TrustIT

A stranger walks in behind your employee carrying a box, and nobody stops them. From there they can plug into a network port, take a laptop, or sit at an unlocked computer. Get your team comfortable asking 'can I help you?' and make locking your screen normal when you step away.

Why AI Agent Sandboxes Are Failing Security Tests -

Why AI Agent Sandboxes Are Failing Security Tests Autonomous AI agents escaped a sandbox and accessed Hugging Face via reward hacking, exposing architectural control and isolation flaws.

Everyone's downloading AI tools at the moment, and scammers have caught on.

Say someone on your team wants to try a new AI app. They search for it, click the top result, and end up on a page that looks like the real company's site. They download the app. It's fake, and it steals every password saved on their computer.

The fake sites are hard to spot because they copy the real ones closely, and the link is often an ad shown above the real website in the results.

Security firms have reported a lot more of this over the past year.

Only download software by going to the company's real website yourself, not by clicking an ad or a search result. If a page asks you to install something and you're not sure it's real, don't. And it helps to agree as a team on which AI tools you use, so people aren't installing unknown ones to try them out.

Malware still arrives as an email attachment someone opens without thinking. Be wary of .exe, .msi, .scr, scripts like .js or .bat, disk images like .iso, and any Office file asking you to enable macros. Unexpected attachment? Check with the sender another way before opening it.

Trezor data breach impact now reaches 81,000 customers -

Trezor data breach impact now reaches 81,000 customers Cryptocurrency hardware wallet maker Trezor says an August data breach at its shipping and logistics provider, ShipMonk, affects an additional 67,000 U.S. customers.

How many people know the password to your company Instagram? If it's in a spreadsheet or a group chat, you can't see who used it and it walks out the door when someone leaves. Use a password manager with a shared vault so people can use logins without ever seeing the password.

OpenAI Agents Hijack Another Victim Website -

OpenAI Agents Hijack Another Victim Website OpenAI agents made 15,000–18,000 autonomous edits to a German wiki over three months, evading moderation and echoing tactics seen in the Hugging Face breach.

Mathspace discloses data breach affecting over 1 million people -

Mathspace discloses data breach affecting over 1 million people Online maths learning platform Mathspace disclosed over the weekend that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system.

People reported losing $3.5 billion to imposter scams in 2025, per the FTC. That's someone pretending to be your bank, a supplier or your boss to get money moved. Never act on an out-of-the-blue message. Call them back on a number you already have.

FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025 New data from the Federal Trade Commission reveal that people reported losing a staggering $3.5 billion to imposter scams in 2025, with reported losses increasing nearly three times since 2020.

By default, a Microsoft account will accept a login attempt from anywhere in the world.

Most attacks on Microsoft accounts come from overseas, from automated tools trying stolen passwords by the thousand. If your business only works in one or two countries, there's no reason to allow a login from anywhere else.

There's a setting in Microsoft 365 called Conditional Access that lets you block any login from outside the countries you operate in. Someone trying your password from the other side of the world is turned away, even if the password is right.

It won't stop everything, and a determined attacker can route through your country to get past it. But it blocks the flood of automated attempts from places you'll never deal with, and that's most of what you're up against.

You'll need the right Microsoft plan, and it's set up in the admin area, so ask your IT provider to turn it on and set the countries you work in.