relationship with the gang’s leader, “LockBitSupp,” under his real name.

identified and charged a Russian national

 named Dmitry Khoroshev as LockBitSupp in May 2024—and the UK’s National Crime Agency (NCA) seized LockBit’s site with an international task force, 

—DiMaggio already knew his name. IT Brew caught up with DiMaggio after his talk to discuss the role of human intelligence in cybersecurity, why it works, and the war on ransomware.

This interview has been edited for length and clarity.

This kind of human intelligence, does it have a role in more typical security work, or is it primarily for these more bespoke things that you’re able to do?

I will say, there’s a lot of risk that goes in with the human side…Personal exposure, threats of everything from swatting, to acts of violence, to doxxing you and putting all your personal information out there.

So it’s not in your traditional security work, but it is expanding. [There are] other use cases where it comes in very handy—the companies that are trying to gain access to data logs, stolen data, things of that nature, or new malware that might be for sale. Creating these profiles, engaging with threat actors, doing what’s called controlled buys, where you go in to either buy malware…or even just to get a data sample to validate if the threat actor actually has what they say they do.

How do you make sock puppets credible without actually being able to engage in any kind of cyber crime?

There’s two approaches to that. One, you fake it until you can’t, and then you get burned. That’s why you always have to have development puppets—because every account you make, it’s got a lifespan, and at some point it’s going to become obvious you’re not a criminal.

But one way to get around that is called account hijack, and that’s where you look for, like, a mid-level cyber criminal. When I say mid-level, I mean somebody who’s not dominating the forms of conversation, but has been around here and there enough that people know who they are. And then what you do is you create an account on a peer forum, and you mimic their screen name, and you pretend to be them. Now, the lifespan of those are even shorter, so those have to be used, very targeted, for very specific purposes…but they can be very effective.

Why do you think these actors are still so vulnerable to targeted stings like this?

Honestly? Comes down to human psychology. A lot of these people haven’t been treated well in their life. They haven’t gotten a whole lot of attention. And when you know what those vulnerabilities are, and you cater your persona to those vulnerabilities, you can become very appealing to where they almost want to become friends with you…A lot of people hear that when I talk about the psychology of it, and they think that’s just fluffy words. But it’s really, really not.

You can also look at the NCA, see how they used strong psychological tactics in Operation Cronos on LockBit. It’s been extremely effective in tarnishing their brand and breaking trust for their affiliates.

Does the takedown make you any more confident that these efforts are having an overall impact on ransomware?

No. You have to look at the wins for what they are. We don’t really have the ability to arrest people, it just doesn’t happen, because they’re in Russia.

You compare Operation Cronos to previous takedowns, one of the biggest things you’ll see is how they stage things, how they sort of trolled and taunted the adversary and dwindled putting things out, did it spaced out over time…That’s what the NCA did in this attack, is they made them feel the way that their victims feel.

The people that are expecting, ‘Oh, this isn’t effective, because they’re just standing up a new site,’ they’re not understanding the big picture, baby steps. We gotta work with what we have. And this is like the war on drugs.

Analyst1 chief security strategist Jon DiMaggio

LockBit infiltrator Jon DiMaggio on human intelligence, sock puppets, and ransomware

Analyst1 Chief Security Strategist Jon DiMaggio unmasked LockBit’s ringleader before the police announced it.

Your next cybersecurity incident could be the result of someone else’s breach.

There’s ample evidence to suggest that software supply chain attacks have 

 by the think tank Ponemon Institute, in conjunction with security firm Synopsys, found 59% of nearly 1,300 IT and IT security practitioners reported their organization had experienced at least one such attack.

Approximately 28% of respondents pinned the attack on an “unpatched open-source vulnerability previously detected, and 23% of respondents say it was the result of a zero day vulnerability,” according to the report. Others pointed to a compromise of build pipelines via malicious injection (21%), malicious dependencies (19%), and other causes (8%).

 to security practitioners: The threat actors behind software supply chain attacks are adopting sophisticated tactics, techniques, and procedures faster than defenders can keep up.

Attackers are picking software supply chains because their growing complexity enables them to exploit “asymmetric difficulty,” said Lloyd Evans, vice president of governance, risk, and compliance at digital services firm Aquia. Attackers with visibility into supply chains can often find low-hanging fruit like configuration errors or unpatched vulnerabilities buried deep enough to avoid scrutiny by security professionals.

“Security teams have to focus on the highest-prioritized, highest-leverage activities that can reduce the most risks,” Evans told IT Brew. Modern software development practices rely on multiple layers of dependencies downstream from each other, he said, and developers of end products might find it difficult or impossible to handle them all without assistance from automation-enabling tools like software bills of materials (SBOMs).

Shandra Gemmiti, senior director of cross-portfolio solutions at Synopsys’s Software Integrity Group, pointed out that 45% of respondents reported increased security budgets, but a little under 40% felt funding or staffing levels were adequate. The survey also showed low adoption rates of labor-saving methods, such as policy-based open-source management or automated monitoring, she said.

“There are so many respondents still relying on manual code reviews, manually monitoring external security feeds for new security vulnerabilities, and manually pulling together and compiling SBOMs,” Gemmiti told IT Brew. “It’s just not sustainable.”

The survey also found just 35% of respondent organizations are generating or producing SBOMs, and those that did were likely to cite industry regulations or customer and government requirements as motivators.

That “indicates they’re really only producing [SBOMs] on an ad hoc basis,” Gemmiti said.

Traditional methods of ranking risk like the Common Vulnerability Scoring System (CVSS) can be overwhelmed by sheer volume, Evans warned.

“It’s a very unforgiving approach to do vulnerability management in this dynamic,” Evans said. “You scan an application, you might get hundreds, you might even get thousands of findings, all with a severity score.”

 (EPSS) model, an emerging standard that uses a variety of data sources to rank all published common vulnerabilities and exploits by probability of an actual attack. While EPSS helps security professionals prioritize remediation efforts, it’s also a relatively new standard with some limitations, like having 

 that prevents ranking many vulnerabilities.

Developers can also reduce risk by remaining focused on value streams instead of chasing trends or implementing unnecessary features, Evans said—the fewer software components needed to satisfy customer requirements, the better. He also advised weighing the ease and cost savings of relying on open-source components against potential risks, like project 

If developers can’t be confident in their ability to track vulnerabilities and configurations in open-source dependencies, “leveraging software by purchasing from a company who is doing that might be a better option, and a better use of resources,” Evans told IT Brew.