We’re Tracking the Future of Security

Author: Osiris

  • EASA Proposes New Security Rules for Drone Operations

    EASA Proposes New Security Rules for Drone Operations

    The European Union Aviation Safety Agency has issued Opinion 06/2026 proposing amendments intended to tighten the security of drone operations across Europe. The package addresses the continued growth of unmanned aviation and the need to align operational authorization with security, identification and oversight.

    From aviation safety to security assurance

    Unmanned Airspace reports that the opinion covers a broad set of changes affecting operators and authorities. EASA opinions are proposals within the European rulemaking process, not the same as rules already in force. Operators should therefore distinguish the published proposal from the legal text that may eventually be adopted.

    Security controls for drone operations can include operator identity, remote identification, protected command links, incident reporting and restrictions around sensitive locations. The practical effect depends on aircraft category, operating environment and the final implementing rules. Authorities also need systems that can consume identification data without treating every unknown aircraft as hostile.

    Implications for airspace security

    Airports, critical infrastructure operators and counter-UAS teams should follow the rulemaking because regulatory identification and operational data can improve incident assessment. They do not replace independent detection or response authority. A balanced airspace-security program must combine legal process, reliable sensor evidence and proportionate intervention.

    Sources

  • Denmark Buys Weibel Radars for Military Counter-Drone Operations

    Denmark Buys Weibel Radars for Military Counter-Drone Operations

    Denmark’s defense acquisition organization is purchasing radars from Danish manufacturer Weibel Scientific for military counter-uncrewed-aircraft operations. The procurement reflects the growing emphasis on dedicated detection as armed forces respond to small and fast-moving aerial threats.

    Detection before engagement

    Unmanned Airspace reported the purchase on 21 September, citing Denmark’s defense procurement authority. Radar is one part of a counter-UAS chain that may also include radio-frequency sensing, electro-optical confirmation, command-and-control software and an authorized mitigation method. The sensors must provide tracks that operators can classify and correlate before any response is selected.

    Small aircraft create difficult conditions because terrain, buildings, birds and legitimate aviation can generate clutter or competing tracks. Performance therefore depends on siting, calibration and integration as much as on the sensor specification. Military deployments also need clear procedures for transferring tracks among local units and wider air-defense networks.

    Integration is the central test

    The acquisition should be judged by field acceptance, data quality and operational fit rather than radar count alone. Track continuity, false-alert handling and identification workflows are particularly important near bases and civilian airspace. Denmark’s purchase adds to European investment in counter-UAS and airspace security amid concern about both hostile drones and ambiguous incursions.

    Sources

  • Idaho National Laboratory Introduces TOPGEAR for Cyber-Physical Influence Risk

    Idaho National Laboratory Introduces TOPGEAR for Cyber-Physical Influence Risk

    Idaho National Laboratory is developing TOPGEAR, a platform intended to show how corporate relationships and individual influence can create risk around critical infrastructure. The name stands for Technology, Organization and Person of Interest Graph Extraction, Analysis and Reporting.

    Looking beyond a conventional cyberattack

    Traditional assessments often concentrate on software vulnerabilities, network boundaries and physical hazards. TOPGEAR instead connects information about organizations, people and infrastructure assets. The objective is to reveal how investments, acquisitions, board positions or supplier relationships could create influence over facilities such as substations and data centers without a malware incident.

    Industrial Cyber reports that the platform draws on public sources including regulatory filings and energy data, then represents the information across social, infrastructure and cross-layer networks. Analysts can examine how an entity is connected to an asset and identify concentrations that may deserve additional review. The output is an aid to analysis, not proof that a relationship is malicious.

    A broader resilience model

    The project illustrates why critical-infrastructure protection requires ownership, supplier and governance data as well as technical telemetry. Organizations adopting similar methods should record source provenance, confidence and update dates so that old or ambiguous relationships do not become false accusations. TOPGEAR adds another perspective to security intelligence by treating organizational influence as a cyber-physical dependency.

    Sources

  • US Coast Guard Opens AI and Machine Learning Center

    US Coast Guard Opens AI and Machine Learning Center

    The U.S. Coast Guard is establishing a Center for Artificial Intelligence and Machine Learning at the Coast Guard Academy in New London, Connecticut. The center is intended to combine operational needs, academic research and workforce development rather than treating AI as a standalone software procurement.

    Mission-focused prototypes

    Industrial Cyber reports that the center will work with the Technology Readiness Directorate and the Office of Data and AI. Early work includes buoy-positioning analysis, cutter patrol scheduling and maritime border-security applications. The stated goal is to develop practical prototypes on shorter cycles while teaching military and civilian personnel to use approved tools responsibly.

    Partnerships with research institutions are expected to support testing and technical review. For a maritime service, however, deployment conditions can be more demanding than a laboratory benchmark. Systems may face intermittent communications, limited computing resources, sensitive operational data and the need for accountable human decisions.

    Security considerations

    Useful governance should define which data an AI system can access, what recommendations it may make and which actions always require an authorized operator. Models also need monitoring for drift and failure under unusual conditions. The center’s value will depend on whether prototypes can be integrated with existing port and maritime security workflows without weakening command responsibility.

    Sources

  • Google Cloud Publishes Secure Agentic AI Blueprint for Manufacturing

    Google Cloud Publishes Secure Agentic AI Blueprint for Manufacturing

    Google Cloud has published a blueprint for deploying agentic artificial intelligence in manufacturing while preserving physical safety, operational resilience and human authority. The framework addresses agents that can move beyond analysis to plan tasks or propose actions across enterprise, engineering and plant-floor workflows.

    Three connected operating domains

    The blueprint groups opportunities into business operations, engineering and industrial operations, and unified cybersecurity and resilience. Examples include procurement checks, predictive-maintenance analysis and the triage of security telemetry across IT and operational technology. Google emphasizes targeted pilots, data readiness, governance and access controls rather than unrestricted deployment.

    That distinction matters because an error in a factory can have physical consequences. An agent that summarizes maintenance records presents a different risk from one that can change a production schedule or interact with control infrastructure. The latter requires constrained permissions, tested rollback paths and a human decision point for consequential actions.

    Security architecture before scale

    Manufacturers should separate deterministic control from experimental AI services, validate data flows and monitor agent activity as a privileged workload. Digital twins and isolated environments can support testing without exposing production equipment. The blueprint reinforces a wider industrial monitoring principle: faster automation is valuable only when teams can explain, authorize and reverse its actions.

    Sources

  • HKCERT Warns VPNs, Firewalls and Remote Access Devices Face Rising Attacks

    HKCERT Warns VPNs, Firewalls and Remote Access Devices Face Rising Attacks

    Hong Kong’s computer emergency response team is warning organizations that VPN appliances, firewalls, routers and remote-access systems remain high-value entry points for attackers. The guidance, issued on 15 September and reported by Industrial Cyber, stresses that installing a patch does not prove an already-exposed device is clean.

    Why patching may be only the first step

    An attacker can exploit an edge device before remediation, steal credentials, create an account or establish another persistence mechanism. Closing the original vulnerability does not automatically remove those access paths. HKCERT therefore recommends reviewing accounts, active sessions, privilege changes, logs and suspicious data transfers after patching, particularly when a vulnerability is known to have been exploited.

    The issue matters in industrial environments because remote-access systems often bridge corporate and operational networks. An edge compromise can expose credentials or routes that would otherwise remain unavailable from the public internet. Asset owners need an accurate inventory of external interfaces, including systems installed by contractors or retained after projects end.

    Operational response

    Defenders should prioritize exploited vulnerabilities, enforce multifactor authentication, revoke suspect sessions and investigate for unauthorized accounts or backdoors. Monitoring should continue after the immediate incident. These measures fit a broader cyber-physical security program that treats identity, network architecture and recovery planning as connected controls.

    Sources

  • Google Says Gemini Security Test Reached Three Companies’ Systems

    Google Says Gemini Security Test Reached Three Companies’ Systems

    Google has disclosed that a security assessment involving Gemini reached systems belonging to three companies after test infrastructure was associated with domains the researchers did not actually control. The event was part of an authorized evaluation, but it demonstrates how autonomous or highly assisted testing can move beyond its intended boundary when scope assumptions are wrong.

    A scoping failure, not an AI permission model

    Reporting by The Record and The Hacker News says the test environment treated certain domains as controlled assets. Gemini then followed the available paths and interacted with external systems. Google said it contained the activity and contacted affected organizations. The episode is a reminder that a model can obey its task while still producing an unsafe result if inventory and ownership data are inaccurate.

    Traditional penetration tests already require written scope, target validation and stop conditions. Agentic tooling increases the need for those controls because it can enumerate and act faster than a human tester. Domain ownership should be verified immediately before execution, and high-impact actions should require an independent approval step.

    Lessons for production AI

    Security teams should place agentic test systems inside constrained networks, maintain explicit allowlists and log every action. A kill switch is useful only if operators can see that a boundary has been crossed. The incident also reinforces the value of separating simulation from live infrastructure when evaluating emerging security technologies.

    Sources

  • TASK#STOMP Backdoor Steals Wi-Fi Credentials, Screenshots and Business Files

    TASK#STOMP Backdoor Steals Wi-Fi Credentials, Screenshots and Business Files

    Security researchers have described a Windows backdoor tracked as TASK#STOMP that uses PowerShell to collect sensitive information from compromised computers. Reported capabilities include stealing stored Wi-Fi credentials, capturing screenshots and clipboard data, and searching for business documents that may be useful for espionage or follow-on intrusion.

    Living-off-the-land tradecraft

    According to Securonix research summarized by Help Net Security, the operation relies heavily on native Windows components and scripted execution. That approach can reduce the number of obvious malicious binaries placed on disk. The backdoor also uses scheduled-task behavior for persistence, giving defenders a reason to examine task creation and modification alongside PowerShell logging.

    The collection profile is notable because it combines access information with operational context. Wi-Fi credentials can help an attacker understand trusted networks, while screenshots and clipboard captures may reveal session tokens, internal tools or information that users never intended to save as files. Document discovery then broadens the impact beyond the initially compromised endpoint.

    Defensive implications

    Organizations should monitor suspicious PowerShell ancestry, encoded or unusual command lines, new scheduled tasks and unexpected access to credential stores. Endpoint telemetry should be correlated with identity and network events rather than reviewed in isolation. This is especially important where office networks connect to cyber-physical systems, because stolen administrative credentials can create a path toward operational environments.

    Sources

  • Sentry AI Deploys 100th Solar-Powered Mobile Security Unit

    Sentry AI Deploys 100th Solar-Powered Mobile Security Unit

    Sentry AI has deployed its 100th SolarGuard mobile security unit, marking a scale milestone for a model that combines solar-powered field hardware, cloud video analytics and remote human review. The trailers are designed for construction sites and other temporary locations where wired power, fixed connectivity and permanent camera infrastructure may be unavailable.

    Mobile monitoring for changing sites

    Security Today reported that alerts are reviewed by remote personnel against each site’s response plan. Depending on the event, the operator can dismiss harmless activity, issue a voice warning or escalate to site contacts or law enforcement. The architecture illustrates why analytics alone do not constitute a complete response: a useful deployment also needs verification, communications and documented escalation rules.

    Construction security presents unusual design constraints. Perimeters move, materials create new blind spots, and lighting or network conditions can change as work progresses. A trailer that was correctly positioned one week may require relocation after the next phase of construction. Solar generation and battery condition also need routine inspection rather than being assumed to remain adequate throughout a project.

    Operational lessons

    The milestone reflects broader demand for relocatable surveillance, but buyers should assess coverage, communications resilience, privacy zones and alarm-handling capacity. Mobile units are best treated as part of an intrusion and perimeter security plan with scheduled field verification, not as unattended appliances.

    Sources

  • Hong Kong and Singapore Expand Facial Recognition for In-Vehicle Border Clearance

    Hong Kong and Singapore Expand Facial Recognition for In-Vehicle Border Clearance

    Hong Kong and Singapore are expanding the use of facial recognition for border checks that can be completed while travelers remain inside their vehicles. The initiatives are intended to shorten processing at high-volume land crossings while retaining identity checks that are normally performed at a staffed booth.

    How the approach changes border processing

    Biometric Update reported that Hong Kong is preparing in-car clearance at the Hong Kong–Zhuhai–Macao Bridge and examining related arrangements at the new Huanggang Port. Singapore has also been extending automated immigration clearance, including vehicle-lane processes. The common design objective is to link a traveler’s face with an authorized travel record without requiring every occupant to leave the vehicle.

    Such systems depend on controlled capture conditions, reliable document and watchlist integration, and clear procedures for exceptions. A failed match must route the traveler to a secondary process rather than be treated automatically as evidence of wrongdoing. Operators also need controls for children, passengers whose appearance has changed, poor lighting and partial occlusion inside a vehicle.

    Security and governance questions

    In-vehicle biometrics can improve throughput, but border agencies still have to manage retention, access logging and false-match risk. The technology should be evaluated as one layer within a broader access-control and identity architecture, not as a substitute for trained officers. Independent performance testing and transparent fallback procedures will be important as deployment expands.

    Sources