Für Laien mag das wie ein Märchen klingen, aber: Das Gesicht eines Menschen ist wie ein offenes Buch. Es erzählt von Charaktereigenschaften, Denkmustern und natürlich auch vom Führungsstil. Die Wurzeln dieser Wissenschaft der Psychophysiognomie reichen Jahrtausende zurück und werden heute in vielen Bereichen genutzt, von der Kriminalistik bis zur Persönlichkeitsentwicklung. 

 

Das Bewegungsnaturell

Die Formensprache eines Gesichts gibt wertvolle Hinweise. Markante, eckige Formen wie ein breiter Kiefer und dominante Wangenknochen deuten auf das Bewegungsnaturell hin. Solche Chefs sind „Macher“, lieben Herausforderungen und handeln zielstrebig. Ihr Führungsstil ist dynamisch und durchsetzungsstark. 

Doch es gibt eine Kehrseite: Diese Persönlichkeiten können dominant wirken und wenig Geduld aufbringen. Ihre direkte Art fordert klare Kommunikation und schnelle Ergebnisse. 

Umgangstipp: Begegnen Sie solchen Chefs mit gut strukturierten Vorschlägen, ohne lange Erklärungen. Struktur und Fakten statt Emotionen sind hier der Schlüssel. Respektieren Sie seine Entscheidungsfreude, aber zeigen Sie, dass Sie selbst eine starke Position vertreten können. 

 

Das Empfindungsnaturell

Chefs mit feinen, zarten Gesichtszügen und großen Augen sind dem Empfindungsnaturell zuzuordnen. Diese Persönlichkeiten sind kreativ, emphatisch und feinfühlig. Sie legen Wert auf ein harmonisches Arbeitsumfeld, lieben den Dialog und entwickeln kreative Lösungen gemeinsam mit ihrem Umfeld. 

Aber aufgepasst: Ihre hohe Sensibilität macht sie empfänglich für Konflikte oder Spannungen. Kritik sollte stets diplomatisch formuliert werden, da sie schnell als persönliche Ablehnung wahrgenommen werden kann. 

Umgangstipp: Bauen Sie Vertrauen auf, zeigen Sie Wertschätzung und Respekt und präsentieren Sie Ideen als Teil eines gemeinsamen Prozesses. 

 

Das Ernährungsnaturell

Schließlich gibt es Chefs, deren Gesichtszüge durch runde Formen geprägt sind – typische Zeichen des Ernährungsnaturells. Sie schätzen Stabilität, Behaglichkeit und klare Strukturen. Ihr Führungsstil ist pragmatisch und auf langfristige Sicherheit ausgerichtet. Sie sind ausgezeichnete Netzwerker und lieben es, Ressourcen zu planen und zu verteilen.  

Achtung: Ihre Komfortzone kann manchmal eine gewisse Trägheit mit sich bringen und sie neigen dazu, Veränderungen nur sehr langsam zu akzeptieren. Sie schätzen bewährte Lösungen und haben eine Vorliebe für Traditionen. 

Umgangstipp: Argumentieren Sie pragmatisch und betonen Sie die Vorteile von Stabilität und Sicherheit. Geben Sie ihnen die Zeit, neue Ideen zu durchdenken und zeigen Sie vor allem klar auf, wie einfach und sinnhaft die Umstellung zum langfristigen Erfolg beiträgt. 

 

Die Mischung macht’s: Kombinierte Naturelle und ihre Ansprechbarkeit

In der Realität sind die wenigsten Menschen einem einzigen Naturell klar zuzuordnen. Häufig vereinen Gesichter Merkmale von zwei – manchmal sogar drei – Naturellen. So treffen beispielsweise die Zielstrebigkeit des Bewegungsnaturells und die Empathie des Empfindungsnaturells aufeinander oder die Stabilität des Ernährungsnaturells wird durch kreative Aspekte des Empfindungsnaturells ergänzt. 

Viele Führungspersönlichkeiten sind übrigens klare Bewegungs-Ernährungs-Naturelle, da der ihnen innewohnende Pragmatismus und die Zielorientiertheit durch die Dynamik des Bewegungsnaturells angeschoben wird. 

Tipp: Achten Sie darauf, welche Merkmale stärker ausgeprägt sind, und gestalten Sie Ihr Verhalten und Ihre Kommunikation entsprechend, das eröffnet ganz neue Möglichkeiten der Zusammenarbeit. 

 

„Du“-Denken oder „Ich“-Denken: Welcher Typ ist Ihr Chef? 

Ein weiterer Aspekt der Gesichtsdeutung ist, ob jemand im „Ich-“ oder „Du-Modus“ agiert. Eingefallene Wangen und eine große Nase deuten auf ein „Ich“-Denken hin – ergebnisorientiert und zielgerichtet, aber weniger mitarbeiterbezogen. Eine hohe Stirn, volle Wangen und offene Augen signalisieren dagegen den „Du-Modus“. Solche Chefs schätzen Teamgeist und gemeinsame Lösungen. 

Tipp: Stimmen Sie Ihre Kommunikation darauf ab. „Ich“-Denker schätzen klare Ergebnisse, während „Du“-Denker einen wertschätzenden Dialog bevorzugen. 

 

Nutzen statt Urteilen: Wie Gesichtslesen Ihre Arbeitsbeziehung verbessert

Die Psychophysiognomie ist keine Wahrsagerei, sondern eine klare Methode, um Menschen besser zu verstehen. Indem Sie die Gesichtsstruktur Ihres Chefs analysieren, erkennen Sie, was ihn antreibt und wie Sie Konflikte vermeiden können. Dieses Wissen hilft, Vertrauen aufzubauen und effektiver zu agieren. 

Fakt ist, das Gesichtslesen schärft den Blick für die Einzigartigkeit jedes Menschen, reduziert Missverständnisse und verbessert die Zusammenarbeit. In einer Welt, die stark von zwischenmenschlichen Verbindungen abhängt, ist dies ein unschätzbarer Vorteil. 

Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented even by companies reporting strong financial performance.

But it’s not just AI leading to workforce cuts. Complementing this technological shift are ongoing economic uncertainty, inflation, and higher interest rates, compounded by a chip shortage and rising energy costs. This mix is driving companies to cut costs and streamline operations for increased efficiency.

According to data compiled by Layoffs.fyi, an online tracker that keep tabs on job losses in the technology sector, 123,941 tech employees were laid off at 269 companies in 2025. The site also reports that 71,981 government employees were laid off by DOGE alone, with 182,528 total federal workers laid off.

Here is a list — to be updated regularly — of some of the most prominent technology layoffs the industry has experienced recently.

Notable tech layoffs in 2026

• Monday.com
• Microsoft
• Meta
• Cisco
• Cloudflare
• Oracle
• Atlassian
• Salesforce
• Amazon
• Ericsson

July 22, 2026: Monday.com cuts 20% of its workforce to restructure for the AI era

The company says the decision to cut 620 jobs isn’t about margins, but about creating a flatter organization built around AI agents, autonomous teams, and deeper customer engagement.

July 6, 2026: Microsoft cuts 4,800 jobs, primarily in sales and Xbox teams

As the company trims thousands of jobs, it’s also investing in embedded engineering teams and AI infrastructure. The layoffs come several weeks after the company offered 8,750 US employees voluntary retirement buyouts.

June 5, 2026: Tech industry cut 38,242 jobs in May, worst since 2024

AI was blamed for 40% of the job cuts in May, up from 7% in January, according to research by employment placement company Challenger, Gray & Christmas.

May 20, 2026: Meta cuts 8,000 jobs, around 10% of workforce

The cuts are expected to expected to hit Meta’s engineering and product teams the hardest, arriving as Meta pivots toward AI to boost efficiency across its organization, according to Yahoo Tech.

May 13, 2026: Cisco to cut nearly 4,000 jobs despite strong growth in AI, enterprise networking

Despite reporting positive financial news — including record third-quarter revenue of $15.8 billion, a 12% year-over-year increase — Cisco said it will eliminate almost 4,000 jobs.

May 7, 2026: Cloudflare to cut 1,100 jobs in AI-focused restructuring

About 20% of Cloudflare’s global workforce will be culled as the company pivots for the agentic AI era, Reuters reported.

April 1, 2026: Oracle to cut up to 30,000 jobs globally, putting enterprise support and roadmaps at risk

Oracle began laying off employees on March 31 in what could be the largest workforce reduction in the company’s history. Employees received termination emails at 6 a.m. local time with immediate system lockouts and no prior warning. (Note: in June, CNBC put the final layoff tally at 21,000.)

March 12, 2026: Atlassian cuts 1,600 jobs to fund AI and enterprise expansion

Atlassian will reduce its global workforce by approximately 10%, eliminating around 1,600 roles, as the collaboration software maker redirects capital toward artificial intelligence development and enterprise sales.

March 11, 2026: Tech layoffs surpass 45,000 in early 2026

A recent analysis by RationalFX found 45,363 job cuts globally so far this year—with roughly 68% or more than 30,000 occurring in the U.S. — highlighting ongoing workforce cuts even as many tech companies report strong revenue growth.

February 10, 2026: Salesforce lays off staffers as executive leadership churn continues

Salesforce has reduced close to 1,000 roles earlier this month across teams, including marketing, product management, data analytics, and its Agentforce AI unit, Business Insider reported, quoting employees familiar with the matter.

January 23, 2026: Amazon layoffs expected to disproportionately hit AWS and tech talent

As the market slows down, AWS and other Amazon units are preparing for another round of layoffs, which is expected to overwhelmingly impact tech talent. An email from HR leader Beth Galetti on Jan. 28 confirmed 16,000 job cuts.

January 15, 2026: Ericsson plans to shed 1,600 jobs in Sweden

 Ericsson lans to cut some 1,600 jobs in Sweden, the telecommunications equipment maker said doubling down on recent cost-saving measures that have helped it weather a prolonged downturn in telecoms spending, Reuters reports.

January 13, 2026: Meta plans to cut around 10% of employees in Reality Labs business

Meta plans to cut around 10% of the employees in its Reality Labs division who work on products including the metaverse, according to three people with knowledge of the discussions, according to The New York Times.

Layoffs in 2025

• Cisco
• Oracle
• Windsurf
• Intel
• Microsoft
• Crowdstrike
• HPE
• Autodesk
• HPE
• CISA
• Workday
• Salesforce
• Meta

Global tech-sector layoffs surpass 244,000 in 2025

Economic uncertainty, elevated interest rates, and AI adoption have driven workforce reductions across tech companies worldwide, according to a RationalFX report.

October 28, 2025: Amazon to cut 14,000 jobs across company

Amazon will reduce its overall workforce by 14,000, cutting layers of management across the company and hiring in some areas to support its “biggest bets”.

August 18, 2025: Cisco and Oracle to cut hundreds of Bay Area jobs

Tech companies Cisco and Oracle are cutting hundreds of jobs across the Bay Area. Cisco will eliminate 221 positions at its Milpitas and San Francisco offices, effective Oct. 13. Oracle is reducing 101 positions in Santa Clara on the same date 

August 5, 2025: 3 weeks after acquiring Windsurf, Cognition offers staff the exit door

Cognition, the AI coding startup that acquired rival company Windsurf three weeks ago, laid off 30 employees last week and is offering buyouts to the roughly 200 remaining employees on the team, reports The Information.

July 25, 2025, Intel to lay off 22% of workforce, CEO Tan signals ‘no more blank checks’

Intel will reduce its workforce to 75,000 employees by the end of 2025 as new CEO Lip-Bu Tan implements sweeping changes designed to transform the struggling chipmaker

July 8, 2025, Intel layoffs begin: Chipmaker is cutting many thousands of jobs

Intel has begun laying off employees across the company. CEO Lip-Bu Tan told workers back in April to expect major layoffs at Intel in the coming months as the chipmaker slashes costs and overhauls its organization after years of technical setbacks and falling sales.

July 2, 2025: Microsoft will cut 9,000 workers

Microsoft will lay off about 9,000 employees, a source familiar with the workforce cut told CNBC.  The cuts will reportedly affect less than 4% of Microsoft’s global workforce and will impact different teams, geographies and levels of experience. This is the latest in a string of cuts the tech giant has made this year.

June 17, 2025: Intel looks to factory layoffs to return to profitability

Intel will lay off up to 20% of its manufacturing sector employees starting in July, according to media reports, as the company looks for options as it seeks a return to profitability. The cuts reportedly will be made around the world, but some of the layoffs will be closer to home, according to a report in The Oregonian citing an internal company memo from Intel manufacturing Vice President Naga Chandrasekaran.

May 7, 2025: CrowdStrike to lay off 5% of staff

CrowdStrike announced a plan to cut about 500 roles, roughly 5% of its workforce, to streamline operations and reduce costs. The cybersecurity company will incur about $36 million to $53 million in charges related to the layoffs

March 6, 2025: HPE cuts 2,500 jobs, remains committed to Juniper buy

CEO Antonio Neri told Wall Street analysts that HPE would begin implementing a cost-cutting program involving layoffs of about 2,500 employees over the next 18 months. HPE employs about 61,000 people worldwide.

Feb. 27, 2025: Autodesk to lay off 9% of workforce

Software maker Autodesk is laying off 1,350 staff. With the rise of subscription and multi-year contracts billed annually, and self-service enablement, it finds it needs fewer sales staff, CEO Andrew Anagnost said in a message to employees. And with its cloud, platform, and AI products proving most profitable, it’s concentrating its staff and investments there.

Feb. 27, 2025: HP to lay off 2,000 more

As part of an ongoing restructuring, HP plans to lay off up to another 2,000 workers. In recent weeks, the company has tried — unsuccessfully — to do away with telephone support staff by forcing callers to wait for at least 15 minutes if they refuse to use self-service support resources online. The company swiftly backtracked, but wider job cuts are still on.

Feb. 21, 2025: CISA lays off 130

Government employees get laid off too: In this case, 130 workers at the US Cybersecurity and Infrastructure Security Agency are being shown the door as a result of a DOGE decision. Cybersecurity experts are concerned that the cuts will harm the international collaborations that CISA has fostered, quite apart from their concerns about the security of the DOGE layoff process itself.

Feb. 5, 2025: Workday lays off 1,750

As it moves to invest more in AI and international growth, Workday is laying off 8.5% of its workforce and disposing of unused office space. Some analysts fear the cutbacks will affect the company’s customer service — unless AI can pick up the slack.

Feb. 4, 2025: Salesforce lays off over 1,000

At the same time as it’s hiring sales staff for its new artificial intelligence products, Salesforce is laying off over 1,000 workers across the company, according to Bloomberg. As of June, 2024, the company had over 72,000 employees, according to its website. Salesforce did not comment on the report. In 2024 the company reportedly laid off around 1,000 staff too, in two waves: January and July.

Jan. 14, 2025: Meta will lay off 5% of workforce

Mark Zuckerberg told Meta employees he intended to “move out the low performers faster” in an internal memo reported by Bloomberg. The memo announced that the company will lay off 5% of its staff, or around 3,600 staff, beginning Feb. 10. The company had already reduced its headcount by 5% in 2024 through natural attrition, the memo said. Among those leaving the company will be staff previously responsible for fact checking of posts on its social media platforms in the US, as the company begins relying on its users to police content.

Tech layoffs in 2024

• Equinix
• AMD
• Freshworks
• Cisco
• General Motors
• Intel
• OpenText
• Microsoft
• AWS
• Dell

Nov. 26, 2024: Equinix to cut 3% of staff

Despite intense demand for its data center capacity, Equinix is planning to lay off 3% of its workforce, or around 400 employees. The announcement followed the appointment of Adaire Fox-Martin to replace Charles Meyers as CEO and the departures of two other senior executives, CIO Milind Wagle and CISO Michael Montoya.

Nov. 13, 2024: AMD to cut 4% of workforce

AMD will lay off around 1,000 employees as it pivots towards developing AI-focused chips, it said. The move came as a surprise to staff, as the company also reported strong quarterly earnings.

Nov. 7, 2024: Freshworks lays off 660

Enterprise software vendor Freshworks laid off around 660 staff, or around 13% of its headcount, despite reporting increased revenue and profits in its fourth fiscal quarter. The company described the layoffs as a realignment of its global workforce.

Sept. 17, 2024: Cisco lays off 6,000

After laying off around 4,200 staff in February, Cisco is at it again, laying off another 6,000 or around 7% of its workforce. Among the divisions affected were its threat intelligence unit, Talos Security.

Aug. 20, 2024: General Motors lays off 1,000 software staff

More than 1,000 software and services staff are on the way out at General Motors, signalling that it could be rethinking its digital transformation strategy. In an internal memo, the company said that it was moving resources to its highest-priority work and flattening hierarchies.

August 1, 2024: Intel removes 15,000 roles

Intel plans to cut its workforce by around 15% to reduce costs after a disastrous second quarter. Revenue for the three months to June 29 stagnated at around $12.8 billion, but net income fell 85% to $83 million, prompting CEO Pat Gelsinger to bring forward a company-wide meeting in order to announce that 15,000 staff would lose their jobs. “This is an incredibly hard day for Intel as we are making some of the most consequential changes in our company’s history,” Gelsinger wrote in an email to staff, continuing: “Our revenues have not grown as expected — and we’ve yet to fully benefit from powerful trends, like AI. Our costs are too high, our margins are too low. We need bolder actions to address both — particularly given our financial results and outlook for the second half of 2024, which is tougher than previously expected.”

July 4, 2024: OpenText to lay off 1,200

OpenText said it will lay off 1,200 staff, or about 1.7% of its workforce, in a bid to save around $100 million annually. It plans to hire new sales and engineering staff in other areas in 2025, it said.

June 4, 2024: Microsoft lays off staff in Azure division

Microsoft laid off staff in several teams supporting its cloud services, including Azure for Operations and Mission Engineering. The company didn’t say exactly how many staff were leaving.

April 4, 2024: Amazon downsizes AWS in a fresh cost-cutting round

Amazon announced hundreds of layoffs in the sales and marketing teams of its AWS cloud services division — and also in the technology development teams for its physical retail stores, as it stepped back from efforts to generalize the “Just Walk Out” technology built for its Amazon Fresh grocery stores.

April 1, 2024: Dell acknowledges 13,000 job cuts

Dell Technologies’ latest 10K filing with the US Securities and Exchange Commission disclosed that the company had laid off 13,000 employees over the course of the 2023 fiscal year; it characterized the layoffs and other reorganizational moves as cost-cutting measures. “These actions resulted in a reduction in our overall headcount,” the company said. A comparison to the previous year’s 10K filing, performed by The Register, found that Dell employed 133,000 people at that point, compared to 120,000 as of February 2024. Dell announced layoffs of 6,650 staffers on Feb. 6, but it is unclear whether those cuts were reflected in the numbers from this year’s 10K statement.

See news of earlier layoffs.

Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.

“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in the report.

The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.

Riding this shift in were a few notable phishing campaigns, including an automated business email compromise (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.

To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to MFA for accounts that still require passwords.

Tycoon2FA disruption sent attackers exploring

The take-down of Tycoon2FA forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.

“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.

The decline extended to QR Code lures and fake CAPTCHA pages, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.

But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.

The adaptation came in the form of using Microsoft Teams as a social engineering channel. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.

Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.

Phishing changes but the defense doesn’t

While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.

QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.

BEC attacks hit 9 million in March, falling to 3.9 million in June.

But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant MFA to reduce the effectiveness of credential theft campaigns.

The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, FIDO keys, and Microsoft Authenticator.

Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.

This article first appeared on CSO.

Die Steckdose wird zum ständigen Begleiter, das Ladekabel zum wichtigsten Accessoire im Rucksack: Wenn der Notebook-Akku nachlässt, wächst unweigerlich der Frust im Alltag. Die schlechte Nachricht: Der chemische Alterungsprozess von Lithium-Ionen-Zellen ist unvermeidbar. Doch ein schwacher Akku bedeutet noch nicht zwingend, dass ein älterer Laptop in den Elektroschrott gehört. Oft lässt sich der Stromspeicher problemlos austauschen und die Reparatur ist wirtschaftlich sinnvoll. Aber nicht in jedem Fall. Wir zeigen, wie Sie sich an Fakten statt am Bauchgefühl orientieren und wann es Zeit wird, sich nach neuer Hardware umzusehen.

Diagnose: Fakten statt Bauchgefühl

Bevor Sie Schraubenzieher zücken oder neue Hardware kaufen, muss geklärt werden: Ist Ihr Akku wirklich verschlissen, oder saugt ressourcenfressende Software im Hintergrund heimlich den Stromspeicher leer? Die Frage ist schnell beantwortet, denn sowohl Windows als auch macOS bieten tiefgreifende Diagnose-Tools, die sich mit wenigen

Unter Windows: Öffnen Sie die Windows-Eingabeaufforderung (CMD) oder PowerShell als Administrator und tippen Sie den Befehl

powercfg /batteryreport

ein. Windows generiert daraufhin eine detaillierte HTML-Datei, die tief ins System blicken lässt. Öffnen Sie die Datei unter dem angegebenen Pfad – z.B. „C:\battery-report.html“. Entscheidend sind hier zwei Werte: die Design Capacity (die ursprüngliche Nennkapazität Ihres Akkus ab Werk) und die Full Charge Capacity (die aktuell noch erreichbare Maximalkapazität). Liegt die aktuelle Kapazität unter 80 Prozent des Ursprungswertes, gilt ein Akku allgemein als verschlissen. Spätestens wenn er die 70-Prozent-Marke unterschreitet, wird der Kapazitätsverlust im Alltag oft zu einer spürbaren Einschränkung – das Bauteil ist Ende seines Lebenszyklus angekommen.

Bei macOS: Auf einem MacBook führt der Weg über das Apfel-Menü zu Systemeinstellungen → Allgemein → Info → Systembericht. Unter dem Reiter „Stromversorgung“ finden Sie die Anzahl der Ladezyklen sowie den Zustand. Apple garantiert in der Regel, dass ein Akku nach 1.000 vollständigen Ladezyklen noch mindestens 80 Prozent seiner ursprünglichen Kapazität halten kann. Fällt der Wert darunter, rät das System oft von selbst zum Service.

Schrauben oder schrauben lassen?

Steht der Defekt fest oder ist die Alterung bereits weit fortgeschritten, folgt oft eine logistische Herausforderung. Die Hardware-Realität von 2026 ist Verbrauchern nämlich nicht gerade entgegengekommen – zumindest beim Akku: In vielen modernen Ultrabooks, Surface-Geräten oder MacBooks sind die Akkuzellen großflächig im Gehäuse verklebt. Das macht den Tausch für Laien gefährlich, weil bei einer Beschädigung der Zellen akute Brandgefahr besteht.

Der Gang zur Fachwerkstatt ist deshalb oft alternativlos – achten Sie hierbei am besten auf zertifizierte Betriebe, die eine Garantie auf das Ersatzteil gewähren. Anders sieht es bei reparaturfreundlichen Business-Geräten wie dem Lenovo ThinkPad T14 Gen 5 oder Vorreitern der Modularität wie dem Framework Laptop 16 aus: Hier brauchen Sie oft nur einen passenden Schraubendreher und zehn Minuten Zeit, um den Akku selbst zu tauschen. Wie Sie Ihren Akku am Laptop oder am Smartphone selbst tauschen können, erklären wir in diesem Ratgeber.

Achtung beim Teilekauf: Sparen Sie nicht am falschen Ende. Extrem billige Nachbau-Akkus von No-Name-Händlern auf großen Marktplätzen bergen nicht nur ein Brandrisiko, sondern schummeln oft auch bei der echten Kapazität. Greifen Sie unbedingt zu Originalteilen des Herstellers oder zu zertifizierten Ersatzteilen etablierter Drittanbieter (wie iFixit).

Wenn die Diagnose zeigt, dass Ihr Akku physisch noch fit ist, dann liegt das Problem vermutlich an Software mit Selbstbedienungsmentalität. Praktisch: Windows und macOS verfügen über integrierte Stromfresser-Finder. Unter Windows navigieren Sie zu Einstellungen → Strom und Akku → Akkunutzung. Dort listet Windows genau auf, welche Apps in den letzten Tagen am meisten Energie verbraucht haben. Auf dem Mac erfüllt die App Aktivitätsanzeige (Reiter Energie) denselben Zweck. Stoßen Sie hier auf Programme, die Sie gar nicht aktiv nutzen, sollten Sie deren Hintergrundaktivität einschränken oder die Software komplett deinstallieren.

💡 Infobox: Das neue Recht auf Reparatur (Stand 2026)

Das Recht auf Reparatur stammt von der Europäischen Kommission und dem EU-Parlament. Ziel des Gesetzespakets ist es, die wachsenden Berge von Elektroschrott auf dem Kontinent zu reduzieren und die Kreislaufwirtschaft zu stärken. Nach der Verabschiedung der EU-Richtlinie im Jahr 2024 hatten die Mitgliedsstaaten bis 2026 Zeit, die Vorgaben in nationales Recht umzusetzen – nun greifen die Regeln schrittweise und wirken sich zunehmend auf den Reparaturalltag aus.

Was Verbraucher davon haben:

• Reparaturpflicht: Hersteller sind nun gesetzlich verpflichtet, für gängige Elektronikgeräte (wie Smartphones und Laptops) Reparaturen anzubieten – und das auch nach Ablauf der gesetzlichen Gewährleistung.
• Zugang zu Ersatzteilen: Unabhängige Fachwerkstätten und ambitionierte Bastler erhalten leichteren Zugang zu Original-Ersatzteilen und offiziellen Reparaturanleitungen.
• Weniger Software-Sperren: Praktiken wie das sogenannte “Parts Pairing” (bei dem Ersatzteile per Software blockiert werden, wenn sie nicht von einer offiziellen Vertragswerkstatt eingebaut wurden) werden stark eingeschränkt.
• Mehr Wirtschaftlichkeit: Durch den faireren Wettbewerb sinken die Reparaturkosten, was den Tausch eines Akkus oft attraktiver macht als einen teuren Neukauf.

Wann lohnt sich der Tausch?

Um zu beurteilen, ob sich die Investition für den Austausch lohnt, hilft die bewährte 50-Prozent-Regel: Übersteigen die Kosten für die Reparatur (Ersatz-Akku plus eventuelle Arbeitszeit der Werkstatt) mehr als die Hälfte des aktuellen Restwerts des Notebooks, wird die Angelegenheit unwirtschaftlich.

Ein Rechenbeispiel: Ein vier Jahre altes Premium-Notebook, das früher mal 1.500 Euro gekostet hat, bringt auf dem Gebrauchtmarkt vielleicht noch 400 bis 500 Euro. Eine Investition von 120 Euro für einen fachgerechten Akkutausch ist dann noch durchaus sinnvoll und kann dem Gerät weitere zwei bis drei Lebensjahre verschaffen. Bei einem ohnehin leistungsschwachen 400-Euro-Plastikbomber aus dem Jahr 2021 ist eine 100-Euro-Reparatur jedoch (jenseits von Nostalgiegründen) kaum zu vertreten und gilt als unwirtschaftlich.

Wann ein Neukauf wirklich sinnvoll ist

Mal ehrlich: Der Akku ist oft nur das offensichtlichste Symptom eines veralteten Systems. Wer über eine Reparatur nachdenkt, sollte objektiv prüfen, ob die restliche Hardware den heutigen Anforderungen noch gewachsen ist – oder ob man mit einem neuen Laptop besser fährt:

• Windows 10 Support-Ende: Das offizielle Support-Ende von Windows 10 (Oktober 2025) liegt bereits hinter uns. Privatanwender in der EU haben zwar Glück im Unglück: Wer mit einem Microsoft-Konto angemeldet ist, erhält die Extended Security Updates (ESU) im ersten Jahr bis Oktober 2027 kostenlos. Doch spätestens im Herbst 2027 ist endgültig Schicht im Schacht. Geräte, deren Prozessoren nicht offiziell für Windows 11 zertifiziert sind (ältere CPUs vor der Intel Core 8. Generation oder AMD Ryzen 2000er-Serie), stoßen dann an ihre praktische Lebensdauergrenze. Ohne den auslaufenden ESU-Schutz sollten Sie ab diesem Zeitpunkt bei betroffenen Windows-Geräten nicht mehr in einen neuen Akku investieren.
• Speicher-Flaschenhälse: Verlöteter, nicht aufrüstbarer Arbeitsspeicher von 8 GB stößt selbst bei ausschließlicher Browser-Nutzung und Office-Anwendungen oft an seine Grenzen.
• Träge Performance: Wenn das Notebook nicht nur schnell leer ist, sondern beim Öffnen von Programmen ins Schwitzen kommt und der Lüfter permanent auf Hochtouren läuft, bringt auch der stärkste neue Akku kein flüssiges Arbeitsgefühl zurück.

Zeit für einen neuen Laptop?

Wenn kein (sinnvoller) Weg mehr am Neukauf vorbeiführt, ist das nicht immer eine schlechte Nachricht: Moderne Geräte punkten nicht nur mit deutlich mehr Ausdauer jenseits der Steckdose – sie bringen auch spürbar mehr Tempo und Sicherheit, effizientere Hardware und oft angenehm leise Kühlung in Ihren Alltag.

Fazit und Checkliste: Akku tauschen oder Neukauf?

Die Entscheidung zwischen Werkstatt und Neuanschaffung ist am Ende des Tages ein Abwägen von Kosten, Nutzen und Sicherheit. Die folgende Checkliste hilft dabei, das Schicksal Ihres Notebooks zu klären:

Der Tausch lohnt sich, wenn:

• der Laptop noch alle Leistungsanforderungen im Alltag erfüllt.
• Windows 11 offiziell unterstützt wird (oder macOS/Linux aktuell ist).
• die Gesamtreparatur weniger als 50 % des Restwerts kostet.
• das Gehäuse unbeschädigt ist und Scharniere sowie Tastatur noch zuverlässig funktionieren.

Ein Neukauf ist besser, wenn:

• das Betriebssystem (z. B. Windows 10) keine Sicherheitsupdates mehr erhält.
• das Gerät durch 8 GB RAM oder eine alte CPU ohnehin ein Flaschenhals im Alltag ist.
• Displayschäden oder defekte Ports weitere, teure Reparaturen erfordern.
• die Reparatur den Zeitwert des Geräts deutlich übersteigt.

(PC-Welt)

I haven’t slept much in the past few weeks. Not because of some theoretical cyber risk that keeps many executives awake, but because reality just delivered a real wake-up call to our industry — a call that every executive must answer, now.

Imagine this: A major global enterprise, a company most of us interact with indirectly every single day, wakes up to find its entire digital environment obliterated. Thousands of employees in dozens of offices and remote locations are suddenly offline. Customers are cut off, supply chains grind to a halt and regulators are notified with a chilling admission: “We have no idea when we’ll be back.”

This wasn’t ransomware. There was no negotiation, no decryption key to buy, no easy way out. It was destruction — deliberate, coordinated and geopolitically motivated — not monetary.

As a chief customer officer who’s worked with countless customers on cyberattack risks, my perspective hits a bit differently than a CISO or a CTO. I see the aftermath, not just the attack surface. I see the faces behind the tickets, the operations team locked out of their own systems, the support agent answering panicked calls at dawn. And I ask: How many organizations have actually stress-tested their response to this scenario — not a hypothetical, but this very real, lights-out event? Here’s what every leader needs to confront today:

Recovery is not just a technical exercise

The first assumption to break during a real crisis is the belief that recovery is purely technical.

Many organizations have done tabletop exercises and have a backup and recovery playbook, so they feel prepared. They can point to backup windows, retention schedules and immutability controls. The moment a true blackout happens, a different reality surfaces. The people who own the recovery steps either do not know each other, lack the authority to make decisions without supervisor approval or need guidance from offline systems.

The reality is that technical infrastructure almost always holds up better than human infrastructure. Organizations have built their recovery strategy around the assumption that someone competent will be awake, available and empowered when a cyber event happens.

Still, backups are only as good as their independence. Let’s be blunt: If your recovery infrastructure shares identity, authentication or network trust with your Microsoft tenant (such as Azure, Microsoft 365 or Teams), you don’t actually have a recovery plan; you have a false sense of one — and a liability. A recent survey found that while 90% of organizations express confidence in their ability to recover from a cyber incident, fewer than one in three ransomware victims fully recovered their data.

True resilience means immutable, air-gapped backups, untouchable by the same compromise. Anything less is an illusion. I talk to customers about their recovery plans constantly. The customers who have rehearsed all scenarios sleep soundly. Those who haven’t? They’re rolling the dice.

Most business continuity plans ignore ‘total blackout’

I’ve reviewed hundreds of business continuity plans. Almost all assume partial failures — a region, an application, a data center. But what if every system, in every country, goes dark simultaneously? That’s an entirely different playbook. If your team hasn’t run a drill for a global, simultaneous outage, you’re not prepared. The probability is low, but the cost of being unready is existential.

Connected devices, OT systems, field hardware, partner integrations — they all plug into your enterprise network. When the core collapses, it’s not just IT at risk. It’s operational technology, physical safety systems and in regulated sectors, potentially human lives. Understanding and testing those interdependencies is non-negotiable.

This is also where boards need to change the conversation. A study found that only 5% of companies have cybersecurity experts on their board of directors. Recovery time objectives (RTOs) should not be buried in technical appendices. It’s all jargon to boards. That makes translation essential. RTOs must be explained in terms of business impact. “We can recover in four hours” is a technical statement. “Every hour of downtime costs us $2.3M and creates regulatory exposure in three jurisdictions” is a board statement.

That is the level of clarity leaders need.

The most prepared organizations do not wait for an incident to educate the board. They bring the conversation forward proactively. They frame recovery in business terms: revenue, regulatory standing, customer trust and brand reputation.

The most effective framing is often simple. Show the most critical systems. Show what happens if each one is down for one hour, four hours, 24 hours and 72 hours. Show the current recovery capability against each and then show the gap.

If your board is not demanding real answers, your business continuity strategy is likely underfunded and your business is exposed. This is a risk conversation worth forcing because the consequences do not stay inside IT. They can show up in customer churn or missed revenue and ruin an organization’s reputation.

Threat intelligence must be actionable, not archived

Geopolitical attacks, hacktivist campaigns and nation-state targeting aren’t abstract threats. They are active risks, and that intelligence cannot languish in the security team’s inbox. Executive leadership must be looped in — and immediately — so gaps can be closed before they’re exploited. Too often, intelligence enters the security operations function and never reaches the teams responsible for recovery infrastructure or executive decision-making.

If a threat actor is targeting a specific class of backup agents, the team responsible for those agents needs to know now, not two weeks from now. If intelligence suggests destructive activity against a sector, recovery owners need to validate isolation, access paths and restoration procedures immediately. If geopolitical tension increases the likelihood of targeting, executive leadership needs to understand what exposure exists and what actions are being taken. The organizations that survive aren’t just the best at incident response. They’re the ones who anticipated, rehearsed and invested before the attack.

Part of investing in a recovery strategy requires closing the loop between signal and action. The most prepared organizations have already mapped their critical recovery dependencies to specific threat categories. When intelligence touches one of those categories, there is a named owner and a clear set of actions. No guessing or forwarding emails into the void is needed because the distance between the warning and the employees’ ability to do something is shortened.

Looking ahead, the conversation will continue to evolve beyond traditional cyber response. Because in an AI-enabled enterprise, the new question is whether the data within those systems can still be trusted. When AI systems make decisions based on enterprise data, the attack surface becomes the data’s accuracy. A threat actor who quietly corrupts a dataset over 90 days before a recovery event has done more damage than just downtime. They can poison the inputs driving decisions across the business.

Regardless of how AI will change threat intelligence and cyber response, these principles remain the same. Know your problem, whether structural or technological. Ensure your human infrastructure keeps pace with your technical infrastructure, with clear cross-functional ownership and the tools and knowledge to act autonomously. Communicate with your boards often — and correctly.

Let’s not wait for the next headline to ask, “Are we ready?” Have those conversations now. Test your assumptions. Close your gaps. Because in today’s threat landscape, resilience isn’t IT’s job — it’s everyone’s mandate.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Agentic AI has advanced from the promises-and-pilots phase of 2025 to reality and rollouts in 2026. In the process, agentic AI is transforming virtually every aspect of customer relationship management (CRM), the platform that manages sales, marketing, and customer service.

“Last year, everybody was dipping their toes into the water,” says Keith Kirkpatrick, research director at The Futurum Group. This year, agentic AI has built momentum from the boardroom down, with companies recognizing that having an AI strategy is imperative. “They feel like if they don’t embrace it now, their competitors will.”

Harry Datwani, a principal at Deloitte Digital, adds that enterprise CRM customers have transitioned from “proof of concept” to “scale and execution.”

“Across sales, service, marketing, even in the commerce space, enterprises are really using AI and agentic,” he says.

“CRM in 2026 is undergoing a structural shift, not just an incremental evolution,” says Forrester analyst Kate Leggett, noting that AI is becoming a core part of CRM infrastructure, not just a feature or an add-on. According to Forrester data, around 70% of companies are already using AI in their CRM systems, she says.

Here are the hot AI-driven trends in CRM this year.

CRM becomes an action hero

CRM platforms have traditionally served as passive, static systems of record. Now, agentic AI is transforming CRM into a powerful, real-time solution that can act autonomously.

“Organizations that rethink CRM as a real-time, AI-powered system of action — and embrace agentic AI to handle complex, unpredictable work — are better positioned to deliver exceptional customer experiences,” says IDC analyst Neil Ward-Dutton. “This approach not only enhances satisfaction and loyalty but also drives operational efficiency and business agility.”

Forrester’s Leggett says that AI-powered CRM platforms have advanced from simple data capture to real-time decision-making and execution. Standard capabilities include next-best action recommendations, call summaries, automated updates, generated emails, knowledge creation, predictive forecasting, and deal scoring.

She adds that AI agents can now execute workflows, such as routing cases, sending follow-ups, and updating records (with human oversight). They can also handle end-to-end service and sales tasks autonomously, including case resolutions and sales development activities.

Agentic drives workforce changes

AI use in CRM systems is also impacting workforce strategies.

“We used to hire for deep expertise,” says Constellation Research analyst Liz Miller. “AI has commoditized expertise because I can take all that data from my CRM and train my AI models to go deep, to know everything about any product I’ve ever sold, from what has worked, what hasn’t, every price, every sale.”

Now, instead of hiring candidates with deep expertise, organizations are looking for candidates who can go wide. “I can train a model to have deep expertise. What I can’t train for is experience, because experience is what happens when a person has gone broad across a lot of different scenarios and faced complexity across that broad scenario,” says Miller.

For example, AI systems can automate many aspects of marketing, Miller notes, but there’s no substitute for creativity: people who can interrogate the data and come up with innovative marketing campaigns that connect with customers.

Terence Chesire, group vice president of ServiceNow CRM and industry workflows, says that organizations are using agentic AI to free up team members from repetitive, lower-value activities. Those employees have now moved to higher-level roles “where they’re working on transformational deals rather than just building a spreadsheet.”

“That’s what we’re seeing as super-exciting as organizations not just free up people, but the speed and effort reduction and the friction reduction in what they can do,” he adds.

Data layer takes center stage

AI’s promise to deliver actionable customer and marketing intelligence has placed even greater emphasis on the importance on sound data management practices for CRM.

“The light bulb has flashed on very brightly for our clients,” says Deloitte’s Datwani. “Everyone is talking about AI agents, but your ability to really extract value is inextricably linked to the quality of your data and the ability to make that data accessible. What we’re finding is that despite large investments over time our clients still have fragmented data. And so, they are data rich and insight poor.”

The good news, says Datwani, is that AI agents themselves can help clean up and organize data. And vendors such as Snowflake and Databricks, along with the traditional CRM powerhouses, are offering powerful data analytics solutions. “Everyone is battling for that data layer,” Datwani says.

Forrester’s Leggett adds that CRM platforms are converging with customer data platforms (CDPs), real-time event streams, and external data sources to create connected customer data networks. These real-time, connected data models can help organizations deliver hyper-personalization at scale.

Agentic ushers in pricing complexity

The shift from license- or subscription-based pricing to an outcome or consumption pricing model has the potential to help CIOs tie their CRM costs to specific business metrics, such as the number of customer service calls resolved per hour. But it has also introduced a new level of complexity when it comes to budgeting for CRM costs.

For example, Chesire says ServiceNow’s CRM pricing plan starts with a baseline subscription model, and on top of that, customers get a certain number of AI tokens per user and can buy additional tokens as AI usage ramps up.

Meanwhile, Salesforce has rolled out pay-per-resolution pricing with its recently unveiled AI Help Agent and last month acquired usage-based billing specialist m3ter. Oracle is also piloting outcome-based AI pricing.

All these approaches undercut the predictability of the subscription model, which will complicate CIOs’ cost calculus, Deloitte’s Datwani says. “Now, as you start to think about consumption and tokens, costs might look different. As folks are opening up the architecture with things like headless CRM, what will the cost model look like for API calls or MCP server calls? So, there’s many more variables,” he adds.

The rise of multi-agent orchestration

To act autonomously, agents need to access multiple data sets and software platforms seamlessly. As a result, the proliferation of agents, some embedded within specific vendor platforms and some created in-house, is going to require an orchestration layer, Futurum’s Kirkpatrick says.

He points out that organizations need to monitor and manage agents, enforcing the same type of policy-based access control that exists for people. Organizations also need to set limits on what domains a specific agent can get into, what types of data they can access, what lines can’t they cross.

Kirkpatrick predicts that a new class of orchestration tools will emerge, although it’s not clear whether that orchestration layer will be provided by the leading CRM vendors, hyperscalers, or third parties.

Datwani agrees. “The orchestration layer is an interesting area, where the traditional vendors are in on it, the hyperscalers are also offering it, and there are third parties. It’s my belief that there’s not going to be a clear winner.”

The interface becomes conversational

Enterprise users who have traditionally had to manually wrangle with CRM systems are likely to find the ability to employ voice commands using a natural language interface to be a game changer. For starters, a salesperson can say, “I have a meeting today with Customer X. Help me prepare.” The agent will collect relevant data, ingest it, and provide a summary with recommendations.

ServiceNow’s Chesire says voice-enabled CRM systems have an “almost magical” ability to record, transcribe, and understand the content of a call between a salesperson and a customer or potential customer. The system can then “build a quote” based on that conversation.

On the customer service side of the equation, AI-driven voice technology enables customers to speak to an AI agent, describe the problem using natural language, and get a response. The agent has the capability to, for example, solve a credit card dispute, order a replacement product, send out a service rep, or do whatever is needed to resolve the issue, says Chesire.

Beyond that, agentic technology is capable of understanding the underlying business process flaws that led to the product snafu, and make recommendations for ways to fix whatever led to the issue in the first place, he adds.

Agentic drives business process transformation

With the emergence of outcome-based pricing, organizations are taking a fresh look at how they measure the benefits of CRM systems. That conversation is leading to an even more important analysis of underlying business processes. Or, as Constellation’s Miller says, “The old adage of applying new technology to old processes only gets you more expensive old processes.”

“When we survey customers, we hear time and time again that the reason why they want to apply AI into their organizations is to foster exponential opportunity and exponential growth,” she says. “How do we get there with CRM has started to become the new conversation.”

According to Miller, AI systems breach the walls of siloed data and can take a fresh look at legacy workflows. They also don’t get sucked into turf wars between marketing and sales teams. As a result, they often recommend new actions that can lead to better processes. “I think it’s starting to happen. You’re starting to see applications where AI is beginning to accelerate decision-making and decision velocity,” she says.

“The next phase of maturity is going to be, how do we start to spread AI across our platforms so that we are seeing that holistic end-to-end relationship that we have always wanted to optimize. How do we thread that across platforms and across solutions. We’re starting to see organizations on the leading edge really start to pull those strategies together,” says Miller.

In der beschaulichen Gemeinde Neubulach im Nordschwarzwald nähe Calw wird derzeit Bau- und Digitalgeschichte geschrieben. Denn hier findet eine Weltpremiere statt: Es entsteht der weltweit erste Supermarkt aus dem 3D-Betondrucker. Mieter wird der Discounter Netto.

Mit einer Grundfläche von rund 1.700 Quadratmetern und einer gedruckten Wandfläche von über 1.300 Quadratmetern setzt das Projekt neue Maßstäbe für den industriellen Einsatz automatisierter Bauverfahren. Wo früher Maurer Stein auf Stein setzten, ziehen heute zwei mobile Instatiq P1 Roboter (Progress One) präzise ihre Bahnen.

Roboter statt Kelle und Mörtel

Die Maschinen spritzen den Beton Schicht für Schicht übereinander, bis Wände mit einer Höhe von bis zu sieben Metern entstehen. Dabei können die Roboter auf der Baustelle flexibel umgesetzt und neu positioniert werden. Das ermöglicht den Bau großflächiger Gewerbeimmobilien in Rekordzeit.

So wurde der gesamte Wandrohbau inklusive aller baulichen Schnittstellen in nur etwa vier Wochen realisiert. „Mit dem ersten gedruckten Supermarkt zeigen wir, dass 3D-Druck im realen Gewerbebau angekommen ist“, erklärt Markus Schilling von Instatiq. Gleichzeitig zeigt das Projekt, dass der 3D-Druck nicht länger nur für kleine Pilotprojekte oder Wohnhäuser reserviert ist. Für Optimisten stellt er gar eine wirtschaftlich relevante Alternative für den großflächigen Handel dar.

Grüner Beton

Während die Druckroboter die Hauptarbeit an den Wänden leisten, wird die Konstruktion durch konventionelle Bauteile wie Stützen und Ringbalken ergänzt. Diese Verzahnung von digitaler Bauvorbereitung und klassischem Rohbau war eine der Herausforderungen, die durch die Zusammenarbeit von Firmen wie Nelcon und der Köhler Bauunternehmung gemeistert wurde.

Doch nicht nur die Technik ist revolutionär, sondern auch das Material. Zum ersten Mal wird bei einem solchen Großprojekt der Near-Zero-Zement evoZero von Heidelberg Materials eingesetzt. Dieser Zement basiert auf der sogenannten CCS-Technologie (Carbon Capture and Storage). Dabei wird das CO₂ direkt im Werk im norwegischen Brevik abgeschieden und anschließend dauerhaft im Meeresboden gespeichert.

Nachhaltiger Gewerbebau

Das Ergebnis ist ein 3D-Druckbeton, der signifikant weniger CO₂ verursacht, ohne dass die Rezeptur oder die technischen Eigenschaften – wie Pumpfähigkeit und Formstabilität – verändert wurden. Matthias Fischer von Heidelberg Materials betont denn auch: „Hier kommen zwei zukunftsweisende Ansätze unter realen Bedingungen zusammen: innovative Materialien und neue Bauverfahren.“

Hinter dem Projekt steht ein breites Partnernetzwerk. Bauherr ist die Bäckerei Sehne, die das Gebäude nach Fertigstellung an den Lebensmittelhändler Netto Marken-Discount vermieten wird. Für Netto ist die Filiale in Neubulach ein klares Bekenntnis zu Innovation und Ressourcenschonung. So heißt es bei dem Discounter: „Der Einsatz von 3D-Druck zeigt, wie sich innovative Technologien bereits heute effizient und nachhaltiger im Filialbau einsetzen lassen.“

Unter dem Strich ist der Supermarkt in Neubulach mehr als nur ein Gebäude. Er ist schlicht ein Beweis dafür, dass automatisiertes, schnelles und nachhaltigeres Bauen keine Zukunftsmusik mehr ist. Mit rund 292 Kubikmetern Druckbeton ist das Projekt laut Instatiq derzeit das weltweit größte realisierte 3D-gedruckte Gebäude.

Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.

“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in the report.

The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.

Riding this shift in were a few notable phishing campaigns, including an automated business email compromise (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.

To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to MFA for accounts that still require passwords.

Tycoon2FA disruption sent attackers exploring

The take-down of Tycoon2FA forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.

“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.

The decline extended to QR Code lures and fake CAPTCHA pages, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.

But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.

The adaptation came in the form of using Microsoft Teams as a social engineering channel. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.

Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.

Phishing changes but the defense doesn’t

While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.

QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.

BEC attacks hit 9 million in March, falling to 3.9 million in June.

But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant MFA to reduce the effectiveness of credential theft campaigns.

The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, FIDO keys, and Microsoft Authenticator.

Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.

This article first appeared on CSO.

Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.

“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in the report.

The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.

Riding this shift in were a few notable phishing campaigns, including an automated business email compromise (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.

To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to MFA for accounts that still require passwords.

Tycoon2FA disruption sent attackers exploring

The take-down of Tycoon2FA forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.

“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.

The decline extended to QR Code lures and fake CAPTCHA pages, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.

But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.

The adaptation came in the form of using Microsoft Teams as a social engineering channel. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.

Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.

Phishing changes but the defense doesn’t

While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.

QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.

BEC attacks hit 9 million in March, falling to 3.9 million in June.

But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant MFA to reduce the effectiveness of credential theft campaigns.

The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, FIDO keys, and Microsoft Authenticator.

Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.

A new attack method found by Zenity Labs reveals that AI agents are becoming persistent insiders that attackers can recruit, rather than malware they have to install.

Its researchers have discovered AgentForger, a phishing-based attack that silently creates and launches a fully autonomous AI agent within OpenAI workspaces.

Once running, the agent has full access to apps like Outlook, Slack, SharePoint, and Google Drive. It is configured to operate indefinitely without further user interaction, can approve its own access by toggling “never ask” settings, and can continue to act on new assignments sent via email by the attackers that control it. Broad, unfettered access to systems allows it to perform reconnaissance, harvest sensitive data and credentials, impersonate victims, and launch phishing campaigns.

While OpenAI resolved the vulnerability four days after disclosure, on a larger scale, AgentForger sheds light on what can happen when AI agents go rogue.

“We’re moving into a world where software doesn’t just help people work. It works alongside them,” said Michael Bargury, co-founder and CTO of agentic AI security platform Zenity. “As AI agents become more capable, attackers will naturally look for ways to influence them, just as they’ve always looked for ways to influence people.”

A ‘persistent operator’ that acts without approval

OpenAI’s Workspace Agents can connect and work autonomously across Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams. Users open the agent builder, describe what the agent can do in natural language, connect to tools, set approvals, review and test, schedule actions, then publish. For instance, an agent can autonomously handle incoming emails, review and take actions with approval, gather information from various sources to send out daily briefings, or automatically respond to questions in ChatGPT or Slack channels.

Normally, this is “useful automation,” Zenity AI red team researcher Mike Takahashi wrote in a blog post. But in this attack, “the same scheduler becomes the persistence mechanism.”

The creation workflow kicks off the moment a user clicks on a phishing link containing instructions from the threat actor. For the attack to work, a victim must be logged into ChatGPT and Workspace Agents, and have at least one integration with another app, such as Outlook, Gmail, Slack, Google Drive, SharePoint, or Teams.

Because those connections already exist, OAuth consent screens are not triggered. Furthermore, the victim does not need to click on another link, keep a Builder tab open, or even visit ChatGPT again.

The forged agent is a “persistent operator;” it is installed on the original click and given a schedule, and at those predetermined times, the agent invokes itself, scans for emails from attacker addresses with the subject line “task”, carries those orders out, then returns results to the same attacker-controlled email address.

It goes undetected because the attacker prompt instructs the Builder to toggle Outlook to never ask for approval of its actions. Typically, the default is “always ask,” to keep agents from taking unauthorized action; that switch gives agents the ability to act without asking for human approval.

“AgentForger showed that an attacker could deploy an autonomous insider agent inside your ChatGPT workspace with a single click,” said Bargury. From there, it can continue to access information, harvest credentials from various sources, impersonate employees, and carry out phishing attacks and fraud while “leveraging the trusted victim’s identity.”

A ‘planted accomplice’ that does all the work

Once activated, AgentForger can perform reconnaissance to create an internal map of a company. For instance, agents can scan Outlook, Slack, Teams, Google Drive, SharePoint, or calendar data to identify people, roles, active projects, internal discussions, or all-hands recurring meetings. This can help attackers identify where in the enterprise to target next, based on active teams and channels, projects in the works, or prominent users.

“This is the kind of internal context an attacker normally has to build slowly,” Takahashi noted. But in this scenario, action is based on a single emailed assignment. The attacker’s “planted accomplice” does all the work.

In another scenario, the agent can steal data by searching for and identifying financial documents, business agreements, or invoices. Or, it can steal credentials by scanning for messages containing passwords, one-time codes, access tokens, password recovery links, or API keys. Further, it can impersonate victims to carry out phishing scams, for instance, by sending legitimate-looking Teams messages instructing users to confirm their credentials on a fake Microsoft login page.

In all cases, collected information is organized, analyzed, and sent back to the attacker.

“AgentForger points to something much bigger than a single vulnerability,” said Bargury. “It’s less about one bug and more about understanding how the security model changes as AI becomes part of everyday business operations.”

FOMO exposing security gaps

This isn’t necessarily about trust, but more about the need to move fast and adapt, Bargury emphasized. AI agents are helping employees automate work, make decisions faster, and get more done. But enterprises fear they’ll fall behind if they don’t move quickly enough.

“The challenge is that we’re introducing a fundamentally new kind of technology into the enterprise,” said Bargury. “The pressure to integrate the next AI feature is outpacing the security controls needed to safely deploy it.”

However, the answer isn’t to slow down adoption, he emphasized; the business value is too significant. Rather, the first step is understanding where AI agents exist, who created them, what they’re connected to, and what they’re allowed to do. And when it comes to autonomous agents, enterprises need to pay attention to the processes that trigger them: A schedule, an incoming email, or another automated event.

“Those triggers should be governed just as carefully as the agent itself,” said Bargury.

High-impact actions should require approval where appropriate, and security teams should be able to quickly disable an agent or its triggers if something doesn’t look right, he said.

More broadly, AI agents are introducing the need for a new security model, he pointed out. The question is no longer just “Does this agent have permission?” It’s also, “Is this the behavior we intended?”

“The organizations that answer both questions will be in the strongest position to adopt AI safely,” Bargury said.

Der heimliche Cybercrime-Akt zweier KI-Modelle von OpenAI hat weltweit ein enormes Echo in Mainstream– und sozialen Medien hervorgerufen. Der Vorfall dürfte die Debatte über die allgemeine KI-Sicherheit und den verantwortungsvollen Umgang mit der Technologie neu befeuern.

Doch der Incident wirft auch spezifische Fragen auf. Etwa, wie genau die OpenAI-Modelle es geschafft haben, ihrer Sandbox zu entkommen und warum das beim ChatGPT-Erfinder zunächst niemandem aufgefallen ist. Oder, wie andere Unternehmen solche und ähnliche Vorkommnisse künftig verhindern können. Dazu haben wir die Einschätzung von Branchenexperten und Analysten eingeholt.

Zunächst werfen wir aber noch einen kurzen Blick darauf, was sich eigentlich abgespielt hat. Falls Sie bereits informiert sind, können Sie alternativ auch das nachfolgende Meme konsumieren, um sich den Vorfall noch einmal auf unkonventionellere Art und Weise vor Augen zu halten.

Der autonome Hugging-Face-Hack

Die KI-Plattform Hugging Face meldete Mitte Juli einen Cyberangriff auf ihre Produktions-Infrastruktur. Diese wurde offenbar vollständig autonom von einem agentenbasierten KI-System gefahren, das sich dabei sowohl Zugriff auf interne Datensätze als auch auf Zugangsdaten verschaffen konnte.  

Wie sich im Rahmen der folgenden Untersuchung herausstellte, stammte die autonom hackende KI von OpenAI. Eigentlich wollte der KI-Pionier lediglich zwei seiner neuen Modelle – GPT 5.6 Sol sowie ein nicht näher spezifiziertes Pre-Release-Modell – innerhalb einer Sandbox mit dem Benchmarking-Tool ExploitGym testen.

Die Aufgabe für die KI: Schwachstellen in tragfähige Exploits zu verwandeln. Die Testumgebung selbst war OpenAI zufolge mit beschränktem Netzwerkzugriff ausgestattet. Die KI sollte lediglich auf einen intern gehosteten Drittanbieter-Service zugreifen können, der als Proxy und Cache für eine Package-Registry fungierte. Die Guardrails auf Modellebene waren für den Test laut dem KI-Unternehmen reduziert worden.

Das war der KI aber offenbar nicht genug: Sie verkettete zunächst einige zuvor unbekannte Schwachstellen in der Testumgebung, um sich uneingeschränkten Internet-Zugriff zu verschaffen, wie OpenAI in einem Blogbeitrag offenlegt: „Mit diesem Zugriff führten unsere Modelle in unserer Forschungsumgebung eine Reihe von Privilege-Escalation- und Lateral-Movement-Aktionen aus, bis sie eine Node mit Internetzugang erreichten.“

Weil die OpenAI-Modelle bei Hugging Face offenbar Lösungen für ihre ExploitGym-Aufgaben vermuteten, suchten sie nach Möglichkeiten, Zugriff auf diese zu erhalten. Und fanden sie dann auch, wie OpenAI darlegt: „In einem Beispiel verkettete das Modell mehrere Angriffsvektoren, darunter gestohlene Zugangsdaten und Zero-Day-Schwachstellen, um auf den Servern von Hugging Face einen Remote-Execution-Pfad zu finden.“

Das Security-Team von OpenAI konnte diese Vorgänge im Nachgang identifizieren und schloss sich daraufhin mit dem Team von Hugging Face zusammen, welches die Attacke seinerseits bereits identifiziert und (mit einigen Anlaufschwierigkeiten) eingedämmt hatte.

„Wir betrachten dies als beispiellosen Cybervorfall mit hochentwickelten Fähigkeiten und reagieren entsprechend. Wir teilen zu diesem Zeitpunkt vorläufige Erkenntnisse, damit Sicherheitsverantwortliche nachvollziehen können, was passiert ist, und besser einschätzen können, wozu die Modelle inzwischen in der Lage sind“, schreibt OpenAI in seinem Blog – und verspricht, weitere Details zu veröffentlichen, sobald diese vorliegen.

KI-Ausbruch bei OpenAI – so reagieren Experten

Branchenexperten und Analysten bewerten den schlagzeilenträchtigen Incident um OpenAI und Hugging Face folgendermaßen:

• Alexei Balaganski, Lead Analyst bei KuppingerCole: „Dieser Vorfall sollte nicht als ‚Rogue AI‘-Geschichte betrachtet werden. Das Modell hat exakt das getan, wofür agentische Systeme gemacht sind: Es hat sich allen verfügbaren Tools und Wegen bedient, um das ihm gesetzte Ziel zu erreichen. Die Sicherheitsvorkehrungen, die es normalerweise in Zaum gehalten hätten, wurden von OpenAI selbst zu Testzwecken deaktiviert. Darin besteht die wahre Lektion.“
• Jonathan Care, Lead Analyst und AI Practice Lead bei KuppingerCole: „Es geht bei diesem Vorfall nicht darum, dass eine KI ausgebrochen ist und zum Angreifer wurde. Wir wussten, das würde passieren. Bemerkenswert ist allerdings, dass die Verteidiger – in diesem Fall das Team von Hugging Face – keine kommerziellen KI-Modelle nutzen konnten, um den Angriff zu analysieren. Denn deren Guardrails sorgen dafür, dass kein Exoploit-Code verarbeitet werden kann.“
• Gerald Beuchelt, CISO bei Acronis: „Der Vorfall verdeutlicht eine zentrale Herausforderung für Incident-Response-Teams: Angreifer sind nicht an Nutzungsrichtlinien gebunden. Verteidiger können hingegen an die Grenzen ihrer eigenen Tools stoßen, wenn diese genau jene Daten nicht verarbeiten, die für eine Untersuchung erforderlich sind. Im Ernstfall können daraus Verzögerungen mit unmittelbaren operativen Folgen entstehen.“
• Sabine Frömling, Experten-Autorin und Cybersecurity-Beraterin: „Der eigentliche Sicherheitsvorfall war nicht die KI – sondern die Sandbox, die aus Versehen eine Tür zum Internet hatte. Man hat ein Raubtier freigelassen und dem Zaun die Schuld gegeben.“
• Martin Zugec, Technical Solutions Director bei Bitdefender: „Was meiner Meinung nach für KI-generierte Malware galt, untermauert auch dieser Vorfall: Die Bedrohung ist real, KI ist aber keine Magie. Wer glaubt, es mit einer neuartigen Superwaffe zu tun zu haben, wartet auf eine neuartige Gegenmaßnahme. Wer jedoch erkennt, dass es sich um bereits bekannte, aber unerbittlich angewandte Angriffstechniken handelt, weiß bereits, was zu tun ist.“
• Richard Werner, Cybersecurity Platform Lead Europe bei TrendAI: „Das Narrativ von der ‚eigenmächtig handelnden KI‘ ist effizient darin, Verantwortung abzuwälzen. Das ist, als würden Sie eine autonome Waffe bauen, diese auf einem vermeintlich sicheren Testgelände erproben, sie außer Kontrolle geraten und jemanden treffen lassen – und der Welt anschließend erklären, die Waffe habe eigenständig gehandelt. Das ist zwar technisch korrekt. Dennoch bleibt es Ihre Waffe, Ihr Testgelände und Ihr Versagen.“

Was Unternehmen jetzt tun sollten

IT- und Sicherheitsentscheider können aus dem Hugging-Face-Hack mehrere Lektionen ziehen. Etwa, dass Sicherheitsvorkehrungen auf Modellebene nicht als primäre Security-Grenze für KI-Agenten geeignet sind, wie Biswajeet Mahapatra, Principal Analyst bei Forrester, festhält: „Prompt-Guardrails sind keine Sicherheits-, sondern Verhaltenskontrollmaßnahmen. Und diese können versagen, umgangen oder absichtlich deaktiviert werden.“

Der Forrester-Analyst rät Unternehmen deshalb dazu, KI-Agenten als hochriskante, nicht-menschliche Identitäten zu behandeln – und jeden einzelnen in einer isolierten Umgebung zu betreiben, in der Datenzugriff auf den jeweiligen Task beschränkt bleibt und die Zugangsdaten selbst möglichst schnell ablaufen: „Das sorgt für einen akzeptablen ‚Blast Radius‘: Wird ein Agent kompromittiert, kann er nur einen einzigen Workflow, Datensatz oder eine einzige Anwendung beeinträchtigen. Anstatt die gesamte Unternehmensinfrastruktur.“

Sanchit Vir Gogia, Chefanalyst bei Greyhound Research, warnt an dieser Stelle davor, (Drittanbieter-)Services unter den Tisch fallen zu lassen: „Dienste, die auf Package Registries, Update-Systeme oder andere externe Ressourcen zugreifen, können ebenfalls zu Einfallstoren werden, wenn sie nicht derselben, ausgiebigen Prüfung unterzogen werden wie der Agent selbst.“

Unabhängig davon sollten Unternehmen laut Gogia auch testen, ob ihre Containment-Grenzen auch funktionieren, anstatt sich allein auf Architekturdiagramme oder dokumentierte Richtlinien zu verlassen: „Im Rahmen dieser Tests sollte geprüft werden, ob Anmeldedaten erlangt, Trust-Grenzen überwunden und Systeme außerhalb der einem Agenten zugewiesenen Aufgabe erreicht werden können.“

KuppingerCole-Chefanalyst Care rät IT-Entscheidern und Unternehmen im Wesentlichen zu drei Maßnahmen, nämlich:

• ein fähiges Modell auf der eigenen Infrastruktur auszuführen, das unter der eigenen Kontrolle steht und mit Guardrails ausgestattet ist, die sowohl eine forensische als auch defensive Nutzung ermöglichen. Nur so ließen sich Angriffe dieser Art auch zuverlässig analysieren.
• jeden KI-Agent in der eigenen Umgebung als privilegierten Insider zu behandeln – statt als vertrauenswürdigen Benutzer: „Wenn die Modelle von OpenAI aus ihrer Sandbox ausgebrochen sind, sollten Sie davon ausgehen, dass Ihre Agenten dazu auch in der Lage sind.“
• den eigenen Incident-Response-Plan mit Blick auf Angriffe in maschineller Geschwindigkeit zu aktualisieren: „Hugging Face hatte einige Tage Zeit, um zu reagieren, Sie haben vielleicht nur Minuten.“   

Acronis-CISO Beuchelt rät Organisationen, die gehostete LLMs für Security-Untersuchungen einsetzen, dazu, deren Grenzen möglichst bereits im Vorfeld zu durchdringen und zu testen – sowie ein alternatives Modell auf der eigenen Infrastruktur bereitzuhalten: „So reduzieren Sie das Risiko, im entscheidenden Moment keinen Zugriff auf wichtige Analysefunktionen zu haben. Gleichzeitig bleiben sensible Incident-Daten und Zugangsinformationen innerhalb der eigenen Organisation.“

Udo Schneider, Governance, Risk & Compliance Lead Europe bei TrendAI weist darauf hin, dass die beiden naheliegendsten Lösungsansätze bei Angriffen wie dem der OpenAI-KI auf Hugging Face nur teilweise greifen. Human-in-the-Loop-Kontrollen funktionierten zwar, so der Experte, skalierten aber nicht für die langlaufenden, komplexen Workflows, denen Incidents dieser Art entspringen. Ebenso könnten engere Guardrails für Modelle oder Prompts zwar helfen, stellten jedoch keine Garantie dar: „Es handelt sich um probabilistische Systeme. Eine Guardrail ist insofern keine Mauer, sondern eher eine starke Wahrscheinlichkeitsannahme.“

Deshalb komme es laut Schneider vor allem auf die unspektakulären, nicht-KI-spezifischen Kontrollen an: „Zugriffsfilterung, Kontrolle darüber, was überhaupt als Input beim Modell ankommt, Sandboxes, die tatsächlich halten, und Berechtigungskonzepte nach dem Least-Privilege-Prinzip.“

In Panik zu verfallen, wäre nach Ansicht von Martin Zugec, Technical Solutions Director bei Bitdefender, in jedem Fall die falsche Reaktion:„Was gegen solche Angriffe wirkt, ist eine präventionsorientierte Security, die den Handlungsspielraum eines Angreifers von vorneherein einschränkt – und eine verhaltensbasierte Abwehr, die bösartige Muster kennzeichnet, unabhängig davon, mit welchen Tools diese generiert wurden.“

Dieser Artikel wurde mit Material unserer Schwesterpublikation CSOonline.com angereichert.

Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented even by companies reporting strong financial performance.

But it’s not just AI leading to workforce cuts. Complementing this technological shift are ongoing economic uncertainty, inflation, and higher interest rates, compounded by a chip shortage and rising energy costs. This mix is driving companies to cut costs and streamline operations for increased efficiency.

According to data compiled by Layoffs.fyi, an online tracker that keep tabs on job losses in the technology sector, 123,941 tech employees were laid off at 269 companies in 2025. The site also reports that 71,981 government employees were laid off by DOGE alone, with 182,528 total federal workers laid off.

Here is a list — to be updated regularly — of some of the most prominent technology layoffs the industry has experienced recently.

Notable tech layoffs in 2026

• Monday.com
• Microsoft
• Meta
• Cisco
• Cloudflare
• Oracle
• Atlassian
• Salesforce
• Amazon
• Ericsson

July 22, 2026: Monday.com cuts 20% of its workforce to restructure for the AI era

The company says the decision to cut 620 jobs isn’t about margins, but about creating a flatter organization built around AI agents, autonomous teams, and deeper customer engagement.

July 6, 2026: Microsoft cuts 4,800 jobs, primarily in sales and Xbox teams

As the company trims thousands of jobs, it’s also investing in embedded engineering teams and AI infrastructure. The layoffs come several weeks after the company offered 8,750 US employees voluntary retirement buyouts.

June 5, 2026: Tech industry cut 38,242 jobs in May, worst since 2024

AI was blamed for 40% of the job cuts in May, up from 7% in January, according to research by employment placement company Challenger, Gray & Christmas.

May 20, 2026: Meta cuts 8,000 jobs, around 10% of workforce

The cuts are expected to expected to hit Meta’s engineering and product teams the hardest, arriving as Meta pivots toward AI to boost efficiency across its organization, according to Yahoo Tech.

May 13, 2026: Cisco to cut nearly 4,000 jobs despite strong growth in AI, enterprise networking

Despite reporting positive financial news — including record third-quarter revenue of $15.8 billion, a 12% year-over-year increase — Cisco said it will eliminate almost 4,000 jobs.

May 7, 2026: Cloudflare to cut 1,100 jobs in AI-focused restructuring

About 20% of Cloudflare’s global workforce will be culled as the company pivots for the agentic AI era, Reuters reported.

April 1, 2026: Oracle to cut up to 30,000 jobs globally, putting enterprise support and roadmaps at risk

Oracle began laying off employees on March 31 in what could be the largest workforce reduction in the company’s history. Employees received termination emails at 6 a.m. local time with immediate system lockouts and no prior warning. (Note: in June, CNBC put the final layoff tally at 21,000.)

March 12, 2026: Atlassian cuts 1,600 jobs to fund AI and enterprise expansion

Atlassian will reduce its global workforce by approximately 10%, eliminating around 1,600 roles, as the collaboration software maker redirects capital toward artificial intelligence development and enterprise sales.

March 11, 2026: Tech layoffs surpass 45,000 in early 2026

A recent analysis by RationalFX found 45,363 job cuts globally so far this year—with roughly 68% or more than 30,000 occurring in the U.S. — highlighting ongoing workforce cuts even as many tech companies report strong revenue growth.

February 10, 2026: Salesforce lays off staffers as executive leadership churn continues

Salesforce has reduced close to 1,000 roles earlier this month across teams, including marketing, product management, data analytics, and its Agentforce AI unit, Business Insider reported, quoting employees familiar with the matter.

January 23, 2026: Amazon layoffs expected to disproportionately hit AWS and tech talent

As the market slows down, AWS and other Amazon units are preparing for another round of layoffs, which is expected to overwhelmingly impact tech talent. An email from HR leader Beth Galetti on Jan. 28 confirmed 16,000 job cuts.

January 15, 2026: Ericsson plans to shed 1,600 jobs in Sweden

 Ericsson lans to cut some 1,600 jobs in Sweden, the telecommunications equipment maker said doubling down on recent cost-saving measures that have helped it weather a prolonged downturn in telecoms spending, Reuters reports.

January 13, 2026: Meta plans to cut around 10% of employees in Reality Labs business

Meta plans to cut around 10% of the employees in its Reality Labs division who work on products including the metaverse, according to three people with knowledge of the discussions, according to The New York Times.

Layoffs in 2025

• Cisco
• Oracle
• Windsurf
• Intel
• Microsoft
• Crowdstrike
• HPE
• Autodesk
• HPE
• CISA
• Workday
• Salesforce
• Meta

Global tech-sector layoffs surpass 244,000 in 2025

Economic uncertainty, elevated interest rates, and AI adoption have driven workforce reductions across tech companies worldwide, according to a RationalFX report.

October 28, 2025: Amazon to cut 14,000 jobs across company

Amazon will reduce its overall workforce by 14,000, cutting layers of management across the company and hiring in some areas to support its “biggest bets”.

August 18, 2025: Cisco and Oracle to cut hundreds of Bay Area jobs

Tech companies Cisco and Oracle are cutting hundreds of jobs across the Bay Area. Cisco will eliminate 221 positions at its Milpitas and San Francisco offices, effective Oct. 13. Oracle is reducing 101 positions in Santa Clara on the same date 

August 5, 2025: 3 weeks after acquiring Windsurf, Cognition offers staff the exit door

Cognition, the AI coding startup that acquired rival company Windsurf three weeks ago, laid off 30 employees last week and is offering buyouts to the roughly 200 remaining employees on the team, reports The Information.

July 25, 2025, Intel to lay off 22% of workforce, CEO Tan signals ‘no more blank checks’

Intel will reduce its workforce to 75,000 employees by the end of 2025 as new CEO Lip-Bu Tan implements sweeping changes designed to transform the struggling chipmaker

July 8, 2025, Intel layoffs begin: Chipmaker is cutting many thousands of jobs

Intel has begun laying off employees across the company. CEO Lip-Bu Tan told workers back in April to expect major layoffs at Intel in the coming months as the chipmaker slashes costs and overhauls its organization after years of technical setbacks and falling sales.

July 2, 2025: Microsoft will cut 9,000 workers

Microsoft will lay off about 9,000 employees, a source familiar with the workforce cut told CNBC.  The cuts will reportedly affect less than 4% of Microsoft’s global workforce and will impact different teams, geographies and levels of experience. This is the latest in a string of cuts the tech giant has made this year.

June 17, 2025: Intel looks to factory layoffs to return to profitability

Intel will lay off up to 20% of its manufacturing sector employees starting in July, according to media reports, as the company looks for options as it seeks a return to profitability. The cuts reportedly will be made around the world, but some of the layoffs will be closer to home, according to a report in The Oregonian citing an internal company memo from Intel manufacturing Vice President Naga Chandrasekaran.

May 7, 2025: CrowdStrike to lay off 5% of staff

CrowdStrike announced a plan to cut about 500 roles, roughly 5% of its workforce, to streamline operations and reduce costs. The cybersecurity company will incur about $36 million to $53 million in charges related to the layoffs

March 6, 2025: HPE cuts 2,500 jobs, remains committed to Juniper buy

CEO Antonio Neri told Wall Street analysts that HPE would begin implementing a cost-cutting program involving layoffs of about 2,500 employees over the next 18 months. HPE employs about 61,000 people worldwide.

Feb. 27, 2025: Autodesk to lay off 9% of workforce

Software maker Autodesk is laying off 1,350 staff. With the rise of subscription and multi-year contracts billed annually, and self-service enablement, it finds it needs fewer sales staff, CEO Andrew Anagnost said in a message to employees. And with its cloud, platform, and AI products proving most profitable, it’s concentrating its staff and investments there.

Feb. 27, 2025: HP to lay off 2,000 more

As part of an ongoing restructuring, HP plans to lay off up to another 2,000 workers. In recent weeks, the company has tried — unsuccessfully — to do away with telephone support staff by forcing callers to wait for at least 15 minutes if they refuse to use self-service support resources online. The company swiftly backtracked, but wider job cuts are still on.

Feb. 21, 2025: CISA lays off 130

Government employees get laid off too: In this case, 130 workers at the US Cybersecurity and Infrastructure Security Agency are being shown the door as a result of a DOGE decision. Cybersecurity experts are concerned that the cuts will harm the international collaborations that CISA has fostered, quite apart from their concerns about the security of the DOGE layoff process itself.

Feb. 5, 2025: Workday lays off 1,750

As it moves to invest more in AI and international growth, Workday is laying off 8.5% of its workforce and disposing of unused office space. Some analysts fear the cutbacks will affect the company’s customer service — unless AI can pick up the slack.

Feb. 4, 2025: Salesforce lays off over 1,000

At the same time as it’s hiring sales staff for its new artificial intelligence products, Salesforce is laying off over 1,000 workers across the company, according to Bloomberg. As of June, 2024, the company had over 72,000 employees, according to its website. Salesforce did not comment on the report. In 2024 the company reportedly laid off around 1,000 staff too, in two waves: January and July.

Jan. 14, 2025: Meta will lay off 5% of workforce

Mark Zuckerberg told Meta employees he intended to “move out the low performers faster” in an internal memo reported by Bloomberg. The memo announced that the company will lay off 5% of its staff, or around 3,600 staff, beginning Feb. 10. The company had already reduced its headcount by 5% in 2024 through natural attrition, the memo said. Among those leaving the company will be staff previously responsible for fact checking of posts on its social media platforms in the US, as the company begins relying on its users to police content.

Tech layoffs in 2024

• Equinix
• AMD
• Freshworks
• Cisco
• General Motors
• Intel
• OpenText
• Microsoft
• AWS
• Dell

Nov. 26, 2024: Equinix to cut 3% of staff

Despite intense demand for its data center capacity, Equinix is planning to lay off 3% of its workforce, or around 400 employees. The announcement followed the appointment of Adaire Fox-Martin to replace Charles Meyers as CEO and the departures of two other senior executives, CIO Milind Wagle and CISO Michael Montoya.

Nov. 13, 2024: AMD to cut 4% of workforce

AMD will lay off around 1,000 employees as it pivots towards developing AI-focused chips, it said. The move came as a surprise to staff, as the company also reported strong quarterly earnings.

Nov. 7, 2024: Freshworks lays off 660

Enterprise software vendor Freshworks laid off around 660 staff, or around 13% of its headcount, despite reporting increased revenue and profits in its fourth fiscal quarter. The company described the layoffs as a realignment of its global workforce.

Sept. 17, 2024: Cisco lays off 6,000

After laying off around 4,200 staff in February, Cisco is at it again, laying off another 6,000 or around 7% of its workforce. Among the divisions affected were its threat intelligence unit, Talos Security.

Aug. 20, 2024: General Motors lays off 1,000 software staff

More than 1,000 software and services staff are on the way out at General Motors, signalling that it could be rethinking its digital transformation strategy. In an internal memo, the company said that it was moving resources to its highest-priority work and flattening hierarchies.

August 1, 2024: Intel removes 15,000 roles

Intel plans to cut its workforce by around 15% to reduce costs after a disastrous second quarter. Revenue for the three months to June 29 stagnated at around $12.8 billion, but net income fell 85% to $83 million, prompting CEO Pat Gelsinger to bring forward a company-wide meeting in order to announce that 15,000 staff would lose their jobs. “This is an incredibly hard day for Intel as we are making some of the most consequential changes in our company’s history,” Gelsinger wrote in an email to staff, continuing: “Our revenues have not grown as expected — and we’ve yet to fully benefit from powerful trends, like AI. Our costs are too high, our margins are too low. We need bolder actions to address both — particularly given our financial results and outlook for the second half of 2024, which is tougher than previously expected.”

July 4, 2024: OpenText to lay off 1,200

OpenText said it will lay off 1,200 staff, or about 1.7% of its workforce, in a bid to save around $100 million annually. It plans to hire new sales and engineering staff in other areas in 2025, it said.

June 4, 2024: Microsoft lays off staff in Azure division

Microsoft laid off staff in several teams supporting its cloud services, including Azure for Operations and Mission Engineering. The company didn’t say exactly how many staff were leaving.

April 4, 2024: Amazon downsizes AWS in a fresh cost-cutting round

Amazon announced hundreds of layoffs in the sales and marketing teams of its AWS cloud services division — and also in the technology development teams for its physical retail stores, as it stepped back from efforts to generalize the “Just Walk Out” technology built for its Amazon Fresh grocery stores.

April 1, 2024: Dell acknowledges 13,000 job cuts

Dell Technologies’ latest 10K filing with the US Securities and Exchange Commission disclosed that the company had laid off 13,000 employees over the course of the 2023 fiscal year; it characterized the layoffs and other reorganizational moves as cost-cutting measures. “These actions resulted in a reduction in our overall headcount,” the company said. A comparison to the previous year’s 10K filing, performed by The Register, found that Dell employed 133,000 people at that point, compared to 120,000 as of February 2024. Dell announced layoffs of 6,650 staffers on Feb. 6, but it is unclear whether those cuts were reflected in the numbers from this year’s 10K statement.

See news of earlier layoffs.

I haven’t slept much in the past few weeks. Not because of some theoretical cyber risk that keeps many executives awake, but because reality just delivered a real wake-up call to our industry — a call that every executive must answer, now.

Imagine this: A major global enterprise, a company most of us interact with indirectly every single day, wakes up to find its entire digital environment obliterated. Thousands of employees in dozens of offices and remote locations are suddenly offline. Customers are cut off, supply chains grind to a halt and regulators are notified with a chilling admission: “We have no idea when we’ll be back.”

This wasn’t ransomware. There was no negotiation, no decryption key to buy, no easy way out. It was destruction — deliberate, coordinated and geopolitically motivated — not monetary.

As a chief customer officer who’s worked with countless customers on cyberattack risks, my perspective hits a bit differently than a CISO or a CTO. I see the aftermath, not just the attack surface. I see the faces behind the tickets, the operations team locked out of their own systems, the support agent answering panicked calls at dawn. And I ask: How many organizations have actually stress-tested their response to this scenario — not a hypothetical, but this very real, lights-out event? Here’s what every leader needs to confront today:

Recovery is not just a technical exercise

The first assumption to break during a real crisis is the belief that recovery is purely technical.

Many organizations have done tabletop exercises and have a backup and recovery playbook, so they feel prepared. They can point to backup windows, retention schedules and immutability controls. The moment a true blackout happens, a different reality surfaces. The people who own the recovery steps either do not know each other, lack the authority to make decisions without supervisor approval or need guidance from offline systems.

The reality is that technical infrastructure almost always holds up better than human infrastructure. Organizations have built their recovery strategy around the assumption that someone competent will be awake, available and empowered when a cyber event happens.

Still, backups are only as good as their independence. Let’s be blunt: If your recovery infrastructure shares identity, authentication or network trust with your Microsoft tenant (such as Azure, Microsoft 365 or Teams), you don’t actually have a recovery plan; you have a false sense of one — and a liability. A recent survey found that while 90% of organizations express confidence in their ability to recover from a cyber incident, fewer than one in three ransomware victims fully recovered their data.

True resilience means immutable, air-gapped backups, untouchable by the same compromise. Anything less is an illusion. I talk to customers about their recovery plans constantly. The customers who have rehearsed all scenarios sleep soundly. Those who haven’t? They’re rolling the dice.

Most business continuity plans ignore ‘total blackout’

I’ve reviewed hundreds of business continuity plans. Almost all assume partial failures — a region, an application, a data center. But what if every system, in every country, goes dark simultaneously? That’s an entirely different playbook. If your team hasn’t run a drill for a global, simultaneous outage, you’re not prepared. The probability is low, but the cost of being unready is existential.

Connected devices, OT systems, field hardware, partner integrations — they all plug into your enterprise network. When the core collapses, it’s not just IT at risk. It’s operational technology, physical safety systems and in regulated sectors, potentially human lives. Understanding and testing those interdependencies is non-negotiable.

This is also where boards need to change the conversation. A study found that only 5% of companies have cybersecurity experts on their board of directors. Recovery time objectives (RTOs) should not be buried in technical appendices. It’s all jargon to boards. That makes translation essential. RTOs must be explained in terms of business impact. “We can recover in four hours” is a technical statement. “Every hour of downtime costs us $2.3M and creates regulatory exposure in three jurisdictions” is a board statement.

That is the level of clarity leaders need.

The most prepared organizations do not wait for an incident to educate the board. They bring the conversation forward proactively. They frame recovery in business terms: revenue, regulatory standing, customer trust and brand reputation.

The most effective framing is often simple. Show the most critical systems. Show what happens if each one is down for one hour, four hours, 24 hours and 72 hours. Show the current recovery capability against each and then show the gap.

If your board is not demanding real answers, your business continuity strategy is likely underfunded and your business is exposed. This is a risk conversation worth forcing because the consequences do not stay inside IT. They can show up in customer churn or missed revenue and ruin an organization’s reputation.

Threat intelligence must be actionable, not archived

Geopolitical attacks, hacktivist campaigns and nation-state targeting aren’t abstract threats. They are active risks, and that intelligence cannot languish in the security team’s inbox. Executive leadership must be looped in — and immediately — so gaps can be closed before they’re exploited. Too often, intelligence enters the security operations function and never reaches the teams responsible for recovery infrastructure or executive decision-making.

If a threat actor is targeting a specific class of backup agents, the team responsible for those agents needs to know now, not two weeks from now. If intelligence suggests destructive activity against a sector, recovery owners need to validate isolation, access paths and restoration procedures immediately. If geopolitical tension increases the likelihood of targeting, executive leadership needs to understand what exposure exists and what actions are being taken. The organizations that survive aren’t just the best at incident response. They’re the ones who anticipated, rehearsed and invested before the attack.

Part of investing in a recovery strategy requires closing the loop between signal and action. The most prepared organizations have already mapped their critical recovery dependencies to specific threat categories. When intelligence touches one of those categories, there is a named owner and a clear set of actions. No guessing or forwarding emails into the void is needed because the distance between the warning and the employees’ ability to do something is shortened.

Looking ahead, the conversation will continue to evolve beyond traditional cyber response. Because in an AI-enabled enterprise, the new question is whether the data within those systems can still be trusted. When AI systems make decisions based on enterprise data, the attack surface becomes the data’s accuracy. A threat actor who quietly corrupts a dataset over 90 days before a recovery event has done more damage than just downtime. They can poison the inputs driving decisions across the business.

Regardless of how AI will change threat intelligence and cyber response, these principles remain the same. Know your problem, whether structural or technological. Ensure your human infrastructure keeps pace with your technical infrastructure, with clear cross-functional ownership and the tools and knowledge to act autonomously. Communicate with your boards often — and correctly.

Let’s not wait for the next headline to ask, “Are we ready?” Have those conversations now. Test your assumptions. Close your gaps. Because in today’s threat landscape, resilience isn’t IT’s job — it’s everyone’s mandate.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Ein Cyber Risk Assessment unterstützt dabei, potenzielle Bedrohungen und Schwachstellen für wichtige digitale und physische Unternehmens-Assets zu identifizieren, zu bewerten und zu priorisieren. Trotzdem stolpern in diesem Zusammenhang immer noch viele CISOs und Sicherheitsentscheider über Fallstricke, die sie daran hindern, ihre Risk-Assessment-Ziele vollumfänglich zu erreichen.

Welche das konkret sind und wie man sie gewissenhaft meidet, haben wir im Gespräch mit Security-Experten herausgefunden.

1. Einfach nur abhaken

Die wohl größte Falle im Zusammenhang mit Risk Assessments besteht darin, diese als Checkliste zu behandeln – statt als Entscheidungshilfe, die mit realem Business Impact oder Threat-Szenarien verknüpft ist. Shirsendu Mondal, Security-Forscher an der University of North Carolina, klärt auf: „Wenn sich Ihre Risikobewertung nur noch darum dreht, irgendwelche Kästchen abzuhaken, verlieren Sie die Fähigkeit, die tatsächlichen Risiken einer Umgebung zu Tage zu fördern. Das Ziel eines solchen Assessments sollte jedoch sein, aufzudecken, an welchen Stellen tatsächlich eine Gefährdungslage besteht.“ 

Der beste Weg, diese „Selbstzufriedenheits“-Falle zu umgehen, besteht laut dem Forscher darin, einen kontextorientierten Ansatz zu fahren: „Fragen Sie konkret danach, wo sich die betreffende Ressource befindet, wer darauf zugreifen kann, welche Daten sie berührt, wie wichtig sie für den Betrieb ist und was passiert, wenn sie ausfällt. Risiken sollten stets mit den geschäftlichen Auswirkungen korreliert werden – nicht bloß mit technischen Erkenntnissen.“

Eben, weil Risiken seiner Ansicht nach mehr sind als nur technische Probleme, empfiehlt Mondal Security-Entscheidern, andere Führungskräfte aus dem Unternehmen in das Security-Gefüge zu integrieren – etwa aus der IT und dem Betrieb.

2. Ergebnisse schönreden

Besonders in schwierigen Zeiten ist es das A und O, den Stakeholdern (und sich selbst) gegenüber ehrlich zu sein. Diese Auffassung vertritt auch Pablo Riboldi, CISO beim Softwareunternehmen BairesDev: „Wenn die Ergebnisse entmutigend sind, sollte man einfach zugeben, dass sich die Bedrohungslage deutlich schneller entwickelt hat, als über das bisherige Bewertungs-Framework abzusehen war.“

Anstatt einfach nur Schwachstellen-Listen zu übergeben, rät Riboldi dazu, konkrete Angriffsszenarien abzubilden: „Zum Beispiel, indem Sie die drei kritischsten Assets priorisieren und ein eingehendes Risk Assessment durchführen. So lässt sich auch ein unmittelbarer Mehrwert demonstrieren.“

3. Scope falsch einschätzen

Nicht wenige CISOs sichern Dokumentenkontrollen ab, haken Compliance-Checkboxen ab und erstellen ein Risikoregister, das den Eindruck vermittelt, dass alles in Ordnung ist. Der Schein trügt jedoch des Öfteren, wie Denis Calderone, CTO beim Sicherheitsdienstleister Suzu Labs, aus eigener Erfahrung weiß: „In solchen Fällen kommt es nicht selten vor, dass sich niemand die Mühe gemacht hat, zu testen, ob diese Kontrollen tatsächlich funktionieren. Oder, ob der Scope der Risikobewertung auch das abdeckt, worauf es wirklich ankommt.“

Der Technologieentscheider hat dazu auch ein Beispiel aus der Praxis auf Lager: „Wenn das Risk Assessment die Produktionsserver und das Unternehmensnetzwerk umfasst, der alte Dev-Rechner, ein Drittanbieter-Portal oder ein verwaister API-Endpunkt dabei aber außen vor bleiben, ist das ungünstig. Angreifer betrachten die gesamte Umgebung und finden genau den Einstiegspunkt, der zuvor als nicht bewertungswürdig erachtet wurde.“

Künstliche Intelligenz (KI) verschlimmere die Situation laut Calderone noch: Unternehmen setzten vielfach KI-Tools ein, verknüpften diese mit internen Systemen und gewährten ihnen Zugriff auf sensible Daten – ohne dass das in die Risikobewertung einfließe. Der Experte warnt: „Wenn Ihr Risk Assessment aufgesetzt wurde, bevor Ihr Unternehmen damit begonnen hat, KI in Workflows zu integrieren, ist es bereits veraltet.“

4. Annahmen nicht hinterfragen

Wenn sich die Zielsetzung einer Risikobewertung in Richtung „Hauptsache bestanden“ verschiebt, stellt das vielleicht Auditoren zufrieden. Die Unternehmensleitung könnte dadurch jedoch in die Irre geführt werden, wie Amit Basu, CIO und CISO beim Schifffahrtsunternehmen International Seaways, erklärt: „Führungskräfte und Vorstandsmitglieder sehen ein fertiges Risikoregister und gehen davon aus, dass das Unternehmen geschützt ist. Unterdessen bleiben echte Bedrohungen unberücksichtigt, weil sie nicht nahtlos in den Bewertungsrahmen passten. Dieser Fallstrick ist unsichtbar – er verbirgt sich hinter einem Dashboard.“

Nach Ansicht von Basu ist ein Risk Assessment nur so gut, wie die ihm zugrundeliegenden Annahmen: „Diese sollten Sie explizit dokumentieren und immer dann überprüfen, wenn sich das Business verändert, eine Bedrohungslage verschiebt oder ein Sicherheitsvorfall eine Lücke zu Tage fördert.“

Ein Risk Assessment, so der CISO, sei nicht als fertiges Produkt zu betrachten, sondern als lebendiger Beitrag zu einem fortlaufenden Dialog zwischen Security-Abteilung und Unternehmen.

5. Risiken nicht mit Impact verknüpfen

Probleme in den Hintergrund zu rücken oder herunterzuspielen, fällt deutlich leichter, wenn man den Zusammenhang zwischen Risiko und Business einfach ausblendet. Das erkennt auch Dan Moore, Senior Director of Strategy and Identity Standards beim CIAM-Spezialisten FusionAuth, an. Er warnt jedoch vor den Folgen dieses Gebarens: „So wird es sich diffizil gestalten, tatsächliche Risiken zu kommunizieren. Schlimmer noch: Es liefert den Mitgliedern des Security-Teams einen Vorwand, sich darüber zu beschweren, dass sie missverstanden oder nicht wertgeschätzt werden – und das beeinträchtigt die Effektivität des Teams.“

Der Manager erachtet es als wichtig, stattdessen konkret zu sein und zielgerichtet vorzugehen: „Verzichten Sie auf Angaben wie eine Patch-Compliance von 95 Prozent. Sprechen Sie stattdessen über das Risiko, das nicht gepatchte Systeme für das Unternehmen darstellen.“

Dabei seien manchen Systemen – etwa Legacy-Konstrukten, die nicht mit dem Internet verbunden sind – geringere Risiken inhärent als anderen, selbst wenn sie dieselben Patch-Probleme aufwiesen, meint Moore und empfiehlt, diese Tatsache anzuerkennen und die Reaktion entsprechend abzuwägen.  

6. Compliance mit Security verwechseln

„Compliance allein ist weder ein Garant für robuste Security, noch erfüllt sie die Mindestanforderungen für einen wirksamen Schutz“, hält Adriel Desautels, CEO der Security-Beratung Netragard, fest.

Unternehmen gerieten demnach besonders oft in diese Falle, wenn sie für Penetrationstests externe Firmen beauftragten, die sich auf Compliance konzentrieren und gleichzeitig „erstklassige Dienstleistungen“ versprechen. „In Wahrheit liefern diese oft automatisierte Scans, die als manuelle Tests getarnt sind“, meint Desautels.

Das Ergebnis sei ein falsches Sicherheitsgefühl, warnt der Manager: „Vergegenwärtigen Sie sich einfach, dass bei jedem größeren Sicherheitsvorfall der letzten zehn Jahre eine Organisation beteiligt war, die zum Zeitpunkt des Angriffs alle Compliance-Vorgaben erfüllt hatte.“

7. Risiken nicht vollständig verstehen

Unternehmen betrachten Risk Assessments oft als eine Art „Schwachstellenkatalogisierung“, bei der es darum geht, Lücken zu finden, Schweregrade zu erfassen und Audits zu bestehen. Letzteres heißt allerdings nicht, dass die Risiken auch verstanden wurden.

Geht es nach Safi Raza, Senior Director for Cybersecurity bei Fusion Risk Management, sollten sich CISOs darauf konzentrieren, technische Risikosignale mit betrieblichen Folgen zu verknüpfen: „Dazu muss man verstehen, welche Services betroffen sind, wie sich Störungen ausbreiten und was das für den Umsatz, die Kunden oder regulatorische Verpflichtungen bedeutet.“

Der Experte rät in diesem Zusammenhang dazu, zunächst von statischen Bewertungen zu einer kontinuierlichen, kontextbezogenen Risikotransparenz überzugehen, um sicherzustellen, dass Risiken nicht nur technisch verstanden werden.“ (fm)

Dieser Artikel ist im Original bei unserer Schwesterpublikation CSOonline.com erschienen.

Liebe Microsoft-Entscheider,

Ich möchte keine Hassliebe zu Visual Studio Code (VS Code) entwickeln. Aber ihr macht es mir wirklich schwer. Früher war VS Code einfach nur ein Editor, den man mit Hilfe von Add-Ons genau so konfiguriert hat, wie man es brauchte oder wollte. Deshalb habe ich das Tool bisher auch wirklich gerne für diverse Dev-Aufgaben in unterschiedlichen Programmiersprachen genutzt. Zum Beispiel, um:

• mit Extensions einen Python-Workflow aufzusetzen, der Datenbankfunktionen erschließt,
• eine Umgebung für das digitale Publishing von Büchern zu erstellen, oder
• ein Screenwriting-Projekt einzurichten.

Natürlich geht all das auch noch heute. Aber: Buchstäblich jede neue Funktion in Visual Studio Code dreht sich heute nur noch um ein Thema: KI. Das hat inzwischen Ausmaße angenommen, angesichts derer ich mir die Frage stelle, ob in Eurem Unternehmen überhaupt noch jemand am eigentlichen Editor arbeitet.

Die Release-Notes zu VS Code 1.127 sind ein gutes Beispiel: Abgesehen von einer Funktion, dreht sich auch hier alles nur um Agenten und Large Language Models (LLMs). Gleiches gilt auch für die Vorgängerversion. Der Trend ist klar erkennbar: VS Code entwickelt sich rasant weiter, vor allem in Richtung Frontend für Agenten. Alles andere scheint erst einmal nachrangig.

Manche mögen argumentieren, dass Microsofts Dev-Tool inzwischen so ausgereift ist, dass es an den Kernfunktionalitäten nicht mehr viel zu optimieren gibt – weshalb der Fokus nun eben vor allem darauf liegt, neue Nutzer über den KI-Trend anzuziehen. Das ist allerdings kein Grund dafür, dass all diese KI-Funktionen auf IDE-Ebene integriert werden müssen. Meiner Meinung nach sollte Euer Fokus eher darauf liegen, die native Erweiterbarkeit von VS Code zu fördern – statt keinen Stein auf dem anderen zu lassen, nur um KI-Funktionen zu nativen Elementen zu machen.

Im Grunde geht es Euch in meinen Augen vor allem darum, Visual Studio Code zum ersten Anlaufpunkt für KI zu machen – insbesondere für GitHub Copilot. Allerdings rückt so aus meiner Perspektive die Entwicklererfahrung zugunsten der Allgegenwärtigkeit von KI in den Hintergrund. Wenn Ihr wirklich glaubt, dass jeder User von VS Code ein „Agentic Development Environment“ (ADE) einer IDE vorzieht, liegt Ihr in meinen Augen völlig falsch.

KI-Tools werden zwar nicht wieder verschwinden. Ich glaube aber durchaus, dass es künftig zu einer Konsolidierung kommen wird.  Frontier-Modelle, die alles können und noch sechs weitere Features obendrauf packen, werden sich bald nur noch nur für große Anbieter lohnen, die ein Netz aus API-„Mautstellen“ darum herum errichten – und genug Geld haben, um entsprechende Rechenzentren zu betreiben.

Der allgemeine Trend geht bei KI eher hin zu kleineren, lokal gehosteten Modellen, die spezialisierte Tasks bewältigen – und mit deutlich weniger Aufwand zu trainieren, bereitzustellen und zu betreiben sind. Es macht also echt wenig Sinn, das Pferd hinter den Karren zu spannen – wie bei den nativen KI-Funktionen von VS Code.

Gleichzeitig habe ich die Hoffnung, dass es nicht mehr so lange dauert, bis die KI-Funktionen wieder aus Visual Studio Code herausgelöst und in ein Add-On verfrachtet werden. Bis es so weit ist, bleibt mir wohl nur, mich damit abzufinden, dass mein Lieblings-Editor zunehmend mit KI-Funktionen vollgestopft wird – ganz gleich, ob sie für meinen Anwendungsfall überhaupt Sinn machen oder nicht. Immerhin ist es (noch) möglich, das ganze KI-Zeug in VS Code zu deaktivieren.

Während ich diesen Text hier schreibe, habe ich gerade das Update auf VS Code 1.128 erhalten. Das enthält eine nutzwertige Funktion, die ich sicher oft nutzen werden: die Möglichkeit, Tastatur-Shortcuts auf Betriebssystemebene einzurichten. Ansonsten dreht sich auch bei diesem Update alles nur um eines: KI.

Besinnt Euch darauf, was Visual Studio Code groß gemacht hat – ansonsten riskiert Ihr auf lange Sicht, Benutzer zu verlieren.

Liebe Grüße,

ein genervter Visual-Studio-Code-Poweruser.

Dieser Artikel ist im Original bei unserer Schwesterpublikation Infoworld.com erschienen.

Business email and collaboration suite Zimbra has received a major security update that fixes several critical issues that could allow attackers to execute malicious code on the server or in users’ browsers.

Available in commercial and open-source editions, Zimbra Collaboration Suite is a self-hosted Microsoft Exchange alternative that is popular with businesses, government entities, and educational institutions, which has made it a target for attackers in the past.

Version 10.1.20 released this week includes patches for nine vulnerabilities, including a permanent fix for a critical flaw announced in June in the SNMP monitoring component that could be exploited to inject commands when notifications are enabled.

The release also fixes four cross-site scripting (XSS) vulnerabilities in the Classic Web Client that could allow attackers to execute malicious scripts when users view emails in the web interface. For example, one vulnerability can be triggered through specially crafted attachment filenames and another when users render an attachment.

XSS vulnerabilities are dangerous because they execute scripts in the user’s browser in the context of the page. That gives rogue code the same privileges as the user, enabling it to perform malicious actions, exfiltrate data, or even leak session cookies.

In 2025, an XSS vulnerability in the calendar import feature of the Zimbra Classic Web Client (CVE-2025-27915) was exploited in attacks targeting Brazilian military personnel. Many other Zimbra vulnerabilities have been exploited over the years, sometimes as zero-days, especially by Russian state-sponsored APT groups, such as Fancy Bear (APT28), Cozy Bear (APT29), and Winter Vivern (TA473).

A recent incident involved a Russian threat group targeting a Ukrainian critical infrastructure agency in March using specifically crafted emails that exploited a known Zimbra stored XXS vulnerability (CVE-2025-66376).

Another vulnerability fixed in the newly released Zimbra 10.1.20 could allow authenticated attackers to bypass email forwarding restrictions. Adding email forwarding rules to a compromised account is a common way to achieve persistence and continuously exfiltrate emails from a mailbox over an extended period of time, even if the account password is changed.

The release also fixes a security issue related to access controls in the EWS extension, an authorization issue in mailbox delegation, and a server-side request forgery (SSRF) vulnerability in the Nextcloud integration. Nextcloud is another self-hosted collaboration suite that is popular with government and public institutions that don’t want to rely on public clouds.

It’s worth noting that this is the second Zimbra security update this month. Version 10.1.19, released on July 7, patched another unspecified security issue in the Classic Web Client that could run malicious code when specially crafted emails were opened by users.

Zimbra owner Synacor strongly advises customers to upgrade to the latest available version as soon as possible to keep their environments secure. While none of these flaws had zero-day status, hacker groups have a history for quickly adopting known Zimbra exploits.