Hristiyan Lazarov

BSI publishes countermeasures against evasion attacks on LLMs The German Federal Office for Information Security (BSI) has released “Evasion Attacks on LLMs – Countermeasures in Practice.” The paper addresses a rising threat to AI systems based on LLMs: evasion attacks. Unlike data poisoning, these attacks happen during operation. Attackers use indirect prompt injections, jailbreaks, or adversarial prompts to bypass or manipulate a model’s intended behavior and safeguards. BSI recommends practical countermeasures, including: 1) Secure and well-defined system prompts 2) Filtering harmful third-party content 3) Explicit user confirmation before executing sensitive actions The attached checklist and real-world examples help integrate these measures into existing systems. The guidance targets developers, IT leaders, and public institutions using pre-trained LLMs such as OpenAI’s GPT.

80

3 Kommentare

The first Cyber Matters Podcast of 2026 is here and its a cracker 💥 Dr. Heiko Klarl, CEO of Nexis, frames the real challenges behind identity and access management In our latest episode, hosted by Tom Wilding and Gia Thomas at neuco! Passwords are broken. How has the industry continued moving forward? ⦿ Passkeys & OIDC ⦿ Decentralised identity models ⦿ Hyperscaler-backed sync And… addressing the tension between privacy and convenience. Has the journey to a passwordless future already began? Thank you for being a guest Heiko! 🔗 Link to full podcast in the comments! #neuco #podcast

14

3 Kommentare

Facts on the table: The latest IT Security Situation Report by the Bundesamt für Sicherheit in der Informationstechnik (BSI) shows the pressure on cybersecurity is far from easing. Many organisations still lack clarity on which vulnerabilities are most critical – or where immediate action is needed. The numbers offer that clarity. From unpatched systems to growing supply chain risks, the data outlines where we stand as we enter 2026: Evolving threats, exposed infrastructures, and a growing need for shared resilience. Security, IT, OT, public sector – we all need facts to prioritise and act. Let’s use them to drive progress. In Germany and across Europe. 🌍 Stay informed with it-sa 365! 🦾 #itsa365

15

The Munich Security Conference 2026 was shaped by competing tales about the state of the rules-based international order.   In some accounts, the order is damaged or entirely broken; in others, it is being overhauled. But while interpretations differed, the responses converged around two types of urgent efforts: building better bulwarks in defense of cherished values and rules, especially on the European continent, and exploring new coalitions to fill at least some of the global governance gaps.   Against this backdrop, our #MSC2026 Debrief, written by Sophie Eisentraut and Randolf Carr, distills four key insights that shaped this year’s debates, and sum up the most important debates from three busy conference days.   👉 You can find them summarized below—or read the full Debrief on our website: https://lnkd.in/g45mkdTu

71

3 Kommentare

𝗚𝗲𝗿𝗺𝗮𝗻𝘆'𝘀 𝗗𝗶𝗴𝗶𝘁𝗮𝗹 𝗦𝘂𝗿𝘃𝗲𝗶𝗹𝗹𝗮𝗻𝗰𝗲 𝗧𝗼𝗼𝗹𝗸𝗶𝘁 𝘐𝘯𝘤𝘳𝘦𝘢𝘴𝘦𝘥 𝘜𝘴𝘢𝘨𝘦 𝘰𝘧 𝘵𝘩𝘦 𝘚𝘵𝘢𝘢𝘵𝘴𝘵𝘳𝘰𝘫𝘢𝘯𝘦𝘳 State surveillance software, or "Staatstrojaner", functions similarly to conventional malware, enabling unauthorized access to a target's device to monitor communications and extract data. In #Germany, the Federal Office for the Protection of the Constitution (#BfV) has increasingly utilized such tools to intercept encrypted communications, such as those on WhatsApp or Telegram, by deploying spyware directly onto its civilians' devices. This approach allows for real-time surveillance and retrospective analysis of chat histories. The legal framework for such operations was established in June 2021, permitting intelligence agencies to conduct "Quellen-Telekommunikationsüberwachung". This method captures communications at the source, either before encryption or after decryption, thereby circumventing traditional encryption barriers. According to CypSec Group's analysis, the BfV employed this technique against over 6.000 civilians in 2024, facilitating the automated monitoring of their communications. Law enforcement agencies have also adopted these tools under the provisions of the Code of Criminal Procedure since 2017. Unlike intelligence services, police are authorized to perform "Online-Durchsuchung" (online searches), granting them broader access to stored data, including documents, images, and other files. However, the deployment of such software remains relatively infrequent, with official statistics reporting 49 instances of source telecommunications surveillance and six online searches in 2022. The deployment of state surveillance software raises significant cybersecurity and ethical concerns. These tools often exploit undisclosed vulnerabilities in software, which, if left unreported, can be used by malicious actors, thereby increasing the overall risk to digital infrastructure. These tools have been implicated in surveillance activities by intelligence agencies targeting journalists, activists, and political opponents, such as the Alternative für Deutschland (#AfD) Many instances have been documented where such tools have been repurposed by unauthorized parties to install additional malware, conduct unauthorized surveillance, or exfiltrate sensitive data. The lack of transparency and accountability in the deployment undermines public trust and poses challenges to democratic oversight. The inherent capabilities of such #spyware, including keylogging, screen capturing, and remote activation of microphones and cameras, amplify the potential for political and economic abuse. The increasing utilization of state surveillance software by German intelligence and law enforcement agencies thus severely undermine individual rights. #StateSurveillance #DigitalRights #PrivacyProtection

36

4 Kommentare

🔐 The CISO's Role Is Evolving – From Defender to Strategic Enabler In today’s financial sector, cybersecurity is no longer just a technical challenge — it's a strategic imperative. As highlighted in PwC Germany’s latest article, from Jakob, Ugur and myself, CISOs are stepping into a new role: strategic pacemakers who help to shape business decisions. 💡 The shift is clear: - Cyber risks are now board-level concerns. - Regulatory pressure is increasing focus on technical implementation. - Cyber Resilience is a key differentiator in a competitive market. To meet these demands, CISOs must go beyond information security. They need to: ✅ Operationalize the cyber risk management with measurable KPIs ✅ Communicate the risks effectively with executive leadership ✅ Foster a culture of cyber security across the entire organization This transformation opens exciting opportunities for CISOs to become architects of trust and drivers of innovation in their organization. 🔗 Read the full article here: https://lnkd.in/gRG7eVGR #CyberSecurity #CISO #FinancialSector #Leadership #DigitalTransformation #PwC, Alina Jean Gerhards, Jakob Böhmer Ugur Demir, Karsten Wilop, Moritz Anders, Dr. Alexander Köppen, Philipp Schulz, Andreas Eichmann, Jörg Botsch, Thomas Klir, Leonie Baranowski

62

6 Kommentare