The Week in Tech: Why Cloud Resilience, Remote Access and AI Security Matter Now

For Australian businesses, the latest technology news carries a practical message: cloud platforms are becoming more capable, but also more connected and more dependent on sound security fundamentals.

Introduction

The past seven days have brought a mix of security warnings and cloud innovation. Microsoft has published new intelligence on how attackers are abusing legitimate remote management tools, while its latest defence report highlights the growing links between identities, cloud systems, applications, software supply chains and AI agents.

There is also useful news for organisations trying to modernise without expanding their IT teams. AWS is promoting more automated security testing and remediation, while Cloudflare has introduced a serverless event streaming service aimed at reducing infrastructure overhead for developers.

The common thread is control. Businesses need to know who and what can access their systems, which services are critical, where data is moving, and how quickly they can respond when something changes. Here are the five developments business leaders should understand.

1. AI is accelerating cyber risk, but the basics still decide the outcome

Microsoft released its 2026 Digital Defense Report on October 1. The report describes a security environment where threats move across infrastructure, identities, applications, cloud environments and software supply chains. It also notes that attackers are using AI to improve reconnaissance, social engineering, malware development and post-compromise activity.

The important point for smaller organisations is that AI has not replaced familiar attack methods. It is making them faster, more targeted and easier to scale. Phishing remains phishing, compromised credentials remain compromised credentials, and an exposed service is still an exposed service. The difference is that attackers may now be able to personalise campaigns, search for weaknesses and automate parts of an intrusion more efficiently.

Microsoft also highlighted the security implications of AI agents. These systems can access business data, APIs and applications on behalf of users. That can create productivity gains, but it also introduces questions about identity, permissions, monitoring and revocation.

For a business, an AI tool should not be treated as just another application. It may be able to read documents, send messages, create records or trigger workflows. If its access is too broad, a compromised account or poorly designed integration could create a much larger incident.

According to the Microsoft Digital Defense Report, established controls such as least privilege, identity protection, monitoring, secure software development and data protection remain central to managing the risk.

Why it matters for businesses

• A single stolen identity can provide a path into email, cloud storage, finance systems and customer data.
• AI assistants and agents can create new data handling and privacy risks if employees use them without clear approval.
• Insurance, customer contracts and privacy obligations increasingly depend on evidence that access and security controls are being managed.
• Security teams need visibility across email, endpoints, cloud applications and identity systems rather than relying on isolated alerts.

Practical recommendations

• Create an approved list of AI tools and document what data each tool is allowed to process.
• Review permissions for Microsoft 365, Google Workspace, cloud consoles and other business-critical services.
• Require phishing-resistant MFA for administrators and high-value accounts wherever possible.
• Remove dormant accounts, unused applications and excessive permissions at least quarterly.
• Make sure security alerts from identity, endpoint and cloud systems reach someone who can act on them.

2. Attackers are abusing legitimate remote management tools

A Microsoft investigation published on September 29 examined phishing campaigns that abused legitimate remote monitoring and management software. The attackers reportedly distributed a signed MSP360 installer using deceptive filenames and familiar business lures such as meeting invitations, document-sharing pages and software update prompts.

After the software was executed, the attackers used it to launch PowerShell and install ConnectWise ScreenConnect. That created a second remote access channel, giving the attackers persistence and additional control over compromised devices.

This is not a story about one product being inherently unsafe. It is a warning about the way legitimate tools can be repurposed. Remote management software is essential for managed service providers and internal IT teams, but it is also attractive to criminals because it can blend into normal administration.

The issue is particularly relevant to Australian small and medium-sized businesses that rely on an MSP. A business may have strong endpoint protection yet still be exposed if an attacker persuades an employee to install a legitimate support tool or if an old remote access agent remains active after a contract ends.

Microsoft's threat intelligence advisory on RMM abuse provides detection and hunting guidance. The key lesson is that organisations need to manage remote access as a privileged capability, not as ordinary desktop software.

Why it matters for businesses

• Unauthorised remote tools can bypass normal support processes and provide direct access to devices.
• A compromised remote management account may expose multiple customers if an MSP environment is affected.
• Legitimate software can make incidents harder to detect because security teams may initially treat it as approved activity.
• The reputational impact can be significant when customers learn that an attacker used a trusted service or supplier as an entry point.

Practical recommendations

• Maintain a current inventory of every remote support and monitoring tool installed across company devices.
• Require approval before new remote access software can be installed or executed.
• Use allow lists, application control and endpoint detection policies to flag unapproved RMM tools.
• Review MSP accounts, installer permissions, session logs and technician access regularly.
• Disable or remove remote access agents when staff leave, suppliers change or devices are retired.
• Ask your IT provider how it detects suspicious use of its own tools and how quickly it will notify you.

3. A Zimbra vulnerability shows why internet-facing services need urgent attention

Microsoft Threat Intelligence has reported exploitation of CVE-2026-73570, an unauthenticated command injection vulnerability affecting the Zimbra Collaboration Suite when the optional Zimbra SNMP package is installed and notifications are enabled.

The vulnerability can be triggered through a specially crafted email sent to an internet-facing server. Microsoft observed attackers using the flaw to deploy web shells and reverse shells, escalate privileges, collect authentication material and establish persistent remote access. The company reported activity across more than one region and industry.

Zimbra version 10.1.20, released on July 20, includes the relevant remediation. Microsoft also advised organisations to remove the optional package or disable SNMP notifications where patching must be delayed, while restricting exposure to trusted hosts.

This is a useful reminder that the risk profile of an internet-facing service is determined by configuration as well as software version. An organisation may have a supported product but still be vulnerable because an optional component was enabled years ago and forgotten.

The Microsoft advisory on CVE-2026-73570 includes technical indicators and remediation guidance. Even businesses that do not use Zimbra should take the broader lesson seriously: public-facing systems require an accurate asset register, fast patching and continuous review.

Why it matters for businesses

• Email and collaboration servers contain sensitive conversations, contacts, credentials and business records.
• A server compromise can become a wider identity or ransomware incident.
• Attackers may use legitimate administrator tools and ordinary shell commands, so antivirus alone may not provide enough protection.
• Unpatched systems can create privacy, contractual and regulatory exposure, particularly where customer or employee information is stored.

Practical recommendations

• Confirm whether your business or suppliers operate internet-facing Zimbra servers or other self-hosted collaboration platforms.
• Prioritise vulnerabilities that allow unauthenticated remote code execution or command injection.
• Review optional modules, plugins and services that are not required for day-to-day operations.
• Restrict management interfaces and mail services using firewalls, VPNs, network segmentation and trusted source addresses.
• Investigate unexpected web shells, reverse shells, new services, scheduled tasks and changes to privileged accounts.
• Rotate credentials and authentication secrets after a suspected compromise, not just after applying a patch.

4. Cloud security automation is moving from advice to action

AWS has used a recent security announcement to promote AWS Continuum, an approach designed to discover, prioritise, validate and remediate security risks with machine assistance. The service is intended to work with existing security services and to help teams determine which findings are genuinely exploitable and which require urgent attention.

The opportunity is clear for organisations with small IT teams. Security tools can generate more findings than people have time to investigate. Automated validation and prioritisation may help reduce noise, focus attention on exposures that affect important systems and speed up routine remediation.

However, automation should not mean unrestricted autonomous change. A poorly configured remediation workflow could interrupt a production application, lock out users or remove a resource that was needed for a business process. The safest approach is to begin with visibility, testing and approvals before allowing automated changes in production.

The AWS Security Blog announcement describes machine-speed security as a way to reduce manual coordination around vulnerability management. For smaller organisations, the practical value may come less from adopting a new branded service and more from applying the operating model: centralise findings, rank them by business impact and make remediation measurable.

Why it matters for businesses

• Automated triage can help small teams deal with cloud security findings more consistently.
• Faster vulnerability validation may reduce time spent chasing false positives.
• Security automation can support evidence collection for audits and customer assurance requests.
• Automation without change control can create operational risk of its own.

Practical recommendations

• Start with a complete inventory of cloud accounts, subscriptions, workloads, storage and identities.
• Define which systems are critical before setting remediation priorities.
• Use policy-as-code and configuration monitoring to detect drift from approved settings.
• Test automated remediation in a non-production environment before enabling it on live services.
• Require human approval for actions that affect identity, networking, databases or customer-facing applications.
• Track metrics such as time to detect, time to validate and time to remediate.

5. Serverless event streaming could simplify data-heavy applications

Cloudflare announced K2 in public beta on October 1. The service provides durable, ordered event streams on its developer platform, allowing applications to write events once and let multiple consumers process them independently.

For example, an online retailer might generate an order event that needs to be read by fulfilment, analytics and fraud detection systems. Rather than forcing all systems to process the event at the same time, an event stream can hold the data while each consumer works at its own pace.

Cloudflare says K2 is built on R2 object storage and is designed for high-scale data movement, long-term retention and fan-out consumption. It is available to Workers Paid accounts in public beta, with beta limits including 10 GB of storage and 30 MB per second of produce capacity per stream. Cloudflare says usage will not be billed during the beta period, with pricing expected later.

This is not an immediate recommendation for every SME. It is more relevant to software companies, ecommerce businesses and organisations building real-time workflows. But it illustrates a broader trend: cloud providers are packaging infrastructure capabilities that previously required specialist teams to operate.

The Cloudflare K2 announcement explains how the service separates event producers from consumers and supports independent readers. Businesses considering similar services should still evaluate retention, portability, security controls, regional processing and exit options before committing important data.

Why it matters for businesses

• Serverless services can reduce the need to manage clusters, brokers and scaling infrastructure.
• Durable event storage can improve resilience when downstream systems are unavailable.
• Independent consumers can support analytics, fraud detection and operational workflows without duplicating data capture.
• Public beta services may change their limits, features and pricing, so they should be tested carefully.

Practical recommendations

• Identify business processes that would benefit from asynchronous processing rather than immediate system-to-system calls.
• Test event replay, failure recovery, retention and duplicate handling before using a new platform in production.
• Confirm where data is stored and whether the service meets customer, privacy and contractual requirements.
• Use strong API authentication, short-lived credentials and separate environments for development and production.
• Review exit plans and make sure events can be exported or reconstructed if the service changes.

What This Means For Your Business

The news this week is not a reason to panic or to buy every new security product. It is a reason to make the basics visible and repeatable. Know your important systems, know who can access them, know which remote tools are installed and know how quickly your team can respond to a high-risk alert.

For most SMEs, the best first steps are practical: turn on strong MFA, remove unused accounts, patch public-facing systems, review supplier access and test backups. If your business uses AI tools, add them to the same governance process as other software. Decide what data they can access, what actions they can take and how their access will be revoked.

Cloud innovation can help businesses do more with smaller teams, but convenience does not remove responsibility. Before adopting a new SaaS, serverless or AI service, check its security model, data location, retention rules, incident notification commitments and pricing after any trial or beta period.

A short review with your IT provider this week can uncover more risk than another month of reacting to headlines. Focus on identity, exposure, remote access, recovery and supplier accountability. Those controls remain useful whether the next threat arrives through email, an internet-facing server, a cloud console or an AI-enabled workflow.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.