In Case You Missed It: Infoblox CISO Says AI Should Be Viewed as an Accelerator While N-able Exec Tackles Resilience and Attackers Are Looking to Exploit Passkeys

Tech-Channels caught up with Infoblox CISO Henrick Smith and N-able Chief Innovation Officer Robert Johnston at Black Hat to talk AI as an accelerator and resilience even as new research from ExtraHop shows that 49% of ransomware victims detect attacks only after data Is already gone.

Infoblox CISO Henrick Smith Discusses AI, Cyber Hygiene, and the Future of Enterprise Security

The rapid adoption of AI is reshaping enterprise security. While organizations are racing to adopt agentic AI and new development methodologies, the biggest challenges are not entirely new. Instead, AI is exposing long-standing weaknesses in cyber hygiene, asset management, and security processes while dramatically accelerating the speed at which organizations must respond. Tech Channels sat down with Infoblox CISO Henrick Smith during Black Hat to examine how AI is changing software development, cost management, security operations, executive decision-making, and even the role of cybersecurity vendors. Smith emphasized that AI should be viewed as an accelerator that augments human expertise rather than replacing it.

N-able's Robert Johnston Business Tackles Resilience, AI, and the Mid-Market Security Challenge

Organizations, particularly in the mid-market, are rethinking resilience as cyber risk accelerates. Business resilience is a combination of proactive protection, real-time detection and response, and recovery, rather than a single security capability.Tech-Channels met up with N-able Chief Innovation Officer and Chief AI Officer Robert Johnston at Black Hat to continue a conversation that began a few short months at RSA about where SMB and mid-market organizations remain underprepared, how regional and community banks are changing their technology posture, and why AI is likely to compress attack timelines dramatically. Johnston argues that AI should ultimately be used to remove low-value work from security teams while enabling faster, more automated defense.

Five Billion Passkeys Are Now in Use. Attackers Are Learning Where the Trust Still Breaks

With five billion passkeys now live globally, we’ve finally stripped attackers of their favorite weapon: the reusable passwords. Passkeys have removed one of the oldest weaknesses in authentication by getting rid of the reusable secret attackers can phish, steal, or stuff into another login page. Yet as that door slams shut, attackers are already doing what they do best: finding whatever the system trusts next. Recent Unit 42 research into Google’s synced passkey ecosystem shows where that attention is moving. The researchers demonstrated three attack paths that begin with malware already running on a Windows machine and then work through the surrounding authentication infrastructure, including device identity, user verification, and recovery. In the most serious scenario, they were able to recover the private keys behind synced passkeys themselves. FIDO Alliance says 75% of consumers now use passkeys on at least some accounts, while 68% of organizations are deploying, piloting or rolling them out.

The Meta Case Exposing a Dangerous Blind Spot in AI Performance Reviews

Earlier in the summer 26 Meta employees alleged that internal AI systems helped score, rank and select workers during layoffs affecting around 8,000 jobs. According to the complaint, employees taking protected leave appeared disproportionately on the termination list because the systems treated reduced digital activity as weaker performance. One plaintiff, a scientist on approved pregnancy leave, reportedly learned about her layoff two days before giving birth. Another employee said time away for an injury contributed to a lower rating. A manager on medical leave was informed that his role would end only 16 days into his absence. Meta disputes the allegations, noting, “These claims lack merit and are not based on facts. Workforce management and organizational decisions were and are made by people, not AI.”

49% of Ransomware Victims Detect Attacks Only After Data Is Already Go

Ransomware is becoming harder to detect at the stage where intervention still matters. ExtraHop’s 2026 Global Threat Landscape Report shows that nearly half of victims (49%) discovered an attack only after data had already been stolen. Meanwhile, attackers remained inside enterprise networks for an average of almost two and a half weeks before detection, long enough to map systems, escalate access, and turn stolen data into leverage. That delay is becoming more dangerous as AI changes the speed of cyber operations. Ransomware groups are applying AI where it pays off most: reconnaissance, phishing, credential abuse and lateral movement. Enterprises are also adding AI to security operations, but too much of the SOC still depends on manual triage, fragmented alerts and incomplete network context. That visibility gap gives attackers room to work.

Ransom Cartel’s Creator Gets 16 Years for Building the Business Behind the Malware

A federal judge in Virginia has sentenced Maksim Silnikau to 16 years in prison for his role in Ransom Cartel. The court records describe something far more organized than the familiar picture of a ransomware operator sitting at a keyboard and breaking into companies one by one. Ransom Cartel worked as a service. Silnikau, 40, created and administered it while affiliates carried out attacks against at least 18 companies between 2021 and 2023, according to the Justice Department.

Silnikau supplied locking tools and bought stolen credentials from initial access brokers, according to The Hacker News. Affiliates used a hidden site to monitor attacks, speak with victims, and divide the proceeds. Silnikau even rated affiliates by performance and rewarded the most productive