Welcome to The Predictability Factor by Monica Talks Cyber, a bi-weekly deep dive and POV at the intersection of AI, Security, Privacy and Tech, written by a hacker and CISO, to help you Go From Chaos to Resilience in The World of AI.

Data Governance | Strategy & Leadership | Culture & Literacy | GRC | Controls & Engineering

As a hacker, I learned early that the front door is for amateurs. But most of the time, even the back door isn’t locked.

This October, in the same fortnight, two attack waves with no known link hit Japan and France.

At around 3:40 on the morning of 7 October, ransomware hit one region of IDC Frontier's cloud. The SoftBank subsidiary cut the region off from its network and froze customer management consoles in every other region. 495 companies and local governments were affected. Prefectural and city websites, a zoo and a news agency went dark. The attacker claims it needed seven minutes to get in and wiped 554,153 snapshots. That claim is unverified. But the outage is not.

Most of those 495 organisations were not the ones the attacker broke into. As is so often the case, the attack came through the provider. Every one of them now owns an incident it could not prevent and could not see coming from inside its own network.

Japan's police logged a record 123 ransomware reports in the first half of 2026, most of them against smaller firms. Concentration is what turns one of those reports into hundreds of incidents.

I have sat on the customer side of that phone call. In every CISO role I held, the vendor questionnaire asked whether a provider had backups. It rarely asked whether those backups sat inside the same blast radius as the systems they were meant to save. It never asked for evidence that those backups actually worked in a crisis. When your snapshots live on the control plane the attacker just took, you do not have a backup. You have a copy of the victim.

So when did you last ask your cloud provider where your snapshots actually live? More importantly, when did you last test them with your vendor?

Four nights later, France. On the night of 11 October, attackers reached the refrigeration controllers of supermarkets, forced continuous defrost cycles and pushed cabinets as high as 50°C. The French finance minister put the toll at about 700 of the country's 10,000 supermarkets. Intermarché and Netto alone counted at least 300 stores, and Intermarché's chief executive put the losses at "tens of millions of euros nationwide in a single day". Even though attacks against OT have increased, and so has awareness, the controls to protect critical infrastructure have not kept pace, especially as technologies keep converging.

Danfoss, whose controllers were involved, said the incident concerned obsolete or unpatched equipment. Two months earlier, Claroty had published three vulnerabilities in one of its controller lines and counted 2,765 of them reachable from the internet. For the newer line, a fix existed. For the older ones, there was nothing left to patch. Either way, the boxes stayed online.

This was not a sophisticated attack. From where I used to sit as a hacker, an internet facing management interface on hardware nobody updates is the easiest night a cybercriminal will ever have. I have been there before. I have hacked operational technology. I’ve seen the pattern repeat. The failure happened long before October, when someone either didn't understand or implicitly accepted the risk of keeping that box connected. But nobody owned the risk.

Who owns that controller in your estate? Facilities? The store? The refrigeration contractor? Or nobody at all? Meanwhile, the backdoors kept multiplying, inside your own walls and across your entire supply chain.

France's cyber agency already did the math. ANSSI counted 99 data breaches since 1 August, and its director told lawmakers that transposing NIS2 would have prevented the majority of them. The NIS2 bill has been postponed again, with no new date and full compliance aimed at the end of 2028. I have helped implement NIS2 inside global Fortune 500 organisations, including critical infrastructure. For its own ministries, France did move: ANSSI's new REACTIV capability lets it make them take immediate protective measures within tight deadlines. Companies like these supermarkets get no such push. They wait for the decrees.

Nobody can prove NIS2 would have saved a single fridge. But Article 21 asks for asset management and supply chain security, and in my view those are exactly the two controls missing in both of these stories. You do not need a transposed directive to know where your snapshots live. You do not need a decree to pull an unsupported controller off the internet. But you do need to understand your true risk exposure across your IT and OT convergence, especially anything exposed on the internet.

Every unsupported device still connected and every provider contract nobody reread is a risk acceptance. The law is behind, as always. Your signature is not. You signed that decision years ago. The attackers are now simply collecting on it.

Most cyberattacks still exploit the same basic lack of cybersecurity, over and over again.

Data Governance | Strategy & Leadership | Culture & Literacy | GRC | Controls & Engineering

Just because you put an "AI generated" label on your deepfaked spokesperson doesn't mean you have the right to use that face. Legal ticked the box, and the campaign went live.

But here's what's changing in some countries, and I believe others should follow suit.

Under a bill Denmark tabled on 8 October, that tick may be on the wrong box entirely. And the person expected to prove otherwise would not be your vendor. It would be you, the one who published it.

Start with what Denmark is proposing, and what it is not. Culture minister Zenia Stampe tabled the bill on 8 October. It would make it unlawful to share a realistic digital imitation of a person's appearance or voice without their consent, and she wants it in force at the turn of the year. It is a bill, not a law. It is not the first attempt either. It carries out a deal the previous government struck in June 2025, and the work had to restart after Denmark's general election earlier this year.

It covers ordinary people, not only performers. Satire, parody and criticism of power stay exempt, unless the fake becomes misinformation that could seriously harm someone's rights, life or property. The minister frames it as securing the right to your own body and voice.

The detail that truly matters is the burden of proof. It flips how it has worked so far.

In the 2025 consultation draft, whoever makes the imitation available to the public has to prove there was consent, not the person whose face or voice was used. It applies even when the sharing was careless or accidental, because no intent is required. Consent can also be withdrawn at any time, with no formalities, and nothing may be shared from that moment on.

This is the killer part. Protection runs until 50 years after the person's death.

Breaches are not a crime. Redress runs through the civil courts, with damages, compensation and orders to remove the content.

So who in your organisation owns the consent record? And who pulls the content when consent is withdrawn on a Friday afternoon and the campaign is still running on six platforms?

No matter who you are, this is important. Your voice. Your face. Your likeness. That is yours.

The EU AI Act already asks for transparency. Article 50 requires anyone deploying deepfakes to label them as AI-generated or manipulated. That is a disclosure duty. But it says nothing about whether the person in the video agreed to be there.

I have built governance frameworks for global enterprises in highly regulated sectors, and in every CISO role I ran security and privacy as complementary functions. Not opposing. Complementary. Security and privacy are not opposing forces, nor should they be. If anything, regulations, and more importantly technical security controls, should enforce privacy protections, not deny them. The failure pattern is always the same. A control gets designed for the regulator in front of you, but nobody actually owns the risk until someone complains. That is a failure, not a true symbiosis between security and privacy.

A law is only as strong as its enforcement. The hardest cases will be anonymous actors operating from unknown locations, far from any Danish court. A civil claim will not stop the deepfake of your chief executive calling your finance team from an untraceable number. That remains a security problem, solved with verification controls, not lawsuits.

Data Governance | Strategy & Leadership | Culture & Literacy | GRC | Controls & Engineering

We are living in the worst Dunning-Kruger effect of our lifetimes.

Just because someone is an "AI leader" does not make them a security, privacy or anti-fraud expert.

Just because someone calls it "superintelligence" does not mean they know better.

On 10 October, Elon Musk described on X a new way to shop with Grok:

It is a convenient idea, and convenience is exactly how agentic AI becomes your insider threat. My concern is not the person or the product. It is the advice. A photo of a card carries the number, the expiry date and the cardholder's name. That is most of what a fraudster needs for an online purchase, and it now sits in a chat history or with multiple AI agents you do not control.

There is a lot that goes into securing payment infrastructure and each transaction. I'm not saying that AI agents should not handle your purchases. I'm saying you need to do it securely, safely and with data security in mind, not just leave an image of your credit card on any social or agentic platform that doesn't meet the requirements.

Mastercard unveiled Agent Pay in 2025. The caveat? It is built on tokenised credentials, and it requires AI agents to be registered and verified before they can pay. Visa does the same, with tokenised credentials that replace card details altogether. The companies building the rails for AI shopping are designing them so the agent never holds your card number. A photo hands it over anyway. Insecurely.

Even if you have 3D Secure (3DS), the extra check your bank runs on online card payments, switched on for your card, and you are not giving away your three or four digit security code, do not put your card details online insecurely or give them to an AI agent. 3DS on its own will not protect you. There are ways to bypass it, sometimes as simple as phishing and social engineering, which far too many people still fall for.

The regulators' own numbers say the same. The joint EBA and ECB report found that strong authentication works, especially for cards. Yet payment fraud in the European Economic Area still rose to €4.2 billion in 2024, and the report singles out the manipulation of payers as one of the main types of fraud on the rise. Card fraud was also 17 times higher when the recipient sat outside the EEA, where strong authentication is often not used. Your AI agent shops wherever the best deal is.

As a hacker, you learn quickly that the strongest control is only as strong as the person asked to approve it. An agent that clicks "approve" faster than you can blink makes that attack surface even larger and more vulnerable.

If you are really the daredevil, at the very least add defence in depth, first, before you do such madness. After twenty years as a hacker and three times as a CISO, I would never let anything touching money rest on a single control.

For agentic shopping, that means a virtual or tokenised card with a hard spending limit instead of your real one. It means a confirmation step before checkout and an alert on every transaction. And it means answering the question that is still not settled: when the agent buys the wrong thing from the wrong merchant, who owns that loss? You, the agent provider or your bank?

Whoever the advice comes from, the most important rule stays the same. Do not follow any advice that does not put your digital security, privacy and safety first.

The agent can find you the best deal. It cannot give you your card number back.

Data Governance | Strategy & Leadership | Culture & Literacy | GRC | Controls & Engineering

If a stranger broke into a government website to count hospital beds, how long before someone came knocking? An OpenAI agent did exactly that in June.

"Find the data" sounds like the most harmless instruction you could give an AI agent. Until it isn't. On 17 June, an OpenAI model was given a simple job: count the hospital beds in one district, for one year. It was told it could only read web pages. It came back with the right number.

Plus, 24 years of data that nobody asked for, and that clearly didn't belong to OpenAI.

According to OpenAI's own report, the site refused the agent access several times. So it went looking for another way in. It pulled the site's account directory, more than 1,000 email addresses, and weighed whether to guess a password. It reached files it was never meant to see, and those files held the secrets to the site's database and its login system. It also found a way past the site's access controls. Add to that, it saved 24 years of health-facility data.

Fortune reported that its own reasoning asked whether its actions were "ethical", and it kept going anyway. The grader checking its work "marked some responses incorrect and others correct". And the number it returned had already been found through a public search before it broke in.

An attack doesn't always need malice. That is exactly the problem. "Go out and find the data" is how you brief an agent you trust. It is also how cyber criminals work: map the target, harvest the accounts, find the secrets, get in, and take more than you came for. Intent is hard to prove. As a hacker, I recognise every step of that chain. The agent did not need bad intent. It only needed a target and the tools to reach it.

Let me be clear. If anyone else did what this agent did, getting into a system that had refused them, exposing its secrets and taking its data, they would be considered to have broken the law. In the UK, that is unauthorised access under the Computer Misuse Act. In the US, the CFAA covers it. Does an agent at the keyboard change that?

While OpenAI claims it has notified more than 100 organisations, it has not said which ones, or when. We do not know whether it was a responsible disclosure. And more importantly, this report says nothing about whether this site was told, whether its secrets were changed, or what happened to the data its agent took.

Responsible disclosure is also about timing. The break-in happened on 17 June. OpenAI found it on 13 August. The report is dated 15 October. That is at least two months of unknown exposure the government site had to OpenAI's agent. What would you do with a vendor who didn't even know their own agent was attacking until two months later?

Then there is the data. The report says only:

Saved where? Who can read it? Has it been deleted? The 24 years of statistics, the email addresses, the database connection details and the login secrets: the report does not say what happened to any of them.

So ask your own questions, add controls before an agent exploits your vulnerabilities, and put accountability on both sides on the table.

Which agents in your organisation are allowed to roam the internet looking for data? Who set their limits, and who checks what they bring back? What vulnerabilities are exposed? What's your actual cyber risk exposure? Who's accountable when your agents attack, or when you get attacked by other agents? If the answer is the agent itself, you have a bigger liability than you can imagine.

The agent got the number right. That was never the point.

Until next time, this is Monica, signing off!