Cybersecurity Roundup: Partnerships, Funding, and Emerging Threats – October 28, 2025 (CoPhish / Copilot Studio, Nozomi Arc, Crisis24 CISO On-Demand, BU MET)

Daily cybersecurity briefing — Oct 28, 2025: new CoPhish OAuth exploit via Copilot Studio, Nozomi Arc automates OT threat prevention, Crisis24 launches CISO On-Demand, BU MET warns rising cybercrime. Analysis & takeaways.

Introduction — framing the day

The cybersecurity landscape keeps splitting along two axes: (1) technology-driven attack surface expansion — where new tools and platforms (notably AI-built or AI-enabled services) create novel vectors for social engineering and token exfiltration; and (2) industrial-grade defensive innovation and services — where OT/ICS defenders, boutique personal-protection providers, and education programs scale to close the widening skills and tooling gap. Today’s developments reflect both sides: a novel OAuth-exfiltration phishing variant abusing Microsoft Copilot Studio, enterprise-grade automation for OT endpoint defenses, a premium “CISO as a service” product targeted at ultra-high-net-worth individuals and family offices, and an academic call to arms highlighting why more trained defenders matter.

This article summarizes each story, assesses the technical and strategic implications, and provides concrete recommendations for security leaders, SOC teams, and policymakers. Wherever I reference the original reporting or company releases, I’ve included source attributions inline so you can trace the claims directly.

TL;DR — the headlines in one paragraph

• A new phishing technique called CoPhish abuses Microsoft Copilot Studio agents to wrap OAuth consent flows and exfiltrate access tokens — increasing risk for Entra ID tenants and users who can consent to apps. Source: Cyber Security News / Datadog Security Labs.

• Nozomi Networks released Nozomi Arc, introducing flexible automated threat-prevention modes (Detection / Quarantine / Delete) for OT endpoints and integrating Mandiant-powered threat intelligence — a move to safely automate incident containment in operational environments. Source: PR Newswire (Nozomi Networks).

• Crisis24 Private Strategic Group launched CISO On-Demand, a white-glove cybersecurity service for prominent individuals, family offices and executives combining digital footprint reduction, 24/7 incident response, and bespoke remediation. Source: PR Newswire (Crisis24).

• Boston University’s MET highlights soaring cybercrime volumes and economic impact, underscoring the urgency of cybersecurity education and workforce development. Source: BU MET.

Story 1 — CoPhish: Copilot Studio abused to exfiltrate OAuth tokens

Source: Cyber Security News (reporting on Datadog Security Labs).

What happened (clear facts)

Datadog Security Labs (as reported by Cyber Security News) documented a sophisticated phishing technique labeled CoPhish that abuses Microsoft Copilot Studio’s agent-sharing functionality. Attackers create agents (custom chatbots) hosted on legitimate Microsoft domains and configure them to present a seemingly benign login/consent flow. When victims follow the flow and consent, the attacker’s agent captures OAuth tokens (e.g., Entra ID tokens) and exfiltrates them to attacker-controlled endpoints — sometimes hidden via Microsoft IPs and standard token exchange endpoints — enabling mail, calendar, and other Microsoft Graph actions without requiring the victim’s credentials.

Why this is novel and dangerous

Three technical features make CoPhish particularly potent:

1. Hosted on legitimate domains. By sitting on copilotstudio.microsoft.com, the phishing surface looks “official” and bypasses simple domain checks and many user heuristics.

2. Low-code agent customization. The attack uses Copilot Studio’s low-code agent features to build a plausible conversational flow and a “Login” workflow that triggers OAuth flows — effectively weaponizing a productivity tool.

3. OAuth consent abuse (MITRE T1528). Attackers request scopes that can be approved by unprivileged users (e.g., Mail.ReadWrite) or, in the case of misconfigured tenants, can escalate via admin consent patterns; once tokens are granted, attackers act as the user without needing passwords.

Immediate mitigations (practical)

• Tighten consent policies. Enforce admin-only consent for high-risk scopes; adopt the “least privilege” principle and make “user consent” conservative.

• Disable unsolicited app creation. Prevent unprivileged users from creating apps or agents in your tenant where possible.

• Monitor Entra ID audit logs for anomalous consents and for Copilot modifications or agent sharing — instrument automated detection to flag unusual token exchange flows.

• Phishing-resistant auth and session controls. Increase conditional access, require step-up authentication for privileged actions, and consider token lifetimes and refresh policies that limit long-lived token misuse.

Opinionated perspective

CoPhish is a paradigmatic example of how convenience features in productivity platforms create compound risk when they interact with modern auth architectures. Low-code and AI-assistant features accelerate deployment of high-utility workflows — but they also accelerate the attacker’s ability to assemble convincing social-engineering scaffolds. Security engineering must now account for agent-level trust boundaries: who may publish an agent, how agents are reviewed, and what telemetry is captured at the agent layer. Microsoft’s incremental policy tweaks (recently changing default settings for risky scopes) are necessary but insufficient; enterprises must bind their tenant-level identity governance to platform governance over AI agents.

Story 2 — Nozomi Arc: automating safe threat prevention in OT/ICS environments

Source: PR Newswire (Nozomi Networks release).

What happened (clear facts)

Nozomi Networks announced Nozomi Arc, described as the industry’s first cybersecurity solution designed to safely automate threat response in operational (OT) environments. The product expands the Nozomi platform from passive detection into active prevention with three flexible modes — Detection, Quarantine, and Delete — enabling teams to choose containment posture according to operational risk tolerance. The prevention engine is powered by Nozomi’s own threat intelligence and a Threat Intelligence Expansion Pack powered by Mandiant Threat Intelligence, delivering indicators in YARA, STIX, and SIGMA formats. Nozomi emphasizes preservation of uptime and safe containment tailored to OT constraints.

Why this matters for industrial defenders

Historically, OT environments have resisted aggressive automation because control systems are fragile and uptime-critical. Nozomi’s approach signals a maturing belief: automation can be safe if it’s context-aware, reversible, and integrated with OT telemetry. The flexible modes (monitor → quarantine → delete) provide graded responses that map to operational runbooks, while the integration with structured TI formats (STIX, YARA, SIGMA) improves interoperability with SOC workflows.

Implementation considerations

• Change management is paramount. Operators must test automated responses in staging and define precise escalation paths — false positives in “Delete” mode have catastrophic potential.

• Threat intelligence hygiene. Feed management (which IOCs get acted upon automatically) must be auditable and allow quick rollback. Mandiant-sourced IOCs are high quality, but mappings to OT device behavior must be deterministic.

• Visibility and metrics. Monitor MTTR, false positive rates, and production impact metrics. Track the frequency and type of automated blocks and whether they prevent lateral movement or reduce dwell time.

Opinionated perspective

Nozomi’s product evolution is strategically smart: the defensive market’s next phase is trusted automation, not just detection. Vendors who can prove low-friction, low-risk automation for OT will be able to command premium renewal rates. But automation becomes a multiplier only if governance, observability, and human override are built-in from day one. In short: automation must be trustworthy before it is autonomous.

Story 3 — Crisis24 launches CISO On-Demand: white-glove cyber protection for high-net-worth clients

Source: PR Newswire (Crisis24 release).

What happened (clear facts)

Crisis24’s Private Strategic Group introduced CISO On-Demand, a turnkey cyber protection service for prominent individuals, family offices, and executives. The offering bundles real-time surface/dark web monitoring (DigitalTrace), bespoke penetration testing and infrastructure assessment, digital footprint reduction, and 24/7 incident response with discreet strategic and legal support. Crisis24 positions the service as a complement to its existing physical protection and medical concierge capabilities, designed to be highly personalized and discrete.

Why this matters in the market

The premium personal-security market (private protection, medical concierge) is converging with cyber protection. Wealthy individuals face unique risks: targeted extortion, deep-web doxxing, reputation attacks, and identity fraud. Traditional enterprise-focused MSSPs are often ill-suited for personal protection where discretion, lifestyle integration, and non-standard infrastructure (private residences, home networks, IoT devices) matter.

Service design implications

• Privacy-first telemetry. Solutions must limit data collection to what’s necessary and include strict handling and deletion policies to avoid creating new privacy liabilities.

• Integration with physical security. Holistic threat models must combine phishing risk when a principal is traveling or under physical duress (which attackers may exploit). Crisis24’s integrated product acknowledges that cyber and physical threats frequently intertwine.

• Premium response economics. The unit economics of discrete, white-glove response services differ from enterprise SOC models — long tail and one-off emergency support demand flexible resourcing and rapid access to senior incident handlers.

Opinionated perspective

The launch of CISO On-Demand is inevitable and necessary. As threat actors commoditize sophisticated social engineering and deep-web reconnaissance, affluent targets will increasingly demand concierge cybersecurity. That said, the broader policy question is distributional: while family offices can buy bespoke protection, small businesses and ordinary citizens must rely on public trust infrastructure and affordable services. The market bifurcates — premium private protection vs. public-good investments in baseline security for the many.

Story 4 — BU MET: rising cybercrime risk makes cybersecurity education essential

Source: Boston University Metropolitan College (BU MET).

What happened (clear facts)

Boston University MET published an article arguing that growing cybercrime risk underscores the importance of cybersecurity programs. The piece highlights that the FBI’s IC3 received an average of 836,000 complaints per year (2020–2024) — totaling ~4.2 million complaints and more than $50 billion in losses during that period — and cites projections that cybercrime could cost businesses up to $15.6 trillion by 2029 (Statistica). BU MET emphasizes its cybersecurity curricula, participation in White Hat competitions, and its designation as an NSA Center of Academic Excellence to argue for ramped-up education and workforce development.

Why this matters

The combination of rising incident volume, growing economic damages, and structural talent shortages means educational pipelines matter more than ever. Today’s high-value defensive tooling (like Nozomi Arc) and bespoke services (like CISO On-Demand) require trained engineers, threat analysts, and incident managers who can operate at the intersection of IT, OT, and physical security. BU MET’s public call is a reminder: without the talent base, automation and services are necessary but insufficient.

Opinionated perspective

Two persistent myths harm cyber workforce planning: (1) that tools alone replace human analysts, and (2) that the cyber career pipeline is inexorably flooded with qualified candidates. Reality: we need more cross-disciplinary practitioners (legal, policy, ops, OT domain knowledge) and better transitional pathways from academia to industry (apprenticeships, co-ops, and grant-funded placements). Universities calling attention to the risk and to structured programs are doing public service; industry must match that with hiring and training commitments.

Cross-cutting analysis — four strategic themes

1) Platform features become attack surfaces

CoPhish demonstrates that every convenience layer (agent sharing, low-code workflows, embedded chatbots) is a potential attack surface. Security teams must expand threat models from hosts and networks to agents and developer productivity layers.

2) Automation must be safe, explainable, and reversible

Nozomi Arc’s graded prevention modes are the right pattern: automation that maps to operational tolerance (observe → isolate → remove) and that is fully auditable and human-overridable will become the standard for OT environments.

3) Security is becoming a lifestyle product for the wealthy

Crisis24’s offering shows the commoditization of bespoke cyber protection into packaged, high-margin services. This will likely spur competition across boutique firms and traditional MSSPs targeting the ultra-high-net-worth segment.

4) Workforce & education remain the Achilles’ heel

Tools and services multiply—so must trained operators. BU MET’s numbers are a useful reminder that investments in education and practicums are not altruistic; they are strategic infrastructure.

Actionable playbook — what security leaders should do this quarter

For CIOs / CISOs

1. Audit agent and low-code publishing policies: Identify all internal and third-party platforms that allow published agents or apps (Copilot Studio, low-code platforms, bots) and set a risk-tiered approval and review process. Implement admin consent policies for sensitive scopes today.

2. Pilot OT automation with strict guardrails: If you operate industrial networks, run table-top exercises with Nozomi-style automation in detection and quarantine modes before enabling delete actions. Instrument rollback playbooks and forensic preservation.

3. Review high-net-worth exposure: If your institution serves executives, family offices, or VIP customers, create tailored incident response options and guidance. Consider vendor relationships with discreet providers for emergency rapid-response needs.

For SOC / IR teams

1. Instrument OAuth consent telemetry: Monitor consent events and anomalous token usages; add detection for agent-triggered consent flows and host-based anomalies around copilotstudio.microsoft.com interactions.

2. Integrate OT telemetry into triage workflows: Add OT device context to SOC triage so prevention decisions reflect production criticality and not only rule matches.

For policymakers & educators

1. Fund apprenticeship programs: Direct grants to academic programs (like BU MET) that pair students with state/local SOCs or industry partners. Public-private pipelines are essential to close the talent gap.

2. Encourage transparency for agent platforms: Policy frameworks could require platform providers to publish certain security controls and consent-flow disclosure requirements for agent-sharing features.

Risks, pitfalls, and secondary effects to watch

• False-positive automation in OT: Aggressive automation (Delete mode) without rigorous staging risks production outages and safety incidents.

• Shadow agents and supply-chain risk: Third-party or trial agents could be spun up in compromised tenant contexts; enterprises must limit who can deploy agents.

• Privacy liability in private-protection services: Concierge cyber protection collects sensitive PII; providers must avoid creating new attack surfaces via their own telemetry stores.

• Talent bottlenecks: Even with automated defenses, skilled incident responders and OT-savvy engineers will remain constrained; overreliance on automation without people will leave gaps.

How this shapes vendor and procurement strategy

• Buyers should demand provenance and rollback guarantees for any automated action on critical systems. Contracts must include runbook testing schedules, rollback SLAs, and custom MTTD/MTTR targets for automation-enabled features.

• Vendors must document agent governance (how agents are created, who can share them, what telemetry is logged). Platform-level security controls (agent signing, review queues, and blacklisting of high-risk scopes) will be required by enterprise buyers.

• Service providers should package discreet response offerings with contractual privacy and data-retention terms to address elite clients’ needs without creating systemic risks.

Longer-form, opinionated synthesis (brief essay)

Few developments are as informative about the security trajectory as CoPhish and Nozomi Arc together. The former shows how rapid feature innovation (agent builders, low-code flows) can outpace identity governance; the latter shows the maturity of defenders who recognize that human-scale incident handling is untenable at cloud scale and that careful automation — if implemented with human oversight — is the future.

The next five years will be shaped by two kinds of trust engineering: trust in platforms (who may host agents and what vetting occurs) and trust in automation (which automated actions are safe to run on production systems). Organizations that succeed will not be those that simply adopt the newest tool but those that standardize governance patterns — agent publishing controls, consent hygiene, automation runbooks, and human-in-the-loop sign-offs — and invest in the workforce that can operate them.

Quick checklist to implement in 30/60/90 days

• 30 days: Enforce admin-only consent for high-risk Entra scopes; map all internal agent-capable platforms.

• 60 days: Run a scoped OT automation pilot with clear KPIs and fail-safes; contract legal terms for automated action SLAs.

• 90 days: Establish VIP protection playbook (VIP onboarding, privacy constraints, emergency vendor activation) and sponsor 3–5 apprenticeship hires from local academic programs.

Sources

• New CoPhish attack abusing Copilot Studio — Source: Cyber Security News (report on Datadog Security Labs).
• Nozomi Networks — Nozomi Arc autonomous threat prevention for OT endpoints — Source: PR Newswire (Nozomi Networks).
• Crisis24 — CISO On-Demand private strategic protection for individuals and family offices — Source: PR Newswire (Crisis24).
• Growing cybercrime risk and need for education — Source: Boston University Metropolitan College (BU MET).

Conclusion — the narrow, practical thesis

Two de facto truths define today’s cybersecurity reality: (1) attackers will weaponize convenience — agent builders, low-code flows, and social-engineering-friendly UIs are productive for attackers; (2) defenders must automate, but do so carefully — automation is the only scalable path for OT defense and for coping with volume, but it must be governed and reversible.

If you take one thing from today’s briefing: reconcile convenience and control. Tighten consent and agent governance, pilot automated prevention with reversible modes and forensics preserved, extend VIP protection capabilities without creating data liabilities, and invest in the workforce pipelines that will make these tools safe and effective.