WHAT IF YOUR SIEM WAS ALREADY OBSOLETE ? IT'S TIME TO WORRY !

In partnership with

🤖 Dear internet users and fellow Cyberdefenders,

Incident Report N°1347-OMEGA 

Location : Network Sector 3, Zeta Enterprise, 06:42. 

Status : Contamination confirmed. Ransomware active. Backups compromised.

The user clicked. Again.

That morning, everything seemed normal. The SIEM sensors were emitting their usual alert beeps – ignored, as they often were.

The SOC team was asleep on their feet, bogged down in 3,000 false positives.

The awareness training? An e-learning module hastily checked off between two meetings.

As for the security manager… he believed his cyber insurance policy would be enough to absorb the impact.

Fatal error.

The enemy is faster. More furtive. And you are already behind.

In this new world, threats no longer creep. They charge.

These are no longer attacks orchestrated over several weeks. They are lightning strikes.

In minutes, your SIEM is submerged. Your SOAR scripts fall flat.

And the vulnerability, a very real one, had been there since 2023… in sudo. Actively exploited.

Inside your servers.

You thought you could count on global cooperation? Bad news: in the United States, the CISA 2015 law has just expired.

The result: cyber intelligence is collapsing. Every man for himself. Meanwhile, malicious AIs are advancing.

And your defense model? It dates from before deep learning.

🎖️ But all is not lost.

A new generation of defensive weapons is on the march. Smarter, faster, more resilient: XDR + MDR.

The war of logs is over. It's time for an adaptive, automated defense, supported by 24/7 human analysts.

No configuration to maintain, no rules to rewrite every week. Just operational efficiency.

In this special edition, we take you to five fronts:
💥 Why your insurance is no longer enough.
💥 How your employees sabotage your efforts, without meaning to.
💥 What the silently exploited sudo flaw is hiding.
💥 The domino effect of the end of a key US law.
💥 And why XDR/MDR is more than an evolution: it's a matter of survival.

"Want to know more? Click. Download. Read. Train." "The cyber war has begun. And it will not wait for you."

Highlights :

👉 Cyber Insurance: What 90% of Companies Get Wrong Without Knowing 🔐

👉 Cybersecurity at the Office: Your Colleagues (Really) Aren't Following the Training 😴

👉 ALERT: A Critical Flaw in sudo Puts Thousands of Servers at Risk ⚠️

👉 Expired US Law: Cyber Info Sharing Between Companies in Danger ⚖️

👉 SIEM Outdated? Discover Why XDR + MDR are Taking Over from 2025 💡

If this letter was forwarded to you, subscribe by clicking this link 

🗞️​ Guess what ?

The Gold standard for AI news

AI keeps coming up at work, but you still don't get it?

That's exactly why 1M+ professionals working at Google, Meta, and OpenAI read Superhuman AI daily.

Here's what you get:

• Daily AI news that matters for your career - Filtered from 1000s of sources so you know what affects your industry.

• Step-by-step tutorials you can use immediately - Real prompts and workflows that solve actual business problems.

• New AI tools tested and reviewed - We try everything to deliver tools that drive real results.

• All in just 3 minutes a day

Join 1M+ pros

🤓​ Would you like to know more?

1️⃣​ Cyber Insurance: What 90% of Companies Get Wrong Without Knowing

Summary : As cyber incidents explode, more and more companies are turning to insurance to limit the damage. But be warned : insurers are selective and demand concrete measures (MFA, backups, training). Three pillars structure the policies: immediate assistance, compensation for business interruption, and legal coverage. The European NIS2 directive also imposes obligations. In 2024, 4% of insured incidents generated losses exceeding one million euros. Human error, ill-prepared SMEs, and a lack of awareness: the real challenge remains the cyber maturity of organizations.

Details :

• Real, quantified, and massive losses: Data from the insurer Van Breda shows that even SMEs can suffer losses exceeding one million euros. Only 72% of cases remain below €20,000. The cost of an incident can quickly skyrocket without adequate coverage.

• Coverage built on three strategic pillars: Immediate technical assistance, coverage for internal losses, and third-party claims: good insurance policies act as a financial firewall but require a minimum level of security.

• Increasingly strict underwriting criteria: MFA, a robust backup policy, endpoint security, vulnerability management, and training: these are the 5 key levers evaluated before accepting a client.

• Human error, the universal Achilles' heel: 90% of incidents are due to clicking errors, misconfigurations, or uncontrolled behaviors. Regular training is no longer an option.

• The NIS2 effect and regulatory pressure: Europe now imposes security standards. Insurance companies are aligning with this new reality, which requires proof and audits.

What should be remembered ?

Cyber insurance is not just about signing a contract. It is now a mirror of a company's level of cyber maturity. Leaders must see their coverage as an extension of their defense posture – or as an alarm revealing their invisible flaws.

 —————————————————————————

2️⃣ Cybersecurity at the Office : Your Colleagues (Really) Aren't Following the Training

Summary : Despite the efforts of many companies, cybersecurity training remains poorly followed. 45% of employees ignore it or complete it out of obligation, without real engagement. Lack of time, disinterest, or even forgetfulness explain this passivity. This means risky practices persist, such as password reuse or the absence of MFA. The level of awareness also varies with company size. Only large organizations have an identified point of contact. Riot, the source of the study, is sounding the alarm and advocating for a more integrated and engaging approach to training.

Details :

• Theoretical coverage… but not practical: 68% of companies offer training. But only one in two employees actually engages with it. Above all, this creates a false sense of security.

• Three excuses, one common negligence: Lack of time (64%), lack of interest (26%), and forgetfulness (13%): the reasons given mask an underestimation of the risk.

• Widespread risky practices: 48% reuse professional passwords, 70% do not activate MFA, and only 25% use a password manager.

• Inequalities based on company size: 60% of employees in large companies know who to contact in case of an incident… compared to only 18% in very small enterprises (VSEs).

• Riot wants to change the game: With a clear ambition: to protect 10 million employees by 2027 through enhanced education, adapted to real-world conditions.

What should be remembered?

Cyber training cannot remain a simple e-learning module that gets hastily checked off. It is an essential brick in any defense strategy. Without human engagement, no technology can hold up.

 ——————————————————————

3️⃣​ ALERT : A Critical Flaw in Sudo Puts Thousands of Servers at Risk

Summary : The Cybersecurity Information Sharing Act (CISA 2015) was not renewed by the US Congress. It provided legal protection for companies sharing threat data via the AIS (Automated Indicator Sharing) platform. Without it, they risk lawsuits in the event of a leak. The result: an immediate drop in the sharing of Indicators of Compromise (IOCs) and a strategic retreat by large organizations. The impact is particularly strong for AI applied to security, which needs this data for training. A sharp setback for collaborative intelligence that weakens the entire defense chain.

Details:

• Root access via Sudo… without authorization: The exploit uses a root directory controlled by the attacker with a malicious nsswitch.conf file. The result: execution of commands as root.

• A flaw actively exploited, according to CISA: The US agency has included CVE-2025-32463 in its KEV list. It requires federal agencies to apply patches before October 20th.

• A flaw introduced in 2023, patched in June 2025: It remained exploitable for nearly 2 years, making it one of the most serious recent vulnerabilities in the Unix environment.

• PoCs available since July: Even if no massive attacks have been documented yet, the public availability of exploits makes inaction dangerous.

• Other vulnerabilities under close watch: CISA has also issued alerts for flaws in Cisco IOS, Adminer, Fortra GoAnywhere, and Libraesva Email Gateway – all actively exploited.

What should be remembered ?

Sudo is everywhere in Linux systems. A flaw at this level is not just another alert ; it is a structural security failure. The patch is available. Inaction, however, will be inexcusable.

  ————————————————————-

4️⃣​ Expired US Law : Cyber Info Sharing Between Companies in Danger

Summary : The Cybersecurity Information Sharing Act (CISA 2015) was not renewed by the US Congress. It provided legal protection for companies sharing threat data via the AIS (Automated Indicator Sharing) platform. Without it, they risk lawsuits in the event of a leak. The result: an immediate drop in the sharing of Indicators of Compromise (IOCs) and a strategic retreat by large organizations. The impact is particularly strong for AI applied to security, which needs this data for training. A sharp setback for collaborative intelligence that weakens the entire defense chain.

Details:

• A strategic legal vacuum: Companies now fear being sued if shared data is misused or compromises another entity.

• Key players on alert: ReversingLabs and BreachRx decry a "historic setback." Without this law, the shared threat database is immediately impoverished.

• A threat to AI in cybersecurity: Less data = less effective AI. The impact on automated and predictive detection capabilities is immediate.

• A fertile ground for adversaries: Less shared information means more blind spots. The domino effect can harm the entire digital supply chain.

• France and the EU must learn lessons: Trust in information sharing also relies on robust legal frameworks. Europe must guard against a similar scenario.ical independence from U.S. political decisions and provides the added value of local expertise and support.

What should be remembered?

Modern cybersecurity relies on collaboration. Cutting off information flows is like removing the sensors from an immune system. The private sector can no longer wait for a political signal to cooperate effectively.

5️⃣ SIEM Outdated ? Discover Why XDR + MDR are Taking Over from 2025

Summary : Traditional SIEM/SOAR tools are no longer up to the task of handling current threats. Too complex, costly, and slow to react, they are gradually being replaced by XDR (Extended Detection and Response) solutions coupled with MDR (Managed Detection and Response) services. These new approaches offer a faster response, lighter maintenance, and advanced analytical capabilities. The integration of artificial intelligence and automation allows for the detection of latent threats without an overload of alerts. CISA now recommends these hybrid architectures to respond to the rise of burst attacks, particularly ransomware.

Details:

• Powerful SIEM/SOAR… but too demanding: They require constant maintenance, up-to-date playbooks, and continuous monitoring. The majority of SOCs do not have the bandwidth to keep up.

• XDR: a proactive and intelligent response: Analysis of raw data allows for the detection of suspicious behaviors before they become incidents. The race to create manual rules is over.

• MDR: the 24/7 human element: MDR adds a human layer of analysis and incident response. It is the equivalent of an expert, outsourced SOC.

• An optimized total cost of ownership: XDR/MDR platforms are more cost-effective in the long run than traditional SIEM solutions. Less noise, more results.

• Official recommendation from CISA: The US agency is pushing critical infrastructures toward these models to counter the increasing speed of ransomware.

What should be remembered?

Cybersecurity can no longer be static. Anticipation must take precedence over reaction. XDR + MDR is not a trend; it is the structural response to an enemy that no longer waits.

CYBERTRIVIA - DID YOU KNOW ? 🤔

Zscaler – The champion of Zero Trust in the cloud

Zscaler is an American cloud-native platform founded in 2007, based in San Jose, California, specializing in securing network access in hybrid environments.

With over 6,000 employees and generating more than $2.2 billion in revenue in 2024, it has become a key player in Zero Trust and SASE (Secure Access Service Edge).

Zscaler connects users to applications without going through traditional VPNs or firewalls, while ensuring granular security through its Zero Trust Exchange infrastructure.

Highlight :

In 2025, as traditional VPN infrastructures show their limits in the face of growing mobility and lateral threats, Zscaler has seen a massive adoption of its ZIA (Internet Access) and ZPA (Private Access) services, particularly in the healthcare, telecom, and government sectors.

What sets Zscaler apart is its ability to natively integrate identities (Azure AD, Okta), detection systems (EDR, SIEM), and critical applications (Microsoft 365).

Recently, the company has enriched its offering with AI features for behavioral analysis and SLA capabilities driven by the ZDX platform.

For any company looking to eliminate its traditional VPNs, MPLS, or firewalls, Zscaler represents a strategic building block toward a 100% Zero Trust, fluid, and scalable network architecture.

It is much more than a product: it is a pivot for modern infrastructures.

CYBERTRIVIA - DID YOU KNOW ? 🤔

Count to 39... and imagine an attack

In 2023, a cyberattack was launched somewhere in the world every 39 seconds. This figure, reported by CybelAngel, illustrates a brutal reality: the digital threat is constant, automated, and globalized.

And contrary to the Hollywood image of the lone hacker, the majority of these attacks are driven by bots, scripts, or cybercrime-as-a-service infrastructures. Phishing, ransomware, intrusion, vulnerability exploitation… the spectrum is broad.

It is a reminder that in cyberspace, time is not a luxury: every minute of inaction, of delayed patching, of human negligence is a window of opportunity for the adversary.At a company level, this means that defense must never sleep, because the attack, for its part, never stops.

👉️ Let me know if you need further adjustments !