From the PrOTect IT All Weekly Security Brief, sent to the list on October 8, 2026.
Your firewall did not stop USB drives in 2005. It did not stop Dropbox in 2012. It will not stop Linda from uploading your quotes to a free AI tool today.
This week's episode: "AI Is the New Shadow IT: Why Blocking It Never Worked with Jack Smith"
Jack Smith has 25 years in enterprise IT and hosts the IT Horror Stories podcast. His point is a simple one: AI is not a new problem, it is the latest version of an old one. If you have ever wondered how to actually respond when employees start using AI tools before you have a policy, this conversation gives you a real framework for thinking it through - including the uncomfortable question of what happens when a system that gives a different answer every time is trusted to make a decision that has to be consistent.
Listen: https://protectitallpod.com/ep126/
This week in cyber
CISA published an advisory on end-of-life Hitachi Energy RTU500 firmware version 9.x, with findings reported by Dragos. If you are running RTU500 devices on legacy firmware, this is worth reading - end-of-life means no patch is coming, so your options are mitigation or replacement.
https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-06
Johnson Controls EasyIO FG building controllers have vulnerabilities that can give an attacker full unauthorized access to the device. Building controls are easy to forget about in an OT security review, but they sit on your network and in your facilities.
https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-01
Hitachi Energy's SOI product has a remote code execution vulnerability in its Apache ActiveMQ component. RCE in an OT-adjacent product is about as serious as it gets - an attacker who gets there can affect confidentiality, integrity, and availability all at once.
https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-04
Do this this week
Pull up the three CISA advisories above and run them against your asset inventory. It should take under an hour. If you find a match - a Hitachi Energy RTU500, REB500, SOI, Asset Suite, or a Johnson Controls EasyIO FG - flag it now and get the right people in the same room. Knowing you have an exposed device is always better than not knowing.
Short of the week
This week's short is about why the easy fixes still get skipped.
https://www.youtube.com/shorts/7KqZ7tI0S30
If this show has helped you, a YouTube subscribe goes a long way - we are working toward 500 subscribers at https://www.youtube.com/@PrOTectITAll.
Aaron