Kategorie

Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges. [...]

Gartner predicts that security operations centers will have 50% more engineers than analysts by 2028 as AI agents take over routine alert handling. Prophet Security examines how AI is reshaping SOC roles, from analyst responsibilities and detection engineering to threat hunting and exposure management. [...]

A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. [...]

European law enforcement authorities arrested seven suspects and seized more than 100 servers in a joint action targeting an unnamed company suspected of providing fraudulent trading websites to criminal gangs. [...]

Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws. [...]

Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Your team is remediating more vulnerabilities than ever, yet your breach risk has barely changed. You’re spending too much time and effort on exposures attackers may never exploit, while higher-risk exposures sit, waiting in the queue. Gartner®’s report on exposure prioritization states that fewer than 10% of vulnerabilities are exploited, yet most are treated as urgent. The report also argues [email protected]

A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. [...]

In an industrial network, malicious activity can be hard to tell apart from normal data exchange between devices. Malicious actors routinely rely on legitimate tools and the Living-off-the-Land technique, so a single network connection may show no known signs of an attack: the device uses a familiar protocol and transmits ordinary data. An anomaly can hide in subtle details: the data source, the time of access, or the volume of transferred data may be atypical for a particular device. However, to detect this kind of anomaly, you need to understand the roles of the devices at both ends of the connection and know which network activity patterns are typical for them.

But an organization’s asset inventory data is often incomplete, which makes it harder to catch unauthorized connections in time. Suppose monitoring detects a host that regularly exchanges data with programmable logic controllers (PLCs). Its IP address is known, but the inventory does not specify what role it plays: is it an engineering workstation, a process data server, or a piece of contractor’s equipment? The host may also have been on the industrial network for a long time, with its record going out of date after a network upgrade.

In the joint OT asset inventory guidance released by CISA and its partners in 2025, inventorying devices and classifying them by role are treated as part of OT asset management. For organizations, this is one of the most important areas: according to the SANS 2025 ICS security survey, 50% of respondents had deployed or significantly expanded ICS inventory and visibility tools over the previous 12 months, and 54% named them as investment priorities for the next 12–24 months.

Device inventory in Kaspersky Industrial CyberSecurity for Networks

In Kaspersky Industrial CyberSecurity for Networks, the Asset Discovery technology is the foundation of asset visibility. Passive network traffic analysis detects devices and their interactions, while recognition rules help determine the device category and extract available information about it, such as the vendor, model, or software version. Exactly which attributes the system can obtain depends on the protocol and the traffic it observes. We covered this in more detail at the Kaspersky Industrial Cybersecurity Conference.

Hardware and software information in the device card

The product also supports active polling modules (APMs): where polling is allowed, they can request additional configuration and firmware version details from devices. This kind of inventory is far more detailed than a list of IP addresses.

Installed modules and their placement in a PLC rack

However, even accurate hardware information doesn’t always explain what function a host performs in a specific industrial facility. Gaps appear for various reasons. Some devices send identifying information only at startup or during configuration, while others rarely communicate. Proprietary protocols can’t always be parsed, and encryption may leave only connection metadata for analysis. If the monitoring system doesn’t receive traffic from every segment of the industrial network, some network activity goes unobserved. Active polling doesn’t suit every device or every operating condition.

Devices of unknown category

When there isn’t enough direct information about a device, its category can be refined by looking at the patterns of its recurring network interactions. Analyzing these interactions is the job of Machine Learning Event Processor (MLEP), a service included in Kaspersky Industrial CyberSecurity for Networks 5.0. This machine-learning-based event processor can both refine device categories and detect anomalies in their network behavior.

What data does MLEP analyze?

To compare device behavior, you don’t need to store every packet as a separate observation (a data object) in the ML model. MLEP represents network sessions as a sequence of short 15-second fragments. For each fragment, MLEP stores information about the endpoints (IP, MAC, and port), the direction of data exchange, the protocol, and the number and size of the packets transmitted. Together these make up an event, which then gets a timestamp. Traffic thus becomes a sequence of events showing which hosts a device communicated with, when, and how communication intensity changed.

Aggregating data into events also sets the method’s limits. An aggregated fragment can’t be used to reconstruct the exact order of individual packets or the content of commands. MLEP can draw conclusions about a new protocol only if another KICS technology has managed to recognize it. That said, comparing stable network connections and changes in exchange volume doesn’t require a detailed record of every packet. These observations form the basis of the device’s behavioral history.

From observations to MLEP results

Each object has its own behavioral history, and one object’s history can’t be applied to another. But the principles of behavior analysis, along with some common rules, work across different objects.

Let’s look at how this works in MLEP, which is built on a spiking neural semantic network (NSN).

Event identification

Neurosemantic networks structure information as a multilayer ordered graph, where the data in each consecutive layer builds on the data in the previous one. The nodes of this graph — that is, the units of information in each layer — act as neurons.The NSN creates dedicated channels to handle different event parameters (port, IP, and so on). Unique parameter values for each channel are stored as neurons in layer 0. The event itself, which consists of a set of parameter values, is stored as a neuron in layer 1 of the network. If an event occurs for the first time, neurogenesis creates a new neuron with input connections to the corresponding parameter neurons. This lets the network learn and operate on the event stream at the same time. If the event has occurred before, the network activates the same neuron that was created when the event first appeared. This way, the network identifies each event precisely. Each neuron that corresponds to an event also collects basic statistics: when it was last activated and how many times it has been activated.
 

Event history

In NSN-based event processing, layer 2 and above store sequences of events over time: recurring patterns and the full history. However, categorization and statistical anomaly detection don’t require storing the full packet sequence or a detailed timeline of every network event. As we noted earlier, events are themselves aggregates, which means the order of network packets has already been averaged out. So MLEP keeps history only temporarily, within each episode (30,000 aggregated events by default), which saves computing resources.

Statistics processing in MLEP

MLEP processes statistics mainly through specialized listener neurons on layer −1 (minus one) of the network. Attention heads and monitors are built on these neurons.

Key components of the NSN

When an event arrives, the corresponding neuron is activated, and the network instantly knows whether that neuron is new or was created earlier. Each attention head subscribes to the events or event features it needs and takes in only the activations of the matching neurons. If an event occurs for the first time, all heads are notified and then decide whether to subscribe (grow a connection to the relevant neuron) and receive information about activations of such neurons from then on.

It is called a spiking network because activation information is a spike, not a number. This spike tells the head that something it’s interested in has happened.

An attention head is configured according to scenarios — the situations that MLEP should send alerts about. The core of a head’s configuration is a query, which filters incoming information and serves as the subscription criterion. Unlike regular database queries, this query runs on the stream, so it can react to an event instantly.

Attention heads work very much like the semantics of ordinary human language. A query has a subject of attention (one or more grammatical subjects) and conditions (the other parts of the sentence). In the infrastructure of an industrial enterprise, the subjects are devices on the network, and the conditions are various aspects of network communication, such as ports, protocol, and average packet size. If a head has many subjects (for example, if it’s interested in every device on an industrial network), it fans out: it creates a child head for each individual value of the subject of attention, that is, each device. The child head then watches a specific device and reports to the parent head.

Attention heads don’t accumulate or process statistics. They only filter event streams. When an attention head receives a relevant event, it activates and sends a spike to the monitor subscribed to that head.

Monitors, in turn, have stacks for accumulating and processing events. They can also have their own queries and post-filter information from the head. For example, they can select only new events from those filtered by the head.

There are several types of monitors:

• Stat monitors track changes in the average count of specific events (for example, device activity) over time intervals typical for those events, or in the average values of numeric event parameters (for example, changes in device traffic volume).
• Monitors work from the event alone: they fire when an event has occurred a certain number of times within a given interval, or has occurred for the first time.
• Similar-behavior monitors work with heads that can generalize events, that is, extract just a few parameters whose combination is shared (generalized) across many events.

MLEP uses these monitor types to implement scenarios for categorizing devices and detecting their anomalous behavior:

1. For categorization, MLEP uses attention heads and monitors that identify common behavior across different assets and group devices accordingly. MLEP then takes information from Asset Discovery about the known categories of some assets and extends those categories to other assets in the same group. Because a device can show different types of activity, it may land in several groups. MLEP then makes a weighted assessment across all relevant groups.

   Groups of devices with similar network behavior

   At the final stage, the system verifies that assigning the category to the asset is permissible. This is again done by special rule monitors loaded into the NSN at system startup. The rules rely on asset metadata available from Asset Discovery and APMs.

2. MLEP takes a similar approach to anomaly detection: an attention head and a monitor define an anomaly scenario, often loosely. When a monitor activates on such a scenario, MLEP generates an alert about unusual behavior.

The current version of MLEP ships with preconfigured heads and monitors.

The functional dynamic diagram below shows how events from devices on an industrial network are processed.

Event processing flow (click to play)

MLEP in practice: how behavior helps complete the asset inventory

At a facility with several similar production lines, device information may be more complete on some lines than on others. On one line, devices are identified as PLCs, while on another, after an upgrade, some hosts show up only as addresses: the available traffic didn’t provide enough information to determine their category. Still, these devices communicate with the same types of HMIs and process data collection servers. Their communication directions, frequency, and volumes may be similar.

That’s where MLEP comes in. It takes the categories of already known assets and matches recurring features of their network behavior against those of uncategorized devices. When the observed interactions turn out to be similar, MLEP can add a category for that host to the inventory.

Device category suggested by MLEP

Once the category is refined, the industrial network map provides more context about the equipment on the network. When analyzing network activity, the analyst immediately sees the device’s suggested category and can skip looking up each IP address in the design diagrams. This approach is especially useful where equipment changes faster than the documentation is updated.

The suggested category is also checked against existing device information and defined constraints. This helps filter out some contradictory options, but prediction quality still depends on how much of the traffic is visible, especially if the device communicates only rarely.

Anomalous activity and streaming statistics

Investigations of real-world attacks show that attackers actively use both standard tools and permitted protocols. You don’t always need to know an attacker’s specific technique in advance to spot potentially malicious activity. Signature-based detection helps find known signs of an attack, but it doesn’t assess how typical an observed interaction is for a particular device. MLEP compares current activity with the device’s usual network profile: which hosts it communicates with, which protocols it uses, when and how much data it transmits, its average packet size, and so on. The changes it detects help guide the direction of the investigation. Correlating these changes with other events and the operational context helps determine whether malicious actions could be behind them. When investigating an incident that has already been detected, anomalies help reconstruct the sequence of actions.

The first version of MLEP comes with six preconfigured monitors, one for each type of deviation from the device’s usual network profile:

Anomaly How it helps with event analysis New external host Flags a new external connection that wasn’t previously seen in the device’s observed behavior, even if the IP address isn’t listed among known IoCs. Helps check whether this connection appeared at the same time as other suspicious events. New combination of destination address and port Shows that the device has begun using a service it hasn’t used before. Once an incident has been detected, this helps trace new connections after the more critical events have been analyzed. Unusually large volume of data sent Highlights data transfers that are atypical for the device and helps correlate their timing and direction with other events. Atypical activity time Shows that the device was active at a time that’s unusual for it. In an already detected incident, this helps reconstruct the timeline of actions around the main alert. New protocol Helps spot a new method of communication, even when the device is communicating with familiar hosts. Activity with signs of scanning Shows that the device has started contacting an unusually large number of neighboring hosts. This signal helps reveal possible reconnaissance ahead of attempts to access equipment.

During an investigation, anomalies help reconstruct the sequence of changes: when a specific host established new connections, switched protocols, increased its data transfer volume, or shifted its operating hours. Matching events by device and time shows an analyst how activity unfolded around an incident that has already been detected.

This is especially useful when some of the attacker’s actions fell outside the monitored scope or didn’t trigger other KICS technologies. Correlating these changes with the device’s role, protocol analysis data, and events from other technologies gives the analyst a more complete timeline. Behavioral anomalies show exactly where to look for the missing links and which network interactions need attention.

Atypical Activity Time anomaly card

In the event list, anomalies detected by MLEP are marked with an AI label. Each event shows its name, source, destination, timestamp, and the ID of the triggered scenario.

Conclusion

In an industrial network, whether behavior is anomalous depends on the host where it occurs and that host’s place in the industrial process. The repetitive nature of many communications makes a change in normal data exchange easier to spot, while knowing a device’s function and criticality helps gauge the possible consequences. Taken together, these observations make network traffic more than a list of connections: it helps assess new events in the context of a specific facility, even without an attack scenario known in advance. Machine learning technologies are well suited to this kind of comprehensive analysis, as they can process and organize huge streams of heterogeneous data. Starting with version 5.0, Kaspersky Industrial CyberSecurity for Networks handles this function with MLEP, which works effectively alongside the product’s existing functionality.

“Zoom Got It Done” is the tagline for the company’s new Zoom Ahead campaign, with the focus being how Zoom’s AI-first capabilities take conversations to completion. This one features Kate McKinnon and builds on their “I Use Zoom!” spot with Bowen Yang that kicked off this consumer-friendly campaign late last year.

For the record, I’m not a fan of their comedic approach here, but the ads hold your attention, and it’s great seeing SNL favorites playing over-the-top corporate tropes. Am just not so sure the messaging gets it done.

Wearing my Marketing hat, I’ll note that B2C marketing campaigns from tech companies are really hard to do well, especially when the audience is not the economic buyer. The Zoom ads are aimed at workers – end users – while the buyers – IT and CEOs – are caricatured as the worker’s worst nightmare.

This is a topic I’d love to explore further, but I need to stay on script and tie their Got It Done tagline to the main topic, namely my review of the recent Zoomtopia event. While the event is mainly for customers and partners, I was part of the small cohort of analysts who attended as well.

Since Zoomtopia caters primarily to those economic buyers, it wasn’t surprising that the Got It Done message was the opening theme for the event, capped by a local choir that went full gospel to celebrate the uplifting power of AI to get work done and relieve us of so many tedious tasks that undermine our productivity. Am not sure if everyday workers get that euphoria when using Zoom, but that’s the aspiration – nothing wrong with that, amen.

Choir singing the praises of ‘Got It Done’

Jon Arnold

More importantly, I think Zoom is trying to communicate how AI is transforming their platform into something bigger than video calls and meetings. On that count, I think Zoomtopia succeeded, perhaps in ways that most people don’t realize. In that context (pun intended), I’ve distilled my takeaways into three big ideas.

1. Unified Context Layer

This was the big story at the event, so let’s start there.

I’m never the first analyst to post about industry events, but I’m going with flow here, as this was the lede most of my peers went with for their write-ups. What I haven’t seen so far, though, is connecting the dots to the last time most of our group was at a Zoom event. That would be Perspectives, their analyst-only event, and back in April we got the deep dive on their go-to-market vision, “from conversation to completion”.

The overall reception was positive, and it marked a new chapter in Zoom’s evolution to align more closely with AI’s transformative potential and get beyond being a meetings platform. Building on the premise that all interactions start with some form of conversation, AI does all the hard work of taking those conversational inputs, identifying next-best actions and closing with intelligent task completion.

At Zoomtopia 2026, the big story was Unified Context Layer, which takes that vision one step further. The missing piece was context, where AI is now better able to understand intent, sentiment, urgency, etc., and connect all that to memory across the entire lifecycle of an interaction. Humans simply cannot do this at scale and in real time, so this is where the AI story becomes next level.

On a more basic level, this is no longer about human-to-human communication, the foundation upon which all UCaaS platforms are built. Communication remains the cornerstone for how work gets done, but now it’s just as much about P2P as it is about P2A, A2P, A2A and B2B. Translation – people need to communicate among themselves, but increasingly it’s also agent-to-agent, bot-to-bot and everything in between. Getting context right is more challenging when AI agents are involved, and that point will tie into my second big theme.

Zoom’s new Unified Context Layer

Zoom

To make all this work, the vision needs to be broader, so now it’s “conversation to context to completion”, and that’s what the Unified Context Layer brings to the Zoom platform. You can read more about it here, and I’ll just add some key points to show why the context piece is so important.

• This new layer takes conversations to completion “by linking conversation history with relevant documents and data”. Nothing really new here – other vendors are doing similar things in an effort to become the central hub through which all workflows go. What is new is how these capabilities are framed to support both actual workers – humans – and AI agents. Not only are these agents doing work and completing tasks on behalf of human workers, but as they become more “agentic”, they’ll be doing these things independently. Definitely not something the founding fathers of UCaaS had in mind.
• To become an enterprise-wide “system of action”, this new layer works across all of Zoom as well as third-party applications. This is necessary for agents to pull context from everywhere and every interaction – humans cannot do this on their own, and when all the integrations are in place, data no longer stays in siloes. Their update notes that with MCP connectors and APIs, Zoom can search across over 40 third-party applications, such as ServiceNow, Workday and MSFT OneDrive. Drawing from such a wide range of sources, workers and the workplace become more productive, and makes Zoom Got It Done more than a marketing slogan.
• It’s worth noting how Zoom identifies two forms of data to understand context at a deeper level – dynamic and static. Dynamic would be human-based, real-time interactions in the workplace – calls, chats, meetings, etc. Since all of these are in digital form now, AI can process them as conversational intelligence inputs to drive task completion. Static data represents what’s on record and documented – also in digital form, so it can easily be mined by AI. Together, this presents a more complete picture for automating workflows.
• The emphasis on AI is hard to overstate, as agentic search capabilities serve to get more complete information – and context – to surface answers faster, so tasks can be completed in less time. For example, one of the new features, My Notes, turns meetings into workflows automatically – something that human workers would have spent a lot of time doing manually. Not only that, but Zoom now has prebuilt templates for specific functions, namely sales, marketing and IT. These workflows can now be created directly in My Notes, without human effort to do this with a workflow builder.
• Another sign of where this is going is the distinction between general and specialized AI agents. Why stop at each worker having one AI agent? Never mind the workers – ZoomMate’s AI Agent Teams now can have a general AI agent manage teams of specialized AI agents, further accelerating the time to task completion. Each agent can be assigned a specific task, so you can now have subagents working in parallel to support the overall task. Humans may think they can multitask effectively – it’s a myth – but this approach is next level. AI magic aside, it’s important to note that all of this task automation is subject to human review, so it’s too early to think about using this to replace human workers. Sidebar – this is exactly what Kate McKinnon was getting so worked up about in the ad – let’s just call it misplaced Zoom Rage, where Zoom gets it done in ways her workers simply cannot do.

Zoom Ahead campaign featuring actress and comedian Kate McKinnon.

Zoom

2. AI update – aka, the Anthropic effect

I may be going out on a limb here, but Anthropic was barely mentioned at Zoomtopia, and it seems to me this is driving a lot of Zoom’s evolution, perhaps more than we realize.

If you don’t know, Zoom took a small stake in the company in 2025, and has since added to its position. Financially, it’s been a huge windfall for Zoom, but that’s really beside the point. Zoom and all the other cloud players in their orbit cannot afford to not be close to all the AI players in Anthropic’s orbit – that’s just how Big Tech works.

For Zoom in particular, this is about helping transform the company into an AI-first platform, and what better way to do that than by leveraging their small stake with one of the top three players creating the AI economy? In that context – there’s that word again – their “system of action” vision makes more sense. Yes, human workers will use these tools to take conversations to completion, but longer term, this system will be about AI taking the action.

I’ll call this the “Anthropic Effect” because Claude is now deeply embedded in everything Zoom touches – collaboration and meetings with UCaaS, customer interactions with CCaaS and more recently, ZRA for sales automation – Zoom Revenue Accelerator. All of these data flows cross Zoom’s platform, and this is where AI agents need to be to tap into the data that takes conversations to completion.

Memories can be short, but AI Companion was a cornerstone for how workers engaged with the Zoom platform. Yes, all platforms evolve, and AI Companion was quietly retired, replaced – augmented, really – by ZoomMate. AI Companion hasn’t really gone away; it’s just been subsumed by something bigger and more agentic. Perhaps to make room for Claude, or at least get hooks into what their system of action is trying to do.

On a technology level, this is perfectly reasonable. Zoom has actually been at the forefront of innovation in our space, and they have succeeded at just about everything they’ve taken on internally. However, I think it’s fair to say that even Zoom cannot replicate what Anthropic, OpenAI, Meta, et al have been doing with AI.

Depending on how you look at things, I think the business rationale for riding with Anthropic is even stronger. Consider the chart below, from App Economy Insights. They publish a newsletter that breaks down how tech companies make money, and Anthropic’s revenues are up 45-fold over the last six quarters.

Of greater interest, as their newsletter reports, Anthropic has almost 12,000 enterprise customers spending $100k+ annually – exactly the kind of customers Zoom covets. To whatever extent these customers rely on Claude, this sure dovetails nicely with Zoom’s value proposition. Going from conversation to context to completion at scale requires a lot of AI horsepower, and the more tightly Claude integrates with ZoomMate, the more successful both companies will be.

Of course, Claude could fall out of favor, and all of this will be moot, and every other cloud platform player is partnering with Anthropic, so nothing is for sure. That aside, though, this looks like a good way for Zoom to build a moat they can defend, especially as AI gains trust and is used to automate more workflows and tasks. That makes for a good growth story to become an AI-first system of action that truly takes them out of the UCaaS milieu that is going sideways at best.

Anthropic’s revenue growth

App Economy Insights

3. New management controls for AI

Finally, I wanted to note this focus, as it says a lot about how Zoom wants to be positioned, and how they want to be perceived by enterprise IT leaders.

This is a core piece of the story in terms of Zoom becoming an AI-first platform and truly evolving beyond video calls, meetings and UCaaS. Their new management controls are coming soon, but this signals where and how Zoom intends to play.

With Anthropic now in their DNA, these are the capabilities Zoom will need to become a centralized system of action for enterprises. Not siloed for workplace productivity or in the contact center, but to be the hub for all communications flows.

Again, this is no longer a UCaaS story – one could argue that Teams holds court there, along with other leading UCaaS players – and Zoom is looking beyond this and wants to be positioned on a higher, more strategic plane.

In this – yes, context – the Zoomtopia updates were about the things that IT really cares about when managing these do-it-all platforms. This is about enterprise-wide policy and governance, not updating permissions to edit transcripts, configuring new endpoints for meeting rooms or updating CRM integrations.

These are the bigger picture controls that IT needs to be comfortable and confident that Zoom can really be this system of action for the entire organization. To illustrate, here are three examples for how Zoom intends to earn their trust.

• AI guardrails. Allows IT to customize account-level rules for what AI agents can use or generate. These rules can be highly specific for a team, job function, line of business, etc., but always subject to human review (HITL) to keep AI in check.
• Deepfake risk detection. Not a new idea, but as agentic AI proliferates, and as personal AI agents start clogging your digital channels, the threats become very real. When synthetic data is paired with bad actors, deepfakes can find their way into workflows and customer interactions, making this an enterprise-wide challenge to address, and not just limited to the contact center.
• Compliance Manager. With AI-driven outputs turning up everywhere, there’s a need for centralized visibility to remain compliant. Different platforms track communications in different ways, and when it comes to archiving, data retention, search, retrieval, etc., Zoom will soon be adding more compliance tools to support IT at an organizational level.

Conclusion

Zoom executive Q&A with analysts

Jon Arnold

During the executive Q&A with analysts, Eric Yuan was asked where Zoom would like to be in the future, and I think his three-word response sums up everything I’ve been trying say here. He envisions Zoom as a “work operating system”. Not a UCaaS platform, not a meetings app, but something bigger, and more of a hub that enterprises can organize workflows around.

Conversations to context to completion is the path for getting there, but this puts them up against hyperscalers who are all-in with AI, and not terribly interested in the communications layer that got Zoom this far in relatively little time.

Is Zoom ready for this? Will their customers be ready to view Zoom this way? With much of this data residing with third-party apps, who will ultimately control all the data needed to be a work operating system? What role will the hyperscalers and AI majors play? How will their working relationship with Anthropic evolve to support this vision?

These are just a few leading questions to consider following Zoomtopia. Prediction markets aside, I’m more inclined to bet on Zoom than against Zoom, as their track record for making moves has been pretty good.

The management team has both vision and confidence – they know what they have, where they’ve been and where they need to be going – and I’ll try to answer those what’s-next questions as things progress. As with everything AI, they will progress, and Zoom just might get it done; in which case Kate McKinnon’s Zoom Rage will turn up to 11. Can’t wait to see that!

This article is published as part of the Foundry Expert Contributor Network.

BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions. "Our investigation found that these attacks targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or earlier," BTCPay Server Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. "These attacks aim to encrypt data and extort ransom," it said in a statement Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish maker of refrigeration controls,&nbspSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

Flaws in two open-source AI platforms could let code reach files outside the space meant to contain it.

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

It’s early days for AI-assisted work, and sentiments are mixed about its benefits: Does AI actually bring value and save employees time, or does it bog them down and add unnecessary activities?

Data from ActivTrak seems to vacillate between those two potential realities: The latest research from the productivity tracking software company says employees who use AI most heavily are working up to 90 minutes longer each day, yet its previous research, published earlier this year, found that they are actually working less.

The discrepancy may be due in part to the timespan and sample sizes of the data collection for the two reports, but it indicates that enterprises should still be wary of vendor claims about AI-related productivity gains. Measuring them remains incredibly difficult.

AI use compared

ActivTrak’s current findings are based on behavioral work data gathered from 9,140 knowledge workers across 467 enterprises over a five month period (April 1 to September 25, 2026). This sample is much smaller than that of its previous report based on 443 million hours of work performed by 163,638 employees across 1,111 organizations over a three year period (January 1, 2023 through December 31, 2025).

According to the latest findings, heavy AI users are working between 8.42 and 9.08 hours per day, compared to 7.58 hours for those not using AI. This contradicts ActivTrak’s previous finding that average workdays had decreased by roughly 9 minutes (a 2% decline) thanks to AI.

On the productivity front, heavy AI users have 22% shorter focus sessions than light users (37.8 minutes versus 48.2), suggesting their work is more fragmented due to AI use; further, they switch apps 15% more frequently.

“Over time, those interruptions add friction to high-value work that requires concentration, critical thinking, and sustained attention,” Sarah Altemus, manager of the ActivTrak Productivity Lab, said in a blog post describing the latest findings.

ActivTrak’s previous report had found that over the period of the earlier study, focus efficiency, the percentage of work time spent in focused, uninterrupted activity, fell to a three year low of 60% with AI use, and average focused session time in 2025 declined by 9% from 2023. However, that same report found that daily productive time increased by 19 minutes, or 5%, to 6 hours and 36 minutes, with AI in the workplace. Furthermore, productive sessions grew by 13%.

The company’s latest report also tracked the productivity differences between users of tools with embedded AI and users of web-based AI tools. Those using embedded AI switched apps 0.6 times an hour, while those using AI on the web switched between 1.7 and 4.2 times per hour. That’s up to 4x more switching than by employees who don’t make use of AI at all, which creates what ActivTrak describes as a “swivel-chair tax” — the additional effort spent by employees due to the movement between apps.

Similarly, in its previous report, ActivTrak had found that this multitasking rose 12%, or 10-plus minutes, with AI.

Interestingly, according to the latest research, light users spend more active work time in core job-specific apps (81.4% compared to 78%).  “In other words, more frequent AI engagement doesn’t necessarily translate into more focused work,” Altemus pointed out.

The larger issue is the way organizations manage the additional capacity that AI may create, Altemus noted. “When employees complete tasks faster, managers may assume they have room for more responsibilities,” she said. Without clear workload boundaries, time savings may be redirected into additional work that can be taxing.

The numbers often don’t tell the full story

ActivTrak has a useful view of how work moves across applications, noted Sanchit Vir Gogia, chief analyst at Greyhound Research, but he also pointed out that it sells the capability that produces these measurements.

Recorded use depends on what the instrumentation can detect, he observed. For example, an employee can use AI at work and still appear in the non-user group, and work on an unmanaged personal device sits outside the measured estate. In addition, an API or a background agent can finish work without producing a desktop session, and passive screen time, an offline meeting captured through a calendar, and paid hours are also different measures. Furthermore, switching apps is easier to observe than switching attention within an application.

Ultimately, he noted, those judging the value of AI need to establish what happened after the first task became faster. “An improvement per paid hour can conceal effort left off the timesheet,” said Gogia. “The [enterprise] board should be able to say whose day improved and whose work made that improvement possible.”

This article originally appeared on CIO.com.

To set an environment variable in a Bash session on Linux, enter an export command such as export EDITOR=vim.

David Goguen’s free chmod calculator shows what Linux permission numbers mean before you copy a command.