A new take on bug bounties, AI red teams and our New Year’s resolutions

Cybersecurity Resolutions for 2026

The discussion opens with panelists proposing New Year’s resolutions for the cybersecurity industry in 2026, emphasizing a necessary evolution in mindset and practice.

• Shift from IT Problem to Business Resilience: Cybersecurity should no longer be viewed as a siloed IT function but as a core component of business survival and operational resilience. The goal isn’t just to prevent attacks but to “keep the business running no matter what.” This requires weaving security into the fabric of corporate operations and decision-making at every level.
• Embrace Proactive Quantum Preparation: With quantum computing’s threat to current encryption standards looming, organizations must begin assessing their cryptographic posture now. This involves identifying where encryption is used, how data is stored, and what will be vulnerable to “harvest now, decrypt later” attacks.
• Adopt Passkeys and Secure AI: Panelists strongly advocate for the widespread adoption of passkeys to combat phishing, the number one vector for data breaches. Additionally, the industry must get serious about securing AI, as it is a permanent fixture in the technological landscape. This includes leveraging resources like the OWASP Top 10 for Large Language Models.
• Use AI to Augment, Not Replace, Professionals: A critical point is that AI should be seen as a tool to enhance the productivity and effectiveness of security professionals, not as a means to reduce headcount. Attackers are also leveraging AI, so augmenting human teams is essential to keep pace. As one panelist noted, “You cannot cut your way to the top on this. You’re going to cut your way to the bottom.”

Microsoft’s Expanded “In Scope by Default” Bug Bounty

Microsoft’s decision to expand its bug bounty program represents a significant shift in responsibility for software supply chain security.

• Ecosystem-Wide Responsibility: The new “In Scope by Default” policy considers all online services in scope from launch and, crucially, includes vulnerabilities in third-party or open-source components that have a “direct and demonstrable impact on Microsoft Online services.”
• A Collaborative Approach: This move is praised as a “rising tide lifts all boats” situation, recognizing that modern software is an interconnected ecosystem. Vulnerabilities often exist at the interfaces between components, and securing the entire chain is vital. It also provides a strong economic incentive for researchers to stay on the “white hat” path rather than turning to the black market.
• Historical Shift: The change is remarkable when contrasted with the industry’s historical stance, where researchers who disclosed bugs were often met with legal threats rather than rewards.

The Long Tail of the LastPass Breach

The 2022 LastPass breach serves as a stark reminder of the long-term consequences of credential theft.

• “Harvest Now, Decrypt Later” in Practice: Years after the initial theft of 30 million encrypted vaults, attackers are still methodically decrypting them and using the credentials to steal cryptocurrency. This demonstrates that the “harvest now, decrypt later” threat model is not just a future quantum computing concern but a present-day reality with conventional attacks.
• The Password Manager Paradox: While the incident highlights the risk of centralizing credentials, the panelists agree that reliable password managers are still a net positive. They enable the use of long, strong, and unique passwords for hundreds of services—a feat impossible for a human to manage. The key takeaway is not to abandon these tools but to choose trustworthy providers, use multi-factor authentication, and adopt passkeys wherever possible.
• The Failure of Human Hygiene: The ongoing success of the attackers highlights a fundamental weakness: poor user security hygiene. Despite a three-year warning, many victims evidently failed to rotate the compromised credentials, allowing the breach to have a multi-year impact.

OpenAI’s Automated AI Red Teaming

OpenAI is tackling the challenge of prompt injection by using AI to secure AI.

• Adversarial AI for Defense: OpenAI’s new defense mechanism involves an “adversarial model” trained on prompt injection techniques. This model actively searches for new attack methods. When a successful method is found, the agent models are immediately trained on it to build a defense.
• Keeping a Human in the Loop: While a positive step, this automated defense isn’t a silver bullet. AI models can still hallucinate, leading to false positives or negatives in threat detection. Therefore, the advice remains to limit the permissions granted to AI agents and, most importantly, keep a human in the loop for critical decisions. AI should augment human oversight, not replace it.
• The Naivete of Young AI: An interesting point was raised comparing a generative AI’s experience to that of a human. An AI that has only “lived” for a few years lacks the street-savvy, wisdom, and negative experiences that teach humans about deception. This makes it susceptible to social engineering and other attacks that a human might recognize.

“AI is still. It’s really intelligent, but not very street-savvy. And it will fall for these kinds of things.”

ClickFix-as-a-Service and the Commercialization of Cybercrime

The rise of the “ErrTraffic” malware suite signals the industrialization of ClickFix, a social engineering attack that tricks users into running malicious commands.

• Lowering the Barrier to Entry: By packaging the attack into a professional, SaaS-like tool available for purchase (e.g., for $800), cybercriminals are lowering the barrier to entry. This allows less-skilled actors to launch sophisticated attacks at scale, achieving reported success rates of 60%.
• Psychological Warfare: The technique is evolving beyond simple copy-paste commands. It now incorporates psychological tactics, such as creating fake visual glitches or broken text on a user’s screen to induce panic and frustration, compelling them to run the “fix” without thinking.
• Cybercrime as a Business: This trend underscores that cybercrime operates as a professional industry. These groups have revenue streams, develop products (like Ransomware-as-a-Service or phishing kits), and function like businesses. Defending against them requires understanding that they are well-resourced and highly organized operations.

• Tags:
• AI Security
• Prompt Injection
• Cybersecurity
• OpenAI
• Social Engineering
• Bug Bounty
• LastPass
• Password Managers
• ClickFix