Most retailers follow a familiar holiday playbook. In 2026, with AI playing a meaningful role on both sides of the shopping equation for the first time, they may need to rewrite it, especially since consumers seem to be moving faster than retailers.

New research reveals that 65% of consumers plan to use AI for at least one part of their holiday shopping in 2026, but only 8% of retailers say they’re ready to deliver.

So what will it take to win the season?

Retailers need to master both sides of the equation: shaping demand and responding to it. The perfect recommendation means little if the product is unavailable or fulfillment is too slow. At the same time, even the best-run operation cannot capture a sale if the brand never enters the shopper’s consideration set.

Connecting those two sides is where the opportunity lies — and this year, the stakes are particularly high. As consumers rely more heavily on AI, the habits, brand preferences and expectations established now could shape how consumers, and the AI assistants acting on their behalf, shop for years to come.

Shaping demand: AI recommendations are becoming the new gift guides

“What should I buy Dad for Christmas?” is increasingly a question for an AI assistant rather than a sibling. With a bit of back-and-forth, that shopping assistant can often deliver a better answer by evaluating a wider set of options, cross-referencing sources such as consumer reviews and expert roundups, and applying personal preferences and constraints. AI shopping assistants can help consumers discover gift ideas, compare products, and identify the best-fit option based on factors such as the recipient, occasion, budget, brand preferences, size, and availability.

Using AI in this way changes what it means for brands to be discoverable. Recent research shows that a full 74% of shoppers use AI for product discovery, but less than 3% of the citations used by LLMs were brand-owned pages.

For brands and retailers, this shift raises the stakes for how they show up in the digital ecosystem beyond their own website. It also opens the door for smaller, less familiar brands with a strong digital presence and greater visibility in AI recommendations.

While optimizing an owned website for AI product discovery remains a necessary first step, it is no longer sufficient. Winning in AI discovery requires brands to build a consistent and credible presence across the broader digital ecosystem, ensuring AI systems can find, interpret, and trust information from sources such as publishers, buying guides, consumer reviews, and online communities. This broader approach, often referred to as generative engine optimization (GEO), focuses on improving the clarity, consistency, and credibility of the information AI systems use when generating recommendations.

The practical starting point is to map the AI discovery journey just as brands once mapped the search journey. Identify the questions consumers are likely to ask, test whether the brand appears for different needs and personas, examine which competitors are being recommended instead, and trace the sources shaping those answers. Then brands can work to close the gaps, strengthening product information on their own sites while earning credible reviews, editorial coverage, and authentic conversation in the third-party environments AI relies upon.

Gift-giving is emotional. LLMs are rational.

When it comes to gift-giving, we often say, “It’s the thought that counts.” But as shoppers increasingly turn to AI for help, it’s the feeling behind the thought that may be tougher to replicate.

Designed to weigh objective criteria like price, quality, and availability to find the “best” choice, AI models often fall short when it comes to the symbolism, and connection that accompany a gift. For example, Lipton tea may be the best everyday choice when Mom goes to the grocery store, but perhaps not the ideal gift for her. A highly rated digital kitchen scale may be a lovely gift for an avid baker, but come off as an inadvertent swipe for someone on a diet.

For brands, this puts a premium on two things AI cannot determine from product specifications alone: shopper intent and brand identity. Intention means giving AI enough context to understand not just what a shopper is looking for, but who they are buying for and why. Brand identity provides the emotional layer, the associations, values and meaning that make one choice feel more personal or appropriate than another.

Brands with a strong identity have an opportunity to not only land on the short list of AI recommendations, but also “win the override” when they don’t. Unlike traditional measures of satisfaction or loyalty, the Conscious Override Rate (COR) measures how often shoppers deliberately choose a preferred brand over an AI’s top recommendation, reflecting the strength of brand loyalty and preference beyond algorithmic influence.

That makes this holiday season particularly consequential. As shoppers use AI for product discovery at meaningful scale for the first time, brands are competing not simply for this year’s purchase, but also influencing long-term preference.

Meeting demand: The experience is only as good as the operation behind it.

AI can help retailers create a better path from discovery to purchase, but winning the recommendation is only half the battle. A highly relevant recommendation means little if the product is unavailable, the delivery promise is unreliable or unexpected fulfillment costs appear at checkout.

AI can play an important role in removing these points of friction. But while consumers are willing to use AI, they aren’t necessarily looking for an “AI experience.” They want AI to be felt, not seen—working behind the scenes to make shopping easier and more relevant.

That starts before the purchase. AI-powered demand planning can help anticipate not only what consumers will buy, but where and when demand will materialize. The bigger opportunity is to connect those signals of customer intent directly to operational decisions—from forecasting and allocation to replenishment and last-mile capacity.

Fulfillment then turns inventory into experience. Once a shopper is ready to buy, AI helps retailers determine which location should fulfill the order, through which channel and at what speed and cost. That requires connecting inventory visibility with warehouse, store, transportation and last-mile capacity through an intelligent control tower.

And the journey does not end at the doorstep. Holiday shopping inevitably becomes holiday returns, making reverse logistics another critical capability. Retailers can leverage AI to coordinate returns or troubleshoot questions; on the operation side, intelligent solutions can also be used to automate tasks like inspecting merchandise and restocking.

The bottom line: It takes two to win.

This holiday season, AI may be rewriting the playbook. But winning still comes down to one equation: create the demand, then be ready to deliver.

Webinar

Beyond the basket

How top grocers link foot traffic, execution and loyalty

Mark Ruston is Capgemini’s Global Retail Lead with 22+ years in consulting and transformation. He helps Tier 1 retailers and CPGs bridge strategy and execution, driving growth and measurable outcomes. With global experience and deep supply chain expertise, Mark champions AI to boost productivity and reduce waste — positioning operations as a key driver of consumer experience.

A data-driven approach to capturing ROI from investments and realizing value with Siemens Teamcenter

Organizations invest millions in product lifecycle management platforms, engineering tools, and digital transformation initiatives. Yet one challenge remains common across industries: how do you objectively measure whether those investments are delivering value?

For many enterprises, investment decisions are still influenced by varying assumptions, inconsistent business cases, and limited visibility into realized outcomes. The result is uncertainty around prioritization, difficulty comparing initiatives, and limited confidence that funding is directed toward the highest-value opportunities. As organizations continue to invest in PLM platforms such as Siemens Teamcenter and broader digital enterprise capabilities, the challenge often shifts from identifying improvement opportunities to objectively quantifying and comparing their business value. While these initiatives can improve collaboration, process efficiency, data quality, and product lifecycle visibility, organizations frequently lack a consistent methodology to evaluate expected benefits and validate realized outcomes across competing investments.

To address this challenge, Capgemini collaborated with the client on a new approach to investment prioritization and value realization: the “Return on Investment Business Value Framework”, or “ROI-BVF”.

The challenge: making investment decisions more objective

Product development organizations continuously evaluate opportunities to improve engineering efficiency, accelerate innovation, and modernize technology platforms. However, establishing a direct connection between investment decisions and measurable business outcomes is often difficult. For organizations managing large PLM environments such as Teamcenter, these challenges become even more complex. Investment decisions extend beyond whether to invest and often involve determining where to invest across platform upgrades, new capabilities, process improvements, and Siemens Xcelerator solutions. Leaders must evaluate options such as Teamcenter, Teamcenter X, and other complementary capabilities, each with different business impacts, implementation efforts, and expected returns, making objective value assessment critical for effective prioritization.

Many organizations face similar obstacles:

Limited visibility into how investments translate into business outcomes

Difficulty comparing initiatives using a consistent framework

Funding decisions based on subjective inputs rather than fact-based analysis

Challenges validating whether expected benefits were actually achieved after implementation

Without a standard way to assess value, organizations risk allocating resources based on assumptions rather than measurable impact.

Introducing ROI-BVF: a structured approach to measuring value

ROI-BVF – Return-on-Investment-Business Value Framework – provides a consistent methodology for quantifying business value and translating operational improvements into financial outcomes. The framework creates a common language for evaluating investments, comparing opportunities, and validating value realization. ROI-BVF was designed not only to calculate ROI, but to establish a common language between business and technology stakeholders. By creating a consistent methodology for measuring value, organizations can make more objective investment decisions, align on expected outcomes, and track realized benefits over time.

The framework focuses on both tangible and intangible value dimensions.

Tangible value includes:

Time savings

Cost reduction

Capacity release

Intangible value includes:

Increased transparency

Greater decision confidence

Improved user experience

Together, these dimensions enable organizations to make more consistent and data-driven investment decisions while creating a repeatable model that can scale across portfolios and programs. ROI-BVF provides a common methodology for evaluating value across a broad range of Siemens-enabled transformation initiatives, from Teamcenter deployments and engineering change management improvements to digital thread, quality management, requirements management, and workflow automation capabilities.

Connecting operational work to measurable ROI

A key differentiator of the ROI-BVF methodology is its ability to create a credible link between day-to-day work and financial outcomes.

The approach begins by establishing a detailed baseline of how work is performed today. Roles are mapped to core activities, effort levels are quantified, and operational data is collected to understand how time is spent across the product development lifecycle.

From there, improvement initiatives are connected to specific roles and activities. Expected efficiency gains are validated with subject matter experts and translated into measurable business impact. Finally, labor costs and resource utilization metrics are applied to convert those improvements into financial value.

This process enables transparent, comparable, and decision-ready insights that can support funding decisions before implementation and validate realized value after delivery. Additionally, this same baseline allows clients to compare Siemens product options against one another on a like-for-like basis – for example, whether migrating from core Teamcenter to Teamcenter X delivers enough incremental value to justify the change.

Supporting Lean Portfolio Management

ROI-BVF is designed to strengthen portfolio governance by introducing data-driven business cases during the analysis phase of Lean Portfolio Management.

By providing a consistent framework for evaluating initiatives, organizations can:

Build structured business cases

Quantify expected value using a common methodology

Compare initiatives objectively

Improve prioritization decisions across portfolios

This helps organizations move more confidently from idea generation to funding decisions while improving overall investment discipline.

Creating resilience in a changing environment

Large transformation programs rarely remain static. Business priorities shift, technologies evolve, and project scopes change over time.

ROI-BVF addresses this reality by maintaining a stable measurement baseline. Even when programs pivot, organizations can continue measuring value consistently by mapping changes back to the same role and task-based foundation.

This creates traceability, supports auditability, and ensures that ROI calculations remain credible throughout the lifecycle of an initiative.

A scalable model that can extend across programs and business domains

The result is greater confidence that resources are being directed toward the opportunities that deliver the greatest business impact.

Looking ahead

As organizations continue adopting Siemens Xcelerator solutions such as Teamcenter, Polarion, Mendix, and broader digital enterprise capabilities, the ability to objectively quantify value becomes increasingly important. With Capgemini, our heavy machinery client is able to combine operational insights with financial outcomes, and ROI-BVF provides a practical path toward more transparent investment decisions and stronger value realization.

Overall, the framework represents more than a new measurement tool – it establishes a foundation for making product development investments more measurable, comparable, and actionable across the enterprise.

*ROI BVF is a methodology and framework established by Capgemini Invent North America. For more information, please reach out to us.

Author

Mahsa Najafabadi

Senior Engineer Consultant, Capgemini Invent

Mahsa Najafabadi is a Consultant at Capgemini specializing in PLM‑driven digital transformation and enterprise value realization. With a Systems Engineering background and over eight years of cross‑industry and consulting experience within complex product organizations, she partners with PLM and engineering leaders to quantify ROI, strategically align PLM investments, and deliver measurable business outcomes through Business Value Frameworks.

The Cyber Resilience Act (CRA) is becoming a defining pillar of the European cybersecurity regulatory landscape, alongside NIS 2, DORA, and the Cybersecurity Act 2. Yet the CRA marks a fundamental shift. While many existing frameworks focus primarily on securing the infrastructures and operations of regulated entities, the CRA extends cybersecurity obligations directly to digital products across their full lifecycle.

While Cyber Awareness Month 2026 highlights the need to stay ahead of evolving cyber risks, the CRA reinforces a fundamental principle: resilience starts with security built into digital products from the outset, and sustained throughout their lifecycle.

Its scope is broad. Manufacturers, importers, and distributors will all need to demonstrate that products with digital elements placed on the European market meet defined cybersecurity expectations, regardless of organizational size. From connected consumer devices to critical technologies such as smartphones, printers, VPNs, and firewalls, the CRA will shape a market representing several hundred billion euros.

The first obligations begin September 2026, including mandatory reporting of incidents and actively exploited vulnerabilities to the competent authorities. Non-compliance may lead to financial penalties of up to €15 million and, in the most severe cases, the withdrawal of non-compliant products from the market.

For organizations, the CRA is not a remote compliance topic. This is a strategic, operational, and commercial imperative. It requires companies to embed cybersecurity into product strategy, engineering practices, supplier governance, and post-market operations. Capgemini has identified five priority challenges that organizations should address now.

1. Turning a crowded cyber regulatory agenda into an integrated roadmap

The CRA adds another layer of complexity to an already demanding cybersecurity regulatory agenda. Organizations already mobilized around NIS 2, DORA, or sector-specific cyber obligations must now address cybersecurity not only at enterprise infrastructure level, but also at product level.

In a context of overlapping regulations, the challenge is to avoid fragmented compliance initiatives. Organizations need a coherent, sequenced roadmap that limits duplication, rationalizes investment, and creates synergies across regulatory programs. This requires strong alignment between Legal, IT, Business, Product, and Cybersecurity teams around a single integrated cyber compliance program.

2. Leveraging existing standards to accelerate CRA readiness

By applying cybersecurity requirements at product level, the CRA builds on an existing landscape of industrial standards and sector-specific frameworks. In many cases, products already designed in line with recognized standards may partially meet CRA expectations by design.

The first priority is therefore to map current standards, certifications, and regulatory obligations against CRA requirements. This allows organizations to identify genuine gaps, focus resources on the products and capabilities that require action, and build a pragmatic compliance trajectory rather than starting from a blank page.

3. Clarifying accountability across the value chain

CRA obligations vary according to the role performed in the value chain — manufacturer, importer, or distributor — and the criticality of the product concerned.

Manufacturers carry primary responsibility for secure-by-design development, risk assessment, vulnerability handling, security updates, and compliance documentation.

Importers must verify that products placed on the European market are compliant and cooperate with authorities when incidents or vulnerabilities arise.

Distributors are subject to due diligence obligations, particularly in relation to product conformity, vulnerability identification, and incident escalation.

This distinction becomes more complex when a single organization plays several roles at once. A detailed product portfolio analysis is essential to determine the applicable obligations, certification routes, responsible entities, and interactions with competent authorities.

4. Extending product cyber resilience across the supply chain

The CRA reinforces shared responsibility across the digital product supply chain. The definition of manufacturer may include organizations that design, develop, commission, or market products under their own name, including products made available free of charge.

Organizations must therefore establish mechanisms to:

Identify and manage risks arising from third-party suppliers, software components, and embedded technologies.

Monitor vulnerabilities continuously and ensure timely remediation across the product lifecycle.

Coordinate incident reporting, evidence collection, and information sharing across suppliers and partners.

This often requires a review of contractual frameworks to clarify cybersecurity responsibilities, notification duties, remediation expectations, and regulatory evidence requirements, as in other sectorial standards such as ISO 21434 in the automotive sector. Supply chain governance will increasingly become a core component of CRA compliance.

5. Industrializing vulnerability management as a product capability

Under the CRA, the ability to identify, assess, report, and remediate vulnerabilities within strict timeframes is a critical product capability. Organizations will need industrialized processes and tooling to centralize vulnerability detection, including code analysis, automated scanning, dependency monitoring, and Software Bills of Materials (SBOMs).

These capabilities must make it possible to assess business and security impact, prioritize remediation based on product criticality and exposure, and provide the evidence needed to demonstrate compliance.

Beyond detection, organizations must orchestrate patch deployment, maintain traceability, and integrate vulnerability management into DevSecOps and operational processes. Product cyber resilience will depend on the ability to move from periodic compliance controls to continuous, evidence-based risk management.

Anticipate rather than react

The Cyber Resilience Act is more than a new compliance framework because it signals a structural shift in how organizations must approach cybersecurity: not as a downstream control, but as an inherent attribute of digital products and the ecosystems that support them.

With the first milestones approaching and significant sanctions in view, organizations should act now to assess exposure, clarify accountability, mobilize product and security teams, and embed CRA requirements into their operating model. Those that anticipate the regulation will not only reduce compliance risk; they will strengthen trust, resilience, and competitiveness in the European digital market.

Authors

Laurianne Brua

Digital Trust & Security Senior Consultant, Capgemini Invent

Laurianne contributes to Capgemini Invent’s Compliance Compass offering. She helps organizations define and implement their cybersecurity and cyber compliance strategies.

Olivier Gellez

Strategy & GRC Squad Leader, Capgemini CIS

Olivier leads the Governance, Risk, and Compliance (GRC) practice within Capgemini CIS Cybersecurity. He is responsible for structuring service offerings, supporting pre-sales activities, and guiding clients across their governance, risk management, and compliance needs.

Nicolas Hory

Head of France Cyber Center of Excellence, Capgemini

Nicolas leads Capgemini France’s Cyber Center of Excellence (CoE) for connected products and connectivity security (4G/5G). He works closely with clients to identify and address their cybersecurity needs, supporting them across the entire cybersecurity lifecycle of their connected solutions.

Most banking and insurance organizations have successfully modernized their core financial processing platforms using solutions such as Oracle Fusion ERP, policy administration systems, claims platforms, payment systems, treasury platforms, and banking applications.

These systems effectively perform their intended role as systems of record, executing and recording financial transactions across:

General ledger

Accounts payable and receivable

Claims processing

Billing and collections

Payments and treasury

Lending and deposits

Regulatory reporting

However, the information required to manage finance operations does not reside in a single system. Critical financial and operational data often remains distributed across multiple platforms, data warehouses, documents, operational databases, and cloud environments.

As a result, finance teams often struggle to:

Gain a unified view of financial and operational performance

Reconcile transactions across multiple systems

Identify risks and exceptions before they impact the business

Operationalize AI within finance processes

Accelerate decision-making across finance, risk, and operations

The Intelligent Finance Operations Hub transforms fragmented finance operations into a continuously intelligent operating model that improves visibility, accelerates decisions, reduces manual effort, and operationalizes AI across finance, banking, and insurance; delivering quantifiable business outcomes, including:

20–40% improvement in finance productivity

30–60% faster reconciliation and exception resolution

30–50% reduction in financial close effort

5–15% reduction in claims leakage

Improved compliance, controls, and audit readiness

What prevents finance from becoming intelligent

The journey from financial processing to financial intelligence is often hindered by fragmented data, delayed visibility, inconsistent business definitions, and disconnected workflows. These challenges limit operational efficiency, auditability, and the ability to scale AI across finance operations. Combined, these challenges create an intelligence gap that prevents organizations from realizing the full benefits of automation, analytics, and AI.

Common roadblocks to financial intelligence include:

1. Data fragmentation

Financial information is scattered across ERP systems, banking systems, insurance platforms, payment systems, data lakes, and reporting environments. Assembling a complete financial view requires extensive integration, reconciliation, and manual analysis.

2. Operational data stagnation

Business-critical information often remains trapped within operational systems and moves through nightly batches, extracts, and reports before reaching analytics platforms. By the time data becomes available for decision-making, it is no longer real-time.

3. Semantic fragmentation

The same business entities often have different definitions across systems. This creates multiple versions of financial truth and reduces confidence in analytics and AI outputs.

4. Reactive finance operations

Most reconciliation, exception handling, fraud investigation, premium matching, and financial close processes remain heavily manual and event-driven. Rather than focusing on analysis and business outcomes, finance teams spend significant effort gathering information, matching transactions, investigating variances, resolving exceptions, and creating manual journal entries.

5. Limited AI adoption

AI initiatives struggle to scale because enterprise data lacks real-time accessibility, business context, unified semantics, end-to-end lineage, and process integration. As a result, AI remains confined to isolated use cases instead of becoming embedded in day-to-day finance operations.

A framework for intelligent finance operations

The Intelligent Finance Operations Hub creates a unified intelligence layer across finance, banking, and insurance operations, connecting systems of record, enterprise data, AI, and business processes into a single, continuously monitored operating model.

The operating model brings together four connected capabilities that transform enterprise data into intelligent business action:

1. Connect (system + data)

Unifies financial and operational information across finance, banking, insurance, treasury, payments, claims, risk, and regulatory systems into a trusted enterprise data foundation.

2. Understand (AI + insights)

Applies AI, predictive intelligence, semantic search, and business context to transform fragmented data into actionable insights.

3. Act (copilots + agents)

Embedded copilots and intelligent agents automate investigations, resolve exceptions, route approvals, and support operational decision-making.

4. Optimize (operations)

Continuously monitors performance, identifies risks, improves controls, and accelerates financial operations across the enterprise.

The core components of the Intelligent Finance Operations Hub

Rather than replacing existing investments, the Intelligent Finance Operations Hub overlays existing platforms such as Oracle Fusion, banking systems, claims platforms, billing, treasury, and risk solutions to provide real-time visibility, intelligent decision support, and agent-assisted execution.

The Intelligent Finance Operations Hub is built on five interconnected layers that combine transactional systems, trusted data, AI-driven intelligence, and operational execution into a single finance operating model:

1. Systems of record

Oracle Fusion, Banking, Insurance, Treasury, Payments, and Claims platforms remain the systems of transaction and execution.

2. Finance intelligence foundation

Oracle AI Data Platform (AIDP) and Lakehouse create a governed, unified view of financial and operational data.

3. AI and intelligence layer

Oracle AI Database, analytics, copilots, and agents provide intelligence, prediction, automation, and decision support.

Copilots and intelligent agents

Finance copilots and intelligent agents orchestrate actions, automate workflows, support decisions, and manage operational processes across reconciliation, claims, fraud, treasury, and collections functions.

5. Intelligent finance operations layer

Insights are converted directly into business actions across finance, treasury, claims, billing, and shared services operations.

Building a continuously intelligent finance function

The impact of the Intelligent Finance Operations Hub is measured less by technology adoption and more by how quickly organizations can move from information to action. By connecting financial systems, enterprise data, AI, and operational workflows within a single operating model, finance teams can reduce reconciliation and close-cycle effort, accelerate exception resolution, and improve productivity across core finance activities.

With the hub, organizations can achieve 30–60% faster reconciliation cycles, 30–50% reductions in financial close effort, and 20–40% reductions in manual finance operations effort. At the same time, embedded copilots and intelligent agents can reduce investigation and research activities by 40–60% while increasing finance team productivity by 2–3x.

Beyond operational efficiency, a unified intelligence layer provides continuous visibility across finance, treasury, payments, claims, risk, and customer operations. This can lead to 50–70% faster access to operational insights, improved forecast accuracy, and greater confidence in planning and decision-making.

The benefits also extend to governance and risk management. Real-time monitoring, policy-driven automation, and AI-powered anomaly detection can help identify fraud indicators earlier, reduce claims leakage by 5–15%, strengthen audit readiness, and improve financial control across the enterprise.

Making financial intelligence real with Capgemini and Oracle

Capgemini and Oracle help organizations unlock greater value from their existing investments by creating a unified finance intelligence layer across Oracle Fusion, banking, insurance, and operational platforms. Together, we enable organizations to operationalize AI, embed intelligent agents into finance workflows, and transform fragmented finance operations into a continuously monitored, data-driven operating model.

Rather than replacing core systems, the Intelligent Finance Operations Hub builds on existing technology investments to connect information, context, and execution across business processes. This enables continuous visibility into performance, stronger operational control, and faster, more informed decision-making.

While most organizations have already modernized their systems of financial record, the next opportunity is creating a system of financial intelligence that continuously connects data, decisions, and actions across the enterprise. The Intelligent Finance Operations Hub helps close this gap, enabling organizations to move from fragmented processes and reactive operations to intelligent, connected execution at scale.

Authors

Renjith Sreekumar

Head of Oracle Cloud & AI CoE, Financial Services

Renjith Sreekumar is a technology and transformation leader helping Financial Services organizations build AI-ready enterprises through data modernization, intelligent operations, cloud transformation, and agentic AI.

Vijay Shanbhag

Executive Vice President | Global Head – ERP Practice | Financial Services (FS) SBU at Capgemini

As FS ERP Practice leader, Vijay is focussed on building capabilities to sell and deliver ERP work in Financial Services sector (Banking & Capital markets and Insurance). The role includes building out the services and offers to help clients use ERP for Digital transformation driving business value.

Cybersecurity has long relied on penetration testing – having experts run attack scenarios, probe applications and infrastructure, and scan for any weaknesses. It remains one of the most effective ways organizations can find vulnerabilities before attackers do. But with AI supercharging capabilities on both sides of the law, strong cybersecurity defenses are becoming less important to remaining breach-free than the speed with which organizations can identify risk, validate, and remediate it.

The expertise needed to perform pen testing, however, isn’t easily scalable to meet the burgeoning demand. Meaningful manual testing can take weeks, limiting how effectively organizations can defend against attacks as software, apps, and infrastructure change constantly. Manual testing just can’t keep up. Not only does AI enable attack activity on a massive scale, the window between a vulnerability’s discovery and its exploitation is rapidly shrinking.

Security leaders face a simple reality: it’s not enough to conduct a test. Now, organizations must be able to test their environments, frequently, and respond rapidly to any potential threat.

AI is changing what penetration testing can investigate

Used responsibly, with security tools and appropriate oversight, AI has the potential to expand what pen testing can do beyond identifying potential weaknesses. First, it can quickly assess whether the vulnerabilities it detects are exploitable, helping organizations to prioritize remediation of their weakest defenses. It can also map the extent of the weakness by investigating:

which systems or components an attacker could likely access by capitalising on it

whether relatively minor weaknesses, when combined, could create a material attack path

which data, functionality or business assets could be exposed as a result

what remediation options are available

The focus has shifted from finding isolated vulnerabilities to mapping and understanding complex paths of attack and the real-world impact they could have – capabilities that experts have but cannot scale. Frontier AI models are already able to reason across complex tasks, work with code, and support multi-step investigations, thus extending scarce human expertise.

Better testing means better prioritization

From an operational perspective, this shift could create a volume problem: automated defenses may find long lists of vulnerabilities, but not every vulnerability constitutes the same level of risk. Far more valuable is the ability to identify which vulnerabilities are 1) actually exploitable and 2) materially important, and prioritize those for testing and remediation.

AI-assisted testing can support security teams effectively prioritize limited remediation capacity by analyzing how vulnerabilities connect to:

application components

dependencies

likely attack paths

potential business impact

This offers greater visibility over the entire network, bringing clarity to exposure management, risk assessment, and exploitability, as well as the strategic advantage of faster, better-informed decisions around what to fix first.

The bigger prize is risk reduction

Two-thirds of organizations’ security operations are prioritizing AI adoption, but once cybersecurity has identified vulnerabilities, someone still needs to understand the underlying problem, work out how to fix it, implement that fix, and then validate whether it has worked. This often requires multiple hand-offs between security and development teams.

AI offers numerous capabilities that are already compressing this cycle – more than 60% of organizations report at least a 5% reduction in time-to-detect, while nearly 40% reduced their remediation time by 5% or more. By analyzing both the vulnerable code and its surrounding context, and then suggesting appropriate remediation approaches, AI not only speeds up discovery but also reduces the length of time the vulnerability remains unresolved. It is essential, however, that human security expertise remains firmly in the loop to validate the AI agents’ findings, assess the proposed remediation approach, and independently determine whether the remedy is safe, viable, and appropriate.

AI scales expertise. It does not remove the expert

The “assisted” in “AI-assisted penetration testing” is crucial – autonomous AI cannot replace penetration testers. Its ability to perform repetitive investigative work and explore multiple attack paths can certainly increase the speed, scale, and persistence of organizations’ cybersecurity operations. But it cannot replace the human expertise that provides business context, judgement, validation, and accountability, including the ability to determine how severe and material a threat truly is.

For senior leaders, therefore, questions of governance are paramount: organizations need crystal clear clarity on where AI is permitted to act autonomously, where human approval must be sought, and how AI-generated findings are validated.

From periodic testing to continuous validation

With business cycles a thing of the past in our always-on world, traditional methods of periodic penetration testing are no longer up to the job. Fortunately, AI offers the capability for more frequent testing, keeping up with the constant flux in applications, code, and dependencies to enable a continuous security-validation model that replaces occasional snapshots. This in turn shortens the feedback loop between development, security, and operations, as well as remediation and revalidation.

The effectiveness of an organization’s monitoring and remediation depends on:

how much of its environment is tested

how often it is tested

how quickly it can prioritize and fix issues

where to exert human oversight

how AI use in offensive security is governed

It’s already possible for organizations to transition to ongoing pen testing at enterprise scale thanks to AI. The next step is ensuring execution keeps pace with modern software development and AI-enabled threats.

Contact our cybersecurity specialists to explore how AI-assisted testing can help strengthen your resilience and reduce cyber risk.

About the author

Joshua Welle

Vice President, Global Head of Cybersecurity Portfolio

Joshua is a seasoned cybersecurity and national security expert with over 20 years of management consulting and operational experience. He advises CIOs and CISOs on cybersecurity strategy and digital transformation, delivering high-impact programs that drive organizational change. A prolific writer on digital strategy and leadership, Joshua is widely recognized as a thought leader in the field. A retired U.S. Navy Commander, he is a member of the Council on Foreign Relations and Truman National Security Project and holds advanced degrees from Harvard and the University of Maryland.

We often treat human oversight as the safety net for AI.

Let the AI prepare the recommendation and propose the action, and then put a human in the loop to approve it.

Problem solved.

Except there is one uncomfortable question:

What happens when the human stops reviewing and just starts clicking?

As AI agents take more actions, the number of decisions requiring human approval can grow quickly. A person who receives one unusual request may examine it carefully. A person who receives hundreds of similar requests every day may not.

At some point, “human in the loop” can become human just clicking approve.

The assumption sounds reasonable: humans provide judgement, context, and accountability that AI lacks. But simply adding a person to a workflow does not guarantee any of those things.

NIST has cautioned against assuming that a human overseer will automatically provide effective governance. Human decision-makers bring their own cognitive biases, and the effectiveness of different human-AI configurations depends heavily on how roles and responsibilities are designed.

Research also shows how easily people can over-rely on automated recommendations.

In one experiment involving 292 participants, people followed algorithmic recommendations more closely than equivalent human recommendations. More importantly, when participants were able to monitor and adjust the automated recommendation, they were less likely to intervene when the algorithm made its largest errors. The researchers concluded that adding a human in the loop increased uptake of automation while decreasing decision accuracy in their experiment.

That is automation bias: the tendency to rely too heavily on automated output.

The EU AI Act explicitly recognizes this risk. For high-risk AI systems, Article 14 says people responsible for human oversight should be able to understand system limitations, correctly interpret outputs, override or reverse them, and remain aware of the tendency to over-rely on AI-generated recommendations.

In other words, the regulator does not consider the mere presence of a human sufficient. The human must actually be capable of challenging the system. In this sense, approval does not always mean a judgement has been made.

Imagine an AI agent handling procurement.

Most transactions are routine. The agent prepares an action and asks an employee to approve it.

Approve. Approve. Approve. Approve.

After hundreds of correct recommendations, another approval appears.

How carefully does the employee review number 237?

This problem becomes even harder with autonomous agents. A traditional application may require occasional approval. An agent can potentially perform hundreds or thousands of actions as it works toward a goal.

OpenID contributors have raised precisely this scalability concern: per-action approval can lead to consent fatigue and reflexive approval, undermining the control it was supposed to provide.

So perhaps the question should not be on where we can insert human approval, but where does human judgement genuinely add value? Maybe humans should manage boundaries, not clicks.

Meaningful human oversight may require a different model.

Instead of asking people to approve every routine action, organizations can define in advance what the agent is allowed to do independently and what requires escalation.

For example:

An agent may process standard transactions below a certain risk threshold.

But an unusual payment, policy exception, sensitive data access, or action above a defined financial threshold may require human review. The human then focuses attention where judgement matters rather than becoming a bottleneck for thousands of predictable decisions.

NIST’s recent work on post-deployment AI monitoring identifies scaling human-driven monitoring as an open challenge and asks how oversight should vary according to risk and use case.

That may be the more important principle.

Human oversight should be designed around risk, not around the comforting presence of an “approve” button.

Test the human in the loop, too

Before declaring a process safe because it includes human approval, ask:

How many decisions does this person need to review?

Do they have enough information to challenge the AI?

Do they understand what they are accountable for?

How often do they override the recommendation?

Would they recognize an unusual or dangerous request?

Are we measuring whether the oversight actually works?

Human oversight can be extremely valuable, but only when the human is actually overseeing.

Because, ultimately, saying “a human approved it” and “a human meaningfully reviewed it” are not the same thing.

About the author

Monika Teresik

Offer Lead, Cloud Infrastructure Services

Monika Teresik is an Enterprise Service Management expert with over 15 years of experience in overseeing operations, managing transitions, and implementing IT Service Management solutions in complex multi-supplier environments. As the Offer Lead and a member of the portfolio team, she focuses on developing innovative, customer-centric solutions powered by the ServiceNow platform to address complex business challenges.

Smart cities are often data rich but insight poor. An effective city-wide response to the increasing number of climate-related events, such as flooding and heat islands, demands better insight built on integrated data and operating models.

At a glance:

Urban resilience rests on data-interoperability – the ability to connect and use data – across multiple agencies to establish a shared operating picture

Bringing all the data together under the auspices of a single city support center can speed up a unified response to climate events

AI-powered digital twins help cities to anticipate how a climate risk event may evolve and to identify areas of immediate impact

AI agents can assist operators at every step of the incident management response – veracity check, correlation of events, dynamic action plan creation and execution, and continuous monitoring and intelligence generation

The right analytics capabilities enable city leaders to predict climate events and make faster, evidence-based risk mitigation decisions

Torrential rain has caused a river to burst its banks, flooding tunnels and blocking transport routes. Who responds? The water authority pumping out water and managing the clean-up? The transport department rerouting traffic and diverting trains? The first responders? Or all together in a coordinated manner?

Similarly, the summer heatwave has created an urban heat island. Extreme high temperatures can have an impact on public health, transport systems, workforce productivity, and more. Who takes the lead? The health authority, transport operators, or municipal authorities? And who communicates with the citizens?

In both the above climate-impact scenarios, we typically see a multi-agency response. However, while there may be well-established procedures and processes in play, each agency often focuses on its own operational responsibilities. This means that there is limited coordination across the wider system and very little data transparency between all the players.

With climate-related events on the rise, this operational and data disconnect is giving city leaders and policy makers a big headache. In the following article we offer an alternative, more connected route to managing climate risk events utilizing a centralized support center, integrated data, and AI.

What is the impact of a siloed response to climate events?

For public sector leaders getting to grips with the impact of our changing environment, a siloed response can be both costly and, crucially, life threatening.

It can lead to delayed interventions, inefficient resource deployment, duplication of effort, counterproductive actions, and reduced community resilience. Maintenance spending also rises in response to (potentially preventable) damage caused, further adding to the pressure on already over-stretched local government budgets.

Climate risk events can evolve rapidly. Ideally, the fragmented information they generate should be rapidly coordinated across public safety, transport, utilities, health, municipal operations, and community services.

Instead, however, the disconnected data sources and resulting limited situational awareness mean that operators often struggle to get a clear picture of the bigger story unfolding before them. They are also often dealing with manual coordination processes and pressure to make critical decisions with constrained resources.

How does an AI-native operating model approach help to build resilience?

Urban resilience rests on the ability to connect and interpret data across multiple agencies. An AI-native approach moves the area of impact beyond fragmented sensors, cameras, citizen reports, and agency systems to establish a correlated, unified shared operating picture.

Centralized within an operational support center, this AI-infused shared operational picture provides real-time visibility of risks, impacts, resources, and affected communities, while generating actionable insights to support faster, more informed, dynamic response actions.

With the right analytics capabilities in play, the AI-native approach also enables city leaders and policymakers to both predict climate events and make faster, evidence-based risk mitigation decisions.

What’s preventing investment in the solutions needed for a joined-up response?

Many of the available solutions are custom-built for cities. This demands a big budget, which is not readily available in most cities, especially in Europe.

For cities that have not yet invested in an integrated platform, this high cost is prohibitive, although it is less so for those cities that already have data platforms up and running. There are also concerns about how quickly it might take to build a platform capable of making interoperable data real.

AI is very much at the core of modern smart city solutions – see below. This, in itself, has prevented some cities moving ahead with rolling out new solutions. That’s because they are often still in the policy development phase with regards to data, big data, and AI, along with the ethical challenges that these bring.

Can you expand on AI’s role in this connected, smart city approach?

At Capgemini, we’ve worked with Microsoft on an innovation accelerator that uses agentic AI to continuously connect and interpret disparate data sources. This enables faster situational awareness and more confident decision-making.

With the aid of AI, cities can achieve improved cross-agency coordination, more effective use of resources, enhanced resilience, and continuously improving operations that learn from every event to strengthen future preparedness and response.

We call this the Capgemini + Microsoft AI-Native City Support Center. It enables response plans to be translated into coordinated workflows across public safety, transport, utilities, health, municipal operations, and community service – see FAQs, below, for more details.

With the aid of AI, cities can achieve improved cross-agency coordination.

How do AI and scenario planning speed up the response to climate events?

If you can use AI to predict likely climate flashpoints, you can build operating procedures to mitigate them before they occur or escalate.

Response scenarios can be built using data captured from areas identified as being prone to climate-related incidents. By combining AI agents with city digital twin capabilities, cities can anticipate how a climate risk event may evolve, identify areas of immediate impact, assess risks to vulnerable populations and critical infrastructure, and evaluate alternative response strategies before conditions deteriorate.

Scenarios can be run to evaluate how best to respond at the onset of a heat island or flooding. For example, if a weather report indicates that a significant storm is due to hit, rather than waiting until it happens, preparations can begin in advance.

In the AI-native City Support Center, AI agents correlate fragmented observations into a single incident view, providing operators with real-time awareness of risks, impacts, resources, and emerging threats. They recommend relevant operating procedures and automatically generate coordinated action plans and cross-agency workflows.

If you can use AI to predict likely climate flashpoints, you can build operating procedures to mitigate them before they occur or escalate.

How can city leaders keep down costs and speed up time-to-value?

We recognize that starting from scratch is a huge commitment. But what if your city could benefit from all the value of trusted event intelligence and a unified operating picture, without the cost and time delay of a bespoke build?

Standardization is the answer. Our AI-native transformation approach uses an as-a-service, platform-based delivery model that combines Capgemini’s domain expertise, operating model design, and interoperable, standards-based accelerators with Microsoft’s proven AI, data, and cloud technologies. It can integrate with existing open, city, or urban data platforms and domain operational systems.

This reduces the build time and cuts the cost to operate. Up-front investment is also lower because we are taking an innovative approach to delivering this solution. Rather than offering it as purely a technology product, we deliver it as-a-service:

We build and tailor the platform for you

We install the technology in your operational context

We assist in establishing your AI-native operating model and governance

We run and manage it as-a-service.

What value can cities gain from an integrated operating model?

By moving from reactive incident management to predictive and adaptive operations through an integrated operating model, city leaders can:

Achieve a single, trusted view of any climate risk event: Gain a common operating picture across agencies to improve awareness, reduce uncertainty, and accelerate response.

Shift from reactive response to predictive, AI-assisted operations: Move from responding to events after they occur to proactively predicting impacts, prioritizing resources, and planning interventions.

Orchestrate the entire city response while maintaining sovereign control: Improve cross-agency coordination, optimize resource utilization, and strengthen resilience while maintaining digital sovereignty and regulatory compliance.

Combining data and AI for a faster, more informed, and coordinated response

Data continues to proliferate as our cities and urban areas become ever smarter and more digitally connected. This presents both an opportunity and a challenge.

Too much data residing in too many silos and different organizations can hinder a unified and collaborative response to climate events. On the other hand, bringing all the data together under the auspices of a single support center within the city has the potential to speed up a unified response to climate events.

Adding AI agents to analyze and monitor this data provides the all-important city-wide context needed to manage an impending or evolving climate risk event.

CMMC Level 2 Requirements: Complete Guide to All 110 Controls

For defense contractors and subcontractors handling Controlled Unclassified Information (CUI), CMMC Level 2 (Cybersecurity Maturity Model Certification) is the cybersecurity benchmark that matters most. Under CMMC 2.0, Level 2 aligns directly with the 110 security requirements in NIST SP 800-171and is designed to protect sensitive defense information across the Defense Industrial Base (DIB).

Organizations pursuing applicable Department of War (DoW) contracts must implement these controls, document them thoroughly, and prove compliance through either self-assessment or third-party certification depending on contract and security requirements.

This guide breaks down what CMMC Level 2 includes, how the 110 controls are organized, and what businesses need to do to prepare.

What Is CMMC Level 2?

CMMC Level 2 focuses on protecting CUI and serves as the bridge between basic cyber hygiene and advanced security maturity. Unlike CMMC Level 1, which covers only Federal Contract Information (FCI), CMMC Level 2 requires organizations to implement all 110 NIST SP 800-171 controls across 14 security domains. These security controls are not optional checkboxes. They require documented policies, operational procedures, technical safeguards, and evidence that security controls are functioning as intended.

For many contractors, CMMC Level 2 is the most critical certification tier because it applies broadly to companies storing, processing, or transmitting CUI.

What Are the 14 Control Families in CMMC Level 2?

The 110 controls are divided into 14 domains, each covering a core cybersecurity discipline:

1. Access Control (AC) – 22 Controls

Ensures only authorized users, devices, and systems can access CUI. 

Key examples: 

- Least privilege access

- Role-based permissions

- Session lock

- Remote access restrictions

- Network segmentation

2. Awareness and Training (AT) – 3 Controls

Requires personnel to understand cybersecurity risks. 

Key examples: 

- Security awareness training

- Insider threat awareness

- Role-specific security education

3. Audit and Accountability (AU) – 9 Controls

Focuses on logging, monitoring, and traceability. 

Key examples: 

- Audit log generation

- Event monitoring

- Log review

- Time synchronization

4. Configuration Management (CM) – 9 Controls

Ensures systems are securely configured and controlled. 

Key examples: 

- Baseline configurations

- Change management

- Application whitelisting

- Least functionality

5. Identification and Authentication (IA) – 11 Controls

Verifies users and devices before access is granted. 

Key examples: 

- Multi-factor authentication

- Unique IDs

- Password complexity

- Device authentication

6. Incident Response (IR) – 3 Controls

Defines how organizations detect and respond to cybersecurity events. 

Key examples: 

- Incident response plans

- Reporting

- Testing

7. Maintenance (MA) – 6 Controls

Secures system maintenance activities. 

Key examples: 

- Controlled maintenance tools

- Remote maintenance approvals

- Sanitization after repairs

8. Media Protection (MP) – 9 Controls

Protects physical and digital media containing CUI. 

Key examples: 

- Media marking

- Secure disposal

- Encryption

- Physical transport controls

9. Personnel Security (PS) – 2 Controls

Addresses personnel screening and termination security. 

Key examples: 

- Background screening

- Access revocation upon termination

10. Physical Protection (PE) – 6 Controls

Protects facilities and physical access points. 

Key examples: 

- Visitor controls

- Facility monitoring

- Escort procedures

11. Risk Assessment (RA) – 3 Controls

Requires organizations to identify and assess threats. 

Key examples: 

- Vulnerability scanning

- Risk assessments

- Threat remediation

12. Security Assessment (CA) – 4 Controls

Ensures ongoing evaluation of security posture. 

Key examples: 

- Periodic assessments

- Plan of Action & Milestones (POA&M)

- SSP updates

13. System and Communications Protection (SC) – 16 Controls

Protects networks and communications channels. 

Key examples: 

- Boundary defense

- Encryption

- Session integrity

- Split tunneling restrictions

14. System and Information Integrity (SI) – 7 Controls

Maintains system resilience against threats. 

Key examples: 

- Malware protection

- Patch management

- Flaw remediation

- Monitoring

Beyond the 110 CMMC Controls: 320 Assessment Objectives

A common misconception is that implementing 110 security controls is enough. In reality, CMMC assessments evaluate roughly 320 assessment objectives tied to those controls. This means each control may require multiple pieces of evidence, such as policy documents, technical settings, screenshots, interviews, and operational procedures.

For example, enabling MFA is not enough. Assessors may also review:

- Which users are covered

- Whether privileged accounts are included

- How enforcement is configured

- Whether documentation aligns with implementation

The Key Documentation Required for CMMC Level 2

To succeed at CMMC Level 2, documentation is just as important as technical controls.

Essential documents include:

- System Security Plan (SSP)

- POA&M

- Asset inventory

- Network diagrams

- Incident Response Plan

- Access Control Policies

- Security Awareness Records

Without strong documentation, even technically secure organizations can fail an assessment.

How SPRS Scores Impact CMMC Level 2 Readiness

Defense contractors subject to DFARS 252.204-7012 are required to assess their implementation of NIST SP 800-171 and submit their score to the Supplier Performance Risk System (SPRS).

SPRS is the Department of War’s system for recording NIST SP 800-171 assessment scores and tracking contractor compliance with DFARS requirements. Because those assessments are based on the same 110 NIST SP 800-171 security controls that underpin CMMC Level 2, an SPRS score can provide valuable insight into an organization’s current cybersecurity posture.

SPRS assessments include:

- Documenting compliance with DFARS 252.204-7012 requirements

- Measuring implementation progress against NIST SP 800-171

- Identifying security gaps and remediation priorities

- Supporting preparation efforts for a future CMMC Level 2 assessment

- Demonstrating cybersecurity maturity to DoW stakeholders

While an SPRS score is not a measure of CMMC readiness on its own, it serves as an important benchmark for organizations working toward CMMC Level 2 certification.

Self-Assessment vs C3PAO Certification: What To Know

CMMC Level 2 has two pathways:

Self-Assessment:

For select contracts with lower national security sensitivity. Requires annual affirmation and SPRS score submission.

C3PAO CMMC Assessment:

For prioritized contracts involving sensitive CUI. Requires formal third-party assessment every three years plus annual affirmation.

Most defense contractors should prepare as though third-party assessment will eventually apply.

The Common Challenges Organizations Face With CMMC Level 2

Many companies underestimate:

- Scoping complexity

- Legacy systems

- Security configuration gaps across cloud, endpoint, and identity environments

- Vendor management

- Documentation maturity

- Resource constraints

The hardest security controls are often not technical. They are operational, procedural, and evidence-based.

Practical Steps to Prepare for a CMMC Level 2 Assessment

Step 1: Define Scope

Identify all people, processes, technology, and external providers that touch CUI.

Step 2: Conduct Gap Assessment

Map current controls to NIST SP 800-171.

Step 3: Prioritize High-Risk Gaps

MFA, logging, endpoint security, and boundary protection often come first.

Step 4: Build Documentation

Develop SSP and POA&M early.

Step 5: Perform Internal Mock Assessment

Test against third-party assessment objectives, not just control statements.

Get CMMC Assessment Ready Today

If your organization is preparing for CMMC Level 2, the stakes go far beyond passing an assessment. Defense contractors across the DIB are facing increasing pressure to demonstrate strong cybersecurity practices, protect sensitive government information, and maintain eligibility for future contract opportunities.

Organizations that fail to address compliance gaps risk more than operational headaches. They risk lost revenue opportunities, delayed contract awards, increased scrutiny, and weakened trust across the defense supply chain.

CloudFit and easyCMMC help simplify the path forward with a streamlined 30-day approach designed to help organizations strengthen security posture, improve compliance maturity, and prepare for the operational and evidence-based requirements of modern CMMC assessments before engaging third-party assessment organizations.

Comments are closed

FBI Takes Down Major Phishing Operation: What Organizations Can Learn from the W3LL Platform

By Charlie Gebetsberger, Service Engineer

The FBI recently disrupted a major phishing operation known as W3LL, a cybercrime platform that enabled attackers to launch sophisticated credential theft campaigns at scale.

While the takedown represents a significant victory for law enforcement, it also serves as an important reminder that phishing remains one of the most effective attack methods used by cybercriminals today.

Organizations of all sizes should view this incident as an opportunity to evaluate their cybersecurity awareness programs, employee training efforts, and overall security posture.

What Was the W3LL Operation?

W3LL functioned as a phishing toolkit marketplace, providing cybercriminals with ready-made tools that made launching attacks easier and more effective.

Using the platform, attackers could create convincing fake login pages that closely resembled legitimate websites and business applications. Unsuspecting users would enter their credentials, believing they were accessing trusted services.

The platform enabled attackers to:

- Capture usernames and passwords

- Intercept multi-factor authentication (MFA) codes in real time

- Gain unauthorized access to email accounts, business systems, and other sensitive resources

According to the FBI, the operation was linked to more than 25,000 compromised accounts and over $20 million in attempted fraud.

The scale of the campaign highlights how phishing has evolved from simple scam emails into highly organized criminal operations designed to bypass traditional security controls.

Why This Matters to Organizations

Many companies invest heavily in cybersecurity tools, but phishing attacks continue to succeed because they target people rather than systems.

Today’s phishing campaigns are far more sophisticated than the obvious spam messages many employees learned to recognize years ago.

Modern phishing attacks often:

- Replicate legitimate login portals with remarkable accuracy

- Use urgent language to pressure users into taking immediate action

- Appear to come from trusted vendors, coworkers, or business partners

- Circumvent basic email filtering technologies

In many cases, even security-conscious employees can become victims when they are busy, distracted, or responding to what appears to be a legitimate request.

This is why phishing remains one of the leading causes of credential theft, business email compromise, and unauthorized account access.

How Employees Can Help Prevent Phishing Incidents

Technology plays an important role in cybersecurity, but employee awareness remains one of the strongest defenses against phishing attacks.

Organizations should encourage employees to adopt a mindset of verification before action.

Before Clicking a Link or Logging In

Employees should take a moment to verify that a request is legitimate before entering credentials.

Best practices include:

- Carefully reviewing website addresses for misspellings or unusual domains

- Being cautious of unexpected login prompts

- Verifying requests through a secondary communication channel when possible

- Treating urgent requests with additional scrutiny

Attackers frequently rely on urgency because it encourages users to act quickly rather than carefully.

Protect Credentials and MFA Codes

Compromised credentials remain one of the primary goals of phishing campaigns.

Organizations should reinforce the following practices:

- Never reuse work passwords on personal websites

- Use approved password managers whenever available

- Enable and maintain multi-factor authentication

- Never share MFA codes with anyone

Employees should remember that MFA codes are sensitive security credentials and should be protected just like passwords.

Report Suspicious Activity Immediately

One of the most effective ways to limit damage from phishing attacks is rapid reporting.

If something feels unusual, employees should:

- Stop interacting with the website, email, or message

- Avoid entering additional information

- Notify their IT or security team immediately

- Report suspected phishing attempts, even if they are unsure

Security teams would much rather investigate a false alarm than discover a compromised account after an attacker has gained access.

Organizations should also foster a culture where employees feel comfortable reporting suspicious activity without fear of blame or punishment.

Building a Stronger Security Culture

The W3LL operation demonstrates an important reality of modern cybersecurity: attackers do not always need to exploit technical vulnerabilities when they can exploit trust instead.

Successful security programs combine technology, employee education, and well-defined response procedures. Organizations that regularly train employees, reinforce verification habits, and encourage prompt reporting are often better positioned to prevent phishing incidents before they become major security events.

Key Takeaway

The FBI’s disruption of the W3LL phishing platform is a reminder that phishing remains one of the most persistent threats facing organizations today.

These attacks don’t rely on breaking into systems. They rely on convincing people to voluntarily hand over access.

By encouraging employees to verify requests, protect credentials, and report suspicious activity quickly, organizations can significantly reduce their risk.

When in doubt, verify before you trust, and report before it’s too late.

If your organization is looking to strengthen its defenses against phishing, credential theft, and other cyber threats, CloudFit can help. Our managed cybersecurity services provide the expertise, monitoring, and support organizations need to stay ahead of an evolving threat landscape.

Comments are closed

Dirty Frag: Understanding the Latest Linux Kernel Security Threat

By: Chris Bentkowski

Recently, security researchers identified two significant vulnerabilities, collectively known as Dirty Frag, affecting the Linux kernel. If you manage Linux servers or Kubernetes clusters, understanding these flaws is essential for keeping your environment secure.

What is “Dirty Frag”?

Dirty Frag (specifically CVE-2026-43284 and CVE-2026-43500) is a class of local privilege escalation vulnerabilities. In simple terms, it allows a low-privileged user or a malicious container to “break out” and gain full administrative (root) control over the host machine. The issue stems from how the Linux kernel handles certain types of network data, specifically “splice-backed packet fragments”. Under the right conditions, the kernel performs unsafe operations on memory that it should treat as private, leading to memory corruption.

Why it Matters for Kubernetes

In a Kubernetes environment, all containers on a node share the same underlying host kernel.

- Shared Risk: Because this is a kernel-level issue, standard pod isolation isn’t enough.

- The Breakout: If an attacker compromises a single pod, they could potentially use Dirty Frag to take over the entire node.

- High-Risk Scenarios: Clusters are at higher risk if they host untrusted workloads, are internet-facing, or are multi-tenant.

Is Your System Vulnerable?

The vulnerabilities affect a wide range of Linux kernel versions, dating as far back as 4.11 (released in 2017).

Affected Kernel Ranges:

- 4.11 up to 5.10.254

- 5.12 up to 5.15.204

- 5.16 up to 6.1.170

- 6.2 up to 6.6.137

- 6.7 up to 6.12.86

- 6.13 up to 6.18.27

- 7.0.0 up to 7.0.4

Note: Always check with your specific Linux distribution (Ubuntu, RHEL, Azure Linux) for their specific “fixed” version numbers, as many vendors backport security fixes.

How To Protect Your Environment

Security experts recommend a three-step “order of operations” to handle Dirty Frag:

- The Permanent Fix: Patching – The only permanent solution is to update your Linux kernel to a fixed version.   

For Standalone Servers: Apply vendor updates and reboot.

For Kubernetes/AKS: Perform a node image upgrade to ensure every worker node is running a patched VHD/image.

- Temporary Shielding: Module Blocking – If you cannot patch immediately, you can temporarily reduce your risk by blocking the specific kernel modules associated with the vulnerable paths: esp4, esp6, and rxrpc. 

The Catch: This only works if these features are compiled as loadable modules. If they are built directly into the kernel, this mitigation will not work.

Automation: Many teams use a DaemonSet in Kubernetes to automatically apply these module blocks across every node in a cluster.

- Defense-in-Depth: While waiting for patches, you can shrink your “attack surface” by: 

Minimizing the use of privileged containers.

Restricting pods from using hostNetwork or hostPID unless absolutely necessary.

Enforcing strict Pod Security Admissions.

Summary Checklist

- Identify if your nodes are running vulnerable kernel versions.

- Prioritize patching or reimaging nodes to a fixed baseline.

- Validate that updates were applied to existing nodes, not just new ones.

- Monitor for the presence of the esp4, esp6, and rxrpc modules if you aren’t using them.

How CloudFit Can Help

Keeping Linux environments secure requires more than simply applying patches. Organizations need visibility into vulnerable systems, a clear remediation plan, and confidence that updates are being deployed consistently across servers, clusters, and cloud environments.

CloudFit helps organizations identify security risks, manage vulnerability remediation, secure Kubernetes and cloud workloads, and maintain a strong cybersecurity posture through managed security and infrastructure services.

If you’re unsure whether your Linux servers, AKS environment, or Kubernetes clusters are affected by Dirty Frag, our team can help assess your exposure, validate your patch status, and implement security best practices to reduce risk.

Contact CloudFit today to learn how we can help strengthen your infrastructure against emerging threats and keep your environment secure.

References:

Comments are closed