AI Evolution Drives New Approaches to Vulnerability Management at Internet Week 2026

Internet Week 2026 marks the 30th edition of the long-running technical conference focused on internet operations, security, governance, and education. The event runs online from November 19 to 24 and onsite at KFC Hall & Rooms in Tokyo from November 25 to 27 under the theme "Learn the Skills to Survive the AI Era." A dedicated basic-level session titled "C7: AI Evolution Brings a New Wave in Vulnerability Response – On-Site Realities and the Future" will examine how rapid AI advances are shortening the window between vulnerability discovery and exploitation. Organizers Iwata Kotono of ICT-ISAC and Ishibashi Takumi of ISOG-J explain that traditional response methods must be reviewed because attackers can now leverage AI to accelerate both discovery and weaponization. The 90-minute program on November 25 features speakers from LAC Corporation, Nikkei, and Secu Pi who will walk through planning, assessment, and remediation while highlighting practical constraints such as budgets and staffing. The session targets security managers, developers, and operators who want to update existing processes rather than adopt entirely new frameworks.

ScanNetSecurityNovember 2, 2026Translated from Japanese

Read at source

Internet Week (IW), the historic technical conference that has brought together engineers involved in internet technology and operations since the 1990s, celebrates its 30th edition in 2026. The event will be held online from November 19 (Thursday) to November 24 (Tuesday), excluding weekends, and onsite from November 25 (Wednesday) to November 27 (Friday) at KFC Hall & Rooms in Ryogoku, Tokyo, under the theme "Learn the Skills to Survive the AI Era."

One of the highlighted programs addresses vulnerability response in the AI era. Organizers Iwata Kotono of the ICT-ISAC and Ishibashi Takumi of the ISOG-J shared the background and key points of the session during an interview.

Re-evaluating Traditional Methods

The rapid evolution of AI is significantly changing the speed and scale of cyberattacks. The number of discovered vulnerabilities is expected to rise, and the time from discovery to exploitation is likely to shrink. The program reviews the fundamentals of vulnerability response while exploring what changes AI introduces, aiming to give participants hints for reassessing their organizations' practices.

Basic Category Session

Classified under the "basic" track, the session starts with overall concepts and planning, then moves through assessment (information gathering and risk evaluation) and remediation (patch verification and deployment). No advanced knowledge is required; familiarity with terms such as vulnerability and patch is sufficient. The content also covers principles that remain important amid AI-driven changes, making it useful for both newcomers and experienced practitioners seeking to review their current approaches.

Speaker Selection Criteria

Speakers were chosen not only for technical expertise but also for their daily thinking on cybersecurity and hands-on experience navigating real-world constraints such as budgets, personnel, and operational impact. The goal is to deliver practical insights that help attendees feel "this could work in my organization."

Three-Part Structure

The session is divided into three parts covering overall thinking, assessment, and remediation, with experts presenting sequentially. Attendees are encouraged to consider whether their own organizations can implement the discussed measures and to share any difficulties during the Q&A.

Connection to the Main Theme

Rather than requiring entirely new methods, the program emphasizes updating existing vulnerability response knowledge and practices to address AI-accelerated threats. "Surviving the AI era" is framed as the ability to correctly understand changes and decide priorities for one's own environment.

Recommended Audience

The session is aimed at security managers, vulnerability response personnel, and those involved in the development, operation, and maintenance of products, systems, and services. No prior deep knowledge of AI or attack techniques is needed.

Expected Outcomes

Organizers hope the session will prompt participants to reflect on gaps between perceived and actual response capabilities, especially when attackers use AI. Attendees are invited to voice organizational challenges so the room can collectively explore solutions.

The program runs on November 25 from 15:00 to 16:30 in the main hall. Confirmed speakers include Inoue Kei (LAC Corporation), Iinuma Tsubasa (Nikkei), and Abe Yosuke (Secu Pi). More details are available at the official Internet Week 2026 site.

Internet Week ICT-ISAC ISOG-J LAC Corporation Nikkei

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in AI & Model Risk

AI & Model Risk

CyberXero Deploys Swarm of 51 AI Agents Against Ukrainian Critical Infrastructure

Researchers at SOCRadar uncovered the CyberXero campaign after discovering an openly accessible HTTP server at 46.21.250.135 that exposed the group's full workspace, logs, tools, and stolen data. The operation ran two parallel tracks using the same infrastructure: one mass campaign against WordPress and e-commerce sites worldwide, and a targeted strike on Ukraine's energy sector and critical infrastructure. Attackers created 51 specialized AI agents inside the Claude Code environment to automate reconnaissance, vulnerability identification, exploit chaining, and data exfiltration. They also integrated the PentAGI framework with Cobalt Strike for payload generation and attack automation while bypassing model refusals by claiming authorized penetration tests. The group relied on known vulnerabilities such as CVE-2026-4815 in WooCommerce rather than zero-days, achieving rapid results including 4,708 hosts scanned and 32 webshells deployed in 61 seconds. The campaign resulted in the theft of 628,000 records, primarily from a Kharkiv heating supplier, containing names, addresses, account numbers, and energy consumption details.

ekurakNov 2, 2026Translated from Polish

AI & Model Risk

Architecture in the Age of Probability: Why Legacy Blueprints Fail in AI-Integrated Banking Systems

The article examines how generative AI and LLM agents are fracturing traditional deterministic enterprise architecture practices, particularly in regulated banking environments. It highlights the gap between perceived productivity gains from AI coding tools and real-world integration challenges, citing METR 2025 randomized tests showing experienced developers taking 19% longer on complex brownfield tasks. Data from GitClear and DORA reports reveal rising code churn rates and declining delivery stability as cheap AI-generated code floods systems without proper semantic alignment to legacy constraints. Russian regulatory requirements under 187-FZ for critical information infrastructure, 850-P for operational resilience, and 3-MR guidance on human-in-the-loop controls force architects to redesign systems around probabilistic components rather than fixed blueprints. The piece details new guardrails including fitness functions, per-invocation delegation tokens, default-off policies for vendor AI, and exit paths for model drift. It concludes that architecture must now focus on boundaries, interception points, and auditability instead of prescriptive designs.

HabrNov 2, 2026Translated from Russian

AI & Model Risk

AI Hackers vs AI Defenders: Arms Race Accelerates Cyber Espionage in 2026

Roman Strelnikov, head of information security at 1C-Bitrix, examines how AI is transforming both offensive and defensive operations in cybersecurity. Attackers are automating reconnaissance, vulnerability exploitation, and data theft at unprecedented speeds, while organizations increasingly rely on AI agents to manage code, data, and infrastructure. Anthropic's September report highlights the group GTG-20006, linked to the Russian espionage actor Midnight Blizzard, which used Claude to develop tools, prepare phishing infrastructure, collect data, and manage multi-stage operations. The campaign targeted government institutions, diplomatic organizations, and defense enterprises across more than 20 entities in a prolonged effort. The article outlines five key risks emerging from this AI-driven arms race and provides recommendations for mitigation based on real 2026 incidents.

HabrNov 2, 2026Translated from Russian