Three stories, one thread
The VPN flaw was a logic error in certificate validation that let an attacker open a session without a password. It sat in deployments still configured for a protocol deprecated years ago, and it was exploited for over a month before it was found. The advice afterwards was pointed: audit the logs and the configuration; do not assume the patch closes the exposure.
The ERP flaw was worse. A zero-day in an environment-management component, scored near the top of the severity scale, exploited over a two-week window against more than a hundred organisations worldwide — more than two-thirds of them universities — and later confirmed as used by ransomware actors. One institution said a “significant amount” of its student records had been compromised and that the matter was with the police.
The survey was quieter. More than half of organisations hit by impersonation attacks this year; nearly half encountering synthetic-media impersonation of an executive or brand; fewer than half testing their own exposure; and four percent — four — saying they fully monitor and control their AI agents. At a fifth of companies, no single team owns digital-trust risk.
The reporting drew the conclusion itself: the common thread is not the sophistication of the attackers but how much of the exposure sits in configurations and processes organisations already knew were weak.
Why the ERP matters more than the VPN
A VPN is a door. An ERP is the building. The student-records system, the HR platform, the finance ledger, the claims system — these are the systems of record, and they are both the target and the payload: the attacker wants what is in them, and what is in them is the organisation’s most consequential data.
They are also, precisely, the systems that agentic AI programmes are now being designed to write to. An agent that updates a student’s enrolment, raises a purchase order, adjusts a customer’s account or closes a claim needs write access to the system of record. That is the point of the agent. It is also a change in the value of a compromise: an attacker who reaches the agent’s credential, or the integration the agent uses, has a programmatic, high-volume path into the system that a stolen human login never gave them.
So the order of work is not “deploy the agent, then harden the ERP”. It is the reverse, and the week’s news is the case for it.
What “known-weak” looks like in practice
- Deprecated configuration that nobody removed. The VPN flaw lived in a protocol replaced years ago. Every ERP estate has its equivalent: an old integration user with a standing password, an environment-management component exposed because it always was, a customisation from a departed contractor. The agent will be wired into that estate as it is.
- Patch cadence built for a slower world. A zero-day exploited across a two-week window, against systems that typically patch quarterly. The exploitation window is now hours; the systems of record cannot stay on a maintenance-window cadence and be connected to anything that acts at API speed.
- Split ownership. A fifth of organisations have no single owner for digital-trust risk; security operations, fraud and threat intelligence share it unevenly. Add agents — owned by the AI team, connected by integration, acting in systems owned by finance or HR — and the gap widens unless someone is named.
- Third parties that “maintain the platform”. The breached university was “working with the third party that maintains the platform”. Most ERPs are. The processor question from earlier this year applies: what does the maintainer hold, on what terms, and who tells your students.
Impersonation now includes agents
The survey’s headline was human impersonation — executives and staff, increasingly with synthetic media. The four-percent figure sits beside it for a reason. An agent acting in a system of record has an identity, and that identity can be impersonated, hijacked or simply over-granted exactly as a person’s can. The controls are the same ones organisations are slowly applying to executives: a verified identity per agent, not a shared service account; scoped permissions matched to the job description; a way to test the exposure; and a single owner who can answer “what did that identity do, and was it really the agent?”
Before the agent is connected
A short list, in order, for any system of record about to receive its first agent: remove the deprecated configuration and the standing credentials; bring the patch cadence to the reality of a same-day exploitation window; give the agent its own identity with the narrowest possible write scope; make the system’s own change history the audit trail; name the owner of the risk. None of it is new technology. All of it was already known to be weak, which is exactly the point the week made.
