We’re Tracking the Future of Security

Category: News

Current, event-driven reporting, announcements and industry developments.

  • JIATF-401 Awards More Than $25 Million for Southern Command Counter-UAS Capabilities

    JIATF-401 Awards More Than $25 Million for Southern Command Counter-UAS Capabilities

    The U.S. Department of Defense has awarded more than $25 million in multiple procurements to expand counter-uncrewed aircraft capabilities supporting U.S. Southern Command. The package includes interceptors and electronic-warfare systems intended to provide layered detection, tracking and defeat options against small drones.

    The awards were made through Joint Interagency Task Force 401. The task force said its accelerated acquisition process moved the selected capabilities from an operational requirement to fielding in less than a month. Officials described the work as an effort to improve air-domain awareness and precision defeat options across Southern Command’s area of responsibility.

    The announcement did not provide a complete public list of vendors, quantities or performance specifications. That limits direct technical comparison, but the combination of electronic-warfare and interceptor procurements indicates an emphasis on layered response rather than reliance on a single defeat mechanism. Sustainment, spectrum coordination and operator certification will also influence operational value.

    Why it matters

    Rapid acquisition can shorten the gap between a changing drone threat and deployed defenses. It also increases the importance of integration testing, rules of engagement, operator training and evidence-based evaluation across the full counter-UAS chain.

    Sources

  • Verkada Adds Fleet Cameras, Cloud Audio and Read-Only AI Connections to Command

    Verkada Adds Fleet Cameras, Cloud Audio and Read-Only AI Connections to Command

    Verkada has expanded its Command platform with products for fleet video, cloud-managed audio and connections to external artificial-intelligence services. The additions were announced at the company’s VerkadaOne conference in Miami.

    Verkada Transportation brings vehicle camera footage and selected diagnostic data into Command through three ruggedized camera models and a gateway supporting 5G and Wi-Fi. The audio offering adds centrally managed speakers and paging functions for facilities. Catalyst uses Model Context Protocol to connect Command with approved services including Claude, ChatGPT and Gemini.

    The company says the external AI connection will initially operate in read-only mode and support natural-language creation of reports and workflows. Read-only access limits direct control risk, but organizations still need to assess what data is exposed to connected services, how prompts and outputs are logged, and whether sensitive video or identity information can leave an approved boundary.

    Why it matters

    Unified platforms are extending beyond fixed cameras and doors into vehicles, audio and AI-assisted operations. The operational benefit is a shared view, while the governance challenge is maintaining clear trust boundaries across every connected service and preserving the evidentiary controls described in video evidence chain of custody.

    Sources

  • Indra Unveils DRIZZLE Interceptor and Mother-Drone Concept for Mass C-UAS Defense

    Indra Unveils DRIZZLE Interceptor and Mother-Drone Concept for Mass C-UAS Defense

    Indra has introduced DRIZZLE, a family of autonomous effectors intended to counter mass drone attacks. The Spanish technology group presented the system at the UNVEX unmanned-systems event and described it as a compact, disposable interceptor that can operate as a hard-kill effector within a wider counter-UAS architecture.

    According to Indra and reporting by Unmanned Airspace, the interceptor is designed to exceed 400 kilometers per hour and has an approximate standalone range of 80 kilometers. The company also showed a mother-drone concept that carries several interceptors before releasing them closer to a threat area, extending the combined mission range to about 130 kilometers. These figures are vendor claims and have not been independently operationally validated.

    Indra said the interceptor uses a company-developed search and detection system to distinguish and lock onto threats. The proposed architecture allows multiple carrier aircraft and disposable effectors to be used against larger raids, while also permitting installation as a self-protection option for selected vehicles or helicopters.

    Why it matters

    The design illustrates a shift from single-target counter-drone tools toward layered systems intended for coordinated raids. Procurement teams will still need evidence on identification performance, command-and-control integration, safety constraints and cost per engagement before comparing it with other counter-UAS technologies.

    Sources

  • CISA Publishes Cyber Decoy Guidance for Critical Infrastructure Defenders

    CISA Publishes Cyber Decoy Guidance for Critical Infrastructure Defenders

    The U.S. Cybersecurity and Infrastructure Security Agency has released its first detailed guide to designing and operating cyber decoys for critical infrastructure environments. The approach places realistic but controlled systems and information assets inside a network so that attempts to access them can generate high-confidence evidence of malicious activity.

    CISA said decoys can help expose attackers who use stolen credentials, legitimate administration tools and living-off-the-land techniques that may bypass conventional perimeter controls. The guide aligns implementation with the MITRE ATT&CK knowledge base and MITRE Engage framework, and treats decoys as a complement to zero-trust controls rather than a replacement for asset management, identity security or monitoring.

    The agency recommends planning decoys around likely adversary paths and high-value areas, then integrating the resulting alerts into established investigation and response procedures. Organizations must also prevent a decoy from becoming a pivot point and ensure its data does not create privacy or operational risk.

    Why it matters

    Critical infrastructure defenders often face weak signals from legitimate-looking activity. Properly isolated decoys can give operations teams an earlier, higher-confidence warning that an intruder is moving through the environment. That makes them relevant to the broader task of risk-based security planning.

    Sources

  • CISA Cyber Storm X Tests National Response to Critical Infrastructure Attacks

    CISA Cyber Storm X Tests National Response to Critical Infrastructure Attacks

    The U.S. Cybersecurity and Infrastructure Security Agency completed Cyber Storm X, a four-day national exercise that brought together 2,000 participants from more than 200 public- and private-sector organizations. CISA said the tenth exercise in the 20-year Cyber Storm program tested how government and industry would coordinate during a large cyber incident affecting essential services.

    The 2026 scenario centered on a nation-state adversary targeting transportation systems, including rail and ports, alongside the water and wastewater sector. Participants used the exercise to test incident-response plans, information-sharing arrangements and cross-sector coordination without exposing operational systems to a live attack.

    CISA said it will work with the participating organizations to identify lessons and produce a public after-action report. The exercise is intended to expose gaps in plans and decision-making before a real event forces agencies, infrastructure operators and suppliers to coordinate under pressure.

    Why it matters

    Cyber resilience depends on more than defensive products. Large exercises test whether technical teams, executives, regulators and emergency partners can share reliable information and make coordinated decisions while transportation and water services are under stress.

    Sources

  • UK’s Quantum Motion Extends Series C Funding Round to Scale Fault-Tolerant Silicon Quantum Chips

    UK’s Quantum Motion Extends Series C Funding Round to Scale Fault-Tolerant Silicon Quantum Chips

    UK-based Quantum Motion said on September 14, 2026 that it has finalized a second close of its Series C funding round, adding new investors to accelerate the industrial scale-up of its fault-tolerant silicon quantum processors.

    The Round

    The extension tranche was co-led by existing investors DCVC and Kembara, and brought in new and returning strategic and financial backers including imec.ventures, Lansdowne Partners, Sony Innovation Fund, S3 Ventures and Inkef. The additional funding builds on Quantum Motion’s original $160 million Series C round, positioning the company as one of the best-funded quantum computing firms in the UK.

    Silicon-Spin Approach

    Quantum Motion’s approach is built around silicon-spin qubits manufactured using standard 300mm CMOS semiconductor processes, rather than the superconducting or trapped-ion approaches used by many competitors. The company says this allows it to lean on existing commercial chip supply chains — including manufacturing partners such as imec and GlobalFoundries — rather than building entirely bespoke fabrication capability. The new capital will support continued custom silicon co-development, an expanded US research lab in Maryland, and participation in stage B of DARPA’s Quantum Benchmarking Initiative (QBI).

    Why It Matters

    Quantum computing developers face a persistent trade-off between qubit approaches that are easier to control today and approaches believed to scale more efficiently toward the large, fault-tolerant qubit counts needed for practical applications. By tying its architecture to existing semiconductor foundry processes, Quantum Motion is betting that manufacturing scale — not exotic materials or novel fabrication lines — will be the deciding factor in which qubit technology reaches commercially useful scale first. Continued institutional and strategic investment in silicon-based approaches also signals growing investor confidence that a CMOS-compatible path to quantum advantage is commercially viable alongside more established superconducting efforts from larger competitors.

  • L3Harris to Ruggedize VAMPIRE Counter-Drone System for US Navy Littoral Forces

    L3Harris to Ruggedize VAMPIRE Counter-Drone System for US Navy Littoral Forces

    L3Harris Technologies announced on September 8, 2026 that it has been selected to deliver a maritime-ruggedized configuration of its VAMPIRE counter-drone weapon system to the US Navy, aimed at defending littoral combat forces against small unmanned aircraft and uncrewed surface vessel (USV) threats.

    What Is VAMPIRE

    VAMPIRE — Vehicle-Agnostic Modular Palletized ISR Rocket Equipment — is a self-contained, palletized weapon system originally designed to mount on standard vehicle cargo beds, pairing sensors with laser-guided munitions such as Advanced Precision Kill Weapon System (APKWS) rockets to engage small drones and other aerial threats. For the Navy configuration, L3Harris said it is adapting the system to withstand the environmental stresses of maritime and littoral operating conditions.

    “VAMPIRE is a flexible and effective system that meets the unique requirements of the U.S. Navy for littoral C-UxS defense,” said Tony Calderon, President of Targeting & Sensor Systems at L3Harris.

    Capabilities and Integration

    The system is designed to integrate with L3Harris’s Wraith Shield software for layered counter-unmanned-systems (C-UxS) defense, combining detection, tracking and engagement functions across a broader defense architecture. L3Harris has not disclosed a contract value or specific delivery timeline for the Navy variant.

    Why It Matters

    The Navy’s interest in a ruggedized VAMPIRE follows a broader push across the US military to field mobile, vehicle- and vessel-mounted counter-drone systems rather than relying solely on fixed-site defenses, as cheap commercial and militarized small drones proliferate among state and non-state actors. It also follows related moves by L3Harris to mount counter-drone sensors on an uncrewed ground vehicle alongside ARX Robotics, part of a wider industry trend toward distributing counter-UAS sensors and effectors across multiple platform types rather than concentrating them at fixed perimeters.

  • WatchGuard Patches Five Critical Fireware OS Flaws That Could Let Attackers Seize Firebox Appliances

    WatchGuard Patches Five Critical Fireware OS Flaws That Could Let Attackers Seize Firebox Appliances

    WatchGuard has patched five critical vulnerabilities in its Fireware OS and WatchGuard Dimension software, including a set of unauthenticated flaws in the VPN negotiation process that could allow an attacker to remotely execute code on affected Firebox security appliances, according to security advisories the company updated through September 2026.

    The Vulnerabilities

    Three of the critical flaws — tracked as CVE-2026-19313, CVE-2026-19315 and CVE-2026-19318, each carrying a CVSS score of 9.3 — affect the iked process that handles Internet Key Exchange (IKEv1 and IKEv2) for IPsec VPN negotiation. The issues include a heap buffer overflow, a type confusion flaw and a stack-based buffer overflow. Because the affected process is exposed to unauthenticated network traffic, WatchGuard warned that a remote attacker could trigger the defects with specially crafted packets, without needing valid credentials, potentially leading to code execution on the device.

    Two further critical vulnerabilities affect WatchGuard Dimension, the company’s network visibility and reporting platform, and could allow an attacker to take over an administrator account.

    Fixed Versions

    WatchGuard has fixed the flaws in Fireware OS versions 2026.2.2, 12.12.2 and 12.5.20, and in WatchGuard Dimension version 2.3.1. The company said it has not observed the vulnerabilities being exploited in the wild, but urged administrators managing Firebox appliances to update immediately given the unauthenticated, pre-patch attack surface.

    Why It Matters

    Firebox appliances sit at the network edge for a large number of small and midsize organizations, making unauthenticated remote-code-execution flaws in VPN-handling code especially attractive to opportunistic attackers scanning the internet for exposed devices. Network security appliances of this kind have previously appeared on federal exploited-vulnerability tracking lists tied to broader intrusion campaigns, underscoring why perimeter security appliances are routinely targeted once technical details of a flaw begin to circulate. Security teams operating Firebox devices should prioritize patching over other maintenance work and review VPN gateway logs for anomalous IKE negotiation traffic predating the update.

  • San Jose Mineta Airport Completes $2.5 Million Perimeter Security Upgrade With Radar-Tracking Cameras and Rapid Bi-Fold Gates

    San Jose Mineta Airport Completes $2.5 Million Perimeter Security Upgrade With Radar-Tracking Cameras and Rapid Bi-Fold Gates

    Mineta San Jose International Airport (SJC) has completed a $2.5 million perimeter security upgrade funded through a Transportation Security Administration grant, adding radar-cued tracking cameras and rapid-closing vehicle gates along its airfield boundary, airport officials confirmed in mid-September 2026.

    What Was Installed

    The project added new cameras, radar sensors and heavy-duty bi-fold vehicle gates to the airport’s perimeter. Among the key additions is a radar-cued pan-tilt-zoom (PTZ) camera capable of automatically slewing to track an individual or vehicle detected by the radar across the perimeter line. The new bi-fold gates are designed to open and close in roughly seven to eight seconds, reducing the window during which a breach point is left unsecured during vehicle movements.

    Funding and Rationale

    Airport officials said the upgrade was funded through a TSA grant and was not undertaken in response to a specific security incident, but as part of the airport’s ongoing effort to keep passengers, staff and airfield operations safe. SJC has a history of testing perimeter intrusion detection technology; the airport was previously selected by TSA and DHS to trial new perimeter intrusion detection and deterrence technologies under a federal pilot program.

    Why It Matters

    Airfield perimeter breaches — whether by wildlife, vehicles or unauthorized individuals — remain a persistent operational and safety concern for airport operators. Pairing radar detection with cued PTZ cameras allows a smaller security team to monitor a longer perimeter line with fewer static camera positions, while fast-closing vehicle gates limit the time a service or maintenance access point stays open. The approach mirrors a broader industry shift toward radar-camera fusion for perimeter monitoring at airports, ports, and other critical infrastructure sites with long, hard-to-fence boundaries.

  • Foreign Hackers Breach Two Colorado Water Utilities, Alter Pump Cycles and Disable Alarms

    Foreign Hackers Breach Two Colorado Water Utilities, Alter Pump Cycles and Disable Alarms

    Foreign hackers breached the computer systems of two small Colorado water utilities last month, changing pumping cycles, disabling alarms and altering equipment settings before operators regained control, state officials disclosed on September 19, 2026.

    What Happened

    According to Colorado officials, the intrusions did not compromise drinking water quality or treatment processes, and the affected utilities’ operators were able to identify and reverse the unauthorized changes. Governor Jared Polis’s office described the incidents as “brief” and said the associated risks were “quickly addressed by the providers themselves.” The identities of the specific utilities have not been publicly disclosed.

    Officials have not attributed the intrusions to a specific threat actor, though the state noted that previous, similarly styled attacks on US water infrastructure this year have been linked to actors with suspected ties to Iran and China.

    Part of a Wider Pattern

    The Colorado incidents add to a year in which more than 100 drinking water and wastewater systems across at least a dozen US states — including Minnesota, Michigan, Georgia, South Dakota and New Jersey — have reported cyberattacks targeting internet-exposed programmable logic controllers (PLCs). In late July, hackers broke into the operational technology behind more than 30 municipal water systems in Minnesota, changing passwords and IP addresses on exposed PLCs and locking operators out of their own equipment.

    The pattern echoes an earlier wave documented in coordinated attacks that disabled a UK power plant and hit US water utilities, and follows a related warning about active reconnaissance against internet-exposed Siemens S7 PLCs flagged by CISA, the NSA and the FBI.

    Federal Response

    The US Environmental Protection Agency (EPA) said it is investigating the Colorado breaches and working with the affected utilities to identify vulnerabilities and strengthen defenses. The agency has previously reported identifying more than 900 vulnerabilities across over 650 water systems nationwide in 2026, and says it has helped remediate roughly 700 of those weaknesses across more than 500 utilities.

    Why It Matters

    Water and wastewater utilities are frequently smaller, resource-constrained operators with internet-exposed industrial control systems and limited dedicated cybersecurity staff, making them attractive, comparatively low-effort targets for state-linked and opportunistic threat actors alike. Security researchers and federal advisories have repeatedly urged utilities to take PLCs off the public internet, enforce multifactor authentication for remote access, and monitor for unauthorized changes to ladder logic and equipment configurations.