The Watch

Two Defensive Pillars Broken Simultaneously

Your EDR and your network infrastructure both have critical blind spots discovered this week. Together, they represent the most immediately actionable new intelligence since the Veeam 9.9 disclosures.

Cortex XDR: Encrypted Rules Hiding a Global Bypass

InfoGuard Labs decrypted AES-256-CBC-encrypted CLIPS rule files shipped with Cortex XDR agents 8.7 and 8.8 (content version 1790-16658) and found a hardcoded global whitelist. Any process with :\Windows\ccmcache in its command line is exempted from approximately 50% of all BIOC detections — including LSASS dump prevention mapped to MITRE T1003/TA0006.

The exploitation is trivial: an attacker appends this path string to their command line and bypasses credential dumping detection, process injection monitoring, and other behavioral rules. The whitelist was removed in Agent 9.1 with content version 2160, but individual rule-level exceptions remain exploitable even in upgraded agents.

If you ran Cortex XDR agents below 9.1, assume credential theft attempts went undetected. A retrospective hunt for T1003 activity is not optional — it's incident response.

HPE Aruba AOS-CX: No Credentials Needed

CVE-2026-23813 (CVSS 9.8) allows an unauthenticated remote attacker to reset the admin password on HPE Aruba AOS-CX network switches — the devices that form the backbone of your network segmentation. Four versions are affected (before 10.10.1180, 10.13.1161, 10.16.1030, 10.17.1001). Three additional high-severity command injection CVEs (CVE-2026-23814 through 23816) affect the same products.

No exploitation evidence exists yet, but pre-auth admin takeover on network switches is a CVSS 9.8 for a reason. If management interfaces are exposed beyond a dedicated out-of-band management network, you are one scan away from total network compromise.

Chrome Zero-Days: March 27 CISA Deadline

Two actively exploited Chrome zero-days round out the emergency patch list. CVE-2026-3909 (OOB write in Skia) and CVE-2026-3910 (arbitrary code execution in V8) are on the CISA KEV catalog with a March 27 compliance deadline. Google removed one zero-day's description from its advisory, indicating it will be fixed in a future release — monitor release notes.

$75.25 Million in Ransom Payments — Steered by the Negotiator

The DOJ unsealed charges against Angelo Martino, a ransomware negotiator at DigitalMint, for actively colluding with ALPHV BlackCat operators. Co-conspirators Kevin Tyler Martin (also DigitalMint) and Ryan Clifford Goldberg (IR manager at Cygnia Cybersecurity Services) have already pleaded guilty as of December 2025.

The attack model was devastatingly simple: Martino fed confidential client intelligence to ALPHV — information about DigitalMint's own clients — to help maximize ransom demands. He received a cut of payments. One ransom went directly to the trio; five others to ALPHV after Martino exploited his position as the trusted negotiator sitting between victim and attacker.

This is not a theoretical insider threat scenario. A ransomware negotiator, hired to protect victims, was maximizing the ransom they paid — across 10 confirmed attacks.

Implications for Your IR Retainer

Every organization with a ransomware negotiation or incident response retainer needs to reassess their trust model. The Martino case exposes three specific gaps:

• Information compartmentalization: IR firms often get full-scope access to your environment, attack timeline, business impact, and insurance coverage. All of this is leverage for an attacker.
• Conflicts of interest: Negotiation firms that handle multiple simultaneous engagements create a concentration of victim intelligence that's valuable to threat actors.
• Vetting gaps: Background checks and contractual controls for IR retainers rarely match the rigor applied to permanent security hires.

The Kratos Campaign: Trusted Services as Attack Infrastructure

A separate but thematically linked finding: the Kratos PhaaS campaign chains through seven trusted services to harvest M365 credentials. The kill chain exploits trust at every hop — DKIM-validated JP Morgan emails pass SPF/DKIM/DMARC, Cisco Secure Email Gateway redirect links are whitelisted, Nylas tracking pixels are legitimate SaaS, and the landing page sits behind Cloudflare with anti-bot validation that defeats automated sandboxing.

Both the Martino indictment and the Kratos campaign demonstrate the same principle: the most effective attacks don't break trust boundaries — they weaponize them.

200 Days Is Already Here — 47 Days Is Coming

As of March 15, 2026, the CA/Browser Forum's 200-day maximum for TLS certificate validity is in effect. DigiCert moved to 199-day certificates on February 24; SSL.com followed on March 11. The compression trajectory is set and non-negotiable:

• Now: 200-day maximum
• March 2027: 100-day maximum → 3.5 renewals per certificate per year
• March 2029: 47-day maximum → ~8 renewals per certificate per year

For any organization with more than a few dozen certificates, this is an automation-or-outage inflection point. Manual renewal processes that work at 200 days will fail catastrophically at 100 days. The 200-day window is your transition period — use it to implement ACME-based automation before the 2027 deadline makes it mandatory.

PQC: The Other Cryptographic Deadline

Multiple sources converge on the same warning: harvest-now-decrypt-later campaigns are actively collecting encrypted traffic today for future quantum decryption. Keyfactor CSO Chris Hickman estimates U.S. economic exposure exceeds $3 trillion.

What makes this more than a theoretical risk is the scope of the migration challenge. Post-quantum cryptography doesn't just mean upgrading TLS certificates. It requires reaching every cryptographic dependency — and that now includes authenticating thousands or millions of AI agent identities, a dependency most organizations haven't inventoried.

Even if your organization migrates to PQC perfectly, data transiting partner networks using classical-only crypto remains harvestable. PQC is a supply chain problem, not just an internal one.

The recommended approach is a hybrid model: bridging classical and NIST-standardized quantum-resistant algorithms during transition. Prioritize data flows that must remain confidential for 10+ years — IP, M&A activity, customer PII — for immediate hybrid PQC deployment.

The upside of TLS automation: infrastructure capable of automated certificate rotation can also rotate to post-quantum algorithms without manual intervention when the time comes. These two deadlines are converging, and solving one accelerates the other.

The Vulnerability, the Data, and the Market Signal

Three converging data points quantify the AI agent security gap for the first time this week:

1. CVE-2026-25253: A confirmed RCE in OpenClaw affects an estimated 15,200 externally exposed instances. AWS launched managed OpenClaw on Lightsail with Bedrock integration the same week — expanding the attack surface at the worst possible time.
2. 23% prompt injection success rate: Research against OpenAI's Operator agent shows nearly 1 in 4 prompt injection attacks succeed against a production agent with browser and filesystem access. This is against one of the most well-resourced AI companies — baseline success rates against less mature deployments are almost certainly higher.
3. $182M in security funding: Kai raised $125M (Evolution Equity Partners) and Surf AI raised $57M (Accel) specifically for agentic AI security, confirming VCs see this as a large unsolved problem — which means your existing security stack doesn't cover it.

The Architectural Problem

Jensen Huang stood on the GTC stage and publicly called out security vulnerabilities in OpenClaw while pitching Nvidia's NemoClaw as the enterprise alternative. China's cybersecurity agency separately declared OpenClaw "totally insecure." When a $4 trillion company's CEO and a nation-state's security agency agree something is broken, believe them.

The combination of RCE + supply chain risk + overly permissive agent permissions creates a triple-threat scenario: exploitation gives attackers not just code execution, but the agent's full operational scope — file system access, browser sessions, API credentials, and sub-agent delegation chains.

Enterprise AI agent adoption is bottlenecked by permissioning, sandboxing, and regulatory caution — not model capability. The security gap is the constraint, and it's now priced at $182M by the VC market.

What's Different From This Week's Earlier Agent Coverage

Previous briefings covered agent terminal access patterns and NemoClaw's launch. What's new today is the convergence of a specific RCE CVE with quantified prompt injection success rates and venture funding that confirms the gap is real, not theoretical. OpenClaw now has a known vulnerability, a quantified attack success rate, and a market valuation of its security deficiency — all in the same week.