Cybersecurity awareness month: a practitioner's view

The cybersecurity threat landscape today

The newest and most concerning cybersecurity threat that organizations must contend with today comes from AI, in two forms:

Phishing

Phishing via email, SMS and other vectors is still the dominant delivery method malicious actors choose. AI bolsters these social engineering attacks with more sophisticated and personalized hooks and even deepfake-assisted phone calls or videos. This takes believability up to an entirely different level, which requires a new take on training materials and conversations on cybersecurity.

AI agents

If your organization lacks strong AI governance policies and tools, you are open to some genuinely insidious threats that have a long time to work before IT notices. Why? Because when AI agents are afforded high access, attacks can look like legitimate use.

Even without an attack, mistakes, misconfigurations or over-extended autonomy can lead to catastrophic data loss or system damage. For instance: recently, an AI coding agent deleted a production database.

Add in the usual suspects

In addition to these new AI-related threats, InfoSec must still be on guard against:

• Ransomware and malware
• Insider threats
• Advanced Persistent Threats (APTs) and mobile spyware
• Adversary-in-the-Middle (AiTM) attacks
• Zero-day exploits

Cybersecurity is an ever-changing and continuous discipline, not a set-it-and-forget-it effort.

No organization can stay on top of this without expert help and a strong employee training program.

The practice of cybersecurity at Jamf

Our platform

We have built a comprehensive and robust security program to protect against and mitigate modern threats. We use the same one our customers use.

• Jamf maintains active SOC 2 Type II, ISO 27001, ISO 27017, ISO 27701 and ISO 27018 certifications across our core product offerings and cloud infrastructure.
• An incident response program is built on the NIST SP 800-61 framework, with a 72-hour customer notification commitment written into the security schedule.
• Our automated on-device security policies and configurations, combined with risk-based access policies (made possible with Declarative Device Management (DDM)) allow a device to stop cyberattacks as soon as it sees any suspicious activity.

Employee-facing security culture

Employee cybersecurity training cannot be a one-time job. Jamf goes beyond our required annual cybersecurity training, although required training is important. We work to keep security education up front and center throughout the year.

• Ongoing, rather than one-time, phishing simulations that get harder over time so that employees stay sharp
• A recognition program that rewards employees who report genuine (as opposed to training-related) suspicious messages
• Cybersecurity Awareness Month activities in October in addition to monthly blog posts and a quarterly newsletter

Ongoing InfoSec and IT workflows at Jamf

To keep our organization and employees as secure as possible, InfoSec and IT continually review, update and test.

In addition to continual review of policies and standards, Jamf regularly performs the following tests:

• Pre-release vulnerability scans and penetration tests: automated application security vulnerability assessments and penetration testing before every release
• Annual third-party penetration testing: at least annually, an independent consultant conducts comprehensive penetration tests and security evaluations across Jamf's systems
• AI-driven attack surface assessments using native endpoint monitoring, integrations and AI governance

Jamf also engages in the following operational and infrastructure security practices:

• Continuous internal and external vulnerability scanning
• Annual Disaster Recovery (DR) testing and backup restoration
• Real-time environment monitoring with automated intrusion detection, behavioral analytics and continuous telemetry monitoring

Jamf Threat Labs

Jamf is in the unique position of having an entire team of researchers, analysts and detection engineers who focus full-time on understanding emerging threats impacting today’s workforce. Their intelligence informs Jamf's security offerings; it also protects Jamf as a company.

Learn more about Jamf Threat Labs >>

Cybersecurity best practices

Taking part in a continuous and iterative cybersecurity practice requires regular workflows and testing on nearly every front. Ensure that your organization's cybersecurity discipline includes:

Employee training

Employee cybersecurity training has always been a key part of keeping organizations and individuals protected. With the increasing sophistication and subtlety of AI-powered phishing and smishing campaigns and the introduction of AI agent exploits, now is the time to put particular focus on how effective your training is.

Go beyond a required annual cybersecurity training video to incorporate ongoing, integrated phishing tests and education awareness campaigns. Use a third-party vendor such as HoxHunt with an existing program to pepper educational material throughout the year.

Offensive security and threat hunting

The cyber threat landscape is ever-changing and expanding. When you add in the newer risk of AI-powered phishing or AI agent exploits, organizations with a powerful cybersecurity discipline must seek out threats rather than only reacting to them.

Threat hunting uses cyber intelligence to detect active or previous compromises on a system. It’s a key tenet of cyber defense and requires specific skill sets and personnel to implement.

Jamf is lucky enough to have our own cybersecurity experts on call; to threat hunt at your organization, you may want to go with a ready-made solution such as Beacon by Jamf Threat Labs, a macOS-only threat-hunting service from Jamf Threat Labs.

AI governance

Employees are already using AI in your organization — sanctioned or not.

Employees use generative AI tools such as Claude Code, OpenAI Codex, Cursor and GitHub Copilot to get their jobs done or to ask questions. Without proper AI governance, engineering teams can inadvertently leak code; other employees may upload sensitive data to unsanctioned tools. Due to the nature of AI agents, users often grant a great deal of access to internal company systems when they use these tools.

Rather than attempting to ban all AI agent usage, your organization should govern it just as you govern devices, networks and data.

Learn more about AI governance with Jamf >>

Get started with better cybersecurity practices today!

If you aren't sure where to start, take a look at Jamf's Mac Security Checklist and assess which areas are the most important to you, or which area is most lacking. Putting together a cross-team group of experts from IT, InfoSec, management and more to discuss these issues will help to catch any oversights that teams can miss due to siloing.

Make a doable plan and stick with it! Never forget that cybersecurity is a discipline -- not a fixed end goal. Each step you take improves your security posture, whether it be implementing a new employee education campaign, proactively searching for threats or simply automating app updates and patches to avoid any security gaps.

Everyone in your organization has the potential to improve your cybersecurity practice.