buildOne report1 publisher ShinyHunters-linked crews take Okta with a phone call and a rogue MFA device, Health-ISAC warns
Health-ISAC warned members in September 2026 that ShinyHunters-linked crews extort healthcare without encrypting files, in one case taking over 1TB. A dev.to write-up of the warning points to new factor enrollments and bulk exports as the signals to watch.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
Workday's chief executive says the company is still learning how to price AI agents
Workday CEO Aneel Bhusri said the company is "still learning" how to price AI agents. On liability for agent errors, his reported answer opens with a human-in-the-loop principle. That is what buyers have to go on this quarter.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives55
- Confidence55
UK ministers commit frontier AI to hunting flaws in government systems
UK AI minister Kanishka Narayan said on October 12 that government will use frontier AI to find flaws in its systems, after hackathons found over 400 flaws. The fix-time fall from 50 days to eight is credited to a central monitoring service.
Reality
- Evidence35
- Adoption25
- Hype gap+30
- Incentives55
- Confidence55
Sublime Security says calendar phishing is growing exponentially as apps like Google Calendar add invites automatically, even from emails sent to spam. That moves the defence from the mail filter to calendar settings and to what staff do with an unexpected meeting.
Reality
- Evidence52
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence62
Security pros rate their firms secure even where MFA stays optional, Yubico and Okta find
Yubico and Okta's survey of 1,890 tech and security professionals found 23% work where multifactor login is not required on every application. With 88% still rating their company secure, at least one respondent in nine gave both answers.
Reality
- Evidence45
- Adoption55
- Hype gap+15
- Incentives75
- Confidence50
Yubico and Okta found 43% of 2,000 security professionals log in to work with passwords, while 25% use the hardware passkeys they rate most secure. The people surveyed already know which logins are weak, so closing the gap is deployment work for their employers.
Reality
- Evidence55
- Adoption25
- Hype gap+10
- Incentives70
- Confidence60
Island traced fake ChatGPT, Gemini, Claude and Perplexity ad tools to a phishing operation whose Telegram channel took hundreds of victim submissions. Its targets are agency buyers and admins, whose one login can spend several advertisers' balances.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence60
Okta's earnings multiple gained 32 turns while cRPO growth gained two points
Okta's forward earnings multiple went from about 18x to about 50x in five months while its full-year EPS guide rose about 2%. That ties the price as much to investors' view of AI security stocks as to Okta's own forward bookings.
Reality
- Evidence55
- Adoption40
- Hype gap+35
- Incentives
- Not scored
- Confidence50
buildConfirmed2 publishers AWS's CloudWatch Omni, generally available since September 23, lets Okta and Entra ID users investigate incidents without AWS console access. CloudWatch dashboard sharing has let outsiders view prebuilt graphs since 2020, so what Omni adds is the investigation itself, one of the reasons teams paid for third-party platforms.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence55
Remote-worker fraud spreads beyond North Korea to Pakistan, India and Russia, Okta says
Okta's Katie Nickels says fake remote IT workers now operate from Pakistan, India and Russia as well as North Korea, mixing AI with human techniques. That moves the first security check on a new employee into the hiring process.
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap+35
- Incentives
- Not scored
- Confidence40
buildOne report1 publisher MCP's September 28 release lets any server behind a load balancer answer any request
Agentic AI Foundation's September 28 MCP release finalizes stateless servers and bars removing deprecated features before July 2027. Teams moving servers off sessions now have a dated floor to plan migrations against.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+30
- Incentives55
- Confidence30
Blueprint Alliance coalition aims to build agentic AI security standards around four key questions, lists six identity principles as governance guidance
Okta has gathered a dozen-odd technology companies into the Blueprint Alliance to write open security and interoperability standards for AI agents. The standards are still unwritten, and the six principles published so far are identity-management rules, the category Okta sells.
Reality
- Evidence45
- Adoption10
- Hype gap+25
- Incentives75
- Confidence40
Australian Signals Directorate tells AI customers to guard their own keys and sessions
Australia's Signals Directorate says attackers are using stolen AI API keys, tokens and hijacked sessions to get into organisations' AI services. Its guidance tells customers to protect those credentials themselves. In one reported case, a stolen key ran up about US$600,000 in model credits over three weeks.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence50
Stolen AI session cookies survive a password reset, SOCRadar's exposure report says
SOCRadar tied 5,434 infostealer records for AI tools to 1,500 corporate email addresses at 482 large enterprises. The report says those AI accounts belong under the same sign-on and session controls as a company's identity provider and code repositories.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+35
- Incentives85
- Confidence40
Stolen ChatGPT sessions turn up at 358 of 482 companies in SOCRadar's stealer-log study
SOCRadar found captured ChatGPT sessions at 358 of the 482 companies whose AI accounts turned up in 90 days of infostealer logs. The firm ties the spread to shadow AI, with employees opening work-email accounts that IT never sees.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence45
Okta and 11 vendors including AWS, Google Cloud and CrowdStrike signed six shared principles for securing AI agents under a new Blueprint Alliance. Buyers can put the list to vendors in procurement now, while Okta's release describes a reference architecture with no stated way to test compliance.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+35
- Incentives70
- Confidence55
Collaboration-tool alerts quadrupled in a year. The inspection budget still sits with email.
Unit 42 reports endpoint alerts tied to collaboration tools more than quadrupled in 12 months, with 99% linked to chat phishing. Most controls still watch email and logins, not authenticated sessions.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+20
- Incentives80
- Confidence50
A ReliaQuest employee gave up a password and an MFA push five days after the company named the .claims campaign. Device trust, not training, kept the session worthless.
Perspective Coverage
5 publishers
- Builder
- Builder 29%
- Operator
- Operator 56%
- Investor
- Investor 15%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+25
- Incentives70
- Confidence62
More than 100 companies signed a call for collective action on cyber defence whose first principle is that status quo security will not be enough, a sentence co-signed by five of the vendors who supply that status quo.
Perspective Coverage
5 publishers
- Builder
- Builder 33%
- Operator
- Operator 42%
- Investor
- Investor 25%
Reality
- Evidence70
- Adoption20
- Hype gap+35
- Incentives80
- Confidence65
Huskeys closed $27m five months after leaving stealth, with Blackstone leading what Globes calls the firm's first early-stage cybersecurity round. The cheque is worth about 0.002% of its assets.
Perspective Coverage
3 publishers
- Builder
- Builder 25%
- Operator
- Operator 25%
- Investor
- Investor 50%
Reality
- Evidence55
- Adoption25
- Hype gap+35
- Incentives75
- Confidence60