🚨 Over 100 U.S. water utilities were hit by cyberattacks in July alone, according to CISA. 🚨 In today's @SCMagazine, @KevinSurace, CEO of @Token, puts the real risk in perspective: "The Micro-Comm attack demonstrates that protecting the water utility itself is only half the problem. Attackers can go after the companies that manufacture, configure, maintain, and remotely support the technology inside hundreds of utilities." His key takeaway aligns with CISA's strongest recommendation: get operational technology (OT) off the public internet whenever possible. 🌐 🛡️ Reduce exposure 🛡️ Use secure gateways 🛡️ Keep systems patched 🛡️Continuously monitor traffic Critical infrastructure security starts with limiting the attack surface. 🏛️ 👉 Read the full story: scworld.com/news/over-100-us… #Cybersecurity #CriticalInfrastructure #OTSecurity #CISA #BiometricAuthentication

@KevinSurace, CEO of @Token, addresses the White House’s plan to engage the private sector in offensive cyber operations in today’s @SCMagazine coverage—making the essential point that private expertise should strengthen government-led cyber operations, not create independent cyber privateers. 🛡️ Private companies bring specialized talent, advanced tools, global infrastructure, and visibility into malicious activity that government agencies cannot always replicate on their own. But the central question is not whether private-sector capabilities should be involved—it is who remains in command. 🏛️ “Those responsibilities must remain with the government,” said Surace. “Military, intelligence, and law enforcement agencies should control attribution, target selection, legal authorization, coordination with allies, and escalation decisions.” 🎯 Authorized partners can contribute intelligence, infrastructure access, technical capabilities, and operational personnel—but only within a clearly defined, government-led mission. ⚖️ As cyber threats become faster, more automated, and more consequential, clear authority and accountability are not optional. They are the guardrails that distinguish coordinated national defense from dangerous escalation. 🚨 👉 Read the full story: scworld.com/news/white-house… #Cybersecurity #IdentitySecurity #BiometricAuthentication #CyberPolicy #NationalSecurity #CyberDefense #AI #AgenticAI #AutonomousAI #CISO

A 22-year-old architectural weakness in Baseboard Management Controllers (BMCs) is currently exposing over 24,000 servers to critical risk. 🚨 As @KevinSurace, CEO at @Token, notes in today's @SCMagazine article: “For an attacker, compromising the BMC is close to gaining physical access to the server, often beneath the visibility of endpoint security tools.” 🔐 The danger isn’t just in the code; it’s in the neglect. Many BMCs are configured once and then forgotten, sitting outside normal OS security programs. This allows attackers to take password hashes offline, bypassing login alerts entirely, and gain extraordinary control—from shutting down systems to establishing persistence beneath the operating system. 💻 This is a stark reminder that hardware-level security cannot be an afterthought. If your BMCs are using factory-assigned or weak passwords, you are already compromised. ⚠️ 👉 Read the full article: scworld.com/news/ipmi-bug-in… #Cybersecurity #BMC #BiometricAuthentication #IdentitySecurity

"Stolen identities cause 79% of ransomware attacks, says Sophos report" w/expert insight by @KevinSurace of @Token - scworld.com/news/stolen-iden… via @SCMagazine

Great insight from @Token CEO @KevinSurace in @SCMagazine today regarding the latest Okta warning on vishing attacks. ⚠️ Surace nailed the core issue: this isn't about hacking the tech, it's about hacking the human. 🎯 “Attackers impersonate IT support, convince users to approve Microsoft Authenticator prompts, reveal one-time codes or reset credentials, then immediately use those credentials to log into Microsoft 365 before the victim realizes what’s happened,” said Surace. “This is no longer about hacking Microsoft. It’s about convincing a human to authenticate the attacker, which is why these attacks are so effective.” As social engineering gets more sophisticated, relying on push approvals and one-time codes is a liability. The focus must shift to phishing-proof authentication. 🛡️ 👉 Full story: scworld.com/news/okta-warns-… #Cybersecurity #IdentitySecurity #PhishingProof #BiometricAuthentication #PhishingResistant

Great news for the cybersecurity talent pipeline: Two-year online college Campus has launched a new cybersecurity track. 🎓 @Token CEO @KevinSurace nailed it when he said we can’t solve the workforce shortage by only relying on four-year degrees and experienced hires. We need practical, accessible, job-ready pathways — and fast. 🚀 “Community colleges are often closer to employers, more accessible to students, and more focused on job-ready skills,” said Surace. “A graduate with hands-on experience, certifications, and real exposure to identity, cloud security, phishing, incident response, and AI tools can be valuable on Day 1.” He also called on the industry to stop just talking about the talent shortage and actually help build the pipeline — through internships, advisory boards, donated tools, guest instructors, certification vouchers, and clear hiring paths. 💡 👉 Full story in @SCMagazine: scworld.com/news/two-year-on… #Cybersecurity #CyberTalent #CampusCollege #WorkforceDevelopment #AI

"House committee chair calls on Instructure to testify in Canvas hack" w/expert insight by @KevinSurace of @Token: scworld.com/news/homeland-se… via @SCMagazine

"Campaign combines WhatsApp with legit cloud platforms to deliver malicious VBS files" featuring expert insight by @kevinsurace of @Token - scworld.com/news/campaign-co… via @SCMagazine