Breaches - What’s Going On? The anecdotal data is pointing to rising breach levels as some have predicted. I use the word anecdotal carefully (and not dismissively). It does seem there are rising numbers of incidents correlating with attacker adoption of AI tooling.  These incidents might not, or might not yet, show up in official incident reporting data for a few reasons. Many of the incidents might not be significant enough breaches that rise above the threshold of disclosure, are happening in organizations not required to disclose, or are not classic cyber events for which reporting is through different aggregate channels like frauds or other scams.  What is clear as many of us have been saying since even before the “Mythos moment” is that vulnerability count is not the main problem, rather it’s the industrialization of attackers that is or will be the problem. Attackers have been resource-constrained and sometimes skill-constrained. If one or both of these changes then our industry’s dirty little secret that more vulnerabilities have gone unexploited than exploited will change. All targets of opportunity will become victims.  This doesn’t mean that all such incidents are or will be significant, in fact as many have also said it’s not clear yet that AI is or will help attackers monetize the weaknesses they are exploiting (except perhaps in fraud and scams). Even without monetization improvements there will still be more attacks and consequent incidents from agent swarms, as we have seen in recent days. A lot of these seem reminiscent of “script kiddie” type attacks. That is exploiting easily found vulnerabilities with little craft or significant downstream consequence.  Irrespective of this, it does point out what we already knew, that there are way too many vulnerabilities out there to be exploited which even if they don’t cause significant breaches do create reliability risk and drain resources of security teams who have to respond to it all anyway. The bottom line is, nothing new, that more organizations need to implement and relentlessly enforce a more rigorous baseline of controls (MFA, segmentation, critical systems patching, run time controls, IAM, etc.) to present  a stronger default defense. This isn’t that difficult conceptually but it’s hard from a discipline and focus perspective. More organizations need to get way more relentless.  When all (or more) targets of opportunity will become victims, more organizations need to implement a higher baseline. The minimal viable defended organization bar is getting higher.