We’re Tracking the Future of Security

Category: Intelligence

  • Hegseth Orders Pentagon to Treat Counter-Drone Approval Delays as “Operational Risk”

    Hegseth Orders Pentagon to Treat Counter-Drone Approval Delays as “Operational Risk”

    Defense Secretary Pete Hegseth has signed a memorandum ordering the Pentagon to treat bureaucratic delays in fielding counter-drone technology as an operational risk, aiming to clear procedural bottlenecks that have slowed deployment of systems meant to protect U.S. military bases, critical infrastructure and other domestic assets from unmanned aircraft threats, DefenseScoop reported on October 2.

    The five-page directive, dated September 28 and titled “Project Agincourt: Pathway to the Autonomous Warfare Command,” was publicly released the following Friday. “The Department will take down barriers so our warfighters can take down drones,” Hegseth wrote in the memo.

    What the Directive Changes

    The memo targets specific administrative chokepoints that have historically slowed counter-drone hardware and software adoption, including radio spectrum and frequency authorization delays and lengthy safety review processes. Review and approval authorities are now required to treat any delay in processing counter-drone requests as an operational risk rather than routine paperwork.

    Hegseth directed the Pentagon’s chief information officer to review, within 30 days, how DoD components submit counter-UAS spectrum requests to interdepartmental spectrum authorities and to recommend ways to speed approval — work that will feed into the Defense Innovation Unit’s “Project Spectrum Strike” effort. Separately, the department’s chief digital and AI officer was told to coordinate with the CIO, the Office of General Counsel, the Defense Information Systems Agency, U.S. Cyber Command, and the military services to build a single, department-wide approval process that cuts authority-to-operate timelines for tested, validated counter-drone systems from months down to days or weeks.

    JIATF-401 as the Enforcement Backbone

    The directive functions as an enforcement mechanism for Joint Interagency Task Force 401, the Pentagon’s lead counter-drone coordination body, which Hegseth designated as the department’s “synchronization point” for counter-UAS employment across the military services, combatant commands and interagency partners. Under the memo, JIATF-401 becomes the repository for technical data, common hazard assessments, approved mitigation measures and threat intelligence used in all counter-UAS weapon safety reviews.

    Army Lt. Col. Adam Scher, a JIATF-401 spokesperson, told DefenseScoop that the task force “is taking aggressive action to streamline bureaucratic approvals and remove barriers that delay lawful, safe, and effective counter-drone operations,” adding that “JIATF-401 will not accept a slow-moving bureaucracy when faced with a fast-moving threat.”

    Why It Matters

    The directive arrives amid mounting drone incursions over U.S. installations and escalating cartel-linked drone activity along the southern border, pressures that have already driven JIATF-401’s Falcon Peak test series — including its most recent iteration at Yuma Proving Ground — and a pending move toward urban-environment counter-drone demonstrations. By explicitly reframing spectrum and authorization delays as risk rather than process, the memo signals that acquisition speed, not just new hardware, is now a formal Pentagon priority for close-in drone defense.

    • Memo: “Project Agincourt,” signed September 28, 2026, released October 2
    • Key fixes: Spectrum/frequency authorization review (30-day CIO review); single department-wide ATO process targeting days-to-weeks timelines
    • Lead body: Joint Interagency Task Force 401 (JIATF-401), designated as the department’s synchronization point

    Source: DefenseScoop, “Hegseth issues new directive to hasten U.S. military’s counter-drone pursuits,” October 2, 2026. Confidence: DIRECT.

    Sources and Further Reading

  • Alleged Iranian State-Linked Hacker Extradited to US Over University Breaches

    Alleged Iranian State-Linked Hacker Extradited to US Over University Breaches

    Montenegro has extradited Amir Barati, a dual Turkish-Iranian national, to the United States to face charges tied to a long-running campaign of breaches against universities, research institutions and government entities. Montenegrin authorities arrested Barati on June 25 while he was in the coastal town of Kotor, acting on an FBI arrest warrant, and a Montenegrin court approved his extradition under a simplified procedure.

    A campaign prosecutors trace to 2013

    US prosecutors allege Barati is a member of the Mabna Institute, an Iran-based entity accused of running cyberattacks on behalf of Iran’s Islamic Revolutionary Guard Corps. An August indictment named Barati among 17 people charged in a 14-count case connected to breaches at more than 150 US universities and other research institutions, with authorities estimating stolen academic data, intellectual property and related losses at roughly $3.4 billion.

    A rare extradition for an alleged state-linked operator

    Extraditions of individuals accused of acting on behalf of Iranian state interests remain uncommon, making Barati’s case notable regardless of the eventual trial outcome. For research institutions, the case underscores that nation-state-linked actors continue to treat university networks as a long-term espionage target rather than a one-time opportunity, an assessment that shapes how security intelligence teams prioritize monitoring of research data hosted on campus networks.

    Sources and further reading

  • Osavul Raises $10 Million to Detect Hostile Intent Across Cyber and Physical Domains

    Osavul Raises $10 Million to Detect Hostile Intent Across Cyber and Physical Domains

    Hybrid risk intelligence company Osavul has raised $10 million (€8.5 million) in a Series A round led by 33N Ventures, with participation from Balnord, G+D Ventures and existing investor 42CAP. The round, announced October 1, brings the Luxembourg-based company’s total funding to roughly €12 million.

    Reading hostile intent across three domains

    Osavul’s AI platform analyzes open and privileged data sources to identify hostile intent spanning the information, cyber and physical domains, rather than treating them as separate disciplines handled by separate teams. The company, which counts NATO and other defense and government institutions among its customers, says it maps identified intent against a customer’s own people, facilities and supply chains to show where a strike could land.

    Part of a wider funding trend

    Osavul says it has tracked more than 150 state-linked hybrid incidents across Europe since 2022, combining cyberattacks, sabotage, espionage and information manipulation, and plans to use the new funding to expand from government and defense work into enterprise and critical-infrastructure customers. The raise adds to a run of early-stage funding for platforms that promise a single risk picture spanning categories security teams have traditionally monitored with separate tools.

    Sources and further reading

  • CISA Sets Four-Dimension Quality Framework for the CVE Program

    CISA Sets Four-Dimension Quality Framework for the CVE Program

    The U.S. Cybersecurity and Infrastructure Security Agency has published a framework for moving the Common Vulnerabilities and Exposures program into what it calls a new Quality Era. Announced on September 23, the initiative focuses on the reliability and sustainability of the global identifier system used to track publicly disclosed security flaws.

    Four dimensions of CVE quality

    The framework organizes improvement work around four dimensions: transparent program governance, broad ecosystem participation, resilient data infrastructure and trustworthy CVE record content. CISA says the approach builds on its earlier CVE strategy and is intended to give maintainers, CVE Numbering Authorities and users clearer ways to measure progress.

    The timing reflects pressure from a growing international contributor base, expanding software supply chains and AI-assisted development and analysis. Those trends can increase both the volume of vulnerability reports and the demand for records that are complete, timely and useful to defenders. The framework does not replace technical severity scoring or vendor advisories; it addresses the quality of the shared identification and cataloging system that connects those sources.

    What security teams should watch

    Asset and vulnerability-management teams depend on stable identifiers to correlate scanner results, supplier notices and remediation activity. Improvements to record completeness and data infrastructure could make that correlation more dependable, but organizations still need to validate affected versions and remediation guidance against primary vendor sources. SectechMedia follows related operational issues in its cyber-physical security coverage.

    Sources

  • ACCS Publishes Assessment Requirements for ISO Age-Assurance Framework

    ACCS Publishes Assessment Requirements for ISO Age-Assurance Framework

    The Age Check Certification Scheme has published ACCS 1:2026, a set of conformity-assessment requirements linked to ISO/IEC 27566-1, the framework for age-assurance systems. The organization says the document is intended to help conformity-assessment bodies prepare for accreditation and certification work covering age verification, estimation and inference services.

    From a framework to assessable controls

    Age-assurance standards describe objectives and system characteristics, but certification also requires a repeatable method for evaluating whether an implementation meets those expectations. ACCS says the new requirements work with its general scheme rules and have been reviewed by the United Kingdom Accreditation Service for suitability in an accreditation process.

    The development comes as regulators and service providers face growing demand for age checks in online environments. Relevant systems can use identity documents, biometrics, account information or other signals, and each method introduces different privacy, security, accessibility and error-handling considerations. A conformity-assessment scheme does not eliminate those trade-offs, but it can give buyers a structured basis for reviewing claims and audit evidence.

    What buyers should verify

    Organizations evaluating age-assurance services should confirm the exact scope of any certification, the version of the referenced standard and whether the assessment covers the deployed configuration rather than only a generic product. They should also examine data minimization, retention, appeal procedures and performance across the intended user population. Marketing language should not be treated as a substitute for a certificate and its scope statement. SectechMedia monitors related requirements through its Standards Watch coverage.

    Sources

  • Idaho National Laboratory Introduces TOPGEAR for Cyber-Physical Influence Risk

    Idaho National Laboratory Introduces TOPGEAR for Cyber-Physical Influence Risk

    Idaho National Laboratory is developing TOPGEAR, a platform intended to show how corporate relationships and individual influence can create risk around critical infrastructure. The name stands for Technology, Organization and Person of Interest Graph Extraction, Analysis and Reporting.

    Looking beyond a conventional cyberattack

    Traditional assessments often concentrate on software vulnerabilities, network boundaries and physical hazards. TOPGEAR instead connects information about organizations, people and infrastructure assets. The objective is to reveal how investments, acquisitions, board positions or supplier relationships could create influence over facilities such as substations and data centers without a malware incident.

    Industrial Cyber reports that the platform draws on public sources including regulatory filings and energy data, then represents the information across social, infrastructure and cross-layer networks. Analysts can examine how an entity is connected to an asset and identify concentrations that may deserve additional review. The output is an aid to analysis, not proof that a relationship is malicious.

    A broader resilience model

    The project illustrates why critical-infrastructure protection requires ownership, supplier and governance data as well as technical telemetry. Organizations adopting similar methods should record source provenance, confidence and update dates so that old or ambiguous relationships do not become false accusations. TOPGEAR adds another perspective to security intelligence by treating organizational influence as a cyber-physical dependency.

    Sources

  • Physical Security Risk Assessments: Threat, Vulnerability and Consequence Analysis

    Physical Security Risk Assessments: Threat, Vulnerability and Consequence Analysis

    Security budgets are finite, and not every threat deserves the same investment. A physical security risk assessment is the structured process of identifying what could go wrong at a facility, how likely each scenario is, and how much damage it would cause, so that security spending targets the risks that matter most rather than whatever equipment a vendor is currently promoting. Done well, it produces a prioritized list of gaps tied to actual consequences; done poorly, it produces a generic checklist that could apply to any building anywhere.

    Threat Identification

    The first step catalogs what a facility actually needs to defend against, which varies enormously by site: a data center worries about unauthorized physical access to server racks and insider threats, a retail location worries about theft and workplace violence, a chemical plant worries about sabotage with public-safety consequences. Threat identification draws on crime statistics for the area, the facility’s own incident history, industry-specific threat intelligence, and simply asking staff what near-misses or concerns they have already observed on site.

    Vulnerability Analysis

    Once threats are identified, vulnerability analysis asks how exposed the facility actually is to each one — walking the perimeter, testing access points, and reviewing whether existing controls (fencing, lighting, cameras, access control, guarding) would actually detect or delay a given scenario, as opposed to simply being present. A door with a card reader is not a control if it is routinely propped open; a camera pointed at a loading dock is not a control if no one monitors the feed or reviews it after an incident.

    Consequence and Criticality

    Not every asset in a facility matters equally, so assessments rank assets and areas by criticality: what happens if this specific space, system, or piece of equipment is compromised? A server room outage might halt operations company-wide, while a supply closet breach is a minor loss. This criticality ranking, combined with threat likelihood and vulnerability, is what lets an assessment produce an actual risk score rather than a flat list of undifferentiated findings.

    The CARVER-Style Prioritization Model

    Higher-consequence facilities often use structured scoring frameworks, descended from the military CARVER method (Criticality, Accessibility, Recoverability, Vulnerability, Effect, Recognizability), to rank assets and scenarios on a consistent numeric scale rather than relying on a single assessor’s subjective judgment. These frameworks force the assessment team to score each factor separately before combining them, which helps surface disagreements about, for example, how accessible a target really is, rather than letting one loud opinion in the room set the final priority.

    From Assessment to Action

    An assessment that sits in a binder changes nothing. The output that matters is a prioritized remediation plan mapping each significant gap to a specific fix, an owner, a cost estimate, and a timeline, with the highest-consequence, highest-likelihood gaps addressed first. Because threats and the facility itself both change over time, most security programs treat the risk assessment as a recurring process, typically annual or after any major incident or facility change, rather than a one-time report.

    Reference sources

  • Physical Penetration Testing: How Red Teams Assess Physical Security Programs

    Physical Penetration Testing: How Red Teams Assess Physical Security Programs

    A facility can pass every compliance checklist — badges issued, cameras installed, doors alarmed — and still be vulnerable to someone who simply holds a door for a stranger carrying boxes. Physical penetration testing exists to find that gap before an adversary does, by hiring a team to actively attempt unauthorized entry, credential theft, or data exfiltration using the same techniques a real intruder would use, rather than reviewing policies and equipment lists from a desk.

    Scoping and Rules of Engagement

    Every physical penetration test starts with a written scope defining exactly what testers are authorized to attempt, which buildings and hours are in play, and critically, what to do if a tester is confronted or detained — typically a “get out of jail free” letter signed by an authorized executive that testers carry and can present to security or police. Rules of engagement also specify hard limits: most engagements exclude anything that could cause real property damage, injury, or trigger an actual emergency response, distinguishing a controlled assessment from genuine criminal activity.

    Social Engineering and Tailgating

    The most commonly successful technique in physical penetration tests is not defeating a lock but exploiting human courtesy: tailgating through a badge-controlled door behind an employee, posing as a vendor or delivery driver, or simply projecting enough confidence and a plausible cover story that staff assume someone else already verified the visitor. These tests measure whether a facility’s access-control technology is actually being used as designed, since a mantrap or turnstile provides no protection if employees routinely hold the door for anyone walking behind them.

    Lock Bypass and Physical Defeat

    Where technology is tested directly, common techniques include lock picking and bumping on mechanical locks, shimming or manipulating electronic strike hardware, and testing whether door sensors and alarms actually trigger and are actually monitored rather than just installed. Testers also probe less obvious entry points: loading docks, roof access, shared stairwells in multi-tenant buildings, and ceiling tiles or under-floor spaces that can bypass a badge-controlled door entirely.

    Reconnaissance Before the Test

    Serious engagements begin with open-source reconnaissance well before anyone sets foot on site: employee badge photos posted on social media, building floor plans in public permit filings, shift-change patterns visible from a parking lot, and vendor or contractor uniforms that can be replicated. This phase mirrors the reconnaissance a genuine threat actor would conduct and often reveals more exploitable information than the physical test itself.

    Reporting and Remediation

    A physical penetration test is only useful if its findings translate into fixed gaps rather than a list of embarrassing anecdotes. Effective reports document each successful and failed attempt with timestamps and evidence, map findings to the specific control that failed (a policy, a piece of technology, or a training gap), and prioritize remediation by how easily the same technique could be repeated by someone with less skill or access than the test team had.

    Reference sources

  • North Korean Hackers Deploy Stealthy Linux Backdoor Hidden Inside HAProxy

    North Korean Hackers Deploy Stealthy Linux Backdoor Hidden Inside HAProxy

    A North Korea-aligned threat actor has been using a new Linux-based espionage toolkit to target automotive and media organizations in South Korea, according to research published by Rapid7. The framework is designed for long-term, stealthy surveillance rather than smash-and-grab data theft.

    A Backdoor Compiled Into the Load Balancer Itself

    At the center of the toolkit is a custom HAProxy plugin the researchers call the “ted” backdoor, compiled directly into a HAProxy 2.8.12 instance running in the victim’s environment. Rather than running as a separate malicious process, it hooks into HAProxy’s native filter API, internal memory pools, event scheduler and HTTP parser, letting it intercept and inject traffic while genuine load-balancing operations continue normally, which helps it evade routine monitoring.

    The broader framework also includes trojanized versions of common Linux utilities, including agetty, atd, crond, polkitd and sshd, along with a curl-based remote access tool the researchers call CurlRAT and an SSH keylogger that doubles as a staging server. CurlRAT polls its command-and-control server roughly every 12 hours and can decrypt and execute stored commands, write new configuration payloads to disk, or spawn a full interactive shell.

    Initial Access and Attribution

    Rapid7 says the attackers first gained access to an edge server by exploiting a vulnerability in a groupware login portal, then used the SSH keylogger to harvest credentials for lateral movement into internal systems. Once installed, the ted backdoor let attackers redirect or serve malicious content to selected visitors browsing through the compromised load balancer, using low-cost commodity domains designed to blend in with legitimate traffic, in one case mimicking a Naver static-content domain.

    Rapid7 says the toolkit has likely been in use since late 2024, based on the release date of the first HAProxy version it was compiled against. Attack infrastructure and techniques observed overlap with watering-hole methods previously used by APT37 and Lazarus, and the campaign’s timeframe overlaps with Operation SyncHole, a watering-hole campaign against South Korean firms attributed to Lazarus in 2025 — pointing toward a North Korean state-linked actor, though Rapid7 stops short of formal attribution to a specific named group.

  • Geutebrück Enters New Ownership Phase With IBEX and Merantix Momentum Investment

    Geutebrück Enters New Ownership Phase With IBEX and Merantix Momentum Investment

    German video security specialist Geutebrück is entering a new corporate phase after receiving a majority investment from IBEX Wachstumspartner, alongside European AI group Merantix Momentum, according to Security Info Watch and confirmed by law firm Schmitz Knoth, which advised Geutebrück’s shareholders on the transaction. The deal closed on August 31, 2026.

    New Leadership and International Ambitions

    As part of the transition, Tobias Huemmerich will take over management of the company, with plans to further internationalize the business and expand its customer offering, according to Security Middle East. Geutebrück has operated in the video security market for more than 55 years and has built a reputation as a provider of video management software and hardware for public-sector and highly critical infrastructure clients.

    Merantix Momentum Brings AI Expertise

    Merantix Momentum, described as Europe’s leading AI group, is joining the investment specifically to help Geutebrück develop new AI-based applications, according to the companies. Geutebrück has said it sees opportunities to extend its video management platform beyond traditional security use cases, including the potential use of anonymized video data to identify workflow efficiencies and improve occupational safety.

    Part of a Broader Consolidation Trend

    The investment adds to a string of ownership changes across the video surveillance sector as manufacturers seek capital and AI expertise to keep pace with larger competitors. IBEX Wachstumspartner, an owner-managed investment firm focused on succession situations at German medium-sized businesses, said the deal reflects its strategy of pairing growth capital with digitalization expertise for established technology companies entering a generational transition.