Tech Features

Making Sense of Identity Threat Risks

Published

1 year ago

September 5, 2024

By David Warburton, Director, F5 Labs

The growing maturity of cloud computing, including shifts towards decentralized architectures and APIs, has highlighted the complexity of managing credentials in increasingly interconnected systems. It has also underlined the importance of managing non-human entities like servers, cloud workloads, third-party services, and mobile devices.

F5 Labs’ 2023 Identity Theft Report defines identity as an artifact that an entity uses to identify itself to a digital system – such as a workload, a computer, or an organization. Examples of digital identities include username/password pairs and other personally identifiable information or cryptographic artifacts such as digital certificates.

Digital identities cannot stand on their own. They require a system to accept and validate them. In other words, for a digital identity to function there must be at least two parties involved: an entity and an identity provider (IdP) that are responsible for issuing and vetting digital identities. However, not all organizations that provide resources are IdPs—many digital services rely on third-party IdPs such as Google, Facebook, Microsoft, or Apple to vet identities.

Based on our recent analysis, the three most prominent forms of attack in the identity threat arena currently are credential stuffing, phishing, and multi-factor authentication (MFA) bypass.

Credential stuffing

Credential stuffing is an attack on digital identity in which attackers use stolen username/password combinations from one identity provider to attempt to authenticate to other identity providers for malicious purposes, such as fraud.

It is a numbers game that hinges on the fact that people reuse passwords,
but the likelihood that any single publicly compromised password will work on another single web property is still small. Making credential stuffing profitable is all about maximizing the number of attempts, which requires automation.

Phishing

Phishing is perhaps rivaled only by denial of service (DoS) attacks in being fundamentally different from other kinds of attacks. It is an attack on digital identity, to be sure, but since it usually relies on a social engineering foothold, it is even more difficult to detect or prevent than credential stuffing.

Phishing attacks have two targets: there is the end user who is in possession of a digital identity, and there is the IdP, which the attacker will abuse once they’ve gotten credentials. Depending on the motives of the attacker and the nature of the system and the data it stores, the impact of a successful phishing trip can land primarily on the user (as in the case of bank fraud), solely on the organization (as in the case of compromised employee credentials), or somewhere in the middle.

On the attacker side, phishing can range from simple, hands-off solutions for unskilled actors to custom-built frameworks including infrastructure, hosting, and code. The most hands-off setup is the Phishing-as-a-service (PhaaS) approach in which the threat actor pays to gain access to a management panel containing the stolen credentials they want, and the rest is taken care of by the “vendor.”

Dark web research indicates that the most popular subtype of phishing service is best described as phishing infrastructure development, in which aspiring attackers buy phishing platforms, infrastructure, detection evasion tools, and viable target lists, but run them on their own.

Brokering phishing traffic, or pharming, is the practice of developing infrastructure and lures for the purposes of driving phishing traffic, and then selling that traffic to other threat actors who can capitalize on the reuse of credentials and collect credentials for other purposes.

Finally, the attacker community has a niche for those who exclusively rent out hosting services for phishing.

The most important tactical development in phishing is undoubtedly the rise of reverse proxy/ man-in-the-middle phishing tools (sometimes known as real-time phishing proxies or RTPPs), the best known of which are Evilginx and Modlishka. This is largely because it grants attackers the ability to capture most multi-factor authentication codes and replay them immediately to the target site facilitating MFA bypass but also making it less likely that the user victim will detect anything is amiss.

Multi-factor authentication (MFA) bypass

Recent years have seen attackers adopt a handful of different approaches to bypassing multi-factor authentication. The differences between these approaches are largely driven by what attackers are trying to accomplish and who they are attacking.

Nowadays, the reverse proxy approach has become the new standard for phishing technology, largely because of its ability to defeat most types of MFA.

MFA bypass tactics include:

Malware. In mid-2022, F5 malware researchers published an analysis of a new strain of Android malware named MaliBot. While it primarily targeted online banking customers in Spain and Italy when it was first discovered, it had a wide range of capabilities, including the ability to create overlays for web pages to harvest credentials, collect codes from Google’s Authenticator app, capture other MFA codes including SMS single-use codes, and steal cookies.

Social engineering. There are several variations of social engineering for bypassing MFA. Some target the owner of the identity, and some target telecommunications companies to take control of phone accounts.

Social Engineering for MFA Code—Automated. These are attacks in which attackers make use of “robocallers” to make phone calls to the target, emulating an identity provider and asking the victim for an MFA code or one-time password (OTP).

Social engineering for MFA code—Human. This is the same as the above approach except that the phone calls come from humans and not an automated system.

SIM swaps. In this kind of attack, a threat actor obtains a SIM card for a mobile account that they want to compromise, allowing them to assume control of the victim’s phone number, allowing them to collect OTPs sent over SMS. There are several variations of this approach.

So, what does it all mean?

Identity threats are constant and continuous. Whereas a vulnerability represents unexpected and undesirable functionality, attacks on identity represent systems working exactly as designed. They are therefore “unpatchable” not only because we can’t shut users out, but because there isn’t anything technically broken.

This brings us back to the question of what digital identity really is. To go from real, human identity to digital identity, some abstraction is inevitable (by which we mean that none of us is reducible to our username-password pairs). We often teach about this abstraction in security by breaking it down to “something we know, something we have, and something we are.” It is this abstraction between the entity and the digital identity that attackers are exploiting, and this is the fundamental basis of identity risk.

By thinking about digital identities in this way, what we are really saying is that they are
a strategic threat on par with, but fundamentally different from, vulnerability management. With nothing to patch, each malicious request needs to be dealt with individually, as it were. If modern vulnerability management is all about prioritization, modern identity risk management is essentially all about the ability to detect bots and differentiate them from real human users. The next logical step is quantifying the error rate of detecting these attacker-controlled bots. This is the basis on which we can begin to manage the risk of
the “unpatchables.”

Tech Features

Yango Tech: Four Game-Changing Tools Revolutionising Retail Operations

Published

10 hours ago

October 30, 2025

Integrator Web-Admin

A wide angle shot of a robotic arm by Yango Tech in an industrial setup

Consumer demand in the Middle East is rising fast, driven by omnichannel shopping habits and the expectation of speed and accuracy. AI-powered automation has become essential for retailers to keep up. McKinsey projects AI contribute up to $150 billion to GCC economies by 2030, while the UAE’s retail sector is forecast to reach $74.87 billion by 2028. Yango Tech has outlined four key tools retailers can use to succeed in this environment.

1. AI Agents

AI agents are transforming retail with several capabilities. On the front end, they deliver contextually relevant recommendations in real time, tailoring offers based on location, cultural moments, or the weather, while conversational AI enriches the journey with human-like assistance in native languages. They also harness predictive capabilities by analysing unstructured data, from social media to past purchase behaviour, to anticipate shifts in demand and refine pricing or promotional strategies. Ahead of Eid Al-Adha, for instance, they might spotlight premium meat cuts or traditional Arabic sweets, helping retailers unlock revenue increases of 10–15%.

Beyond customer-facing roles, AI agents drive efficiency behind the scenes. Procurement agents compose RFPs, compare vendor offers, and execute sourcing decisions directly in procurement systems, saving up to 80% of manual effort. Replenishment agents forecast inventory gaps, adjust orders dynamically, and use computer vision to redistribute stock or reroute deliveries, boosting accuracy to 95% and cutting waste. Content management agents accelerate time-to-listing by auto-generating product cards, adapting content to trends, and ensuring consistency across markets. Pricing agents track competitor SKUs and demand elasticity in real time, optimising promotions and delivery fees to protect margins while sustaining competitiveness.

2. Smart Price Tags

Price intelligence has become crucial for staying competitive with today’s informed and price-sensitive shoppers. Dynamic pricing algorithms can review millions of products in minutes, optimising strategies at a speed human decision-making cannot match. By applying ML to track competitor pricing, market trends, and demand elasticity, retailers can adjust prices in real time, boosting gross merchandise value by up to 20%. These systems also factor in seasonal shifts, fluctuating supply costs, and product shelf life, while surge pricing AI manages delivery fees or order values during peak periods to protect margins. Digital twin technology strengthens this further by creating virtual replicas of stores, streaming data from sensors and cameras into pricing systems. This real-time visibility into shelves and product movement ensures that pricing decisions are tied directly to availability, enabling retailers to reduce waste, streamline operations, and maintain customer trust while driving profitability.

3. Computer Vision

Computer vision (CV) is redefining how retailers manage store layouts and product assortments by moving beyond static, manually updated plans. Instead of relying only on historical sales data, AI agents equipped with CV analyse real-time customer traffic and interactions to continuously optimize shelf arrangements and product placement. This creates store environments that adapt dynamically to shopper behaviour, boosting sales and improving the overall experience. CV also provides granular insights into store-specific conditions, from equipment to layout constraints, enabling smarter decisions. Beyond the shop floor, warehouses use CV to monitor dispatch accuracy, logistics teams track the condition of trucks in transit, and managers can oversee staff performance in real time. Paired with augmented reality, the technology also delivers richer customer engagement, allowing shoppers to virtually try on clothes or visualize furniture directly in their homes.

4. Robotic automation

Robotics is moving from concept to necessity in retail. In warehouses, robotic pickers trained through behavioural cloning by human experts and thousands of real-world warehouse scenarios reach up to 95% picking accuracy. With the repetitive warehouse tasks taken over, staff can focus on higher-value work and boost productivity.

Autonomous delivery robots are also emerging as practical solutions for dense urban areas. Equipped with high-precision navigation, they operate 24/7 and cut emissions compared to traditional vehicles. They complement existing fleets by reaching locations where larger vehicles cannot, supporting zero-emission urban logistics. As battery technology and urban infrastructure advance, their role in retail operations will continue to expand.

Tech Features

From Control to Intelligence: Why the GCC Is Poised to Lead the Next Security Evolution

Published

1 week ago

October 21, 2025

Integrator Web-Editor

By Wei Huang, Chief Technology Officer, Anomali

In cybersecurity, each era is defined by a shift in architecture. Firewalls dominated the 2000s. Endpoint protection and identity controls shaped the 2010s. Today, we are entering a new phase — one where cloud-native platforms, real-time data correlation, and AI-powered analytics are no longer optional but essential.

Nowhere is this transition more timely than in the Gulf Cooperation Council (GCC) region. As cloud adoption accelerates across the United Arab Emirates (UAE), Saudi Arabia, and neighboring states, national cybersecurity resilience has become a critical pillar of digital transformation. GCC organizations have a unique opportunity to leap ahead — bypassing legacy limitations and adopting next-generation security architectures purpose-built for today’s advanced threats.

The Core Shift: Security Is Now a Data Problem

For decades, cybersecurity focused on control: firewalls, proxies, endpoint agents, and network gateways. While these tools remain foundational, today’s adversaries have evolved. Attackers exploit gaps between systems, bypass controls through misconfigurations, and evade siloed defenses with increasing sophistication.

The result is a fundamental architectural shift: modern security is no longer solely about enforcing control — it’s about processing data. Effective defense requires ingesting, normalizing, and correlating telemetry across every layer of the enterprise: endpoints, cloud workloads, SaaS platforms, identity systems, and external intelligence feeds. When combined with AI-powered analytics, this data-driven approach transforms raw telemetry into actionable insights, allowing defenders to outpace attackers, rather than merely react, once an attack has been detected.

Cloud-Native Design: The Architecture That Scales

Traditional security information and event management (SIEM) systems and on-premises platforms struggle to meet the scale, flexibility, and speed required in modern hybrid environments. Cloud-native architectures, by contrast, offer elastic scalability that aligns directly with national digital transformation priorities across the GCC.

However, the scale of telemetry introduces new challenges. Global cloud storage volumes are projected to reach 100 zettabytes by the end of 2025. Storing and processing such massive datasets can quickly become prohibitively expensive — unless managed with modern design principles.

The solution lies in the security data lake: a unified, long-term, cloud-native repository capable of retaining years of structured and unstructured security data. Unlike legacy systems limited to weeks or months of visibility, a security data lake enables continuous historical analysis for threat hunting, compliance, and investigations.

Crucially, modern architectures decouple storage and compute. Instead of permanently allocating compute resources (as most legacy platforms do), serverless designs apply compute power only when needed, dramatically reducing cost while enabling faster analysis.

For example, by leveraging serverless infrastructure on Amazon Web Services (AWS), Anomali enables compute bursts across thousands of nodes, delivering correlations and searches up to 1,000 times faster, at a fraction of the cost of traditional solutions. This approach is particularly aligned to national resilience goals, where speed and efficiency are essential.

Real-Time Correlation at Petabyte Scale

Today’s attackers automate their reconnaissance, probing continuously for vulnerabilities across every layer of the enterprise. To keep pace, organizations must reduce detection time and response costs, which demands real-time correlation across petabytes of data.

By integrating telemetry from multiple domains — including firewalls, endpoints, SaaS platforms, identity providers, and threat intelligence — organizations gain visibility into attacks that no single control would detect alone. For GCC enterprises expanding hybrid and multi-cloud infrastructures, the ability to correlate across these diverse sources in real time is mission-critical.

AI Delivers Context, Not Just Alerts

Artificial intelligence is now widely marketed in cybersecurity, but much of it offers opaque conclusions without transparency — effectively adding noise rather than clarity.

True AI-powered defense must provide explainability. Anomali applies chain-of-thought (CoT) AI reasoning, ensuring every detection includes the rationale, evidence, and audit trail behind each decision. This transparency builds analyst confidence and accelerates skill development, particularly valuable as GCC nations continue building local cybersecurity talent and operational maturity.

Intelligence Closes the Gaps Left by Controls

Even with modern defenses in place, critical gaps remain. Studies show that many endpoint detection and response (EDR) solutions still miss up to 30% of advanced threats, thanks to sophisticated evasion techniques, configuration gaps, or partial visibility. Firewalls suffer similar challenges: misconfigurations and limited context allow adversaries to slip past perimeter defenses.

This is where intelligence plays a decisive role. By unifying diverse telemetry and correlating billions of daily security events, modern security analytics platforms fill these blind spots, delivering full-spectrum detection across hybrid environments. For critical infrastructure, financial institutions, and government entities in the GCC, closing these gaps is no longer optional — it is a resilience imperative.

Agentless, Serverless, Effortless

Managing thousands of endpoint agents introduces complexity, operational risk, and resource overhead. Cloud-native platforms eliminate much of this friction by integrating directly with cloud platforms, SaaS services, and enterprise infrastructure via secure APIs, allowing telemetry ingestion without deploying additional agents.

For organizations balancing hybrid complexity with cloud-first strategies, agentless deployment models dramatically simplify operations — enabling faster rollout, lower risk, and greater agility.

Why the GCC Is Uniquely Positioned to Lead

The UAE, Saudi Arabia, and neighboring GCC nations are investing heavily in smart cities, digital economies, and next-generation public services. These national ambitions require security platforms that are scalable, adaptive, intelligent, and capable of evolving alongside rapid technological change.

Cloud-native, AI-powered, intelligence-driven security operations are no longer a distant vision but an operational necessity. By embracing these architectures, GCC enterprises and governments are positioned not only to meet today’s security demands, but to set a global standard for the future of cyber defense.

The time to shift from fragmented controls to unified intelligence is now. The future of security isn’t about deploying more tools — it’s about building smarter platforms.

And the GCC is ready.

Wei Huang is the Chief Technology Officer at Anomali, a global leader in intelligence-driven cybersecurity solutions.

Tech Features

Shure’s Growth Story in the Middle East and Beyond

Published

1 month ago

September 30, 2025

Integrator Web-Admin

As the region accelerates its digital and cultural transformation, professional audio will only grow in importance.

By Yassine Mannai, Associate Director Sales, Shure MEA

A portrait of Yassine Mannai, associate director sales, Shure MEA — Yassine Mannai, Associate Director Sales, Shure MEA

The Middle East and Africa (MEA) region is witnessing an extraordinary moment of profound transformation as nations continue to reimagine their respective economies. Cities across this vibrant region are increasingly positioning themselves as global hubs, anchored on rapid technological shifts. From national diversification agendas such as Saudi Arabia’s Vision 2030 to the UAE’s expanding cultural economy and Africa’s urbanization, the region is rethinking how it communicates, collaborates, and entertains. Against this backdrop, professional audio integration has emerged as the key enabler. Pro audio is no longer viewed as luxury; it has become a strategic pillar of productivity, culture, and trust.

For Shure, this represents fertile ground for growth. The company’s trajectory in the region is anchored on a clear multi-prong approach: sustainable value creation through localization, strong partnerships, and continuous education. Rather than chasing short-term wins, the focus is on building strong ecosystems where audio technology empowers organizations to achieve their ambitions.

A Partner in Regional Growth

Demand for professional audio is being fueled by three key drivers. First, the large-scale investments in infrastructure and cultural projects trend in the region is creating an appetite for reliable, scalable audio solutions. Second, with hybrid work and learning still active, audio systems now serve as must-have tools for collaboration, ensuring clarity and engagement. Third, the entertainment and events industry continues to flourish, with audiences expecting immersive sound experiences with emotional connection.

Shure’s presence in conferences, cultural centers, and classrooms underscores its adaptability. By aligning closely with each sector’s needs, the company is not just supplying equipment – it is shaping how people experience communication and culture. Providing the ultimate IT and meeting room solutions is one thing, ensuring that end-user requirements in meeting spaces are consistently met is where the rubber meets the road, which makes factors such as quality, form factor, and smart solutions that leverage technology for seamless integration crucial.

A Strategy Anchored on Three Pillars

Shure’s growth blueprint rests on localization, partnerships, and education.

Localization ensures that global standards are adapted to regional requirements. A broadcaster in Abu Dhabi may demand wireless mobility, while a university in Riyadh seeks scalable, user-friendly systems. Meeting these nuanced needs requires agility and customization.
Partnerships with distributors, integrators, and resellers expand reach and sustain service excellence. These trusted relationships are critical to delivering value on the ground.
Education equips professionals with the right skills to maximize technology investments. Through training initiatives, Shure empowers AV specialists to deploy and maintain systems effectively, ensuring customers achieve long-term returns.

Technology and Innovation at the Forefront

We strongly believe that the future of audio in the region will be shaped by three defining trends.

Immersive experiences are becoming a cultural norm, and audio must now create impact as much as it delivers clarity.
AI and intelligent systems are moving from concept to reality making adaptive audio that responds to its environment the way to go.
Hybrid environments will remain central to work and education even as physical and virtual interactions merge with audio determining whether collaboration succeeds or fails.

A century of sound, a future of possibility

This year, Shure marks its 100-year anniversary. Few technology brands reach such a milestone, and fewer still do so with their reputation for quality and trust intact. For customers and partners in MEA and beyond, the centennial is not merely a celebration of heritage. It is a reassurance that Shure’s next century will be guided by the same principles that made it a global leader – with innovation, reliability, and customer focus at the core.

As the region accelerates its digital and cultural transformation, professional audio will only grow in importance. For IT leaders, this means viewing sound not as an afterthought, but as a strategic layer of infrastructure – one that underscores effective communication, collaboration, and connection.

Shure’s growth story is far from complete. The company’s next chapter is being written in partnership with the region’s institutions and enterprises. And in an age where voices need to be heard clearly across physical and digital spaces, Shure’s mission remains simple: to deliver sound that empowers progress.