This Week in Cybersecurity (September 1 - September 8, 2025)

Cybersecurity is hard and this past week brought headlines that highlight both regulatory progress and the creative ways threat actors continue to adapt. From Microsoft pushing stronger authentication, to AI tools being misused for scams, to boards and regulators tightening oversight, organizations need to stay proactive. Here are the stories that stood out to me and what they mean for you. 

1. Microsoft Enforces MFA on Azure Portal 

The News:

Microsoft announced that multi-factor authentication (MFA) is now mandatory for all Azure portal sign-ins across every tenant. Previously, MFA was strongly encouraged but optional, leaving many organizations exposed to credential-based attacks. Microsoft cited persistent account takeover attempts as the driver behind this universal enforcement. Although it is nice to see Microsoft take action, but they are years upon years too late.  

Why it is Important: 

Credential theft remains the #1 cause of breaches worldwide (Verizon DBIR 2024). By forcing MFA across its cloud platform, Microsoft is raising the baseline for security. However, attackers will pivot, And I expect to see more MFA fatigue attacks, SIM swaps, and phishing kits that mimic push notifications. 

Actions: 

• Ensure your workforce is trained in MFA fatigue attacks (repeated push prompts). 

• Adopt phishing-resistant MFA methods (e.g., FIDO2 keys, certificate-based auth). 

• Monitor authentication logs for unusual sign-in behavior. 

  
  

2. Threat Actors Abuse xAI’s Grok for Malicious Links 

The News: 

Reports have come out that cybercriminals are abusing Grok, the AI chatbot from X (Elon Musk’s company), to generate convincing malicious messages and links. The chatbot’s ability to create human-like, context-rich responses makes phishing campaigns far more persuasive. 

Why it is Important: 

This highlights the dual-use risk of AI. Just as defenders are testing AI for faster detection and response, attackers are weaponizing the same tools for scale and realism. The FBI noted that AI-enabled scams cost U.S. victims over $12 billion in 2023, a number expected to rise sharply in 2025. 

Actions: 

• Strengthen employee awareness training to spot AI-crafted scams. 

• Deploy link and attachment scanning tools that use AI to detect AI. 

• Update incident response plans to account for AI-driven social engineering. 

  
  

3. Qantas Trims CEO’s Bonus After Cyber Incident 

The News: 

Australian airline Qantas announced it has reduced CEO Vanessa Hudson’s bonus following a July cybersecurity incident. While details of the breach remain limited, the move signals accountability at the top for cybersecurity governance. I expect this to catch on and the entire Executive Suite will be impacted financially (CEO, CFO, COO, CISO, CIO, CRO, and even CHRO).  

Why it is Important: 

Boards and executives are increasingly held financially responsible for cyber risk. Regulators from Australia to the U.S. are pressing for oversight at the leadership level, with cybersecurity now seen as a business governance issue, not just a security problem. 

Actions: 

• Ensure your board receives regular cybersecurity briefing with true insight into risk in a quantitative fashion. FAIR Cyber Risk Quantitative Framework is the clear solution to apply to your executive and board briefings.  

• Tie executive compensation to security performance metrics. 

• Document board-level cybersecurity decisions for regulatory safe harbor. 

  
  

4. U.S. State Privacy and AI Laws: Key Dates Ahead 

The News: 

A new legal analysis highlighted a growing wave of U.S. state-level privacy and AI regulations, with key compliance dates set for 2025 and beyond. States like California, Colorado, and Virginia already enforce privacy laws, and others are rolling out AI-specific requirements. 

Why it is Important: 

The patchwork of laws creates compliance complexity. Unlike the EU’s GDPR, the U.S. lacks a unified federal standard, leaving companies exposed to multi-jurisdictional risk. Missing a compliance deadline could mean fines, lawsuits, and reputational damage. 

Actions: 

• Map your data processing and AI use cases against state regulations. 

• Build a regulatory calendar for upcoming deadlines. 

• Align with frameworks like NIST AI RMF for a defensible compliance strategy. 

  
  

5. Roblox Tightens Age Verification 

The News: 

Roblox is introducing stricter age verification for text chat features, aiming to separate adult and child users. This action follows concerns about grooming, inappropriate content, and child exploitation within online gaming spaces. 

Why it is Important: 

With over 70 million daily active users, Roblox has become a central hub for younger audiences and therefore a prime target for online predators. Regulators are watching how platforms implement safeguards, setting precedents that could spill over into other social and gaming platforms. 

Actions: 

• For organizations in gaming or youth services, audit your child safety controls. 

• Communicate with parents and guardians about safe online behavior. 

• Expect stricter age-gating and verification standards across all digital ecosystems. 

  
  

6. Google Board Adds Cybersecurity Oversight 

The News: 

Google’s parent company, Alphabet, has added cybersecurity oversight responsibilities to its board of directors, ensuring that security is backed into top-level governance. This follows SEC rules that require public companies to disclose board-level cybersecurity expertise. 

Why it is Important: 

This move is a signal to the market that cybersecurity is now a boardroom issue and security should be removed from a company's Information Technology organization.  With the SEC already issuing fines for poor disclosure, other Fortune 500 boards are expected to follow. This could reshape how security leaders interact with their boards, demanding better communication and risk quantification. Heat maps are dead, and the business language is in monetary speech not a feeling.  

Actions: 

• Prepare board-ready risk dashboards that tie cyber risk to business outcomes. 

• Board dashboards should also include quantitative risk in the manner the business understands.  

• Educate directors on the FAIR Cyber Risk Quantitative Framework.  

• Ensure your board minutes document cybersecurity oversight activities. 

The Armes Vantage Point:

This week’s stories all connect to a central theme is that cybersecurity accountability is shifting up the chain of command. Whether it’s Microsoft enforcing stronger security defaults, AI tools being weaponized by threat actors, or boards tying executive pay to cyber resilience, the message is clear; security is no longer just about technology. It’s about leadership, governance, and trust. There has never been a better time to move security outside of IT.  

At Armes Vantage, we believe organizations that embed security into strategy, culture, and board oversight will not only help withstand today’s threats but also earn the confidence of their customers, regulators, and partners. The time to elevate cybersecurity to the executive agenda is now. 

News Sources 

• BleepingComputer – Microsoft MFA Enforcement 

• BleepingComputer – Grok Abuse 

• SC World – Qantas Cyber Bonus Cuts 

• JD Supra – U.S. Privacy & AI Laws 

• The Record – Roblox Age Verification 

• HelpNetSecurity – Google Board Cyber Oversight