Welcome to your essential briefing on threats at the intersection of cybersecurity and critical infrastructure, brought to you by Neeve, the edge cloud security platform for smart buildings, making built spaces secure, intelligent, and sustainable.

This Week’s Cyber Insights

• 🔐 NIST Releases Practical Zero-Trust Implementati …

• 🏭 Manufacturing AI Security Paradox: IT/OT Conver …

• 🛡️ AI Agents Transform Proactive Cybersecurity De …

• 🤖 ComfyUI AI Framework Breach Exposes 700+ Server …

• 📰 Further Alerts & Insights

🔐 NIST Releases Practical Zero-Trust Implementation Guide for Critical Infrastructure

The National Institute of Standards and Technology has released comprehensive guidance (SP 1800-35) providing 19 real-world examples of zero-trust architecture implementations using commercial off-the-shelf technologies. Developed through a four-year project with 24 industry collaborators at NIST's National Cybersecurity Center of Excellence, the guidance emphasizes that every ZTA implementation should be treated as a custom build tailored to specific organizational network environments and operational requirements.

• Phased approach starting with asset discovery and inventory of all hardware, software, applications, data, and services

• Risk-based gap analysis to segment infrastructure and protect critical resources with policy enforcement points

• Incremental deployment beginning with identity, credential, and access management solutions plus multifactor authentication

• Continuous monitoring and verification of network traffic for suspicious activity with periodic policy effectiveness testing

• Integration mapping to existing cybersecurity frameworks including NIST Cybersecurity Framework and SP 800-53

🤔 The Bigger Picture:

This practical ZTA guidance addresses the urgent need for building operators and facility managers to implement zero-trust principles across converged IT/OT environments. The phased implementation approach is particularly relevant for smart buildings where traditional network perimeters have dissolved due to IoT devices, cloud connectivity, and remote access requirements for HVAC, lighting, and security systems.

Read the full article

🏭 Manufacturing AI Security Paradox: IT/OT Convergence Creates New Attack Surfaces

The surge in AI adoption has created a cybersecurity paradox for manufacturers, where the benefits of AI-driven digital transformation are offset by dramatically increased attack surfaces as IT and OT environments converge. Rockwell Automation's 2025 State of Smart Manufacturing Report identifies cybersecurity as the #2 external risk for manufacturers, with more than a third of manufacturing executives prioritizing IT/OT security architecture strengthening over the next five years.

• Historically secure OT environments now exposed to internet-based attacks through IT/OT convergence

• AI-powered threat actors using automated vulnerability detection and reconnaissance to map manufacturing plant topologies

• Traditional air-gapped networks no longer providing protection as connectivity requirements increase

• Threat actors targeting OT environments where "crown jewels" of manufacturing businesses reside

• Network Detection and Response (NDR) solutions emerging as critical defense against AI-accelerated attacks

🤔 The Bigger Picture:

The convergence of IT and OT systems driven by AI adoption has eliminated traditional security boundaries that protected manufacturing operations. For facility managers overseeing smart buildings and industrial operations, this represents a fundamental shift requiring new security architectures that can protect converged environments while enabling necessary connectivity for AI-powered automation and optimization systems.

Read the full article

🛡️ AI Agents Transform Proactive Cybersecurity Defense Strategies

Enterprise security teams are deploying agentic AI systems to combat AI-powered attacks that are outpacing traditional reactive cybersecurity approaches, with 47% of AI-enhanced phishing attempts successfully bypassing screening filters in 2024. Agentic AI operates with high autonomy, enabling security teams to predict, detect, and respond to cyber threats at machine speed while reducing false positives and automating time-consuming analysis tasks.

• Autonomous threat detection that can suggest actions independently and may soon operate with full autonomy

• Rapid analysis reducing hundreds of pages of documentation to actionable insights in seconds rather than hours

• Advanced pattern recognition parsing vast datasets to identify stealth campaigns and hard-to-detect anomalies

• Intelligence layer winnowing false positive alerts before they reach human analysts, saving hours of grunt work

• Proactive defense strategies enabling teams to stay ahead of evolving risks and reduce attack effects before they occur

🤔 The Bigger Picture:

The shift from human-directed to AI-autonomous cybersecurity represents a fundamental change in how critical infrastructure operators must approach defense. For building operators and facility managers, agentic AI offers the potential to monitor complex smart building ecosystems autonomously, identifying threats across HVAC, lighting, access control, and energy management systems without requiring dedicated cybersecurity personnel for each facility.

Read the full article

🤖 ComfyUI AI Framework Breach Exposes 700+ Servers to Sophisticated Malware

A coordinated cyberattack against ComfyUI, a popular AI image generation framework, has compromised at least 695 servers worldwide, highlighting the emerging threat landscape targeting AI infrastructure used across industrial and commercial sectors. China's National Cybersecurity Notification Center issued urgent warnings after threat intelligence firm XLab discovered the sophisticated "Pickai" backdoor campaign, which began in February 2025 and escalated significantly in March.

• Attackers compromised Rubick.ai, a commercial AI platform serving over 200 major brands including Amazon and Myntra, potentially creating an upstream vector for further propagation

• Primary infections concentrated in Germany, the United States, and China, with C2 traffic spikes exceeding 400 daily active installations

• Malware creates five synchronized copies across system directories, masquerading as legitimate services like auditlogd and hwstats

• Attackers registered new C2 domain with five-year expiration, indicating sustained campaign commitment

• Employs XOR encryption, process spoofing, and anti-debugging techniques while appending random data to avoid hash-based detection

🤔 The Bigger Picture: 

This attack represents a significant escalation in threats against AI infrastructure, particularly concerning for organizations deploying AI models in industrial environments. Building operators and facility managers utilizing AI-powered systems for automation, energy management, or security should immediately audit their AI deployment stack and implement network segmentation to isolate AI processing environments.

Read the full article

Further Alerts & Insights