What is the top cybersecurity issue is on employees’ minds right now? In the past 60 days, passkeys have generated more questions from thousands of Aware Force readers than any other topic in our 10‑year history, which says a lot about how confusing (and important) this shift beyond passwords feels at work. And they’re good questions: people want to know what passkeys change in their daily sign‑ins, whether they’re really safer, and what this means for the future of their digital security.

• Passkeys are basically “no‑password passwords”: a digital key stored on your phone or computer that logs you in with your fingerprint, face, or PIN instead of something you type, and they’re starting to replace old‑fashioned passwords across consumer and business apps.
• We’re moving rapidly toward passwordless sign‑in, and many large platforms already treat passkeys as a first‑class option for accounts. More than 15 billion online accounts now support passkey sign‑in worldwide, roughly double the number from a year ago.
• Passkeys trade “remember lots of complicated passwords” for “use what already unlocks your phone or laptop,” while quietly killing off many of the attacks—phishing links, reused passwords, huge credential leaks—that have driven your newsletter questions for a decade. Make passkeys a part of your communication during October Cybersecurity Awareness Month.

Go Deeper

• https://developers.google.com/identity/passkeys
• https://www.sequentur.com/passkeys-explained-are-they-going-to-replace-passwords-for-business/
• https://support.apple.com/en-us/102195

The big story this month in AI involves the company that owns ChatGPT: We now have proof that AI tools can slip the leash. OpenAI’s models broke out of a test lab and into another company’s tech platform. The models didn’t guess passwords; they found a brand‑new software bug and used it to wander across OpenAI’s network until they reached the open internet.

• Once online, the AI grabbed credentials, poked at more weaknesses, and quietly logged into a tech platform called Hugging Face, which is widely used by companies and researchers as a hub for testing AI components.
• What is so startling about this cyber breach is that there was no human hacker at the keyboard. The models found a previously unknown bug, used it to get broader network access, then moved laterally until they reached a machine with full internet connectivity.
• Experts see this as a concrete example of how advanced AI can act like a highly skilled attacker: discovering vulnerabilities, moving through networks, and exploiting weaknesses with little or no human guidance. AI is making cyberattacks faster, more scalable, and easier for less‑skilled criminals by automating tasks like phishing, vulnerability discovery, malware generation, and large‑scale password guessing.

Go Deeper

• https://openai.com/index/hugging-face-model-evaluation-security-incident/
• https://huggingface.co/blog/security-incident-july-2026
• https://www.trendmicro.com/en/research/26/g/inside-the-openai-hugging-face-incident.html

Facebook has introduced free “verified” badges, designed to prove posts are coming from humans, not AI-generated slop. It requires you to be over 18 and in good standing with Meta’s rules on fraud and scams, and initially shows up in Marketplace, Dating, Groups, and your Profile, with Feed posts coming later. But badges that users have to pay for are prompted on many social media platforms. Are they worth it?

• Meta’s paid “Meta Verified” subscription on Facebook and Instagram is separate: you pay around $11.99–$14.99 per month per profile for a blue badge plus extras like impersonation monitoring, priority support, and some exclusive features. LinkedIn offers free identity verification and has rolled out a “Verified on LinkedIn” badge that can travel to partner platforms to signal your identity is confirmed. X (Twitter) shifted to a mostly paid model: individual users and organizations can buy blue or organizational checkmarks as part of subscriptions, which may include better features and support.
• For organizations and individuals, whether a paid badge is “worth it” depends on what you need: if you face impersonation, customer support issues, or brand risk, the added protection and support can be useful; if you just want credibility, free identity verification on platforms like Facebook and LinkedIn may be enough.
• The bigger story for employees and executives is that verification is shifting from a celebrity perk to a basic online safety tool, and we should expect more platforms to push some form of “prove you’re real” as AI‑generated identities and scams grow.

Go Deeper

• https://www.macrumors.com/2026/07/24/meta-launches-free-facebook-verified-badge/
• https://www.zdnet.com/article/verified-on-linkedin-badge-free-all-websites-apps-deepfakes/
• https://www.zdnet.com/article/verified-on-linkedin-badge-free-all-websites-apps-deepfakes/

Ransomware attacks against organizations have jumped 47% in publicly reported ransomware incidents since 2024. For hackers, the bad news is that payment volume has dropped from 60% in 2024 to 28% last year. For victims, the bad news is that once they’re hit, the chances of a repeat attack rise significantly.

• Governments and security agencies’ advice: don’t rush to pay, because there’s no guarantee it works and it can leave attackers with a foothold and a reason to come back.
• Ransomware actors concentrate heavily on critical industries including manufacturing, healthcare, energy, transportation, and financial services.
• The advice is the same for consumers as it is businesses and governments: have offline, tamper‑proof backups of critical data and systems. At home, it’s the “3-2-1” rule. Keep your original files plus two backup copies (for example: your computer, an external drive, and a cloud backup like iCloud, Backblaze, Carbonite and iDrive).

Go Deeper

• https://www.fortinet.com/resources/cyberglossary/recent-ransomware-settlements
• https://www.bitsight.com/underground/ransomware
• https://www.varonis.com/blog/ransomware-statistics

In the upcoming edition of Aware Force for employees: a terrific new video explaining how Business Email Compromise works. Contact us at [email protected] to see it.

Buying a new car? You’re probably giving the dealership permission to track your every move as you travel. That includes location history, driving behavior, seatbelt use, radio choices, and even things like weight and even facial expressions. You’re not automatically tracked in every leased or financed car but connected‑car data collection is now the norm—and in some higher‑risk finance arrangements, a separate tracker is part of the deal.

• AppleInsider reports that at least one dealer‑installed alarm system had vulnerabilities that could let an attacker abuse its connection to your iPhone via CarPlay‑style integration, requiring an update pushed through the phone to close the privacy and security gap. Consumer Reports and other watchdogs say automakers routinely share or sell driving data to insurers, data brokers, and partners; many drivers only “consent” by clicking through long privacy policies built into apps or purchase paperwork that they never read closely.
• Separate from built‑in systems, many dealerships and subprime lenders install hidden GPS trackers on financed or “buy‑here‑pay‑here” vehicles so they can locate and repossess the car if payments stop; prime lenders and mainstream franchises are less likely to use these devices, but they do exist.
• Security guides warn that if you suspect a hidden tracker, common locations include the OBD‑II port under the steering wheel, kick panels, near the battery, bumpers, or the undercarriage, and they stress documenting and involving authorities if you find a device you never agreed to.

Go Deeper

• https://www.bbc.com/future/article/20260513-your-car-is-spying-on-you-its-about-to-get-worse
• https://www.consumerreports.org/electronics/personal-information/how-to-stop-your-car-from-collecting-sharing-driving-data-a1233378612/
• https://www.brickhousesecurity.com/gps-trackers/how-to-find-and-remove-gps-tracker-from-car