TL;DR: The last couple of weeks became a 'Black October', as they call it - as there were many hacker attacks, each of which, a year ago, would have been the largest event of the year, but now they have all happened within 2 weeks. So which doors are worth checking this week?
A colleague asked me recently how I see the future for solutions. I gave two answers. The first was people who can turn what a business needs into how a solution gets built, somewhere between product manager, solution consultant and product architect, because building is speeding up so much. That one gets its own edition.
The second was cybersecurity, which is speeding up just as fast, and for the same reason: AI made building software cheap, and it made breaking into it cheap as well.
What does a $50 break-in look like?
From late September, according to Reuters, a hacker gave a team of AI agents a brief of a few lines and set them loose on online shops in the US, Canada, Australia and Japan. The agents appear to have run on Claude Code and DeepSeek, and they didn't get tired: they typically spent the best part of a day on each site they got into.
They tried more than 1,200 sites and got into more than 100. The researcher who spotted the campaign put the cost at about $50 of AI usage per break-in. At that price, attackers don't need to choose their targets, which is why "who'd bother with a company our size?" has stopped being a defence.
And this is just one example - of many lately.
What are attackers after now?
Different attacks happened, with lots of personal data stolen and lots of sites put offline to prevent or reduce vulnerability. Thirty-two UK government services went offline, and four more were partly down. The NHS issued a notice. ASOS customers got an unauthorised push notification, and their names and contact details were accessed.
Beyond personal data and large companies, hacker agents are browsing around to find leaked secrets. AI keys, the passwords that let software use a paid AI account, are now loot in their own right. Some users of OpenCode, an AI coding tool, say they were billed hundreds of dollars after a breach that may have exposed their keys, and Railway, a cloud platform, says its attackers wanted keys to train cheap copies of expensive models.
What should a business do now?
The UK's own Cyber Essentials scheme gives a business 14 days to install a critical update. However, in this case it would be better to do it ASAP. A business that patches on day 14 is still within the rules, but Rapid7 says attackers now start using a serious flaw about three days after it goes public, so by then they'll have been at it for more than a week.
Most of this needs someone with admin rights and an hour.
Outside apps in Microsoft 365. In the Microsoft Entra admin center (the part of Microsoft 365 that controls sign-ins), go to Entra ID, then Enterprise apps, then All applications, and check each app's Permissions. An app you don't recognise, or one with more access than its job needs, is a spare key to the office.
AI keys. Give each AI tool its own key with a spending limit. If one leaks, cancel it first and ask questions after, as you would with a lost company card.
Updates. Anything facing the internet gets critical patches in days, not at the end of the 14-day window.
Passwords and keys. Keep them in a password manager or vault, never in a shared document, a spreadsheet or a chat.
Suppliers. A third party now shows up in almost half of all breaches, Verizon says. Ask each supplier with access to your systems two questions: how would you know if one of these doors was used, and how quickly would you tell us?
To sum up
The doors attackers used this October were mostly old ones. What's changed is that getting through one now costs about as much as a takeaway, so every business gets tried, whatever its size.
Back to my colleague's question: I think my two answers end up in the same place. Almost half the UK job ads asking for cyber skills are already for roles that aren't labelled as security jobs, according to the government's latest report on cyber skills. Whoever turns a business need into a working solution will have to know where its doors are.
So when did you last check who has a key to yours?