AI supply chain security means protecting your business from risks introduced by artificial intelligence tools, their connected applications, and outside services. An AI assistant may seem like just another productivity tool, but when it can access company email, files, customer records, or business systems, it becomes another connection that needs to be managed and protected.

Threat update

Researchers have demonstrated a new attack technique called TrustSink that abuses the multi-factor authentication (MFA) features in Microsoft Entra ID, the identity service behind Microsoft 365. An attacker who gains control of a high-level admin account can quietly add a fake MFA provider to the tenant. From then on, every time a user signs in, that fake provider captures their password in plain text while the login completes normally. Organizations that use Microsoft 365 should review their Entra ID authentication settings and lock down admin accounts now.