Microsoft spent this week telling the world that passkeys are now the default sign-in method for Entra ID. Cloudflare rolled out a shiny new engine for sniffing out bot behavior in real time. And somewhere in Germany, Belgium, and the Netherlands, Lidl was quietly telling millions of customers that a third-party IT vendor got popped and their data walked out the door anyway. That’s the state of cybersecurity in one news cycle: the industry keeps building better locks for the front door while the loading dock stays wide open. If you run security for a living, this is the week that should annoy you the most, not because anything novel happened, but because nothing did.

The Cybersecurity Industry Keeps Shipping New Locks

Let’s give credit where it’s due. Passkeys as a default in Entra ID is a genuinely good move. Phishing-resistant authentication baked into the sign-in flow by default, instead of buried in an admin setting nobody enables, closes off one of the most reliable attack paths of the last decade. Credential phishing has been the opening move in more breaches than any exploit chain you could name, and defaulting to something that can’t be phished is the kind of boring, structural fix that actually moves the needle.

Cloudflare’s Precursor is chasing a similar idea from a different angle: continuous behavioral signals instead of one-time bot checks, so automation gets flagged based on how a session actually behaves rather than a single fingerprint at the door. Also good. Also, notably, not what stopped any of this week’s breaches.

Here’s the uncomfortable part. New authentication defaults and better bot detection are exactly the kind of improvements that get announced in blog posts and conference keynotes. They’re visible, they’re measurable, and they make for a tidy press release. Third-party vendor risk management does not. Nobody writes a triumphant blog post about the vendor audit they did last quarter that found nothing wrong. So the visible half of cybersecurity keeps getting better while the invisible half, the stuff that actually breaks, doesn’t get the same attention or budget.

Meanwhile, The Vendor Down The Hall Had A Bad Week

Lidl didn’t get breached. One of its IT service providers did, and that was enough. Attackers got into a separately stored file of customer data and walked off with some of it, and now Lidl’s support pages in three countries are running incident notices instead of return policies. This is the least surprising kind of breach there is, and that’s exactly the problem. Everyone knows vendor risk is real. Everyone still treats it like a compliance checkbox instead of an active attack surface.

Weak security fueling Russian cyberattacks made headlines the same week, with the UK and EU jointly sanctioning individuals and entities for the first time over cyberattacks and disinformation campaigns. Read the fine print on most of these campaigns and it’s rarely a zero-day. It’s misconfigured infrastructure, reused credentials, and organizations that assumed someone else was handling the basics. Nation-state attribution makes for a scarier headline than “vendor had weak security hardening,” but the underlying failure mode is often identical.

Notarized Doesn’t Mean Trusted, It Means Apple Looked Once

Jamf Threat Labs flagged something called CrashStealer this week, a native C++ macOS infostealer that skips the usual AppleScript or Objective-C wrapper tricks and instead ships through a notarized dropper. That’s the part worth sitting with. Notarization is Apple’s stamp of “we scanned this and it’s not obviously malicious.” It was never meant to be an ongoing trust guarantee, but plenty of users and even some IT policies treat it that way, because a green checkmark is easier to trust than it should be.

CrashStealer even validates the victim’s own login password locally before doing anything else, which tells you the authors know exactly how much friction most Mac users will tolerate before they get suspicious. This is the same lesson as the Lidl breach and the Russian sanctions story, just wearing a different disguise: attackers don’t need to break your defenses if they can get inside the boundary you already trust. A notarized binary, a trusted vendor, a reused password. Different door, same hallway.

One-liner for the folks skimming: threat detection built entirely on trust signals is threat detection with a known blind spot.

What Actual Security Hardening Looks Like This Week

None of this requires exotic tooling. It requires treating the unglamorous stuff as seriously as the shiny stuff. Concrete, vendor-neutral moves worth putting on this week’s list:

• Inventory every third-party vendor with access to customer data or your network, and confirm in writing when their access was last reviewed, not when it was granted.
• Apply brute-force lockout and rate limiting on every externally reachable login, admin panel, and API, not just the ones you remember exist.
• Treat code-signing and notarization as a floor, not a ceiling. Pair it with endpoint behavioral monitoring that flags unusual local credential prompts, regardless of how trusted the binary looked at install time.
• Build incident response runbooks that assume the breach originates from a vendor’s environment, not just your own, and rehearse who you notify and how fast.
• Layer defense in depth around identity specifically. Passkeys are a great step, but they protect the front door. Segment networks and enforce least privilege so a single compromised account, human or vendor, can’t reach everything.

The theme running through all of it is the same: cybersecurity maturity isn’t about having the newest control, it’s about making sure the boring controls actually cover the paths attackers use most. Passkeys and behavioral bot detection are real progress. They just weren’t the thing that failed anyone this week.

Sources

• Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID
• Introducing Precursor: detecting agentic behavior with continuous client-side signals
• Hackers breach Lidl’s IT service provider, steal customer data
• Weak Security Continues to Fuel Russian Cyberattacks
• CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks