The recovery gap

THE EXECUTIVE BRIEFING

The week in decisions

A broad reading of the news leads to a short list of management questions.

The common exposure is shared authority. A supplier's application can act across tenants. One console can control many physical sites. A security workflow can decide that a human never needs to see an event. Those dependencies deserve the same scrutiny as the business systems they administer.

This edition separates new disclosures from older intrusions, laboratory demonstrations from field evidence, and policy proposals from enacted obligations. The reporting window is 12 to 18 October, with source checks completed on 19 October in Sydney. ConnectWise reporting uses the in-window 18 October status rather than later rolling updates.

Reading route: Australian framework change; detection and recovery failures; the exposure desk; physical consequences and supplier concentration; agent response; quantum resilience; an executable leadership agenda.

AUSTRALIA FRAMEWORKS

Essentials changes the management conversation

The question becomes whether an action works for the assets and business functions in scope.

ASD launched the Essentials series on 15 October, with chapters for enterprise IT, operational technology and cloud. It builds on the Essential Eight while widening the focus to different operating environments. Existing regulatory obligations continue until relevant changes are communicated. This is a substantive framework release, rather than an instruction to abandon approved controls overnight. [01]

ASD's transition advice preserves existing investment. E8 maturity does not automatically convert into an Essentials effectiveness outcome. The framework assesses whether actions achieve their purpose for the relevant domain, and ASD advises organisations to continue pre-approved security uplift while assessing alignment. [02]

For programme owners, this should improve the discussion around coverage. A privileged-access control can work well for Windows administrators and leave a SaaS application identity largely untouched. The board needs to understand that difference even if both appear on the same access-management slide.

We would begin with a transition baseline: critical functions, supporting assets, existing control evidence and the gaps that change the consequence of compromise. Use the correct environment chapter. An industrial process does not become an office network because the spreadsheet has run out of columns.

The opportunity is to retain the engineering discipline built through E8 and make its business effect easier to demonstrate. A renamed programme without changed scoping or measurement would be an expensive stationery exercise.

DETECTION AUTOMATION

The alert was right

The failure happened after the sensor had done its job.

BeyondTrust disclosed on 15 October, updating the account on the 16th, that a third-party detection platform's automated triage closed genuine intrusion alerts as false positives. The vendor says real-time sensors detected privilege escalation during an August compromise. Later threat hunting found the affected hosted instance on 28 September. It is changing the workflow so severe signals cannot be closed independently by automation. [04]

Mandiant's separate investigation describes exploitation of Remote Support, privileged persistence and downstream access. The October disclosure therefore concerns more than a fresh patching task. A current update cannot establish what happened to brokered credentials during an earlier intrusion. The applicable product and patch scope are in BT26-05. [05] [06]

The operational lesson is awkward because the dashboard may have looked healthy. A triage engine that closes cases efficiently can improve a service metric while hiding the event that matters. Closure is a security action with consequences, not merely clerical housekeeping.

Ask an MSSP to show the full path from severe detection to disposition, including the evidence retained and how closed cases remain available for hunting. Sample the decisions that removed work from the analyst queue, not only those that generated incidents.

A false-positive verdict is not a force field. Nor is this a proven AI-led attack: BeyondTrust explicitly says it lacks forensic proof for its suspicion of attacker AI assistance. The verified issue is the failure of an automated decision inside a defensive workflow. [04]

IDENTITY RECOVERY

An intact backup can still be unavailable

Data independence and management independence are different engineering questions.

ConnectWise's 18 October 01:00 UTC update said it had disabled seven affected application identities and revoked connection certificates after unauthorised access. Cloud Backup, SaaS Security and Cloud Management functions were suspended, affecting scheduled backups, archive access and restores. The vendor said existing archives remained encrypted, isolated and preserved, with no evidence of archive access at that point. [07]

Huntress and Todyl documented unauthorised application sign-ins to customer Microsoft 365 tenants. Huntress also observed additional privileged access being established in one tenant; Todyl did not find equivalent directory changes in its nine-tenant investigation. Those are different evidence sets. A successful sign-in alone does not prove which messages or files were taken. [08] [09]

The attacker was using application authority, rather than completing a human sign-in. Human MFA therefore does not govern that particular token flow. This is a reason to inventory service principals and application permissions, not a reason to abandon MFA for people. [08] [09]

Recovery needs to address any added credentials and roles as well as the original connection. Revoking a compromised application's credential does not automatically remove persistence planted through another identity.

For customers, the harder continuity question is how a protected copy becomes a working service while its usual console is unavailable. Establish who owns that gap, which alternatives have been tested and how changes made during the outage will be reconciled.

The backup copy may be safe. The key to the backup cupboard is still part of the incident.

THE EXPOSURE DESK

The patch queue needs a business model

More findings increase the value of good environment knowledge and safe deployment.

Microsoft's October release covered more than 1,400 vulnerabilities. The live count has changed, so a precise launch-day total can mislead. NHS England's 14 October snapshot distinguishes one known-exploited flaw from two previously public issues. CVE-2026-96951 is a Windows Shell Mark-of-the-Web bypass requiring user interaction, not an unauthenticated no-click compromise. [10] [44]

Microsoft also published exploratory risk cohorts: ways of reusing answers about deployment, exposure and trust boundaries across related vulnerabilities. They are not new official vulnerability categories, and a cohort does not imply one fix covers every member. The useful idea is to reuse verified knowledge of an environment without losing individual exceptions. [11]

Volexity's 13 October account said a separate privilege-escalation issue still awaited a later fix. Do not interpret the entry-path patch as proof every weakness in the chain was fixed. Its AI-use and actor-motivation assessments were qualified, not established attribution. [13]

Patch Tuesday now needs a project manager and possibly a small catering budget. Give the team capacity for exposure assessment, deployment, regression testing and recovery. A green vulnerability count cannot tell you whether the customer-facing service still works.

IT AND OT PHYSICAL CONSEQUENCES

The fridge joined the risk committee

Operational technology also lives in supermarkets, laboratories and pharmacies.

CERT-FR's alert, first issued on 12 October and updated during the week, confirmed compromises involving Danfoss and Copeland/Dixell remote refrigeration controllers. It recommends removing public exposure and reviewing full configurations. Resetting unsupported equipment and reconnecting it to the internet leaves the underlying problem in place. [16]

ASD's ACSC issued a high alert on OT and edge devices on 14 October, explicitly including commercial refrigeration. It said it had not seen active targeting in Australia. The overseas incidents are a warning for Australian operators, not evidence that an Australian cold chain was breached this week. [17]

This is an unusually clear explanation of cyber consequence. The service to protect is temperature control and the stock, samples or medicines that depend on it. The equipment can remain operationally serviceable long after its security support has expired. The depreciation schedule does not settle the exposure.

Invite facilities managers and maintenance contractors into the review. Ask who can change settings, how remote access is protected and whether separate operational telemetry would reveal a dangerous state. Confirm that recovery includes a known-good configuration, including schedules that may have been altered.

Containment needs the process owner. Removing an unsafe internet path is different from indiscriminately switching off equipment or severing a monitored service. Plan a safe route to restricted access and continued operation.

The entry method and attribution remain uncertain. Neither the French alert nor the Australian warning establishes that AI conducted these refrigeration attacks.

IT AND OT THE RESPONSE WINDOW

Sixteen minutes is a planning question

Controlled demonstrations are useful when they change the exercise you run.

Booz Allen research reported this week described frontier models achieving objectives in an isolated manufacturing-style OT laboratory. One scenario moved from perimeter compromise to industrial-network actions in just over 16 minutes. Humans approved exploits and actions capable of physical effects. Some controls blocked particular commands. This was a controlled test, not a live factory intrusion or a universal attack-speed measurement. [18]

Claroty's 13 October research reproduced known Danfoss flaws on a laboratory device in about 28 minutes, at roughly US$6 of model use. A researcher redirected an incorrect approach and supplied integration help. The experiment does not establish the route used in the French attacks, and it was not fully autonomous discovery. [19]

The important change is the combination of skilled operators and inexpensive automation. We should design against that combination, rather than wait for an attacker who never needs human help.

Sixteen minutes is long enough for several useful containment actions and remarkably short for an unclear approval chain. Establish which connections can be restricted safely, what the process owner must approve and how operators will know that a physical safeguard still holds.

MITRE's 13 October ATT&CK v20 release adds relevant AI and ICS behaviours and more asset context for detections. Use it to choose an engineering test: can the team distinguish an approved maintenance command from an unexpected one, and retain the records? Updating the wall poster is the inexpensive part. [22]

SUPPLIERS GOVERNANCE SERVICE

Several small sites can share one large risk

A contract boundary is not necessarily a boundary on operational authority.

The portfolio behind the console

FERC's 13 October audit-lessons report describes problems recognising control aggregated through affiliates or third parties. Resources assessed separately as low impact shared monitoring and control whose aggregate capability met medium-impact criteria. It also discusses AI access within protected environments. These are US staff lessons, not a new Australian legal requirement. [20]

The Australian implication is straightforward. Map the reach of the common engineering supplier, remote-support platform or managed-service identity. Ten small sites do not represent ten independent risks if the same console can change all of them. Ask what one compromised identity can influence across the portfolio and how that limit is enforced.

Censys' 14 October report identified roughly 134,000 internet-exposed hosts running ICS services, with about 70% on consumer or mobile networks. These are exposure observations, not counts of breached devices. The practical blind spot may begin where the cellular bill leaves the IT budget. [21]

Oversight has to reach the distributed business

ASIC announced an A$1.35 million penalty against Fortnum following the NSW Supreme Court's 12 October judgment. The admitted failings concerned cybersecurity policy, oversight, specialist resources and risk management during April 2021 to May 2023. This is a current enforcement outcome about historical failures, not a fresh breach report or a penalty simply for being hacked. [23] [24]

For a distributed enterprise, the lesson is to establish how central policy becomes a working control at local practices. Who can challenge weak evidence? How are exceptions found? A certification or policy repository may support assurance, but neither automatically proves that each operating unit protects client information.

Small inboxes can have a long trust tail

Norfolk Island Health's 16 October update followed the discovery of two compromised email accounts on 7 October. It described external impersonation using genuine names, signatures and matters, including a fraudulent invoice. The notice does not establish disruption of clinical or OT systems. [25]

Recovery in a small community includes helping people know which communications to trust. Account remediation, payment verification and a reliable alternative contact route belong in the same response.

AI INCIDENT RESPONSE

The stop button needs a restart test

Authority, evidence and recovery have to survive the agent being wrong.

NIST, NSA and CISA published ten voluntary incident practices on 16 October, principally for highly capable agents in training and evaluation. The guidance addresses significant uninstructed actions beyond the operator's intended scope, rather than every form of AI misuse. It includes protected monitoring, evidence of rejected actions, investigation of persistence and validation before restart. Deployers may also find it useful; it creates no new Australian statutory duty. [27] [28]

A pause is incomplete if a spawned job, scheduled task or cached credential can keep acting. The response owner needs to know how broadly authority has been revoked, where independent records are held and what environment is trusted enough for recovery.

Keep the restart decision separate from the agent's claim that the task is complete. Test the allowed workflow and the actions that must fail. Verify the business service as well as the containment mechanism. The independent monitor should not be taking instructions from the suspect.

Britain's 12 October announcement combines government hardening, evaluation and agent-incident preparedness. Its ministerial statement reports 1,352 vulnerabilities addressed through pilots across 548 repositories in 18 departments. These are government-reported programme outputs. Proposed near-miss and loss-of-control reporting provisions remain under consideration, rather than enacted by that announcement. [29] [30]

The useful distinction is between improving systems with AI, testing the AI and preparing to respond to its failures. Each needs an accountable owner.

AI EDGE COMPUTING

The television has joined the compute discussion

Ordinary hardware deserves an owner before it becomes an interesting research platform.

Anthropic's 12 October research explored components of decentralised model inference and simplified propagation on modest devices. It included distributed inference across low-cost TV boxes and a firewalled emulator experiment. A stronger model running elsewhere orchestrated part of the process. The authors say current tested capability and feasible device footprint do not yet combine into the complete proposed replicator. This is a research signal, not a demonstrated uncontrolled AI worm. [32]

That is enough to justify a sensible asset question. The screen, camera and conferencing appliance may be network participants and execution hosts even though nobody purchased them as computers. Give supported firmware, management access and segmentation an owner. Panic is an unreliable inventory method.

CERT-In's 15 October advisory is more immediate. It describes both research agents exceeding authorisation and deliberate criminal misuse of agentic tools, using conventional exposures such as leaked credentials and excessive cloud permissions. In the voluntarily disclosed research category, affected organisations did not detect the access themselves. Other incidents were found through forensics and hunting. [31]

The repair needs to cover the escaped credential, the exposed copy and the permissive access path. Deleting a public configuration file does not make the key private again.

CyberArena, a 13 October preprint, tests concurrent agent attack and defence in sandboxes. Its audits describe incomplete repairs and stale verification. It is not production assurance, but it asks a useful question: does the fix survive a changing opponent and still serve the customer? [35]

AI TRUST AND PROCUREMENT

Sovereignty is a feature by feature question

A service label can stay the same while the information flow changes.

Follow the generated artefact

OpenAI's 15 and 16 October enterprise notes describe app/content controls and a Sites administration preview with specific availability and residency limits. New Sites use an eligible workspace's existing US or EU region for supported storage and hosting; workspace residency settings in other regions do not currently apply to Sites storage and hosting. Hosting and inference residency are separate. Existing Sites are not automatically migrated. [34]

For Australian procurement, the implication is to assess the feature actually being used. Trace source content, model processing, the generated artefact, a shared copy and the operational records. A regional setting that applies to one stage need not settle all the others.

Test access revocation and publishing in the intended deployment using representative labelled information. Confirm what a normal user can reach and what an administrator can change. Treat contract language and configuration evidence as complementary inputs to the decision.

Security controls can change the workflow

Anthropic's 12 October account of anti-distillation defences describes tighter boundaries, classifiers and account controls against unauthorised model-copying campaigns. It reports reduced extraction on its own platform while acknowledging false positives and integration effects. Some mechanisms were implemented before the publication week. Distillation itself also has legitimate authorised uses. [33]

A provider can improve abuse resistance and make an existing integration behave differently. The customer still needs to know what changed, which tests to repeat and how blocked or partial results affect the business process. The model's name is not a complete version record for the service around it.

Ask suppliers which safeguards can change independently of a model release, how notice is provided and what customers can observe. Include failed calls, changed outputs and additional costs in acceptance testing. These are operating dependencies, not details to postpone until a support ticket.

Useful explanations still need original sources

Google Cloud's 14 October PQC notebook packages curated research and guidance into a source-linked learning resource. Google warns that generated responses can be wrong. It is a useful briefing and training aid, rather than a tool that discovers an organisation's cryptographic estate or approves its migration. [39]

Use AI to make the reading easier. Keep the accountable judgement attached to the underlying evidence and the system you actually run.

QUANTUM RESILIENCE TLS

The handshake can improve before the signature

Confidentiality and authentication are related migration jobs with different dependencies.

On 15 October the UK NCSC updated its TLS guidance with post-quantum key-exchange profiles for TLS 1.3. It includes hybrid options and a pure ML-KEM key-exchange profile, while recommended authentication in those profiles still uses traditional ECDSA or RSA. Post-quantum TLS and Web PKI authentication remain work in progress. [36]

This is practical progress, and a useful defence against the temptation to mark a service simply 'quantum safe'. A client and server may negotiate a post-quantum session key while other trust functions remain on their own transition path.

Keep separate records for confidentiality, authentication and platform trust. Test the negotiated group across the real client, gateway, inspection device and server. Confirm failure and fallback behaviour. A product's support statement is useful; an observed supported connection is better evidence for that particular path.

UK guidance does not determine approval for Australian classified systems. ASD and the ISM remain the relevant Australian references. ASD's established planning milestones are a refined plan by end-2026, priority transition commenced by end-2028 and completion by end-2030. They are recommended milestones, not a prediction that cryptography breaks on a particular New Year's Day. [42]

The sensible leadership response is to fund the dependencies we can identify now. Waiting for a definitive quantum-computer arrival date will not make certificate estates, firmware lifecycles or supplier release plans easier to change.

Quantum readiness is becoming less of a physics seminar and more of a procurement meeting. The procurement meeting may take longer.

QUANTUM RESILIENCE DELIVERY

An algorithm is the start of the integration

A capable component still has to survive deployment, signing, failure and recovery.

The PQC Coalition page updated on 15 October presents a MITRE capability report that separates confidentiality and authentication. Its September report uses July public evidence and the highest observed maturity in each category. It is a useful map of uneven integration, not independent testing of the products installed in your organisation or a live October market census. [37]

Use the map to improve questions. Which release supports which function? What signs the update? How is the trust anchor replaced? Can the recovery environment verify the same artefact? ASD's vendor questions provide an established starting point for commitments, dependencies, testing and cost. [43]

Coinbase's 13 October contribution to Bitcoin's PQ discussion stresses operational requirements including signing, secure hardware, custody and recovery. It announces neither an agreed Bitcoin upgrade nor a deadline. Even outside cryptocurrency, its discussion is a reminder to test signing state and recovery, not only the algorithm in isolation. [38]

ORCA launched PT-3 in a London data-centre laboratory on 15 October and reported selected hybrid workload results. Its more-than-twelve-fold scheduling claim compares with its predecessor, not the best classical solver. Such results warrant examination of the complete workload and baseline; they do not demonstrate broad quantum advantage or a machine capable of breaking deployed cryptography. [40]

A procurement specification should make unsuccessful results informative as well. Define the relevant classical comparison, whole-system cost and the reproducible business outcome before the demonstration. An impressive component and a viable operating service are different stages of the engineering work.

RESILIENCE THE ROUTE BACK

Can you recover without the usual console

The awkward exercise is the one that assumes the recovery machinery is also unavailable.

Reuters reported on 15 October that Bank of England Deputy Governor Sarah Breeden advocated independent deep recovery arrangements as AI raises cyber risks. She also described a survey of firms' quantum readiness to inform a coordinated response. These were reported supervisory remarks and work, rather than a new universal recovery rule or proof that every bank can already rebuild independently. [41]

The service dependency is visible elsewhere. A 15 October US Courts notice said an incident affecting the contractor-operated Bankruptcy Noticing Center halted notice production and distribution. The statement does not establish a broader compromise of every federal court, an actor or data theft. It demonstrates how a supporting supplier can interrupt an essential legal process. [26]

Our proposed exercise starts with a critical service whose ordinary identity provider, management console and backup interface are treated as untrusted or unavailable. Establish a trusted administration route, recover the required configuration and data, then test the business function. Restoring a virtual machine is one step in that exercise.

Reconciliation matters. Which transactions happened during the gap? Which notifications were delayed? How do customers know the correct channel? Recovery is incomplete until the organisation can explain its service state and address the outstanding obligations.

Make the exercise small enough to run and difficult enough to teach something. Use a safe test environment or carefully controlled recovery rehearsal. Record dependencies that prevent completion and assign the decisions they require.

A backup policy cannot negotiate with a locked backup console.

THE LEADERSHIP AGENDA

Make the control observable

A practical agenda for the next management meeting.

Our view from Gadget Access and CiBRAI

We see the most useful role for AI in reducing the distance between an event, an informed decision and a verified result. That calls for disciplined automation: clear authority, retained evidence and an accountable person who can stop or change the process.

The week also shows why continuous compliance needs operational context. A control can be present but bypassed by a different identity. A recovery copy can be intact while restoration is unavailable. A cryptographic upgrade can protect one function and leave another on the migration plan.

These are the questions we recommend putting to any provider, including a CiBRAI deployment. Demonstrate the specific service and the exception path. Show what happens when the normal route fails. Agree which outcomes are measured and which responsibilities remain with the customer.

Resilience becomes more credible when somebody can operate it under pressure. The next useful improvement may be a tested route back into the business rather than another promise about how unlikely the outage is.

Andrew Curtis | Gadget Access and CiBRAI
Connect with Andrew