New CISA initiative aims to help critical infrastructure operators prepare for disruptions.

Summary

By the N2K CyberWire staff

New CISA initiative aims to help critical infrastructure operators prepare for disruptions.

The US Cybersecurity and Infrastructure Security Agency (CISA) yesterday announced "CI Fortify," an initiative aimed at ensuring critical infrastructure operators are prepared to maintain essential operations during a geopolitical conflict. The agency stated, "For planning purposes, operators should assume that in a conflict scenario third-party connections–such as telecommunications, internet, vendors, service providers, and upstream dependencies–will be unreliable and that threat actors will have some access to the OT network. Isolation and Recovery are emergency planning objectives that can mitigate this threat within the next few years."

CISA's Acting Director, Nick Andersen, told reporters that the agency will be conducting targeted assessments of critical infrastructure entities to help them update their continuity plans so they can operate for weeks while isolated.

The browser is the new endpoint. Are you securing it?

Today’s work happens in the browser - but that’s also where new risks live. From shadow IT to session-based threats, critical activity often goes unseen.

NordLayer Browser gives IT teams visibility and control inside the browser itself—helping protect company data and enforce security across SaaS apps without disrupting workflows.

If your security stack stops short of the browser, it may be time to take a closer look.

Taiwanese police arrest student for allegedly hacking train systems.

Police in Taiwan have arrested a 23-year-old university student for hacking the TETRA (Trans-European Trunked Radio) communication system used by the country's high-speed railway network, BleepingComputer reports. The suspect allegedly used software-defined radio (SDR) equipment he bought online to intercept and decode TETRA radio parameters, then programmed them into handheld radios to impersonate beacons used by the railway. These radios were used to transmit a "General Alarm" signal, which triggered emergency brakes and halted four trains for about 48 minutes on April 5th. The suspect is facing several criminal charges, including causing a danger to public transportation. His lawyer claims the transmission of the alarm signal was an accident.

Taiwanese politicians have also criticized the railway's operators for negligence following reports that the radio parameters had not been rotated in nineteen years.

Join SASEfy 2026: The Summit for SASE and AI on May 20

AI adoption across tools, applications, and agents is outpacing governance. Teams must understand where AI introduces risk, how data is exposed, and how agentic behavior impacts control. Join Cato, Microsoft, Forrester, and Dayforce at SASEfy 2026, the summit for SASE and AI, on May 20 at 12p ET to identify risk, secure AI, and adapt Zero Trust for agentic AI.

Scam apps offer fake phone call records.

ESET has published a report on a large-scale Android scam campaign dubbed "CallPhantom," involving 28 malicious apps available on the Google Play store. The apps, which were downloaded more than 7.3 million times, have since been removed by Google.

The apps purported to give users access to call histories, SMS records, and WhatsApp call logs for any phone number, asking users to make a payment in order to unlock these features. ESET notes, "Unsurprisingly, our analysis showed that the 'call history' data provided by this app is entirely fabricated – the app generates random phone numbers and matches them with fixed names, call times, and call durations, which were embedded directly in the code."

Track global cyber threats with the Microsoft Threat Intelligence podcast

Step into the frontlines of cyber defense with the Microsoft Threat Intelligence podcast. Hear from intelligence experts as they share how they track APTs, gangs, malware, and emerging vulnerabilities. Each episode delivers key insights into espionage, attacker tradecraft, and the skills needed for modern threat hunting. Listen in and stay one step ahead.

Notes.

Today's issue includes events affecting Taiwan, and the United States.

Attacks, Threats, and Vulnerabilities

AI in the Breach: How an Adversary Leveraged AI to Target a Water Utility’s OT (Dragos) Dragos analyzed an adversary using Claude AI to target a water utility's ICS environment. See how AI is changing the OT threat landscape.

Poisoned truth: The quiet security threat inside enterprise AI (CSO Online) Enterprise AI systems can be corrupted through data poisoned by accident, adversaries, or bad hygiene. Most organizations have no idea how large that attack surface is — or whether they’re already exposed.

Trends

Opinion: The U.S. and China Have a Common Foe. Hint: It’s Not the U.S.S.R. (New York Times) The summit between President Trump and President Xi Jinping in Beijing next week could be the most significant encounter between American and Chinese leaders since Richard Nixon met Mao Zedong in Beijing in 1972.

Litigation, Investigation, and Law Enforcement

Noyb cries foul on LinkedIn withholding profile visitor data (The Register) : GDPR Article 15 doesn't care if you want to make money by selling users' data back to them

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

CyberArk IMPACT 2026 (Austin, Texas, USA, May 11 - 13, 2026) At CyberArk IMPACT, cybersecurity practitioners and leaders will come together to explore today’s #1 attack vector – identity. Attendees will acquire a deep understanding of the latest developments in identity-based cyberattacks, including sophisticated attacker techniques that leverage AI and other methods. And most importantly, they will learn how to shut out attackers and prevent unauthorized access by securing every identity across the organization with the right level of privilege controls.

VeeamON 2026: Data & AI Trust Converge for the Agentic Era (Virtual and New York, New York, USA, May 12, 2026) VeeamON Online broadcasts the NYC keynote and select breakout content live and on demand. You’ll hear directly from the teams building the platforms, the customers operating at scale, and the leaders navigating real-world AI risk.

KB4-CON 2026 (Orlando, Florida, USA, May 12 - 14, 2026) Since its inception in 2018, KB4-CON has evolved from a user-focused gathering to the must-attend event for anyone serious about staying ahead in the security landscape. It is the human risk management industry’s premier event, bringing together KnowBe4 customers, channel partners, prospects, plus security advocates and industry professionals. This is your exclusive opportunity to engage with and learn from the industry’s most influential players, all under one roof.

ASCEND 2026 (Washington, DC, USA, May 19 - 21, 2026) ASCEND connects the civil, commercial, and national security space sectors, along with adjacent industries, to embrace the opportunities and address the challenges that come with increased activity in space. Building our sustainable off-world future requires long-term thinking. Strategic planning, innovation, scientific exploration, and effective regulations and standards will help us preserve space for future generations. ASCEND will enable the technical exchanges, debates, and collaboration that will help forge a sustainable off-world future for all.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 05.07.26

Top stories.

New CISA initiative aims to help critical infrastructure operators prepare for disruptions.

Taiwanese police arrest student for allegedly hacking train systems.

Scam apps offer fake phone call records.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Litigation, Investigation, and Law Enforcement

Events