Topic starter
14/07/2026 4:25 pm
TL;DR: Recurring criminal tradecraft across BEC, supply chain, phishing, account takeover, subscription bombing, and indirect prompt injection shows how attackers keep blending human-targeted deception with credential theft and AI misuse to bypass controls, according to Proofpoint’s monthly stop-list. The pattern is operational, not theoretical: identity and access governance fail fastest where trust is implicit and verification is weak.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Cybersecurity Stop of the Month blogs: the complete collection”.
Key questions
Q: What breaks when AI phishing is treated as only an email problem?
A: Teams miss the identity layer of the attack.
Q: Why do delegated identities and CI/CD runners create supply chain risk?
A: Because they often hold the authority to move code, access secrets, or trigger deployments without the same scrutiny applied to human users.
Q: What are the warning signs that AI SOC automation is becoming unsafe?
A: Look for actions taken without a linked case, approvals that happen after execution, investigation summaries that cannot be traced back to source evidence, and workflow changes that only one team member understands.
Practitioner guidance
- Map recurring deception paths across channels Correlate phishing, account takeover, supply chain abuse, and prompt injection events so the same trust failure is not investigated in separate queues.
- Inventory non-human and delegated identities Build a complete register of CI/CD runners, third-party tokens, service accounts, and AI-connected integrations that can act without direct human approval.
- Constrain AI tool permissions by task Limit model and agent access to the smallest viable set of APIs, workflows, and data sources so indirect prompt injection cannot trigger broad action.
Bottom line: Recurring attack classes in this stop-list point to one underlying issue, which is fragile trust in sessions, delegated access, and AI-connected workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:33 pm
Recurring attack patterns matter more than isolated campaigns: Proofpoint’s stop-list is useful because it shows that adversaries are converging on a small set of repeatable trust failures. Phishing, account takeover, and indirect prompt injection all exploit the same governance weakness, which is overconfidence in the legitimacy of a session or instruction source. Practitioners should treat these as linked control failures, not separate threat silos.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams decide whether to prioritise phishing controls or account takeover controls first?
A: Prioritise the control that reduces the most reusable trust. If phishing is feeding token theft, focus on authentication assurance, session binding, and rapid revocation. If the main exposure is delegated access or automation, focus on identity inventory and privilege containment. The right sequence depends on where trust is being reused, not where the alert appears.
👉 Read our full editorial: Phishing, account takeover and AI abuse remain the month’s stop-list