Three Security Priorities You Can’t Ignore this year!
As organisations continue to adopt AI, expand their cloud estates, and support more flexible ways of working, the security landscape is becoming more complex. The challenge in 2026 isn’t just preventing attacks, it’s maintaining visibility, protecting data in new workflows, and ensuring the business can recover quickly when disruption occurs.
This month’s bulletin focuses on three areas that are increasingly critical to operational resilience: securing the use of public AI tools, moving from backup to true recovery capability, and understanding how modern identity attacks can bypass traditional protections.
How to Prevent Employees from Leaking Data Through Public AI Tools
Public AI tools such as ChatGPT and Gemini are rapidly becoming part of everyday workflows. However, anything entered into open AI platforms can be stored, processed, and in some cases used to improve future models, creating a real risk of sensitive business data being exposed.
Adopting AI securely isn’t about restricting innovation. It’s about putting the right controls in place so your people can use these tools with confidence.
Why It’s a Risk:
Lack of clear policy or visibility makes it difficult to control how AI is being used across the business.
Data leakage through prompts can lead to compliance breaches, reputational damage, and loss of intellectual property.
What You Can Do:
Establish a clear AI security policy defining approved tools and what data must never be entered into public models.
Implement DLP with AI prompt protection to detect and stop sensitive data before it leaves your environment.
Provide practical, scenario-based training so employees can use AI safely and effectively.
From Backup to Recovery: How Fast Can You Resume Operations?
Many organisations measure backup success by whether the job completes. But in a real incident, the critical question is how quickly you can restore systems, data, and services and return to normal operations.
Without a tested recovery strategy, backups alone won’t prevent costly disruption.
Why It’s a Risk:
Backups that haven’t been tested may fail when they are needed most.
Slow recovery times can lead to extended downtime and lost revenue.
Ransomware attacks increasingly target backup systems first.
What You Can Do:
Define and review your recovery time (RTO) and recovery point (RPO) objectives.
Regularly test full restores, not just individual file recovery.
Implement immutable or isolated backups to protect against ransomware.
Stolen Session Tokens: The MFA Bypass You Don’t See
Multi-factor authentication is one of the most effective ways to protect user identities. However, attackers are increasingly finding ways to bypass it, not by breaking MFA, but by stealing active session tokens after a user has successfully signed in.
These tokens allow attackers to access Microsoft 365 and other cloud services without needing a password or MFA prompt, making the activity much harder to detect.
Why It’s a Risk:
Session token theft enables attackers to bypass MFA and access cloud services as legitimate users.
Token-based attacks are difficult to detect because they don’t trigger traditional login alerts.
Compromised sessions can lead to data exfiltration, mailbox access, and internal phishing.
What You Can Do:
Enforce device compliance and Conditional Access policies to restrict session use to trusted devices.
Deploy endpoint detection and response (EDR) to identify token theft and malicious activity.
Implement continuous monitoring to detect unusual session behaviour and revoke access quickly.
Stay Operational Through Any Disruption
Ensure your organisation stays resilient in the face of disruption. Symetri’s Business Continuity & Disaster Recovery solutions help you plan ahead, protect critical systems, and recover quickly — minimising downtime and keeping your operations running.
Our services can support you with:
24/7 security monitoring and threat detection
Vulnerability management and remediation guidance
Identity, access, and cloud security posture management
Backup, recovery, and resilience services
Ongoing security assessments and optimisation
Vulnerabilities & Further End-of-Life Notifications
Staying aware of newly disclosed vulnerabilities and active threats is essential for reducing exposure and prioritising patching.
-
Notepad++ Hijacked by State-Sponsored Hackers – Upgrade to v8.9.1
Attackers compromised the Notepad++ update mechanism to distribute malicious payloads. Organisations using Notepad++ should immediately upgrade to the latest version and verify software sources. -
Microsoft Patches CVE-2026-26119 Privilege Escalation in Windows Admin Center
A privilege escalation flaw in Windows Admin Center could allow attackers to gain elevated access to managed systems. Applying the latest security updates is critical. -
Password Managers Share a Hidden Weakness
New research highlights how certain implementation and configuration issues could expose credentials despite the use of password managers, reinforcing the need for MFA and strong endpoint protection. -
Apple Patches Decade-Old iOS Zero-Day Exploited in the Wild
Apple has fixed a long-standing vulnerability reportedly used by commercial spyware. Users should update devices to the latest iOS version to remain protected. -
New Chrome Zero-Day (CVE-2026-2441) Under Active Attack
Google has released an emergency patch for a Chrome zero-day vulnerability being actively exploited. Immediate browser updates are recommended across all endpoints. -
State-Backed Hackers Using Gemini AI for Reconnaissance
Threat actors are leveraging AI tools to support reconnaissance and attack preparation, highlighting the growing role of AI in the cyber threat landscape. -
Fortinet Patches Critical SQL Injection Enabling Unauthenticated Code Execution
A critical Fortinet vulnerability could allow remote attackers to execute code without authentication. Organisations should prioritise patching affected systems. -
Fake AI Assistants in Chrome Web Store Steal Passwords and Spy on Emails
Malicious browser extensions posing as AI tools are being used to harvest credentials and access sensitive data. Review and restrict extension usage where possible. -
Microsoft Under Pressure to Strengthen Defences Against BYOVD Attacks
Bring-Your-Own-Vulnerable-Driver techniques continue to be used to disable security controls, reinforcing the need for device control, EDR, and application control policies.
Agentic AI and the Future of Smart Buildings
How do you design workplaces that are intelligent, sustainable, and built for hybrid work? In our latest Smarter Building Podcast, Cisco’s Bob Cicero shares practical insights on using AI, data, and converged infrastructure to transform the built environment.
How Bluebeam + GoCanvas Are Revolutionising Field Data Capture
In construction, the gap between the construction site and the office has always been a challenge. But by combining Bluebeam’s powerful PDF markup tools with GoCanvas’s mobile forms, companies can finally achieve seamless documentation that flows effortlessly from site to office.
Which Bluebeam Studio Is Right for You? Cloud vs On-premise
Collaboration is the backbone of modern construction projects. Whether you’re reviewing drawings, marking up RFIs, or coordinating across multiple stakeholders, having the right platform makes all the difference. This blog reviews Bluebeam Studio (cloud-based) and Bluebeam Studio On-premise. While both enable teams to work together on PDFs in real time, the choice between them depends on your project requirements, IT policies, and security needs.
21 Tips and Tricks for Bluebeam Revu Every User Should Know
Bluebeam Revu is packed with powerful features that can dramatically improve efficiency in document review, markup, and collaboration. Whether you’re new to Revu or looking to sharpen your skills, these tips and tricks will help you unlock its full potential.
+44345 370 1500 · info@symetri.co.uk