CyberWire Daily - Patching can't wait.

Starting point is 00:00:00 You're listening to the Cyberwire Network, powered by N2K. No, it's not your imagination. Risk and regulation really are ramping up, and these days customers expect proof of security before they'll even do business. That's where Vanta comes in. Vanta automates your compliance process and brings compliance, risk, and customer trust together on one AI-powered platform. So whether you're getting ready for a SOC2 or managing an end-toe, enterprise governance risk and compliance program, Vanta helps keep you secure and keeps your deals

Starting point is 00:00:44 moving. Companies like Ramp and Writers spend 82% less time on audits with Vanta. That means less time chasing paperwork and more time focused on growth. For me, it comes down to this. Over 10,000 companies from startups to large enterprises trust Vanta to help prove their security. Get started at vanta.com slash cyber. Fortnite releases an emergency update for a critical vulnerability. A major outage disrupts Russian banking apps. A new report highlights critical skills gaps. Cybercore scholars struggle to secure jobs.

Starting point is 00:01:35 Scammers use QR codes in fake traffic violation schemes. A proposed lawsuit accuses perplexity of oversharing users' AI transcripts. Cambodia outlaws scam centers. Scammers impersonate Harvard IT, staff. With wrench attack threats of violence, life imitates art. Kevin McGee from Microsoft for startups describes emerging trends on our afternoon CyberT segment with Anne Johnson and speaks with Ali Mellon about her new book, Code War, how nations hack, spy, and shape the digital battlefield. And users find co-pilot's terms of use highly entertaining. It's Monday, April 6, 2026. I'm Dave Bittner,

Starting point is 00:02:28 and this is your Cyberwire Intel briefing. Thanks for joining us here today. It's great as always to have you with us. Fortinette has released an emergency update for a critical Forta-client enterprise management server vulnerability that attackers are already exploiting in the wild. The improper access control flaw lets unauthenticated attackers execute code through crafted requests.

Starting point is 00:03:07 The issue affects multiple Forta-client EMS versions, Researchers observed zero-day exploitation in the past few days. Shadow Server reports more than 2,000 exposed instances online. Exposed management servers can enable rapid enterprise compromise. Fortinette urges immediate hot-fix installation or upgrading to the latest version. A major outage disrupted banking apps and card payments across Russia, blocking transactions, ATM withdrawals, and transit fairs in several regions, including Moscow. The incident affected major banks including Sberbank, VTB, Alpha Bank, T-B, and GOSProm Bank.

Starting point is 00:03:54 Metro Turnstiles reportedly stopped accepting cards, forcing staff to allow passengers through. The cause remains unclear. Some reports link the disruption to Internet regulator Razcomnasdor, blocking infrastructure addresses or VPN services, while officials reportedly cited an internal spare bank failure. Spare bank confirmed the outage but did not explain the cause. Centralized payment infrastructure can create systemic disruption risk. The incident also reflects tightening Russian internet controls, including proposed white list access restrictions during disruptions. A new report from the Sands Institute and GIAC finds the cybersecurity workforce crisis is shifting from staffing shortages to critical skills gaps that are already contributing to breaches.

Starting point is 00:04:50 About 60% of organizations report their teams lack necessary capabilities, while 27% link breaches directly to those gaps. Regulatory pressure influencing hiring surge from 40% percent. to 95% in one year. At the same time, 74% of teams say AI is reshaping workforce structure, including some entry-level roles, while increasing demand for AI security specialists and governance expertise. The report also finds workforce strain is slowing operations. About 57% of organizations report delayed projects, 47% reports slower incident response, and 42% say skills gaps limit monitoring and technology adoption. Only 19% consider their teams fully skilled. Workforce capability gaps now represent a direct security risk, especially in critical infrastructure environments.

Starting point is 00:05:52 The report warns organizations must prioritize structured training, certification, and AI governance to maintain operations. resilience as regulatory demands and automation reshape cyber roles. Cyber Corps scholarship recipients are struggling to secure required federal cybersecurity jobs, raising concerns about a weakening talent pipeline into government service. At a recent virtual CyberCore career fair, only about 40 agencies participated, down from more than 75 typically attending in person. Many agencies lacked cybersecurity openings or directed applicants to USA jobs instead. Scholars must secure qualifying roles within 18 months or risk repaying scholarships that can total hundreds of thousands of dollars.

Starting point is 00:06:47 Some graduates now report considering private sector jobs amid limited entry-level federal opportunities and lingering effects from last year's hiring freeze and workforce cuts. Cyber Corps has long supplied early career cybersecurity talent to federal agencies. Reduced hiring access could undermine workforce development and discourage future public service participation, despite continued policy emphasis on expanding cyber capacity. Scammers are impersonating state courts in new text message campaigns that pressure recipients to scan QR codes tied to fake traffic violation notices.

Starting point is 00:07:28 The messages claim recipients owe $6.99 for unpaid toll or parking violations and include images of alleged court warnings. Scanning the QR code redirects victims through a captcha to fishing sites impersonating state agencies, where attackers collect personal and credit card data. Reports span multiple states, including New York, California, and Texas. QR code delivery helps survey detectives. and enables credential theft at scale. State agencies warn they do not request payments by text message. A proposed class action lawsuit alleges perplexity shared users' AI chat transcripts, including sensitive personal information, with Google and meta without users' knowledge or consent.

Starting point is 00:08:21 The complaint claims prompts, follow-up questions, and full conversations were transmitted through advertising trackers, such as Metapixel and Google Ads, even when users enabled incognito mode. The lawsuit alleges financial and health-related queries were exposed and says non-subscribed users faced broader sharing risks. The case covers chats from December 2022 through February 26 and accuses the companies of failing to disclose tracking practices. Undisclosed sharing of AI chat transcripts could expose sensitive research behavior and personal data at scale. The lawsuit highlights growing privacy risks as users increasingly rely on conversational search tools.

Starting point is 00:09:10 Cambodia has passed its first law specifically targeting online scam centers, introducing prison sentences and fines for operators as authorities expand a nationwide crackdown. The legislation sets penalties of two to five years in prison. prison and fines up to $125,000 for online scam offenses with harsher penalties for gang activity or large-scale victimization. The law also targets money laundering, data harvesting, and recruitment tied to scam operations. Officials say the measure supports a broader campaign to dismantle hundreds of suspected scam sites following international sanctions and criticism. Southeast Asian scam compounds have become a major source of global cyber-enabled fraud. Formal critical statutes may strengthen

Starting point is 00:10:02 enforcement and signal increased regional pressure on organized fraud networks. Harvard University is warning affiliates about an active social engineering campaign in which attackers impersonate IT staff to steal login credentials and sensitive data. Officials say attackers are directing targets to fraudulent websites or urging them to join live calls to capture credentials. The alert follows similar activity reported at the University of Pennsylvania and comes after recent fishing and breach-related incidents affecting Harvard systems. Targeted impersonation attacks can bypass technical defenses by exploiting user trust. Harvard urges affiliates to avoid unsolicited IT contacts and report suspected activity immediately.

Starting point is 00:10:52 A series of violent wrench attacks targeting cryptocurrency holders in San Francisco, San Jose, Sunnyvale, and Los Angeles has raised concerns about physical threats tied to digital asset theft. In one case, attackers posing as delivery drivers forced entry into a San Francisco home and stole about $13 million in Bitcoin and Ethereum after threatening the victim. Investigators believe suspects sometimes accessed victims' delivery accounts to obtain addresses. Authorities arrested multiple suspects linked to several incidents, though investigators, including the FBI, suspect higher-level organizers may be involved. Cryptocurrency's irreversible transfers can make holders attractive targets for coercion-based theft,

Starting point is 00:11:46 expanding cyber risk into the physical domain. wrench attack, by the way, refers to the famous XKCD comic, which we will link in the show notes. Turning to our Monday business briefing, recent cybersecurity investment and acquisition activity reflects continued momentum around artificial intelligence, insider risk, and platform consolidation across the sector. Census raised $70 million to support global expansion, while above security emerged from stealth with $50 million for insider risk capabilities. Varians secured $21.5 million to expand investigative AI agents for financial institutions. On the acquisition side, Airbus agreed to acquire ultra-cyber to strengthen sovereign cyber capabilities, and Rapid 7 acquired Kenzo security to advance AI-driven detection and response operations.

Starting point is 00:12:46 Data Bricks also acquired antimatter and SIFD AI to enhance authentication and threat analytics for AI systems. Investment and consolidation activity increasingly centers on agentic AI security, zero-trust networking, and compliance-driven platforms, signaling a shift toward automation-heavy security operations architectures. Be sure to check out our complete business briefing. That's part of CyberWire Pro, and it drops every Wednesday on our website. Coming up after the break, Kevin McGee from Microsoft for Startups describes emerging trends on our afternoon CyberT with Ann Johnson,

Starting point is 00:13:38 Anne speaks with Ali Mellon about her new book, Code War, how nations hack, spy, and shape the digital battlefield. And users find co-pilot's terms of use highly entertaining. Stay with us. Maybe that's an urgent message from your CEO, or maybe it's a deep fake trying to target your business. Dopple is the AI-Native social engineering defense platform fighting back against impersonation and manipulation.

Starting point is 00:14:21 As attackers use AI to make their tactics more sophisticated, Dopple uses it to fight back, from automatically dismantling cross-channel attacks to building team resilience and more. Dopple, outpacing what's next in social engineering. Learn more at doppel.com. That's do p-p-p-el.com. This episode is brought to you by Tell Us Online Security. Oh, tax season is the worst. You mean hack season?

Starting point is 00:14:55 Sorry, what? Yeah, cybercriminals love tax forms. But I've got Telos online security. It helps protect against identity theft and financial fraud, so I can stress less during tax season, or any season. Plan started just $12 a month. Learn more at tellus.com slash online security. No one can prevent all cybercrime or identity theft.

Starting point is 00:15:15 Conditions apply. Kevin McGee is Global Director of Cybersecurity Startups at Microsoft. I recently caught up with him at RASC 2026, gave him a break from being my... intern to hear him describe some of the emerging trends he's tracking when it comes to startups. You need a certain level of scaffolding to work with a hyperscaler like OS or AWS or what because you'll get on a call with 60 people from Microsoft and they're all going to want things from you. So you need sort of a certain level of size and complexity within your

Starting point is 00:15:56 organizations. You'll be able to just happen to hyperscalers. But when you build that infrastructure, then you can sort of get the lift off that comes with working with us. It can be very difficult sometimes to figure out and navigate Microsoft. I have all the entire tools to see who people are. I often find out about new products

Starting point is 00:16:13 we're releasing from customers because we're doing so many different things and releasing so many things so quickly. And I've given up being, you know, being upset about that that I can't keep up on everything. Right. And here we are at R.

Starting point is 00:16:33 USAC 2026, we are on the show floor right in the middle of everything. And it is my pleasure to welcome Kevin McGee from Microsoft. Kevin, thanks for joining us here today. Thanks for having me, Dave. I always get it wrong, so I'm going to ask you to say it yourself, because your title somehow gets convoluted in my brain. What is your official title with Microsoft? And now I wish I had my notes so I get it right.

Starting point is 00:16:58 I lead our cybersecurity portfolio for Microsoft for startups globally. All right. Let's dig into that. When you are at a conference like this, and part of your responsibility is finding and nurturing that next generation of cybersecurity startups, what's your strategy for surveying the lay of the land when it comes to new companies? I think a lot of it is the prep work up front.

Starting point is 00:17:22 So knowing who you want to see, who are those interesting ones, who can make a connection to some of the smart startups, because they won't have a booth maybe to go by and see. They won't have a president. here. So connecting with them is a little more difficult. If you want to see Microsoft or Crowdstrike or Paulo, you can go to their gigantic booth, and it's pretty easy to book a meeting and whatnot.

Starting point is 00:17:41 But the startups don't really necessarily have those connections. They're harder to find. So you have to do the recon. Up front, I think, is really the key. And then introductions and whatnot can be one of the best ways to figure out who to speak to. Now, is part of your position, the way that you all do things with the startup group at Microsoft,

Starting point is 00:18:03 Do you have an inbound channel where people are hopefuls are reaching out to you? Yes, so we have a whole set of programs. I like to think of it as kind of like an airplane. Microsoft for startups is an airplane. We know we have different classes of if you're two folks in a dorm room with a case of beer and a pizza, and you've got an idea. We've got a solution for you. If you need a higher level of service or go-to-market product growth integrations,

Starting point is 00:18:25 we have a service for you as well too. Ultimately, the program's based on how do we make partners successful? And I founded my first two companies in the 90s and on a BISBark, which was then what Microsoft for startup was called. And it was not just access to the software because it came on discads. They used to send me a box of discads.

Starting point is 00:18:43 It was the access to companies. It was the access to customers. It was the support. It was the brand association. And I think we've really gone back to our roots with the program, which is why I'm excited to sort of have the later part of my career

Starting point is 00:18:55 associated with the program as well, too. Yeah. So when, We're here at a conference like this, and there is one topic that is so dominant, so present, you know. And this year, it's AI, and not just AI, but agentic AI's. Every booth, it seems. If you don't have that as part of your message, why are you even here? You're not even allowed in the door.

Starting point is 00:19:20 Exactly. But how do you track what's next? Because I would guess, correct me if I'm wrong, that a lot of the companies, the startups want to ride on the coattails of that, but you still have to keep your eye on what's coming after that. I think we're at this inflection point.

Starting point is 00:19:41 I think when we look back, maybe the Wiz acquisition will be sort of the end of the one phase the beginning of the new one. So I'm sort of tracking what's happening in the AI space, what they're building, and seeing how broken it is,

Starting point is 00:19:52 and then knowing that three to six months later there will be a startup surge to fix those problems. So I think we'll see a lagging surge of cybersecurity startups behind the technologies. So take MCP. I didn't even know what MCP was three, four months ago.

Starting point is 00:20:06 Probably I'm way behind some of the viewers. But now I'm looking at six different companies that are in that space because of the wide adoption. So I'm trying to get ahead of the curve in that way. And I think there's a new wave coming up. And I've heard consolidations, you know, going to end our industry. I think it's the exact opposite.

Starting point is 00:20:24 I think we've kind of closed off one phase. We're at the beginning of the next one. What? What is your advice for those hopeful startups? Do you have a sort of a general checklist of you should have these things in place? I can tell you what works and what doesn't. Oh, that's even better. Yeah.

Starting point is 00:20:44 One is, are you building a feature or a product? Know what you're doing. If you're building a feature, you want to sell a little bigger company. Build a company that way. But if you've got a very small, total addressable market, and it's a feature, not a product. That's one thing that we kind of figure out where you are. And then two, know your ideal customer profile.

Starting point is 00:21:03 A lot of the startups I talk to, we sell to everybody. You'll never gain any expertise understanding that. Find one customer you can serve really well, figure out everything there is to serve them well, and do a great job and execute, and then work on your next ideal customer profile, ICP. And I think that's really the way to scale because then you understand a customer problem

Starting point is 00:21:25 and you're delivering a real solution. And that's ultimately what customers are buying. They're not buying the technology, they're not buying the model. They're buying a solution to their problem, and everyone feels they have to sell to everybody. Well, if you sold to just Midwest credit unions and you own that market, that's a great base to build from. I feel we have this Silicon Valley story where you're supposed to go large, go quickly. Sometimes you need to move in a small area to really understand the problem. Like, why Combinator really preaches this as the approach to do things that don't scale at first to learn?

Starting point is 00:21:59 And whoever learns faster, I think, wins in the market. Are there common pitfalls that you see, the mistakes that people make that sort of sink their hopes or chances? I think every pitch is not about a VC pitch. I don't really need to know the history of the company. I don't need to know the lineage of everyone of your founders. Get to the point. What problem are you solving for the customer? How big of a problem it is?

Starting point is 00:22:25 And how does it work? I think customers want to get to pass the slides, show me the demo, show me the POV. And so one of the questions I ask quite often, and you'll hear me in a lot of my interviews, is what's the moment when the customer says, I get it, when you do your presentation? Skip everything before that and go right to that, right? Because that's really where the traction happens. When they have their aha moment, everything before that is just noise until they get to that. And then you'll see them actually then say, oh, yeah, well, that, okay, well, that's your.

Starting point is 00:22:57 presentation. Everything you said after, I asked that question to your presentation. Get rid of all the stuff before. How important is the team? I think the team really matters for, especially for VC raising and whatnot. They want to bet on folks that have been there done that before. Having built a few companies myself, I think I really got lucky the first one. I had a little bit of victory disease, the second one. Those are the lessons I learned that made the third one super successful. So I think having a team is really key. And then having been a founder myself, it's a tough slog.

Starting point is 00:23:32 I think we have this TV version or movie version where there's this lone genius that invent something. The best companies are teams. You know, Hewlett Packard, you know? Yeah. Bill and Paul.

Starting point is 00:23:44 Stephen. Stephen, Steve. Yeah. You bring different aspects to the relationship, but also you can shed the load. I think that's really key. What do you, bring to the startups in terms of the spectrum of support that they get when they partner up with

Starting point is 00:24:03 Microsoft? Yeah, I think, and this is a lot of big companies are doing this, not just us, I think it's the right thing to do for innovation in our marketplace, is one, just brand association can be a huge thing, hey, we're working with Microsoft. Two, enterprise distributions are key. We have huge contracts with all sorts of major customers. So if you want to get into XYZ Bank, we have probably 60 people working with that account already. If you can prove, you're, you're product solves a problem and enhances and extends our solutions, you know, we're happy to make that introduction. So there's sort of the trust.

Starting point is 00:24:33 There's also just the platform that we make enabled. So a lot of our solutions we're building now are exactly platforms. And our philosophy, at least mine is we look to partner, partner, partner, then we'll build it if we can't find a partner in the market space, you know, and then maybe we'll look at buying it. So we're very open to entrepreneurs building on our platform. quite the opposite of what you think. We're not looking to sort of compete in every market.

Starting point is 00:24:58 We're actually looking to enable entrepreneurship. And so are many of the other major vendors. I think that's just good for our industry as a whole. All right. Well, Kevin McGee from Microsoft. Thanks so much for joining us. Thanks for having me, Dave. There's a lot more to this conversation than we have time to share here.

Starting point is 00:25:16 So please check out the full unedited interview. You can find a link to that in our show notes. On today's segment, from Microsoft's Afternoon CyberT podcast with Anne Johnson, Anne speaks with Ali Mellon about her new book, Code War, how nations hack, spy, and shape the digital battlefield. Today on afternoon CyberT, I am joined by Ali Mellon, a principal analyst and one of the most clear-eyed voices in cybersecurity today.

Starting point is 00:25:58 One of the things you actually do beautifully in the book is you strip away the mythology about cyber war, the idea that it's chaotic or that's even mysterious, are driven by these shadowy geniuses. What do you think is the most dangerous misconception leaders still have about nation-state cyber attacks? Honestly, it remains that these attacks won't happen to them, that they don't apply to them.

Starting point is 00:26:22 I especially see this with small and mid-sized businesses, and unfortunately the reality is that it's just not true. I think about, and I talk about in this book, Not Petya, as a great example of this, how did Not Petya start? It started with this tax document software created by this company Intellect Service, which was a small family-owned Ukrainian company that just made tax software and was just doing that for the country of Ukraine. It was a small business. It was a family-run business. And it ended up causing such a larger conflict when it was originally hit. And especially in the past few years, and I know that your team has done a ton of research here that's been really valuable to paint this picture, the supply chain is ever.

Starting point is 00:27:04 It is the way in for so many threat actors that don't want to just target the big players and want to find ways in that are a little bit more simple for them or where they can take advantage of some things that they might not be able to take in these larger scenarios. And unfortunately, like the scale that you can get with those attacks is everything too. So especially as we move forward as we continue to somehow be even more interconnected than we are already today, that is the thing that really needs to be driven home is that at the end of the day, everyone has a role to play in this,

Starting point is 00:27:38 and it's important that we address that at the source and do our best to have the strongest security posture possible. I think that's right. I do think that a lot of folks, when they think about nation-state actors, they think that they're going to attack the largest companies in the world, right? The Global 2000 and the Fortune 500,

Starting point is 00:27:55 and in reality, they're not always there, right? They often find the softest targets to make a point. Exactly. So a core idea is that, and I love this, by the way you talk about it, it's that cyber activity reflects national identity, whether it's history, you talked about a little doctrine, even culture, and you focus heavily on the U.S. and on Russia and on China. What should executives understand about how these differences actually play out in cyber operations? It was really fascinating as I was writing this book because I originally started out with the

Starting point is 00:28:27 intent to just look at the cyber attacks that these nations were perpetrated. and focus most of my energies on that. But what I found is the more I went into it, the more that I couldn't ignore, the regulations that were being put in place, the defensive actions that were being put in place, and the actual choices that the governments had made and the social contracts they'd established with their people,

Starting point is 00:28:50 and how all of those things factored into the defensive and offensive decisions they could make, and what was available to them. It's been really interesting because I do feel like when we look, look at the United States as an example, it's so much quieter with the attacks, or it has historically been so much quieter with the attacks that have been perpetrated, much more focused on being clandestine as much as possible, concealing the existence of the operation in any way possible. And a part of that is because there is an expectation that the U.S. is going to act a certain way on the global stage. But you can contrast that with other nations. We can go beyond China and

Starting point is 00:29:29 Russia into like North Korea as an example, they use the cyber attacks that they do, particularly to gather resources through Bitcoin and other cryptocurrencies, because there's no reason for them not to. It's not like we could sanction them more at this point. So they might as well go and use cyber attacks that way. Or you can look at Russia and see just how bombastic a lot of the attacks that they use are and how loud a lot of the attacks that they use are. Because at the end of the day, all the attacker groups associated with Russia are trying to do is get as much attention and as much meaningful attention from Putin as they possibly can. And I find that really interesting because when we look at a lot of the historical decisions that have been made with these cyber attacks,

Starting point is 00:30:18 so much of the success of the cyber attacks nation states perpetrate is based on the coordination that they have between different branches of the military. And so when you've seen, set up a system like there is in Russia where everyone is vying for some type of attention from Putin, it makes it so much more difficult to execute these attacks in a coordinated way where everyone plays their own part. Be sure to check out afternoon CyberT wherever you get your favorite podcasts. Okay, when I sell my business, I want the best tax and investment advice. I want to help my kids, and I want to give back to the community. Ooh, this. Then it's the vacation of a lifetime.

Starting point is 00:31:10 I wonder if my out of office has a forever center. An IG Private Wealth Advisor creates the clarity you need with plans that harmonize your business, your family, and your dreams. Get financial advice that puts you at the center. Find your advisor at IGPrivatewealth.com. And finally, Microsoft is drawing renewed attention to co-pilot's terms of use, which plainly warn the AI assistant is for entertainment purposes only and may not work as intended. The notice, unchanged since late 2025, resurfaced online after users rediscovered language

Starting point is 00:31:56 advising people not to rely on co-pilot for important decisions. Microsoft has repeatedly issued similar cautions during demonstrations, emphasizing human verification is required. Comparable limits appear elsewhere in the industry, reinforcing that even pro-branded AI tools may still discourage professional reliance. Vendor disclaimers quietly undercut the genius in every laptop narrative. The reminder is simple and straightforward. AI assistance can be useful, occasionally impressive,

Starting point is 00:32:32 and confidently wrong in equal measure. As the great philosopher Tom Waits stated, The large print giveth, and the small print taketh away. And that's the Cyberwire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app.

Starting point is 00:33:15 Please also fill out the survey in the show notes or send an email to Cyberwire at N2K.com. N2K's lead producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazas. Our executive producer is Jennifer Ibn.

Starting point is 00:33:35 Peter Kilpe is our publisher, and I'm Dave Vittner. Thanks for listening. We'll see you back here tomorrow.

CyberWire Daily - Patching can't wait.

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.