DMARC Adoption Exposes Organizational Gaps: Controls Exist but Go Unused

Dave Sobel (0:02)

Nine in 10 of the largest companies in America have configured the control that stops email impersonation. Fewer than four in 10 have turned it on. That's a deadbolt fitted to every door in the building, and never once thrown. Everything expensive that happened in security this week happened in the gap between those two numbers. This is The Business of Tech. I'm Dave Sobel.

Two sides of the same business went to machine speed using the same tools. Start with the register. A human attacker used frontier AI models and a set of agents to run a ransomware intrusion from end to end. Reconnaissance, credential theft, cloud abuse, extortion. The whole thing took under 10 hours. Unit 42, the Palo Alto Networks team that ran the incident response, set that against the benchmark. A human crew doing the same job takes about two weeks. And when it was finished, the attacker left the victim an 80-page security audit describing what had just been done to them.

Then connect-wise, the company disclosed a new vulnerability in ScreenConnect, the remote access tool MSPs used to reach client machines, and what it published was not a patch. It was a list of mitigation steps with a permanent fix promised later in the week. The flaw affects cloud and on-premises deployments both. There's no confirmation yet that this particular one is being exploited. But Bleeping Computer notes why nobody is waiting to find out. ScreenConnect's vulnerabilities have been targeted in the wild repeatedly by ransomware crews and by state-backed groups, including a North Korean operation in 2024

Enable lands again too with an emergency hotfix. And Central 2026.3 hotfix 4 out September 5th for a critical pre-authentication remote code execution flaw. And per Helpnet Security, the company's public advisory said there were no confirmations of exploitation, while a separate notice sent directly to customers called it a zero-day being exploited in the wild. We covered Enable shipping an incomplete patch back in August on a different issue. I'm not going to spend much time on them today because they're the example, not the story. Now the other side of it. Cloudflare and OpenAI announced a joint service that does vulnerability discovery and remediation at the edge, running on OpenAI's Daybreak models, including one called a GPT-56 cyber. It finds the flaw, ranks it, and writes a suggested patch. It's in early access and nothing takes effect without a human approving it. That is Cloudflare and OpenAI describing their own product, though take the framing for what it is. But note the list of tasks, because it is the same list the attacker in the first story handed to a machine. And Microsoft stopped waiting on any of it. Beginning the second week of this month, an Exchange Server 2026 or 2019 installation not patched to last October's final baseline gets throttled and then blocked when it sends mail into Exchange Online through an on-premises connector. Microsoft is not asking anybody to patch. It is degrading the server until somebody does.

Four disclosures in one week. Two from people breaking in, two from people selling the fix. All four are moved at the same speed.

If you're listening to this and haven't hit follow yet, on Apple Podcast Search Business of Tech. Takes five seconds and you'll get the next episode automatically.

Here's a reality every MSP knows. Native Microsoft 365 security leaves gaps. Those gaps land on your desk. Proofpoint 365 Total Protection closes them. It's an MSP-first platform that unifies Microsoft 365 security backup and compliance into one integrated console. High security efficacy, less operational friction, and multi-tenant management that scales as you grow. Protect clients against modern threats and stop stitching point tools together. Built on hornet security, now part of Proofpoint. See it at proofpointtotalprotection.com.

The reason they all move at the same speed is that they're all reaching for the same thing. Finding a flaw in writing the fix stopped being a specialty and became a feature of a general purpose model. Look at how the model companies themselves handle that. Anthropic released two models, Claude Fable 5.1 and Claude Mythos 5.1. According to reporting in The Next Web and Silicon Republic, the two are the same model. The difference between them is the safeguard settings. Fable is generally available. Mythos is restricted. You can only get it if you are a vetted user working in cybersecurity or the life sciences. Same weight, same capability, one gate. And look at who the gate is for. Those vetting programs are open only to a set of US organizations. So, whether your shop can buy into the defensive tier of this has already been decided for most of the planet and it wasn't decided on capability.

Think about what that arrangement says the company believes. If the security work could be separated from the attack work down at the level of the model, they would have built two different models. They didn't because it can't. So they built one and put a bouncer on the door. OpenAI arrives at the same place from the other direction. The company says GPT-6 Astra scored 100% on a cybersecurity benchmark called Exploit Bench, that is OpenAI's own number about OpenAI's own product, and then describes the safeguards that stop the model from building advanced exploits while promoting it for secure code review and patching. One capability, two names for it depending on who is holding it.