Master granular policy enforcement for hybrid classical-quantum AI workflows. Secure your MCP servers with post-quantum encryption and advanced threat detection.
The post Granular Policy Enforcement for Hybrid Classical-Quantum AI Workflows appeared first on Security Boulevard.
TL;DR
Security cameras, IoT, and OT devices that are meant to protect us, are easily compromised and turned against defenders, enabling nation-state reconnaissance (Iranian hacks on Hikvision/Dahua cameras during strikes, Russian webcam abuse in Ukraine), espionage via exposed live feeds, ransomware pivots (Akira group bypassing EDR), massive botnets (Mirai/Eleven11bot), and physical disruption. Structural weaknesses like default credentials, poor patching, internet exposure, supply-chain risks and espionage by design makes them ideal attacker tools, especially since they can’t receive endpoint security agents. Zero Trust Connectivity (ZTc) solves this by enforcing network-level Zero Trust: it blocks unauthorized connections before they form, requires no endpoint agents, prevents lateral movement, and supports decentralized deployment with sovereign data custody — giving defenders a powerful way to secure all devices without traditional detection or centralized decryption. In short, the watcher must be properly isolated at the network layer. In cybersecurity, the watcher must be watched most closely of all.
When Your Own Eyes Turn Against You: How Compromised Security Cameras and IoT/OT Devices Become Tools for Your AttackersTurning Defense Technology Against the Defenders
We live in an era where security cameras, smart sensors, industrial controllers, other Internet of Things (IoT) and Operational Technology (OT) devices are deployed everywhere—from traffic poles, corporate boardrooms and factory floors to homes and critical infrastructure. They are meant to watch, alert, and protect. Yet when attackers gain control, these very devices become potent weapons in their hands: silent observers feeding real-time intelligence, hidden pivots into protected networks, launchpads for massive distributed denial-of-service (DDoS) attacks, or even tools for physical disruption and espionage.
The problem is structural. Many IoT and OT devices ship with default credentials, receive infrequent (or no) firmware updates, lack proper network segmentation, and are exposed directly to the internet. Even in well managed deployments of IoT and OT, the supply chain threat is an additional attack vector. In cases where defenders patch devices to the latest firmware update, attackers could still be turning their equipment against them by pushing compromised firmware to the devices.
Once breached they grant attackers low-effort footholds. From there, the devices can be repurposed for reconnaissance, lateral movement, data exfiltration, or amplification of larger campaigns. In OT environments, where these devices increasingly converge with IT networks, a single compromised camera or sensor can open the door to industrial control systems (ICS) that manage physical processes. Cyber as a warfare domain could be the area where underfunded or outgunned adversaries can cause the most damage.
Security researchers and government agencies have repeatedly warned against these risks but the threat is no longer theoretical. Adding to the complexity is the problem that no endpoint agent can be deployed on these devices and a single device compromised could be the only potential connection point the attackers need to advance their attack.
In the light of defending against abuse of security cameras, the following are important aspects to consider:
State Actors Weaponize Cameras for Battlefield Intelligence
In March 2026, researchers at Check Point documented hundreds of hacking attempts by Iranian-linked threat actors targeting internet-connected Hikvision and Dahua IP cameras across Israel, Bahrain, Cyprus, Kuwait, Lebanon, Qatar, and the UAE. The attempts were timed to coincide with Iranian missile and drone strikes, suggesting the cameras were being hijacked for real-time reconnaissance—spotting targets, assessing damage, or guiding follow-on kinetic operations. The attackers exploited known vulnerabilities in the cameras’ firmware and used commercial VPNs and VPS infrastructure to scan and compromise devices.
This mirrors earlier Russian tactics. In January 2024, Russian operatives compromised residential webcams in Kyiv, Ukraine, to monitor air-defense systems and critical infrastructure ahead of missile strikes; some feeds were even streamed publicly on YouTube. A May 2025 joint advisory from more than 20 international agencies (including the U.S., UK, Australia, and others) warned of an ongoing Russian GRU campaign that systematically targeted RTSP servers hosting IP cameras at Western logistics and technology firms, primarily to harvest live imagery and metadata from Ukrainian networks.
Exposed Cameras as Everyday Espionage Tools
In June 2025, cybersecurity firm Bitsight identified more than 40,000 security cameras worldwide with live feeds accessible via nothing more than a web browser and an IP address. Many were located in homes, offices, factories, and public spaces; attackers could view interiors, employee movements, or manufacturing processes in real time. Dark-web forums openly discussed tools to locate and abuse these exposures.
Nation State Espionage Interest
Nation States with an interest in espionage are funnelling data in huge quantity to be processed and harvested for information. Especially concerning China, a myriad of reports show concrete evidence of automatic “phoning home” behavior, persistent data exfiltration even when cloud features are disabled, and specific incidents of communication with China-based servers. This aligns with broader concerns under China’s National Intelligence Law, which requires companies to assist state intelligence efforts.
IoT Cameras as Ransomware Springboards
In early 2025, the Akira ransomware group demonstrated a particularly creative pivot. After endpoint detection and response (EDR) tools blocked their Windows-based encryptor, attackers gained remote shell access to an unsecured Linux-based IP webcam on the victim’s network. From the camera they mounted network shares, exfiltrated data, and launched the ransomware payload—bypassing traditional defenses entirely.
Botnet Armies Built from Hijacked Cameras
Compromised IP cameras and network video recorders (NVRs) remain favorite building blocks for massive botnets. In June 2025, the Eleven11bot malware infected roughly 30,000 devices—mostly outdated IP cameras and NVRs—turning them into a coordinated attack infrastructure. Variants of the decade-old Mirai malware continue to evolve, exploiting unpatched flaws such as those in AVTECH cameras as late as 2024–2025.
Critical Infrastructure at Risk
Unpatched vulnerabilities in AVTECH IP cameras—widely used in finance, healthcare, transportation, and other critical sectors—were actively leveraged to spread Mirai-based malware, prompting advisories from the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Physical disruption is easily achieved. In July 2025, a cyberattack on the Netherlands’ Public Prosecution Service rendered dozens of speed cameras permanently offline (or at least kept them from being reactivated), demonstrating how compromised camera infrastructure can directly impair law-enforcement capabilities.
What This Means for Organizations and IndividualsThese incidents show a clear pattern: attackers no longer need sophisticated zero-days to cause harm. They simply locate the weakest link in the expanding IoT/OT attack surface—often a camera —and repurpose it. The consequences range from privacy violations and espionage to physical-world kinetic support in Cyber War and large-scale service outages.
The good news is that advances in technology does not only provide more leverage to attackers - Defenders also have access to new tools: Enter Zero Trust Connectivity - a new expression of Zero Trust that is implemented on the network level, can disrupt attacks before they could establish a connection. This requires no endpoint agent and does not rely on detecting an attack before the attack could be disrupted. Deployment is decentralized which aids in resilience and facilitates sovereign data custody - meaning there is no centralized data flow or decryption required that has traditionally hindered IoT devices that contain confidential data from being protected by 3rd party security systems.
Defenders must treat every camera, sensor, and OT endpoint with the same rigor as traditional IT assets: enforce strong, unique credentials; implement network segmentation (never expose OT/IoT devices directly to the internet); apply verified patches promptly; monitor for anomalous behavior; and adopt zero-trust principles even for “dumb” devices. The vulnerability protection of ZeroTrust Connectivity without the need to detect intrusions & asset inventory are no longer optional—they are table stakes.
The uncomfortable truth is that the eyes we install to watch over us can just as easily watch for our adversaries. In cybersecurity, the watcher must be watched most closely of all.
Additional Reading:Purdue 2.0? : Rising to the Challenge to secure OT with Zero Trust Connectivity - The ADAM Blog - ADAMnetworks - Explains the role of Zero Trust Connectivity applied to the protection of OT and Critical Infrastructure
“Wartime Usage of Compromised IP Cameras Highlight Their Danger” – Discusses Iranian, Russian, and other actors exploiting cameras for real-time intelligence in conflicts.
“When Smart Cameras Turn Blind: The Growing Cyber Threat to IoT Security Systems” – Covers vulnerabilities in smart camera infrastructure and attacks like the Netherlands speed camera incident.
“The Hidden Security Crisis: Why Your IoT Devices Are Handing Attackers the Keys to Your Network” – Details the Akira ransomware case using a compromised IP webcam as a pivot.
Healing a Broken Philosophy that Keeps Hurting Healthcare - Explores the vulnerability of IoT technologies and how Zero Trust Connectivity provides a solution for protecting technology debt in IoT-rich environments.
1 post - 1 participant
The post When Your Own Eyes Turn Against You: How Compromised Security Cameras and IoT/OT Devices Become Tools for Your Attackers appeared first on Security Boulevard.
71% of SOC analysts report burnout and 67% of alerts go uninvestigated. The triage model is broken. Here's how AI-autonomous platforms are transforming the analyst role from reactive ticket processor to strategic security advisor.
The post The SOC Analyst Was Never Meant to Be a Ticket Processor. Autonomous Triage Proves It. appeared first on D3 Security.
The post The SOC Analyst Was Never Meant to Be a Ticket Processor. Autonomous Triage Proves It. appeared first on Security Boulevard.
What Are Non-Human Identities in Cybersecurity? Have you ever considered how well your organization manages machine identities? Non-Human Identities (NHIs) serve as the backbone of cybersecurity, safeguarding machine-to-machine communications across various industries. But with their intricate nature, managing these identities and the secrets associated with them—like encrypted passwords and tokens—is as crucial as it is […]
The post How certain can you be about Agentic AI’s security capabilities? appeared first on Entro.
The post How certain can you be about Agentic AI’s security capabilities? appeared first on Security Boulevard.
How Do Machine Identities Create a Secure Environment? What happens when an organization’s data falls into the wrong hands due to mishandled machine identities? This concern is at the forefront of contemporary cybersecurity challenges. Machine identities, or Non-Human Identities (NHIs), are becoming increasingly pivotal in securing cloud environments. This discussion delves into how NHIs establish […]
The post How do NHIs build trust in cloud security? appeared first on Entro.
The post How do NHIs build trust in cloud security? appeared first on Security Boulevard.
How Can Machine Identities Enhance Cybersecurity? Could the management of non-human identities (NHIs) be the key to strengthening cybersecurity across various industries? With the increasing adoption of cloud services, the demand for robust security measures has never been more critical. NHIs play a pivotal role in creating a secure digital environment by combining an encrypted […]
The post How can Agentic AI improve organizational security appeared first on Entro.
The post How can Agentic AI improve organizational security appeared first on Security Boulevard.
One architect, 200 static playbooks, zero backup plan. The real consolidation problem isn't tool count — it's architectural dependency. Here's what replaces it.
The post The $250K Single Point of Failure Hiding in Every SOC appeared first on D3 Security.
The post The $250K Single Point of Failure Hiding in Every SOC appeared first on Security Boulevard.
ConductorOne has extended the reach of its identity governance platform to artificial intelligence (AI) tools, agents and integrations based on the Model Context Protocol (MCP). Additionally, the company has now integrated its namesake identity governance platform with the CrowdStrike Falcon Next-Gen Identity Security platform to provide access to threat intelligence in real time that can..
The post ConductorOne Extends Reach of Identity Governance to AI appeared first on Security Boulevard.
Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations') YouTube Channel.
The post [un]prompted 2026 – Opening Poem appeared first on Security Boulevard.
Agentic SOC is the hottest label in cybersecurity AI. Before you evaluate any platform using it, ask these five questions — and understand why architecture matters more than the name.
The post 5 Questions That Expose Whether an “Agentic SOC” Actually Works in Production appeared first on D3 Security.
The post 5 Questions That Expose Whether an “Agentic SOC” Actually Works in Production appeared first on Security Boulevard.
Bank Negara Malaysia’s updated RMiT framework introduces stricter authentication rules for banks and fintech apps. Learn how passkeys, adaptive MFA, device binding, and risk-based authentication help meet compliance.
The post Bank Negara Malaysia RMiT Update: New Authentication Rules for Fintech and Banks appeared first on Security Boulevard.
Regional APT Threat Situation In January 2026, the global threat hunting system of Fuying Lab detected a total of 26 APT attack activities. These activities were primarily concentrated in regions including East Asia, South Asia, and Eastern Europe, as shown in the figure below. Regarding the activity levels of different groups, the most active APT […]
The post NSFOCUS Monthly APT Insights – January 2026 appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..
The post NSFOCUS Monthly APT Insights – January 2026 appeared first on Security Boulevard.
NEW YORK, Apr. 1, 2026, CyberNewswire—TAC Infosec, a global leader in cybersecurity (NSE: TAC), with presence across 100+ countries, announced a historic milestone by crossing 10,000 clients – 6,500+ of TAC Security and 3,500+ of CyberScope, since April … (more…)
The post News Alert: TAC Security surpasses 10,000 customers, scaling global VM and AppSec platform first appeared on The Last Watchdog.
The post News Alert: TAC Security surpasses 10,000 customers, scaling global VM and AppSec platform appeared first on Security Boulevard.
Explore how Post-Quantum Key Encapsulation Mechanisms (KEM) secure AI proxy orchestration and MCP deployments against future quantum threats.
The post Post-Quantum Key Encapsulation Mechanisms in AI Proxy Orchestration appeared first on Security Boulevard.
Cybersecurity Can Learn from the Artemis Launch
The Artemis II mission, bringing humans back to the Moon, had a successful launch today! An amazing cumulation of efforts to manage the mindboggling combination of risks to push a massive rocket into space, in preparation for a trip to orbit the Moon.
Such endeavors come with tremendous risks, which a world-class team works to minimize, but some residual aspects remain and are accepted.
Congratulations to the entire NASA team!
Cybersecurity Can LearnThe cybersecurity industry can learn many lessons from today’s Artemis II achievement.
Having strategic capabilities with clear objectives, resources, and accountability is key:
1. Prediction: Understanding the broad scope of risks, which are likely, and how best to manage them.
2. Prevention: Essential to mitigate the greatest risks that could lead to catastrophe.
3. Detection: Constant monitoring to identify problems as they arise and give the best opportunities to react in a timely manner.
4. Response: Well-rehearsed actions that intercept problems to minimize overall impact.
Lessons from each area create a feedback loop into the process, to make it stronger and more adaptive over time.
Establish and maintain an enduring cybersecurity strategy. Don’t rely on disconnected tactical efforts, as they will underperform over time.
If you need advisement, assistance is out there, reach out to industry leaders.
The post Cybersecurity Can Learn from the Artemis Launch appeared first on Security Boulevard.
Most AI SOC platforms stop at alert classification. Learn why the L1 Automation Ceiling is structural, and how D3 Morpheus delivers L2-level investigation from a single platform.
The post The AI SOC’s L1 Automation Ceiling: Why Classification Is Not Investigation appeared first on D3 Security.
The post The AI SOC’s L1 Automation Ceiling: Why Classification Is Not Investigation appeared first on Security Boulevard.
An AI agent was banned from editing Wikipedia pages... and that's when things got weird, with the agent publishing its complaints publicly.
The post Wikipedia’s AI agent row likely just the beginning of the bot-ocalypse appeared first on Security Boulevard.
OK, RSA 2026 is over. If my record keeping is correct, I first attended RSA in 2006. At that time, I was annoyed by … AI? XDR? NIDS? …. noooo… I was annoyed by NAC (“As many other RSA observers agreed, under each tree you now see a NAC.” NAC rapidly arose from the “wormy” early 2000s and quickly vanished inside network infrastructure devices).
That t-shirtAnyhow…
If the RSA Conference is the annual, sprawling theme park of the cybersecurity industry, then RSA 2026 was the year the park owners unveiled the shiny, terrifying, and utterly bewildering “AI Rollercoaster.” But as my co-host Tim Peacock and I sniffed around the expo floor, a familiar suspicion crept in: half the queue signs were blatant fabrications, and the ride itself might only be half-built.
For decades, we’ve attended this annual security pilgrimage expecting consolidation, disruption, and an industry growing up. And every year, we leave with the same truth: the more things change, the more they stay the same (and no, I am not old enough to be called “a curmudgeon”). This year, the force of AI agents was everywhere, yet the industry’s response — the good, the bad, and the baffling - revealed more about our collective inability to do the fundamentals than it did about the technology itself.
The first thing you notice about the AI Rollercoaster is the marketing. It’s less about engineering excellence and more about colorful claims that would make a 1890s snake oil salesman blush. Our first, unavoidable observation was the sheer breadth of the AI Hype Spectrum, a problem of which AI washing is one of the levels.
We saw vendors across the spectrum: from those quietly using AI for genuine, impactful security tasks to those who merely “spray painted an AI” onto their 2021 marketing materials and called it a new platform. This latter group — the “AI touch-up” artists — are everywhere, simply adding a comma and the word “agents” to their identity management tools description, firewalls, anti-virus and calling it a day (I have booth pictures, yes)
Look, you are not an AI native company if you launched in 2003 and have a “talk to docs / manuals” chatbot in 2026. BTW, your chatbot can be easily convinced to spout political propaganda because your RAG sucks and you think “restrict via system prompt” is AI security…
This brings me to the first core truth of RSA 2026: to succeed, the buyer must be the expert. It is profoundly disappointing — though not surprising — that in an industry claiming to be on the cusp of a technological revolution (AI AI AI!), our most potent advice for a CISO is a throwback to the days of dial-up: due diligence. BTW, see this quote: “The problem is that most of the people attending the RSA Conference can’t understand what the products do or why they should buy them.” This is…. OH HORROR! .. Bruce Schneier in 2008.
The genuine use of AI in a product is now almost entirely disconnected from the glossy message on the vendor’s booth. You, the buyer, need to dig deep, get technical, and understand what they are actually selling. If they claim AI makes their firewall (or: your SOC) better, tell them to show you the numbers (Better how? Better where? By how much? Depending on what?). If they can’t produce data and solid metrics on how AI improved their thing, you must assume they are not credible and are essentially lying. Sorry, but “cloud native firewall” is not a thing.
And speaking of gloss, a related phenomenon was what we called the “Wiz Effect.” We saw a notable rise in whimsical, information-free booths — lots of pinks, purples, superheroes, and non-security-related sports figures. While a tasteful aesthetic is welcome, this strategy only works if you are already a $32 billion company named Wiz. It did work- and it still does work — for Wiz! Wiz can have soup cans in the booth, and it will sell CNAPP by the million. For others, a fantastical booth merely meant your booth was remembered, but your message was utterly lost. Goats! Also, its low-information density approach compounds the problem of AI washing.
In the past, some clowns predicted that our industry will consolidate and only a dozen large vendors will remain. In 2026, many fear a different Vendor Apocalypse where the large AI labs will simply run over existing security vendors. If a massive LLM can run on an endpoint and perform vulnerability analysis, why do you need a standalone vulnerability scanner? To me, this risk is absolutely real, particularly for product categories like Static Analysis (SAST), which seems custom-made for LLM decimation (reminder: I am not an appsec expert). The same logic applies to firewall rule analysis, policy writing, and many simple IAM/PAM decisions. However, it is not yet clear (my gut says “no”, my brain says “wait for RSA 2027, then ask again”) that the entire industry is vulnerable though…
And this is where the industry’s legendary IT inertia kicks in. The persistence of “The Old” is a stunning, annual lesson in the industry’s resistance to disruption. We saw large booths from vendors whose heyday was decades ago — the fifth best firewall and antivirus vendors are still alive and well as if the calendar still shows 2006. Do you believe that Checkpoint sells “AI security”? They do now! Anyhow, they are still collecting hard-earned money from buyers. This proves that the promised AI disruption has not yet killed off even the “number six” player in a market., much less hurt the #1. “Last vendor on the list is … still ON the list” was my insight here.
Why such epic survival skills? I think it comes down to enterprise knowledge and IT inertia. We debated whether the security industry would survive based on the same concept that keeps human analysts relevant against a giant LLM: the possession of “tribal knowledge.” This is the accumulated, aggregated, and integrated gossip … eh … customer data…that good security vendors hold about their clients’ specific environments. This tacit knowledge, the context of why things are done, is not public, and an AI robot won’t have it today (theoretically, there are ways for them to gather it, to be sure). If your security operation relies on this copious chunk of tribal knowledge, a super-intelligent chatbot won’t replace your vendor — at least not yet.
Another odd observation here. For some vendors, promoting “openness” seems like a signaling maneuver for weakness, not strength. We walked past booths proclaiming “open data lake,” “open detection,” and “open ecosystem.” While I believe openness has inherently positive value, my cynical analyst brain immediately wondered: are they more open or are they just not better? See, vendor A sells EDR, and it is really good. Vendor B EDR sucks compared to vendor A. So they market it as “open EDR” because they cannot market it as “the better EDR” (it ain’t better, even according to them). Reactions?
While the hype around AI for security was overwhelming, there was a positive and genuinely exciting shift: the rise of securing AI and agents. Last year, I lamented the lack of focus on protecting AI systems. This year, I was pleasantly surprised to see vendors focusing on securing agents, securing agent identity, and doing data security for the AI supply chain and training data.
The third pilar of this is the bad guy with AI. To me, the real fear isn’t the “Bad Guy with AI” or even the coming “Bad AI”; the fear is the acceleration of the inevitable. If your security posture is bad before AI, it’s just going to be bad — and faster — after AI. As attackers modernize their business with AI, the average time to compromise will drop even further and — IMHO more importatny — a chance of a compromise will go up (ref this week suppy chain hits)
The ultimate takeaway here is the “boring” lesson: Get the fundamentals right (and, yes, AI can help here too). No amount of AI from a threat actor will exploit your cloud misconfiguration if you don’t have one (well, either cloud or misconfiguration). If your defenses against misconfigured systems, containers, and instances are robust, it doesn’t matter that the bad guy has AI; your stuff is more secure. The acceleration brought by AI will simply kill off “luck-based security.” The old adage is true: if your app has no obvious exploitable holes, there’s nothing for the AI-armed attacker to find. Magic!
So my single piece of advice for dealing with this reality, whether you are a buyer, a seller, or an analyst, is simple: demand the data. Do not let vendors get away with buzzword bingo. If a vendor says AI helps, make them prove it with solid metrics. The time for “trust-me-bro” security better be over!
Finally, some reactions from my 3 sessions. The most shocking reactions came from my “AI SOC” peer discussion on Thursday. I noticed a shocking, near-total lack of enthusiasm about AI SOC startups (total) and AI SOC concepts (near total). The best I got was “AI in a SOC sounds great, we will just wait for our SIEM/SOAR vendor or MDR to build it” and “this is better SOAR and we want this, but later.” And think about it: this was for people biased in favor of AI SOC (because they showed up for the session)… Not sure yet what to think of it!
Fun takes from other people(and there are many) are here (key quote: “Perhaps I’m being overly dramatic but I was surprised with the generally relaxed tone about the impending wave of vulnerabilities and the extent of industrialized attackers coming in the coming quarters. Everyone seems to know vulnerability management isn’t where it needs to be in most companies and what’s coming will pile on the pressure.”), here.
Related blogs:
RSA 2026: Agentic Future, Analog Fundamentals — The Paradox of Why the Old Guard Still Survives was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.
The post RSA 2026: Agentic Future, Analog Fundamentals — The Paradox of Why the Old Guard Still Survives appeared first on Security Boulevard.
What Role Do Non-Human Identities Play in Cybersecurity? When considering cybersecurity, how often do we think about non-human identities (NHIs) and their potential for vulnerability? In modern cloud environments, NHIs have grown to become significant players. Defined as machine identities in cybersecurity, NHIs offer critical avenues for addressing security gaps. These identities, along with their […]
The post Is investing in NHI security solutions justified? appeared first on Entro.
The post Is investing in NHI security solutions justified? appeared first on Security Boulevard.
Are You Prepared for the Rise of Non-Human Identities in Cybersecurity? When organizations continue to transition to cloud-based infrastructures, the emergence of Non-Human Identities (NHIs) raises critical questions about scalable security. How do we safeguard these machine identities, which are increasingly vital to our digital operations, yet pose significant security challenges? The management of NHIs […]
The post How to ensure your AI security measures are scalable? appeared first on Entro.
The post How to ensure your AI security measures are scalable? appeared first on Security Boulevard.
