We’re Tracking the Future of Security

Tag: Critical Infrastructure Cybersecurity

  • ENISA Says Three in Four EU Employees Encountered Cyber Threats at Work

    ENISA Says Three in Four EU Employees Encountered Cyber Threats at Work

    Cyber threats are a routine workplace experience for many European employees, according to survey findings highlighted by the European Union Agency for Cybersecurity (ENISA). The results point to a gap between broad awareness of cyber risk and the training, reporting habits and practical confidence needed to respond consistently.

    Survey finds broad exposure but uneven preparedness

    The European Commission’s Eurobarometer survey found that 74% of employees had encountered suspicious emails, messages, voice calls or links during the previous six months. Phishing or fraudulent email was the most frequently reported threat at 39%, while 18% encountered attempts to obtain personal data or passwords.

    Awareness is comparatively high: 83% said a cyberattack could have serious consequences for their organization. Preparedness is less uniform. The survey says 60% received cybersecurity training in the previous year, participation was lower in smaller organizations, and only 48% felt able to recognize AI-generated fake videos. At the same time, 85% expressed interest in improving their cybersecurity skills.

    Operational lessons for security teams

    The findings reinforce the need to treat workforce readiness as part of operational security rather than a once-a-year compliance exercise. Short, role-specific training can be paired with clear reporting channels, realistic phishing simulations and rapid feedback after suspicious activity. Organizations responsible for essential services should also connect employee reporting to incident-response procedures so that a suspicious message can be assessed before it becomes a wider compromise.

    For teams managing connected facilities and operational environments, the human layer should complement technical controls such as access management, network segmentation and monitored response workflows. SectechMedia’s cyber-physical security coverage follows how these controls intersect with physical operations.

    Sources

  • Osavul Raises $10 Million to Detect Hostile Intent Across Cyber and Physical Domains

    Osavul Raises $10 Million to Detect Hostile Intent Across Cyber and Physical Domains

    Hybrid risk intelligence company Osavul has raised $10 million (€8.5 million) in a Series A round led by 33N Ventures, with participation from Balnord, G+D Ventures and existing investor 42CAP. The round, announced October 1, brings the Luxembourg-based company’s total funding to roughly €12 million.

    Reading hostile intent across three domains

    Osavul’s AI platform analyzes open and privileged data sources to identify hostile intent spanning the information, cyber and physical domains, rather than treating them as separate disciplines handled by separate teams. The company, which counts NATO and other defense and government institutions among its customers, says it maps identified intent against a customer’s own people, facilities and supply chains to show where a strike could land.

    Part of a wider funding trend

    Osavul says it has tracked more than 150 state-linked hybrid incidents across Europe since 2022, combining cyberattacks, sabotage, espionage and information manipulation, and plans to use the new funding to expand from government and defense work into enterprise and critical-infrastructure customers. The raise adds to a run of early-stage funding for platforms that promise a single risk picture spanning categories security teams have traditionally monitored with separate tools.

    Sources and further reading

  • Meari IoT Cloud Authorization Flaws Expose Device and Owner Data

    Meari IoT Cloud Authorization Flaws Expose Device and Owner Data

    CISA has warned about two missing-authorization vulnerabilities in the Meari IoT Cloud Platform OpenAPI. The flaws could let an authenticated user cross account boundaries, alter another owner’s device configuration or obtain sensitive device-shadow data.

    What an authenticated attacker could access

    CVE-2026-101104 concerns authorization checks around device configuration. CVE-2026-96613 affects access to the complete device shadow, which CISA says can include device credentials, owner information, network details and telemetry. The advisory lists a maximum CVSS v3 base score of 7.7 and marks all versions as affected.

    The issue is relevant to connected cameras and other cloud-managed devices because the cloud control plane often stores both operational state and credentials. CISA says it is not aware of public exploitation targeting these vulnerabilities.

    No vendor fix was available at publication

    CISA reports that Meari did not respond to coordination attempts and that no fix was planned when the advisory was released. Users are advised to contact the vendor for information. In the meantime, organizations should review whether affected devices are necessary, isolate them from sensitive networks and monitor cloud-account activity for unexpected configuration changes.

    Teams should also rotate exposed credentials where feasible, restrict who can access the management tenant and document an exit plan if risk cannot be reduced. SectechMedia’s video surveillance and imaging coverage explores security considerations for connected camera ecosystems.

    Sources

  • CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA Details Critical Authentication Flaws in Monta EV Charging Platform

    CISA has disclosed four vulnerabilities affecting Monta’s electric-vehicle charging platform. The agency says the issues could allow unauthorized administrative actions or denial-of-service activity, making identity controls and session handling a priority for charging operators.

    Where the weaknesses appear

    The advisory identifies missing authentication and rate-limiting controls, weaknesses involving sessions, and the use of publicly accessible identifiers. CISA assigns the group a maximum CVSS v3 base score of 9.4 and lists monta.app as affected across all versions at the time of publication.

    The practical risk extends beyond a conventional web account. EV charging platforms coordinate users, chargers and operational services, so unauthorized administrative access can affect a distributed physical service. CISA says it is not aware of public exploitation targeting these vulnerabilities.

    Mitigation and operational checks

    Monta is working toward authenticated connections and says its platform supports OCPP 1.6 Security Profile 2. The company also applies throttling and rate limits. Operators should confirm which controls are active in their own tenant and charger estate instead of assuming that a supported feature is already enabled everywhere.

    Security teams should review privileged accounts, revoke stale sessions, monitor failed authentication patterns and segment charger-management services from unrelated business systems. Any configuration change should be tested against charger availability and field-support procedures. Related developments in connected transport can be followed through SectechMedia’s vehicle and transportation security coverage.

    Sources

  • CenterPoint Energy Confirms Customer Data Breach; Utility Services Unaffected

    CenterPoint Energy Confirms Customer Data Breach; Utility Services Unaffected

    Houston-based utility CenterPoint Energy has told regulators that an unauthorized third party obtained personal information relating to some customers through an external-facing system. The company opened an investigation after becoming aware of a claim that customer data had been obtained.

    In its filing with the U.S. Securities and Exchange Commission, CenterPoint said the incident had not affected delivery of electric or natural-gas services and that it did not expect a material effect on the company. The filing did not validate a hacker’s separate claim about the number of records involved.

    SecurityWeek reported that a threat actor had advertised an archive allegedly containing CenterPoint data. That claim remains unverified, so the confirmed facts are narrower: customer information was accessed, an investigation is underway, and operational utility delivery continued.

    Why it matters

    The separation between customer-facing systems and operational service delivery is important for critical infrastructure. A breach can create serious privacy and fraud exposure even when operational technology remains available, and incident reporting should keep those impacts distinct.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • CISA Red-Team Assessments Show Why One SOC Detected an Intrusion and Another Did Not

    CISA Red-Team Assessments Show Why One SOC Detected an Intrusion and Another Did Not

    The US Cybersecurity and Infrastructure Security Agency published A Tale of Two SOCs: Insights From Two Red Team Assessments on August 25, 2026. The advisory compares assessments conducted at two critical-infrastructure organizations and shows how similar adversary techniques produced very different defensive outcomes.

    Two assessments, two outcomes

    At the first organization, CISA’s red team gained access to multiple workstations, elevated privileges across the domain and moved laterally without being detected by the security operations center. The assessment identified gaps in monitoring, cloud visibility, identity protection and communication between separate security teams.

    At the second organization, the SOC detected and quarantined the red team’s initial access. That response forced the assessors to move to an assumed-breach scenario. Defenders also detected and contained portions of the follow-on activity, limiting the red team’s freedom of movement.

    What made the difference

    CISA’s comparison emphasizes operational fundamentals rather than a single security product. Tuned alerts, established network and identity baselines, documented escalation procedures, communication between SOC teams and system owners, and visibility across IT, cloud and operational-technology environments all affected the result.

    The advisory also highlights the risk created by fragmented tooling. Multiple SOCs or endpoint-detection platforms do not automatically improve security when teams cannot see one another’s alerts or coordinate investigations. Cloud identity and application controls require the same operational ownership as traditional endpoint and network monitoring.

    Why it matters for critical infrastructure

    Critical-infrastructure operators increasingly manage connected IT, cloud and OT environments. An attacker who begins on a workstation may use identity systems, remote administration paths or cloud services to move toward operationally important resources. Detection quality therefore depends on whether defenders can correlate events across those boundaries before activity becomes a domain-wide compromise.

    Red-team assessments do not predict every real intrusion, but they provide controlled evidence of how existing people, procedures and technology perform against realistic adversary behavior. CISA’s findings support a practical priority: organizations should test whether their SOC can detect and coordinate a response across the complete environment, rather than assuming that deployed tools are functioning as an integrated defense.

    Sources

    Follow additional developments on Technology News.