Hundreds of cybersecurity workers have received pink slips in the last few months, despite early expectations that the industry would be spared the tech sector's wave of layoffs.

Driving the news: In the last month, at least nine cybersecurity companies have announced layoffs, according to data from Layoffs.fyi.

• IronNet, a cyber company founded by a group of former intelligence officials, said in a public 8-K filing this week it would lay off most of its workers and "substantially curtail" its operations.
• The company joins a growing list that includes Malwarebytes, Fortinet, NCC Group, Rapid7, Dragos, HackerOne and Bishop Fox in cutting staff this year.

The big picture: As the threat landscape expands, demand for cybersecurity products and workers has never been higher.

• But that demand has also spurred competition among cybersecurity vendors, who are now competing for a place in their clients' increasingly streamlined IT and security budgets.

What they're saying: "It is entirely possible that in the cybersecurity space, these companies are facing longer lead times and longer sales cycles," Krista Macomber, a senior analyst focused on data protection and cybersecurity at the Futurum Group, told Axios.

Between the lines: Cybersecurity companies aren't exempt from the anxiety and uncertainty inspired by the current economy, Macomber said.

• Vendors of all sizes are eager to find ways to cut costs to better prepare for a potential recession and any other unexpected changes the macro economy brings next year, she added — and that often means layoffs.

Details: Public information about recent cybersecurity industry layoffs suggest vendors are making sizable workforce cuts too.

• Some of the companies have cut between 10% and 20% of their workforce, resulting in hundreds of jobs losses.
• Rapid7 cut around 18% of its workforce, or roughly 470 jobs. SecureWorks cut 15% of its workforce last month as part of its second round of layoffs in 2023.
• However, some of the cuts have been focused on non-cybersecurity roles, like sales and marketing teams. For example, Fortinet focused its most recent layoffs on the sales, business development and channel partner teams, CRN reported.

The intrigue: Security executives are starting to weigh in more on IT spending decisions — which can drag out sales cycles as executives juggle the additional opinions.

• "What we're seeing is that the CISO, the cybersecurity teams, they're having a seat at the table when it comes to thinking about the IT infrastructure [and] the hardware and software that's in place to store and protect information," Macomber said.

Zoom out: The recent layoffs may also help stabilize cybersecurity vendors' workforces after massive hiring sprees during the pandemic.

• Hundreds of thousands of cybersecurity job postings cropped up on LinkedIn during the first few months of the pandemic as companies rushed to take their daily workflows online.
• Now, similar to the broader tech sector, cybersecurity firms could be stabilizing their head counts, Macomber added.

Meanwhile, the recent layoffs are likely going to exacerbate the ongoing burnout and retention issues that cyber workers still face.

• Earlier this year, a survey from Cobalt found that after layoffs, half of workers whose teams were affected wanted to quit their jobs.

Yes, but: The industry is reportedly still dealing with a shortage of cybersecurity workers.

• The U.S. has enough workers to fill only 69% of the available cybersecurity roles, according to CyberSeek.

Suspected Chinese disinformation operatives are already starting to leverage generative artificial intelligence in their influence campaigns, Microsoft warned Thursday.

Driving the news: Microsoft said in a new report that it has uncovered evidence that suspected China-linked actors are using AI-generated images in their social media campaigns to make them more believable.

• China-linked influence operations have been using AI-generated images since at least March, Microsoft said, and the images are already drawing "higher levels of engagement from authentic social media users."

Why it matters: This is one of the first known examples of a nation-state abusing generative AI in its cyber operations.

Details: Microsoft noticed suspected Chinese operatives using AI-generated images in a monthslong campaign that focused on both divisive U.S. political topics, like gun violence, and "denigrating U.S. political figures and symbols."

• One example of an AI-generated image involves the Statue of Liberty holding a rifle as well as the customary torch, with the text "The Goddess of Violence" overlaying it.
• However, the images still have some flaws: In the Statue of Liberty example, the image gave the statue more than five fingers on one of its hands.

The big picture: Cybersecurity and national security officials have long speculated that adversaries would tap generative AI to make phishing and disinformation campaigns more believable.

What they're saying: "We can expect China to continue to hone this technology over time, though it remains to be seen how and when it will deploy it at scale," Clint Watts, general manager at Microsoft Threat Analysis Center, wrote in a blog post.

The intrigue: Typically, China-linked influence operations have struggled to garner authentic engagement across social media.

• But Microsoft has found that, broadly speaking, China-affiliated influence operations are achieving more on social media as they lean on generative AI, as well as real people, to create tailored, authentic content.

Apple released software updates Thursday that patch two recently discovered, critical security bugs that hackers have already exploited.

Why it matters: The patches fix a set of vulnerabilities that researchers say helped controversial firm NSO Group install its Pegasus spyware onto a person's phone without being noticed.

Details: Apple patched a pair of issues that allowed NSO Group to surreptitiously infect a target's phone with the malicious spyware.

• One of the security flaws was in iOS's Image I/O framework, which allows applications to read and write most image files. If someone sent a malicious image to a victim's phone, a flaw in the I/O framework gave the intruder the ability to execute new code on the device.
• The other flaw was in Apple Wallet. An attacker sending a "maliciously crafted attachment" could also have given attackers code execution abilities.
• The update is available for iPhone 8 and later models, as well as most available iPad models and macOS Ventura systems.

The intrigue: Researchers at the University of Toronto's Citizen Lab uncovered the vulnerabilities while inspecting a phone belonging to an individual who works at a Washington, D.C.-based civil society organization.

• Citizen Lab immediately disclosed its findings to Apple, which rushed out a patch.
• It's unclear how many people have been affected by this exploit, but Citizen Lab said in a blog post that it plans to release more details.

What they're saying: "We commend Apple for their rapid investigative response and patch cycle, and we acknowledge the victim and their organization for their collaboration and assistance," Citizen Lab wrote in the blog post.

Be smart: iPhone users are highly encouraged to install these software updates immediately to avoid a hack.

• Citizen Lab also recommends that high-risk groups, such as journalists, government officials and dissidents, turn on the iPhone's Lockdown Mode feature.

@ D.C.

🏛️ The U.S. and the U.K. sanctioned 11 members of the Russia-linked Trickbot and Conti ransomware gangs. (Axios)

📝 A 2015 National Security Agency inspector general report alleges that senior White House cyber official Anne Neuberger "failed to exercise courtesy and respect in dealings with fellow workers" while she was at the agency. (The Intercept)

🇬🇧 The U.K. government says it won't use controversial powers in the Online Safety Bill, which is awaiting a vote, to break encryption and scan messaging apps for harmful content until it's "technically feasible." (Financial Times)

@ Industry

😰 Cybersecurity workers say they're struggling to fight off burnout and anxiety in an industry that demands 24/7 vigilance against attacks. (CyberScoop)

📲 Apple reported just 234 tips to police about possible child sexual abuse materials on its devices last year, compared to the millions that most other Big Tech firms shared. (Forbes)

🍎 Six prominent K-12 education technology companies have signed a cybersecurity pledge from the Cybersecurity and Infrastructure Security Agency promising to "take ownership of security outcomes" and "embrace radical transparency and accountability." (Cybersecurity Dive)

@ Hackers and hacks

🇨🇳 Microsoft said a crash dump let China-linked hackers obtain a difficult-to-get signing key and break into an engineer's email account during a July breach. (Reuters)

🇰🇵 The FBI says North Korea's Lazarus Group stole $41 million from crypto-based sports betting platform Stake.com on Labor Day. (The Block)

✈️ The Dunghill Leak group claimed responsibility for a ransomware attack on travel booking giant Sabre. (TechCrunch)

👀 Password recovery has gotten a lot more involved than I remembered....