Things That Go Bump in Cybersecurity

This Halloween and beyond, hobgoblins and goons, at least the metaphoric ones, are out there, stirring up a witch’s brew of cyberattacks, disruption and fraud. Some threats such as ransomware are like Michael Myers—you think it’s dead but it keeps rising up, perhaps in a different, more devastating form. As the scariest night of the year arrives, Tech Channels asked defenders what spooks them most. Not surprisingly, the ghost in the machine, just might be an AI agent.

If you want to see something really scary, keep reading:

A Confluence Distraction, Speed, Phishing

What keeps me up at night isn’t a single exploit. It’s three things converging, and the first is the one that haunts me the most: distraction. Every week brings a new headline about AI-driven attacks, and some of it is pushing companies into panic, even to the point of considering pulling services off the internet. That fear travels from the Board to the ELT to me, and then to my team. Sometimes it’s faster to address a concern than to debate it, but each detour pulls us away from the real work of revisiting our foundational security program for the AI era. The scariest outcome is a team so busy reacting to the hype that it neglects the fundamentals.

Second, the speed of agent adoption worries me heading into the holidays. Connected agents are being introduced faster than policies and processes can keep up, which means controls are often missed or applied after the fact. And this isn’t just about the company I advise. It’s every business I rely on when I order or transact online.

Finally, it gets personal: my family. Phishing is now easy to personalize using information found online, and the instincts I built 25 years ago no longer apply. The people I love most are often the least aware of how sophisticated these attacks have become. - Randolph Barr, CISO, Cequence Security

The Rise of Non-Human Identities

What scares me most in cybersecurity today is not ransomware, zero-day vulnerabilities, or even AI itself. It is the growing number of non-human identities (NHIs) and autonomous AI agents operating inside organizations with privileges that nobody fully understands, monitors, or controls. These digital ghosts can access sensitive information, execute transactions, modify configurations, and interact with critical systems, often without meaningful human oversight. Unlike traditional insider threats, these identities do not sleep, take vacations, or necessarily stop when their original purpose disappears. They can become the ultimate invisible insider threat, especially when compromised by a threat actor.

The real nightmare begins when an organization cannot distinguish between a legitimate AI agent performing an authorized task and a compromised identity operating with excessive privileges. Imagine a haunted house where every door is unlocked, every ghost has a master key, and nobody knows how many ghosts are inside. That is the emerging reality of unmanaged machine identities and agentic AI. As we approach Halloween, my biggest concern is that organizations are creating digital monsters faster than they can establish the guardrails to control them. The scariest threat is not the ghost in the machine. It is discovering that we gave the ghost privileged access and forgot how to revoke it. -- Morey Haber, Chief Security Advisor, BeyondTrust

The Attacker Is Already Inside the House

The scariest cybersecurity threat isn't always an attacker trying to break down the door. Sometimes, they're already inside, using stolen credentials and looking exactly like a trusted employee.

Stolen passwords and session tokens can give attackers access without triggering the alarms designed to catch unauthorized logins. But just because an identity is legitimate doesn't mean the activity is.

Here are four warning signs that something sinister may be happening behind a valid login:

• The employee who suddenly knows too much: An account starts accessing sensitive files or departments it has never interacted with before.
• The midnight data grab: An account that normally opens individual records suddenly downloads thousands of files or exports entire databases.
• The disappearing files: Sensitive information is compressed, renamed, or converted before being transferred elsewhere.
• The unexpected destination: Company data starts moving into personal email accounts, unfamiliar cloud storage services, or unapproved AI tools.

The key is connecting these clues. One unusual download might be harmless, but a pattern of unfamiliar access, bulk exports, and suspicious destinations can reveal an intruder hiding behind a trusted identity.

The lesson this Halloween: Don't just watch who's coming through the front door. Watch what happens once they're inside. - Oreen Livni Shein, Software Engineer and Security Researcher, ORION Security

This One Goes Out to the Ones We Trust

Some of the most dangerous cyber threats don't come from obviously malicious websites or unfamiliar attackers. They exploit the people, tools, and infrastructure organizations already trust. And that makes them particularly difficult to spot.

This Halloween, three threats deserve a closer look:

• The monster hiding in your AI tools: Shadow AI can be scarier than an attacker lurking in the shadows. Employees using unauthorized AI tools may unknowingly expose confidential information, customer records, or intellectual property. The threat isn't necessarily malicious intent; it's sensitive data leaving the organization through tools security teams don't know are being used. DNS visibility can help uncover that hidden activity.
• The familiar website that's actually a trap: Through DNS hijacking, attackers can compromise a domain's registrar account or DNS server and change where its records point. The website address looks perfectly legitimate, but visitors can be redirected to an attacker-controlled destination. It's the digital equivalent of knocking on a familiar door and discovering someone else is living inside.
• The trusted guide leading you into danger: DNS cache poisoning allows attackers to plant false records in a legitimate DNS resolver's cache. Users can type the correct website address and still end up somewhere malicious because the trusted system directing their traffic has been compromised.

The common thread is misplaced trust. A familiar domain, an approved network service, or an employee using an AI tool can all appear harmless while creating opportunities for data exposure or compromise.

The real nightmare isn't always what security teams can't see. It's what they see every day but assume is safe. - Yaëlle Harel, Principal Security Market Strategist, EfficientIP

The Well-Appointed Nation-State

Nation-states with the right infrastructure, experienced talent, and ongoing AI literacy are positioned to use AI as a force multiplier, enabling these organizations to greatly increase the amount of malicious software generated and deployed with minimal to no increase in their workforce. This means that attacks will be coming at a much greater pace, providing less time to react and correct before the next wave of attacks occur. Now, that’s scary. - Andy Boyd, CEO, RedLattice

Ghouls and goblins have nothing on cybercriminals and rogue AI agents. But there is hope as security teams innovate to banish ghosts from the machine. To borrow from Michael Jackson, “as darkness falls across the land, the midnight hour is close at hand” and perhaps, “no mere mortal can resist the evil of the Thriller,” but cyber warriors stand ready to defend.