- CIOsurge
- Posts
- š”ļø First large-scale AI-orchestrated espionage attempt disrupted
š”ļø First large-scale AI-orchestrated espionage attempt disrupted
AI-Orchestrated Espionage Disrupted, Migration Projects Overrun Budgets, Repurpose-Then-Productize Insights from Cy Khormaee
Aimply Team & Zack Tembi
November 17, 2025
AI-Orchestrated Espionage Disrupted, Migration Projects Overrun Budgets, Repurpose-Then-Productize Insights from Cy Khormaee
Powered by Single Fin
Welcome to this weekās edition of CIOsurge!
This week:
A mid-September campaign used agentic AI for 80ā90% of intrusion steps; treat enterprise agents like least-privilege service accounts with strong guardrails.
DevOps migrations bled a median $315K and ran 18% over planāprioritize integration-first modernization with SLO gates and security sign-off.
From Cy Khormaee: repurpose existing distribution/telemetry, seed bottom-up adoption, then productize once pull is undeniable.
Letās make this week a game-changer.
Stay sharp. Stay ahead.
š” Guest Expert Insights: Cy Khormaee
š Phishing Explodes, Legacy Fails
Email phishing has evolved faster than defenses can adapt. Static rules and signature lists canāt keep up with attackers who now blend automation, AI, and personalization to bypass filters built for yesterdayās patterns. What worked for spam in 2015 breaks against socially engineered, context-rich campaigns in 2025.
Three forces drive the spike: (1) AI-generated emails indistinguishable from humans, (2) massive credential exposure fueling more targeted access, and (3) distributed work reducing network-layer insight. Prevention now demands behavioral and contextual learning systems that adapt in real time, not point updates. The future of email security is continuous understanding, not static defense.
š”ļø First large-scale AI-orchestrated espionage attempt disrupted
A provider reports disrupting a mid-September 2025 cyber-espionage campaign that used agentic AI to execute 80ā90% of intrusion steps. Attributed with high confidence to a Chinese state-sponsored group, the attackers jailbroke Claude Code, chained tools via MCP, and probed ~30 global targets before accounts were banned and authorities notified.
Treat agents like non-human service accounts with least-privilege, purpose binding, egress controls, and kill switches. Log and inspect prompts, tool calls, and data flows; rate-limit automated actions; whitelist MCP tools; and require vendors to deliver misuse detection, audit feeds, and incident-response SLAs.
On defense, pilot SOC automation for reconnaissance/credential-harvest signatures, wire deception and canary creds, and rehearse āagentic incidentā playbooks. Segment model access, segregate secrets, and gate any code-execution toolchains behind human checkpoints. Assume automation speedādesign detections and workflows to match it.
- Zack Tembi
š Migration projects bleed $315K on average
CloudBeesā 2025 DevOps Migration Index (300+ leaders) finds the average platform migration costs $315K. 57% spent >$1M last year; projects ran 18% over plan; 94% saw no performance gains; 60% missed revenue. 61% cited migration fatigue, 70% developer burnout, 74% more tool sprawl, and 70% had AI pushed without security review.
Stop defaulting to rip-and-replace. Prioritize integration-first modernization, set SLO-based success gates, and require security sign-off for any AI in pipelines. Tie funding to realized performance and revenue, not completion dates.
Tactics: strangler-fig pattern over big-bang cutovers; parallel-run windows; time-boxed proofs of value; renewal guardrails; dedicated change-management budgets. If value isnāt visible by gate two, pause or narrow scope.
- Zack Tembi
šļø At A Glance
š” CIO Spotlights
Sony Music Publishing appoints Michael Young as CIO to drive tech transformation
Michael Young joins Sony Music Publishing as CIO, reporting to CFO Tom Kelly and based in Nashville.
With 25+ years in IT leadership, including at Chatham Financial and Reuters, Young will lead global technology, data, and transformation initiatives.
CEO Jon Platt says Youngās expertise will help advance SMPās mission to better support songwriters worldwide.
TD Bank hires Kiran Vuppu as U.S. CIO to drive tech transformation
TD Bank appointed Kiran Vuppu as U.S. CIO, tasking him with leading technology strategy, delivery, and modernization across the bankās U.S. operations.
Vuppu brings 20+ years of financial-services tech experience from Wells Fargo, J.P. Morgan, Bank of America, IBM, and others.
CEO Leo Salom praised Vuppuās background in product transformation and GenAI as key to advancing TDās tech capabilities.