Cybersecurity for companies in the age of AI: the seven areas

A company today runs a website, a mail domain, dozens of cloud accounts, a network device, a backup job and software it did not write. Automated attacks probe all of it.

This guide covers the seven areas Northwestern Tideline looks after: for each, what breaks (a public case or vendor statement), the control, and a check you can run yourself in about ten minutes. Every number traces to a dated source listed at the end. Every check uses only your own admin panels, records and public DNS.

The seven areas at a glance

1. Website, PHP and CMS

What breaks. On 2026-10-22 Lithuania's National Cyber Security Centre (NKSC) published a FAQ on two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 of 10 under CVSS v4.0.

It states that about 80% of Lithuanian websites run on PHP, that the fix was released on 2026-10-21, and that a system on a PHP branch without security updates should be isolated from the internet while the move to a supported branch is assessed. Per php.net (read 2026-10-25), PHP 8.1 reached end of life on 2025-12-31 and 8.2 receives security fixes until 2026-12-31.

The control. A named person updates CMS core, plugins and PHP branch within an agreed window and tests after each move. See PHP supported versions in 2026 and WordPress plugin vulnerabilities: how to know in an hour.

Ten minutes. Read the PHP version in your hosting panel: 8.1 or lower is unsupported today, 8.2 from 2027-01-01. Count pending updates in the CMS dashboard. Our October survey: Lithuanian company websites: security in October 2026.

2. The email domain

What breaks. A forged invoice “from your address” with new bank details is the scenario SPF, DKIM and DMARC exist to make harder.

DMARC tells receiving servers what to do with mail that fails SPF and DKIM: Google's Workspace documentation gives three actions (reject, quarantine or deliver normally), recommends starting at none and moving to quarantine or reject over time, and asks for SPF and DKIM to be in place 48 hours before DMARC.

The control. SPF, DKIM and a DMARC policy of quarantine or reject, with someone reading the reports. Step by step: DMARC p=reject for companies.

Ten minutes. Look up the TXT record at _dmarc.yourdomain with any public DNS tool. No record, or p=none, means your domain does not yet tell receivers to stop forged mail.

3. Accounts: Microsoft 365 and Google

What breaks. On 2026-06-26 the Lithuanian data protection authority (VDAI) announced a €450,000 fine on a medical company for two breaches, one of them a ransomware attack that encrypted four systems holding patient and employee data; for that attack the notice records that privileged users connecting over the internet had no multi-factor authentication and that access was not restricted to authorised persons.

Sophos's State of Ransomware 2026, as cited on the Tideline page, found 79% of ransomware attacks starting with a compromised identity; in 97% of those cases MFA existed somewhere, just not everywhere.

The control. MFA on every account, including admin and shared mailboxes, and legacy protocols switched off. Microsoft's security defaults do this at no extra cost: all users register for MFA, administrators must use it, and legacy authentication (which does not support MFA) is blocked.

Microsoft states that more than 99.9% of common identity attacks are stopped by MFA plus blocking legacy authentication.

Ten minutes. In the Microsoft Entra admin centre open Entra ID, Overview, Properties, Manage security defaults and read whether it is enabled (Microsoft lists the path for a Conditional Access Administrator or higher). In Google Workspace, open the 2-Step Verification setting. List every exception and ask why.

4. VPN and network devices

What breaks. Edge devices face the internet by design. CISA's Known Exploited Vulnerabilities catalogue held 1,756 entries on 2026-10-23; the most recent Fortinet entry, CVE-2025-61624, a path traversal across several Fortinet products, was added on 2026-10-16. An entry there means exploitation has been observed.

The control. Firmware on a supported release, default admin credentials changed and rotated after staff changes, MFA on VPN logins, and the management interface unreachable from the internet.

Ten minutes. Compare the device's firmware version and install date with the vendor's advisory page. If the management interface answers on the public address, that is the first item on the list.

5. Backups

What breaks. On 2026-10-08 BleepingComputer reported a ransomware attack on the Japanese cloud provider IDC Frontier that the provider said began on 7 October and affected 495 companies and local governments using its cloud service. A provider's copies are the provider's recovery plan, not yours.

The control. A copy that ransomware on your network cannot reach (offline or immutable), a scheduled restore test, and a written record of how long it took.

Ten minutes. Find the date of the last restore someone actually performed, not the last backup job that reported success. If nobody can name it, that is the finding. Book a restore of one real folder this week and time it.

6. NIS2 and KSIS evidence

What breaks. Not a breach but a blank: nobody knows whether the Lithuanian Cyber Security Law applies, so nobody owns the deadlines.

The NKSC KSRA FAQ states that entities implement the organisational requirements within 12 months of entry in the registry and the technical requirements within 24 months, names 2026-04-17 as the date by which the organisational requirements had to be in place, puts the first independent audit no later than three years after entry, and says an organisation not in the registry is not obliged to meet the requirements.

Article 18(4) of the law, as cited on the Tideline page, requires an early warning of a significant incident within 24 hours and a notification within 72 hours. NKSC's KSIS page states that only the head of the company may complete the registration form.

The control. An applicability memo with sources, a document pack kept current, and an incident plan someone can follow at 02:00. Details: NIS2 in Lithuania and KSIS: what companies must do.

Ten minutes. Answer in writing: are we in the registry, since when, and who holds the policy documents. If the first answer is "not sure", ask the company head to check, because only that person can sign in.

7. Flaws in the software you already run

What breaks. A fix helps only when someone maps it to what you run. On 2026-10-21 the Node.js project released fixes for 10 CVEs (four high, three medium, three low) in versions 26.12.1, 24.22.1 and 22.23.4, noting that end-of-life versions are always affected when a security release occurs.

One of them, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder bundled with Node.js, which the project says permits remote code execution. Details: The Node.js Brotli vulnerability, CVE-2026-111497.

The control. A written inventory of what runs where (CMS, PHP, Node.js, servers, mail, edge devices) with versions, and a daily watch of primary sources (CVE.org, NVD, CISA KEV, vendor advisories) checked against it. The record, not the headline, decides whether your exact version is affected.

Ten minutes. Start the inventory: one sheet, one row per system, with the version and the person who updates it. Most companies cannot finish in ten minutes, which is itself the result: what is not on the list is not being watched.

Order and limits

Accounts and the email domain first, because that is where sign-ins and payments happen; then the website; then devices and backups; then the NIS2 evidence; finally the standing watch on flaws, which needs the inventory. The cases above were publicly reported; they are examples, not a statistic.

We hold no certification that lets us call anything "compliant" and test nothing without written authorisation. If you would rather someone did the seven checks with you, the Northwestern Tideline security check starts from your website address and email; a person replies within one business day.