Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Ross McKerchar
The breachpocalypse is here
Seven incidents in seven days Last week I sent our leadership team a list. In seven days, Sophos' internal SecOps team responded to seven incidents: abuse of one of our products via a trial account, the ConnectWise Cloud Backup compromise, PHP2Shell, the eMudhra weak SubCAs, the second supply-chain compromise of LiteLLM this year, critical Node.js vulnerabilities and a GitLab RCE. A year ago, that would have been a quarter's worth.
Operating inside the lethal trifecta: Blast radius reduction in AI agent deployments
AI agents that can read files, call APIs, and perform actions are already being deployed in enterprises. These agents often operate in the center of what Simon Willison terms ‘ the lethal trifecta’ : they can access private data, process untrusted content, and communicate externally, making them susceptible to data theft via indirect prompt injection – where an attacker plants instructions in content that the agent reads on behalf of a trusted user, such as an email, a web page, or a document.
The vulnerability flood is here. Here’s what it means – and how to prepare
Last week, Thomas Ptacek published a piece arguing that vulnerability research is cooked . His thesis: AI agents are about to drown us in a steady stream of validated, exploitable, high-severity vulnerabilities, faster than anyone can patch them. But from where I sit, the more urgent question isn't whether the flood is coming, but whether the infrastructure we depend on can absorb it.
When AI doesn’t know the target is real
A week ago, I wrote about OpenAI’s test agent breaking out of a sandbox and accessing Hugging Face’s production infrastructure. My argument then was that it was more of a containment story than an attacker story, and that the cybersecurity fundamentals we have relied on for three decades still decide the outcome. Yesterday, Anthropic published its own version of the same problem, and the lessons remain the same.
Bug bounty nell’era AI: come sta cambiando la ricerca di vulnerabilità
I programmi di bug bounty stanno attraversando la più profonda trasformazione degli ultimi trent’anni. Da un lato, la diffusione di strumenti di intelligenza artificiale generativa ha provocato un aumento esponenziale di segnalazioni a basso valore aggiunto, spesso caratterizzate da analisi superficiali e risultati non verificati. Dall’altro, i modelli AI più avanzati stanno iniziando a individuare vulnerabilità reali, riproducibili e sfruttabili con una velocità senza precedenti.
Secure by Design in practice: a year of progress on Sophos Firewall
A year ago we published our Secure by Design 2025 progress update, reviewing our commitments against the seven pillars of CISA’s Secure by Design initiative. Since then, enough has happened – across all our products, and in the threat landscape – that a single annual post covering everything no longer does the work justice. So we’re splitting our updates out per product, starting where the stakes are highest: the firewall.
Why Sophos Has Become Its Own AI Test Lab
Every security vendor will tell you about the AI in their products. Far fewer will tell you how their own people use AI — which agents run in their engineering pipelines, what data those agents can touch, and who decided that was acceptable. That second conversation, in our view, is as important. When you onboard a vendor, you don't just inherit their software; you inherit their judgment.
When the "attacker" is an AI agent
Last week, Hugging Face disclosed a security incident of a new kind: an intrusion carried out end to end by an autonomous AI agent. Days later, OpenAI clarified that the “attacker” was its own test agent. Two of their newer models, with safety guardrails deliberately relaxed to benchmark their maximum cyber capability, worked out that the easiest way to ace the test was to cheat. Picture a student who steals the teacher’s answer key, except this student can find zero-days vulnerabilities.
Sophos finds AI compressing cyberattack timelines from weeks to days in its 2026 Security Report
Attackers are no longer experimenting with AI — they are running it in production. A new report from Sophos, based on monitoring across more than 625,000 customers, documents a tracked campaign in which a threat actor deployed 12 AI agents inside a victim's network to write and test 80 exploit modules and 70 evasion techniques in a matter of days.
Bug bounties in the Mythos era
Bug bounties are changing faster right now than at any point in their thirty-year history. On one side, the rise of AI-assisted research has flooded many programs with low-signal ‘slop.' On the other, frontier models are starting to produce validated, reproducible, exploitable vulnerabilities at machine speed. Both trends are accelerating, and neither is going to reverse. That shift reframes what a bug bounty program is for. It’s no longer just a channel for receiving external findings.
Inside the lethal trifecta: Blast radius reduction in AI agent deployments
AI agents that can read files, call APIs, and perform actions are already being deployed in enterprises. These agents often operate in the center of what Simon Willison terms ‘the lethal trifecta’: they can access private data, process untrusted content, and communicate externally, making them susceptible to data theft via indirect prompt injection – where an attacker plants instructions in content that the agent reads on behalf of a trusted user, such as an email, a web page, or a document.
Strengthening authentication with passkeys: A CISO playbook
For decades, passwords have been the standard method for protecting access to systems and accounts. However, passwords can be compromised or stolen via tactics such as brute-force attacks, phishing attacks, and infostealer malware. The shift to multi-factor authentication (MFA) added another layer of security by requiring additional authentication to verify the user’s identity – some combination of something you know, own, or (in the case of biometrics) are.
The vulnerability flood is here. Here’s what it means – and how to prepare
Last week, Thomas Ptacek published a piece arguing that vulnerability research is cooked. His thesis: AI agents are about to drown us in a steady stream of validated, exploitable, high-severity vulnerabilities, faster than anyone can patch them. But from where I sit, the more urgent question isn't whether the flood is coming, but whether the infrastructure we depend on can absorb it.
We let OpenClaw loose on an internal network. Here’s what it found
In my previous article on OpenClaw I wrote: “Even the most ‘risk-on’ organizations with deep AI and security experience, will likely find it challenging to configure OpenClaw in a way that effectively mitigates the risk of compromise or data loss, while still retaining any productivity value.” The Red Team here at Sophos took that as ‘challenge accepted’, so we devised a goal: arm OpenClaw with a standard set of red teaming tools, give it access to one of our legacy on-prem networks, and let...
The High Cost of Low Trust: Our Commitment to Radical Transparency
In our industry, trust isn't an abstract concept. It’s the currency of cybersecurity – the foundation of every partnership we build and every protection we provide. However, a recent independent, vendor-agnostic survey of 5,000 cybersecurity decision-makers across 17 countries reveals a stark reality: we’re facing a trust crisis.
The OpenClaw experiment is a warning shot for enterprise AI security
You may have seen the recent hype around OpenClaw (AKA Moltbot, Clawdbot), an agentic AI framework that can function as a personal AI assistant by performing various tasks on your behalf – such as checking in for flights, managing calendars, responding to emails, and organizing files.
Detecting fraudulent North Korean hires: A CISO playbook
The North Korean worker scheme has expanded into a global threat. Although it originally focused on U.S. technology companies, the scheme has spread to other regions and sectors, including finance, healthcare, and government. Any company hiring remote workers is at risk; as a remote-first technology company, even Sophos has been targeted by North Korean state-sponsored operatives posing as IT workers.
Phake phishing: Phundamental or pholly?
On paper, it sounds so simple: you prepare for the real thing by running simulations. After all, the same principle applies to countless disciplines: sports, the military, transport, crisis preparedness, and many more. And, of course, to various aspects of cybersecurity, including red teaming, purple teaming, Capture-The-Flag (CTF) contests, and tabletop exercises. Is phishing any different? The answer: it’s not, at least in theory.
We need secure products as much as we need security products
Recent events with F5 and SonicWall underline a continuing issue: network infrastructure is constantly under attack, and the cybersecurity industry continues to grapple with deep product security challenges. Our adversaries are targeting the very tools designed to defend us. These are not opportunistic attacks: they’re a long-term strategy requiring years of research and are increasingly involving direct breaches of vendors’ own engineering and product environments.
What happens when a cybersecurity company gets phished?
If you work in cybersecurity, you’ve probably heard the time-honored adage about cyber attacks: “It’s not a matter of if, but when.” Perhaps a better way to think of it is this: while training, experience, and familiarity with social engineering techniques help, anyone can fall for a well-constructed ruse. Everyone – including security researchers – has a vulnerability that could make them susceptible, given the right situation, timing, and circumstances.
Les progrès réalisés en 2025 par Sophos avec l’initiative “Secure by Design”
En 2024, nous sommes devenus l’une des premières organisations à nous engager dans l’initiative Secure By Design de la CISA. En accord avec nos valeurs organisationnelles essentielles en matière de transparence, Secure by Design a été un guide puissant dans nos efforts constants pour évaluer et améliorer de manière continue nos pratiques de sécurité.
Sophos’ Secure by Design 2025 Progress
In 2024, we became one of the first organizations to commit to CISA’s Secure by Design initiative. Aligned with our core organizational values around transparency, Secure by Design has been a guiding force as we continually evaluate and improve our security practices. We recently passed the one-year anniversary of publishing our pledges for improvement and would like to publicly share the progress we have made against the seven core pillars of the Secure by Design framework.
Protezione a prova di manomissione
Una volta che un malintenzionato ha accesso a un endpoint, le soluzioni EDR (Endpoint Detection and Response) spesso rappresentano l’unico ostacolo tra lui e il suo obiettivo, che si tratti di distribuire ransomware, installare malware, accedere a dati o lanciare ulteriori attacchi.
Putting the dampener on tamperers
Once a threat actor is on an endpoint, EDR solutions are often the only obstacle between them and their objective – whether that’s deploying ransomware, installing malware, accessing data, or launching further attacks. As a result, threat actors regularly look for ways to disable security products: escalating privileges if necessary to try to kill processes and services, running EDR killers, and a host of other techniques.
Desde la primera línea: la opinión de nuestro CISO sobre Pacific Rim
Sophos no es el primer proveedor de ciberseguridad que descubre que sus productos perimetrales son el objetivo de un ataque sostenido por parte de un estado nación.
Pacific Rim : immersion dans une contre-offensive (TTP utilisées pour neutraliser les menaces basées en Chine)
Résumé Depuis plus de cinq ans, Sophos enquête sur plusieurs groupes basés en Chine et ciblant les pare-feu Sophos, avec des botnets, de nouveaux exploits et des malwares sur mesure. Avec l’aide d’autres éditeurs de cybersécurité, de gouvernements et d’organismes chargés de l’application de la loi, nous avons pu, avec différents niveaux de confiance, associer des groupes spécifiques au niveau d’activités observées à Volt Typhoon, APT31 et APT41/Winnti.
Pacific Rim: all’interno della controffensiva, i TTP utilizzati per neutralizzare le minacce basate in Cina
Panoramica Da oltre cinque anni Sophos sta indagando su diversi gruppi con base in Cina che prendono di mira i firewall Sophos, con botnet, nuovi exploit e malware su misura. Con l’assistenza di altri fornitori di cybersicurezza, governi e forze dell’ordine, siamo stati in grado di attribuire, con diversi livelli di affidabilità, specifici gruppi di attività osservate a Volt Typhoon, APT31 e APT41/Winnti.
Dalla prima linea: il punto di vista del nostro CISO su Pacific Rim
Sophos non è il primo fornitore di cybersicurezza a scoprire che i suoi prodotti perimetrali sono l’obiettivo di un attacco sostenuto da parte di uno Stato nazionale.
Cronologia di Pacific Rim: Informazioni per i difensori da una catena di campagne di attacco interconnesse
Come abbiamo descritto nel nostro articolo di sintesi, Sophos ha combattuto diversi aggressori di minacce provenienti dalla Cina che hanno preso di mira i dispositivi perimetrali, compresi i firewall Sophos. Qui forniamo una cronologia delle attività degne di nota di questi aggressori, insieme alla nostra risposta alle loro attività e ai rapporti di terze parti che hanno fornito informazioni sull’attribuzione e sul contesto.
最前線から：ソフォス CISO の Pacific Rim に対する見解 (翻訳中)
** 本記事は、From the frontlines: Our CISO’s view of Pacific Rim の翻訳です。最新の情報は英語記事をご覧ください。** Sophos is not the first cybersecurity vendor to find its perimeter products the target of sustained nation-state attack.
タイムラインで見る Pacific Rim：連携した複数の攻撃キャンペーンから得られた情報 (翻訳中)
** 本記事は、Pacific Rim timeline: Information for defenders from a braid of interlocking attack campaigns の翻訳です。最新の情報は英語記事をご覧ください。** As we describe in our overview article, Sophos has been combatting multiple China-based threat actors targeting perimeter devices including Sophos firewalls. Here, we are providing a timeline of notable activity of those threat actors, along with our response to their activities and third-party reports that provided attribution information and context.
Pacific Rim：反撃の内幕 - 中国からの脅威を無力化した手法
** 本記事は、Pacific Rim: Inside the Counter-Offensive—The TTPs Used to Neutralize China-Based Threats の翻訳です。最新の情報は英語記事をご覧ください。** ソフォスは 5 年以上にわたり、ソフォスのファイアウォールを標的とし、ボットネット、新種のエクスプロイト、カスタマイズされたマルウェアを使用する、複数の中国を拠点とするグループを調査してきました。 他のサイバーセキュリティベンダー、政府、法執行機関からの支援により、ソフォスは、信頼度の差はあれ、観測された活動のクラスタを Volt Typhoon、APT31、APT41/Winnti と特定しました。 また、Sophos X-Ops は、エクスプロイトの研究開発活動が四川省で行われていることを確信しています。 この活動で開発されたエクスプロイトが、中国の脆弱性情報開示に関する法律に準じて、目的、能力、および侵害後のツールの使い方が異なる複数の国家支援型グループと共有されている可能性が高い、と X-Ops は判断しています。...
Pacific Rim: Learning to eat soup with a knife
Embedded architecture devices such as network appliances haven’t historically been top-of-the-backlog when it comes to security features, and during Pacific Rim they became the subject of an escalating arms race – one that blue teamers, and not just those at Sophos, must get a handle on. The good news is that many of our existing principles transfer extremely well: More recent network appliance technology is based on well-understood OS’s such as Linux variants.
Pacific Rim: Inside the Counter-Offensive-The TTPs Used to Neutralize China-Based Threats
For more than five years, Sophos has been investigating multiple China-based groups targeting Sophos firewalls, with botnets, novel exploits, and bespoke malware. With assistance from other cybersecurity vendors, governments, and law enforcement agencies we have been able to, with varying levels of confidence, attribute specific clusters of observed activity to Volt Typhoon, APT31 and APT41/Winnti.
From the frontlines: Our CISO’s view of Pacific Rim
Sophos is not the first cybersecurity vendor to find its perimeter products the target of sustained nation-state attack.
Pacific Rim timeline: Information for defenders from a braid of interlocking attack campaigns
As we describe in our overview article, Sophos has been combatting multiple China-based threat actors targeting perimeter devices including Sophos firewalls. Here, we are providing a timeline of notable activity of those threat actors, along with our response to their activities and third-party reports that provided attribution information and context.
Sophos rivela i progressi compiuti nell’ambito del suo impegno per l’iniziativa Secure by Design del CISA
Considerando che le soluzioni tecnologiche sono integrate in quasi tutti gli elementi delle nostre attività personali e lavorative, è essenziale che tutto il software, a prescindere dalla sua funzione, sia progettato tenendo conto della cybersecurity come requisito fondamentale. Se non si adotta la sicurezza come principio fondamentale, non si può raggiungere l’obiettivo di un ecosistema digitale affidabile.
Sophos presenta los progresos realizados en su compromiso con la iniciativa Secure by Design de CISA
Con soluciones tecnológicas integradas en casi todos los elementos de nuestras actividades personales y empresariales, es esencial que todo el software, sea cual sea su función, se diseñe con la ciberseguridad como requisito básico. Si no incorporamos la seguridad como primer principio, no podremos alcanzar el objetivo de un ecosistema digital digno de confianza.
ソフォス、CISA の Secure by Design イニシアティブに対する誓約を発表
** 本記事は、Sophos Provides Progress on its Pledge to CISA’s Secure by Design Initiative の翻訳です。最新の情報は英語記事をご覧ください。** テクノロジーソリューションは、人々の個人的な活動や業務活動のほぼすべての要素に組み込まれているため、すべてのソフトウェアは、その機能が何であれ、サイバーセキュリティを必須要件として設計されている必要があります。セキュリティを最優先に組み込まなければ、信頼できるデジタルエコシステムという目標は達成できません。 セキュリティ主導のアプローチの採用を推進するため、米国サイバーセキュリティ・社会基盤安全保障庁 (CISA) は 2024 年 5 月 8 日、Secure by Design に対する誓約を発表しました。ソフォスは、以下に列記するテクノロジーと製品セキュリティの 7 本の柱に重点を置くこの誓約に、いち早く取り組んだ組織のひとつです。 多要素認証 デフォルトのパスワード 脆弱性の種類そのものを削減 セキュリティパッチ 脆弱性開示ポリシー CVE 侵入の証拠...
Sophos Provides Progress on its Pledge to CISA’s Secure by Design Initiative
With technology solutions embedded across almost every element of our personal and business activities, it’s essential that all software – whatever its function – is designed with cybersecurity as a core requirement. Without embedding security as a first principle, we cannot achieve the goal of a trustworthy digital ecosystem. To accelerate the adoption of a security-led approach, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) launched a Secure by Design pledge on May 8, 2024.
Come definire una politica d’uso per l’IA generativa
In quanto vendor leader a livello mondiale nel settore della sicurezza informatica, riceviamo molte richieste di condivisione di linee guida e policy di cybersecurity che possano contribuire ad aiutare le organizzazioni a difendersi dalle minacce digitali. Attraverso la condivisione delle conoscenze accumulate da Sophos in materia di cybersecurity, vogliamo contribuire a creare un fronte comune nella lotta contro i cyberattacchi.
Construire une politique d’utilisation pour l’IA Générative
En tant que l’un des principaux éditeurs mondiaux de cybersécurité, nous recevons de nombreuses demandes visant à partager des conseils sur les meilleures pratiques et politiques en matière de cybersécurité qui pourraient apporter une véritable valeur ajoutée pour le plus grand bien de tous en aidant les entreprises à se protéger contre les menaces numériques.
Building a Use Policy For Generative AI
As one of the world’s leading cybersecurity vendors, we receive many requests to share guidance on cybersecurity best practices and policies that could help contribute to the greater good of helping organizations defend themselves against digital threats. By sharing Sophos’ own accumulated cybersecurity knowledge our goal is to help create a unified front in the battle against cyberattacks.
Attaque Kesaya - commentaire Sophos
Attaque Kesaya - commentaire Sophos juillet 2021 par Ross McKerchar, VP et CISO de Sophos Le commentaire de Ross McKerchar, VP et CISO de Sophos, au sujet de l’attaque Kesaya : « L’attaque Kesaya est une des attaques criminelles par ransomware les plus étendues que Sophos ait jamais connue. Actuellement, les éléments que nous avons recueillis montrent que plus de 70 fournisseurs MSP ont été impactés, entrainant des conséquences sur plus de 350 entreprises.
SolarWinds breach: how to identify if you have been affected
** We will update this article with additional information as it becomes available. We have also published a playbook to guide any security team that has SolarWinds in their environment and is looking to initiate incident response.
Practical IT: are your firewalls in the wrong place?
Rewind to the 1990s, and the firewall was an organisation’s main technical control for network security. Firewalls were expensive, complicated and arcane. They sat right on the boundary between the dangerous public internet and your safe internal network. The model was refined with the addition of the DMZ, or demilitarised zone. The DMZ was a buffer between your internal network and the internet in which you placed at-risk public-facing systems such as web and mail servers.
Protecting your company during COVID-19: Guidance for CIOs and CISOs
By Ross McKerchar Cyberattackers are resourceful and opportunistic. They will move quickly to take advantage of a situation. COVID-19 is no different. There is a huge amount of global uncertainty and change right now which criminals are seeking to capitalize on. The risks are amplified by the immediate and unforeseen IT challenges that companies are having ensuring their staff can work from home.
How CISOs Can Save their Firms during COVID-19
By Ross McKerchar Cyber attackers are resourceful and opportunistic. They will move quickly to take advantage of a situation. With COVID-19 now, there is a huge amount of global uncertainty and change right now which criminals are seeking to capitalize on. The risks are amplified by the immediate and unforeseen IT challenges that companies are having ensuring their staff can work from home.
Protecting one's company during COVID-19
Cyberattackers are resourceful and opportunistic. They will move quickly to take advantage of a situation. COVID-19 is no different. There is a huge amount of global uncertainty and change right now which criminals are seeking to capitalise on. The risks are amplified by the immediate and unforeseen IT challenges that companies are having ensuring their staff can work from home, writes Ross McKerchar, CISO, Sophos.
Protecting your company during COVID-19: guidance for CIOs and CISOs
Cyberattackers are resourceful and opportunistic. They will move quickly to take advantage of a situation. COVID-19 is no different. There is a huge amount of global uncertainty and change right now which criminals are seeking to capitalize on. The risks are amplified by the immediate and unforeseen IT challenges that companies are having ensuring their staff can work from home.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Ross
Contact Ross, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack