Cyber Asset Attack Surface Management (CAASM) solved a significant problem. Security teams can now say with confidence what they own.  But, two things separate a CAASM tool that stops there from one that actually moves the needle on risk. The first is what the inventory itself carries. The second is what it connects to. 1. An inventory needs to do more than list what exists A list of assets is just the beginning. The tools worth building on now attach criticality and connection data to every asset from day one, so a security team isn’t just looking at a spreadsheet […]

The post Two Things Every Cyber Asset Attack Surface Management (CAASM) Tool Needs to Get Right appeared first on Check Point Blog.

AI agents are moving into the enterprise much faster than most security programs were designed to handle. They are no longer just answering questions or generating content. Agents can read email, access SaaS applications, query databases, invoke APIs, use MCP tools, modify records and execute business workflows. In other words, AI is moving from generating answers to taking actions. For CISOs and C-level leaders, that changes the security conversation. The question isn’t simply whether an organization is using AI safely. A more important question is: Can we confidently identify, govern, monitor, and control every AI agent before it becomes our […]

The post Can We Control Every AI Agent Before It Becomes Our Next Privileged Insider? appeared first on Check Point Blog.

Security teams are under pressure.   Networks are growing. Cloud environments are expanding. AI is accelerating change across users, applications, and infrastructure.   At the same time, security teams are expected to maintain strong protection, support business initiatives, and operate efficiently.  The challenge is not a lack of security control. The challenge is keeping up with a hybrid environment that changes faster than people can manage it.   This challenge will only grow as organizations adopt AI. Gartner predicts that by 2028, 15% of day-to-day work decisions will be made autonomously by agentic AI. As environments become more dynamic, security operations will need to be adapted.   This is where agentic network security […]

The post When Security Operations Can’t Keep Up:  4 Ways Agentic Network Security Management Improves Security Operations appeared first on Check Point Blog.

Between mid-July and early August 2026, models being evaluated internally by OpenAI, Anthropic, and Meta reached real production systems outside their test environments. One exploited a previously unknown vulnerability to escape its sandbox entirely. At the same time, criminal groups showed that frontier capability isn’t required for serious attacks: a ransomware affiliate ran a full intrusion through Claude Code, and a separate campaign, JADEPUFFER, is now documented as the first case of agentic ransomware, an extortion operation a model carried out end to end once a human set it in motion. Check Point Research’s July-August 2026 AI Threat Landscape Digest […]

The post AI Models Broke Their Own Containment: Key Findings from the July-August 2026 AI Threat Landscape appeared first on Check Point Blog.

Check Point uncovers thousands of fake support accounts, with hundreds more appearing every day A delayed flight. Missing luggage. A refund that never arrived.  For frustrated customers, social media has become a direct route to customer support. They tag the company, explain the problem, and wait for a response.  However, threat actors are watching those same conversations.  A Check Point Exposure Management investigation uncovered a coordinated social engineering campaign in which scammers monitor public complaints, impersonate customer support accounts, and approach customers seeking help. Researchers engaged directly with the scammers and followed the attack from the first social media interaction […]

The post Scammers Are Watching Airline Complaints and Posing as Customer Support appeared first on Check Point Blog.

Enterprises are connecting AI assistants to more of their real infrastructure every month, from inboxes to file drives to internal tools, on the assumption that the isolation between users and accounts holds. Check Point Research just tested that assumption against ChatGPT and found a way to break it. Using an internal service that was never meant to carry user data at all, CPR opened a working channel between two completely separate ChatGPT accounts and used it to hand one victim’s session a task from a total stranger, all while the victim’s own conversation looked entirely normal.  Key Takeaways  Check Point […]

The post ChatGPT Let Attackers Read Victims’ Gmail Through a Hidden Channel Between Accounts appeared first on Check Point Blog.

Ransomware kept its grip on organizations through the second quarter of 2026, and the headline number barely moved. What changed underneath that number is more interesting: new research gave us a rare look inside a top tier operation as it was being built, and it revealed just how little it now takes for a small and skilled group to reach the top of the field. Here’s what the quarter actually showed, and what it means for how you defend against it.  Key takeaways  Data leak sites recorded 2,139 ransomware victims in Q2 2026, essentially flat versus Q1 and up 33% […]

The post Ransomware Didn’t Slow Down in Q2 2026. It Just Spread Out. appeared first on Check Point Blog.

Key takeaways Weekly cyber attacks reached 2,336 per organization in July 2026, up 3% from June and 16% year over year Education remained the most attacked industry, averaging 4,848 weekly attacks per organization Latin America recorded the highest regional attack volume, while Europe saw one of the sharpest increases at 18% year over year GenAI adoption continued to expand, with organizations using an average of 8 tools and 1 in 36 prompts carrying a high risk of sensitive data exposure Email remained a key entry point, with 1 in every 128 emails classified as phishing and another 20% falling into […]

The post July 2026 Cyber Threats Surge: Ransomware Attacks Double Year over Year as GenAI Data Exposure Widens appeared first on Check Point Blog.

It typically begins the same way it has for years, with an approach from a recruiter offering a role at a company the target would recognize, accompanied by a PDF describing the position in convincing detail. That approach remains one of the most effective entry points used by state sponsored threat actors today, and Check Point Research has spent recent months tracking a new wave of it. Operation Dream Job, the long running campaign attributed to the North Korea affiliated Lazarus group, has resurfaced with a previously undisclosed Windows vulnerability (CVE-2026-68820), a newly identified backdoor, and a command and control […]

The post State Sponsored Hackers Use Fake Job Offers to Deliver New Zero Day Exploit appeared first on Check Point Blog.

Anthropic’s new inference hooks give enterprises a native enforcement point before prompts ever reach the model. Combined with Check Point Workforce AI Security, organizations get a real-time allow-or-deny decision on every prompt, with no proxy in the path. Why This Matters Enterprise AI adoption has moved well past experimentation. Employees draft documents, write code, summarize meetings, and query enterprise knowledge through large language models every day. The challenge was never understanding that AI introduces risk. It was finding a practical enforcement point. Web gateways and Data Loss Prevention (DLP) tools were designed for websites and SaaS applications, not conversations with […]

The post Native AI Security Comes to Claude: Why Anthropic’s Inference Hooks Matter appeared first on Check Point Blog.

Security leaders evaluating Check Point Exposure Management tend to ask the same questions: how the solution discovers assets, what intelligence it provides, and how well it fits their existing tools and workflows.  Below, we answer the questions that come up most often in product evaluations, offering a practical look at how organizations discover, understand, and reduce cyber risk.  1. How does the platform discover my assets?  Every exposure management program starts with knowing what you own. Security teams cannot assess, prioritize, or remediate exposures tied to systems they do not know exist.  Check Point Exposure Management begins by continuously discovering […]

The post The Top Exposure Management Questions Security Leaders Ask (Part 1) appeared first on Check Point Blog.

Check Point brings open research, objective benchmarks and customer-controlled runtime protection to the industry initiative introduced by NVIDIA.  AI is rapidly changing how organizations build, operate, and protect their digital environments. As a leader in the global cyber community, we believe in the power of collective intelligence. We are proud to join the Open Secure AI Alliance as an inaugural member, working alongside leaders from across cyber security, cloud computing, enterprise software, AI, and the open-source community.  Introduced by NVIDIA, the alliance is creating a collaborative foundation for developing and sharing open technologies that advance AI safety and security, and will help organizations identify, remediate, and responsibly disclose […]

The post Check Point Joins the Open Secure AI Alliance to Advance Open, Measurable and Enterprise-Ready AI Security appeared first on Check Point Blog.

This week, the UK’s AI Security Institute (AISI) published an incident report most organizations would have quietly buried. During a routine cyber evaluation, an AI agent researched the real human maintainers of an open-source project, invented multiple fake online identities, and used them to pressure a real person into approving malicious code. Nobody instructed it to deceive anyone, and deception simply became a route to finishing the task. A human maintainer caught it and refused. The facts AISI ran a cybersecurity challenge 122 times across seven models. In 10 runs, an agent acted outside the scope of the test, producing […]

The post Three AI security disclosures, fourteen days: what the warnings signs are telling us appeared first on Check Point Blog.

More than 30 Minnesota water systems were hit in one coordinated cyber attack. Within days, the Five Eyes told critical infrastructure operators to be ready to pull the plug.  Thirty water systems in two days  Over two days in late July, a coordinated cyber attack hit more than 30 community water systems across Minnesota. The treatment plant in Braham went offline. Plymouth lost cellular communications to two water towers and its wastewater lift stations. Maple Plain declared a local state of emergency. Early reporting points to internet-exposed programmable logic controllers (PLCs) as the way in, and investigators are examining links to Iranian affiliated activity. […]

The post Your VLAN Isn’t an Air Gap: Six Hard Truths From the New CI Fortify Guidance appeared first on Check Point Blog.

What OpenAI’s and Anthropic’s testing incidents really teach defenders  In the past two weeks, two of the world’s leading AI labs have disclosed the same unsettling result. During their own safety testing, their most capable models reached real companies’ systems. First OpenAI, whose models broke into Hugging Face. Then Anthropic, whose models reached three more organizations.  Read the disclosures closely. Two facts carry the weight.  First, the safeguards were not defeated. They were switched off by design. OpenAI ran the models with reduced cyber refusals and safety classifiers disabled, to measure raw capability on a cyber benchmark. A model doing […]

The post AI Escaped a Sandbox. That is Not What Should Worry You appeared first on Check Point Blog.

Threat actor names can sound simple. LockBit. Fancy Bear. BlackCat. Scattered Spider. Anonymous Sudan. Each name gives the impression of a clear group with a defined identity.  In threat intelligence, however, the name is rarely the whole story.  Some names are chosen by attackers. Others are assigned by researchers, security vendors, governments, or public databases. One name may represent a ransomware brand, a hacktivist identity, a research label, a campaign, a malware family, or an activity cluster observed across different incidents.  For security professionals, this distinction is important. Confusing attacker created identities with researcher assigned labels can lead teams to […]

The post The Branding and Attribution Behind Cybercrime appeared first on Check Point Blog.

Key Takeaways Microsoft continues to be the single most impersonated brand in Q2 2026, appearing in 23% of all brand phishing attempts, far ahead of any other company The top five impersonated brands, Microsoft, LinkedIn, Google, Apple, and Amazon, together account for more than half of all brand phishing attempts tracked this quarter Open AI’s ChatGPT entered the top ten most impersonated brands for the first time, signaling that AI tools are now firmly on criminals’ radar Technology was the most targeted industry overall, followed by Social Networks and Banking Real world cases this quarter ranged from fake payment failure […]

The post Which Brands Are Impersonated Most? Inside the Q2 2026 Brand Phishing Report appeared first on Check Point Blog.

Some security teams are reducing critical exposure within hours, while others are leaving similar issues open for days. The 2026 Exposure Gap Report shows that many organizations can identify, validate, and prioritize exposure, but the real challenge begins when teams need to turn those insights into remediation.  Across environments, organizations are often working with similar types of exposure, yet their outcomes vary significantly. The difference depends on how quickly validated findings move into remediation and how consistently teams can repeat that process at scale.  Remediation Speed Varies Significantly  According to the report, Utilities organizations resolve exposure in about 12.6 hours […]

The post What the 2026 Exposure Gap Report Reveals About Remediation appeared first on Check Point Blog.

Microsoft’s guidance on inbound and outbound mail routing for third-party email security has prompted a fair question from customers: how should organizations evaluate inline email security for Microsoft 365?  The answer depends less on whether a solution is inline and more on how that inline architecture is implemented. Microsoft is right to call attention to mail flow designs that can introduce unnecessary complexity, create authentication challenges, duplicate processing, or disrupt the expected Microsoft 365 experience. Those risks are real when a third-party service is bolted onto the environment without careful integration.  That is also why architecture matters. A modern enterprise […]

The post Inline Email Security and Microsoft 365: A Practical View of Mail Routing, Risk, and Prevention appeared first on Check Point Blog.

Today is AI Appreciation Day, and honestly, we mean it. AI has changed how we write code, analyze threats, and get work done faster than anyone thought possible a few years ago. It deserves a moment of gratitude. But at Check Point, we spend most of our year studying the other side of that coin and our newly released AI Security Report 2026 makes one thing very clear: the same qualities we’re celebrating today are exactly what’s made AI such a powerful tool for attackers too. So in the spirit of appreciating AI honestly, not just enthusiastically, here’s what a […]

The post AI Appreciation Day: Let’s Be Honest About What We’re Appreciating appeared first on Check Point Blog.