AI companies need usage data to align pricing with costs, improve products, identify churn risks, and grow revenue through informed decisions. The AI Paradox There is a paradox: AI companies exist to extract intelligence from data, yet many have almost no visibility into how their own software is being used. They design complex models, introduce their product, set a price, and then hope that customers renew their contracts. In a space as fast-paced as AI, such a strategy is no longer safe. Without usage as a guide, price decisions are made on assumptions rather than facts. Product roadmaps are driven by story, not by usage. Customer success teams learn about customer churn when renewal dates are approaching. In reality, usage intelligence has become one of the most important signals in an AI business, guiding everything from pricing strategy to product development and long-term monetization. Why AI Changes the Stakes for Usage Data AI changes the economics of software and, with it, the relevance of usage visibility. The economics of existing software products are linear in cost, whereas those of AI products are not. Compute, energy consumption, as well as third-party model licenses, can all be material variable costs. If usage increases rapidly (through enterprise adoption, agents, or workflows), the cost can grow faster than the revenue generated if pricing is not aligned with consumption. The opposite scenario is just as dangerous. If customers are not using key capabilities, churn may be approaching long before a renewal conversation begins. Research shows the extent of this visibility gap. For AI vendors, visibility is important on the commercial side, too. They need to know how customers are using the AI capabilities they sell. IDC research found that 48% of software buyers want better visibility into their usage. The pace of change is also a concern, with 70% ranking rapid change in the AI ecosystem among their top three AI-related security risks. Pricing, packaging, and business models must evolve at the same pace, and that requires reliable usage intelligence. What Usage Intelligence Actually Looks Like Of all the capabilities that make up a software monetization strategy, usage intelligence is the one most commonly treated as optional — and the one that most consistently separates companies that adapt from those that don’t. It is the feedback loop that connects real-world product consumption back to the decisions that shape pricing, packaging, and product direction. At the instrumentation layer, usage intelligence starts with telemetry data. This includes activation events, entitlements consumed, feature-level data, daily and monthly active users, and time-to-value metrics that track how quickly customers get value from the product. Thales Sentinel can also collect usage data from on-premises, offline, and disconnected environments, so vendors are not limited to tracking always-connected software. The operational layer is where all the telemetry data is made actionable. Usage dashboards in CRM systems enable account teams to see how customers use the software. Health scores can even detect reduced engagement well before any risk of renewal is seen. The enforcement layer makes sure that usage is consistent with contract rights. This is particularly important for consumption-based or token-based pricing schemes. Tracking accuracy is essential for determining customer fairness and vendor revenue. Finally, there is the feedback loop. The insights from usage need to flow back to those responsible for pricing, packaging, product development, and customer success. Without the feedback loop, the data is just more information. Pricing specialists have long argued for incremental experimentation. Research from Simon-Kucher reveals that companies that make frequent, data-informed pricing adjustments tend to achieve stronger growth than those that depend on static pricing models. Usage intelligence provides the evidence required to make those adjustments with confidence. How Usage Data Enables Multiple Business Models Business model agility is increasingly becoming a competitive advantage for AI companies, yet flexible business models cannot exist without trustworthy usage data beneath them. Consumption-based pricing, outcome-based pricing, token models, and hybrid subscription structures all depend on accurate measurement of how customers use the product. There is demand for these models, too. IDC research found that 45% of software buyers prefer usage-based models. In practice, most AI companies adopt a gradual sequence. They begin with subscription licensing to establish predictable recurring revenue. As adoption grows, they instrument feature usage and engagement patterns. That data then enables the introduction of consumption or token-based layers tied to high-value AI capabilities. One AI audio-recognition company did just that. It moved from perpetual licensing to several subscription tiers using Thales Sentinel. Its usage data showed which features customers used most, which helped the company decide how to structure those tiers without making changes to the core technology. Another AI recognition vendor delivering SDKs for embedded systems took a different approach using Sentinel. Their trial licenses expire after a defined number of executions instead of after a fixed time period. This usage-based trial model demonstrates genuine customer interest, giving them a clearer indicator of product-market fit than a simple time-limited evaluation would. Both examples show that usage intelligence transforms monetization strategies from guesswork into evidence-based decision-making. From Data to Decision: Three Practical Applications The real value of usage intelligence lies in informing concrete business decisions. Preventing churn is one of the most immediate uses. Feature-level engagement metrics can detect declining usage several months before a renewal date. This enables customer success teams to step in and show the value or introduce underutilized features, preventing a customer from leaving. Upsell and expansion opportunities can also show up in the usage data. Seat utilization may show that a team is close to capacity and needs more licenses. Feature usage can show when a customer is getting enough value from certain capabilities to justify moving to a higher tier or adding consumption-based features. Usage data can also inform the product roadmap. Rather than relying on assumptions about what customers want, AI companies can see which features people use and which get little attention. This is key in a market full of similar AI capabilities. Companies need to know which parts of their product customers value and are willing to pay for. There is also a need for the collection of usage intelligence to be privacy-conscious. For vendors operating under frameworks such as GDPR or the EU’s AI Act, it is necessary to design telemetry systems that prioritize aggregated data collection over personal data collection whenever possible. The Organizational Challenge However, technology alone is not enough to create usage intelligence. Businesses must also ensure that the intelligence is available to those who can act on it. Usage intelligence only delivers value if it reaches the people who can act on it. Pricing teams need consumption data to make confident adjustments to their models. Product teams need feature engagement data to inform roadmap decisions rather than rely on assumptions. Sales teams need account-level signals to time their conversations correctly. Customer success teams need early warning indicators to intervene before disengagement becomes churn. Finance teams need usage trends to build credible revenue forecasts. Getting that data to all of those functions consistently and in a usable form requires intentional data architecture and a shared organizational commitment to treating monetization as a cross-functional capability rather than a single team’s responsibility. This becomes harder as companies add more AI products. If usage data is split across separate products, teams may struggle to see how a customer is using the wider portfolio. Bringing the data together can show where products are being heavily used, where adoption is low, and where there may be room to expand an account. Building Systems Around Innovation The AI companies that sustain long-term commercial success are the ones who built a system around it that can learn, adapt, and improve as markets shift and customer needs evolve. Usage intelligence is what makes that system adaptive. Without it, pricing decisions are made on assumptions, packaging tiers are defined by intuition, and churn arrives without warning. With it, every commercial decision — what to charge, how to package, what to build next, which customers need attention — is grounded in evidence rather than expectation. In an industry defined by rapid innovation, the AI companies that listen to their own usage data will be the ones best positioned to turn experimentation into sustainable growth. About the Author: Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications. She is also a regular writer at Bora. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, artificial intelligence)
Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and games. As of October 22, attackers stole 11,774,247 email addresses, along with account details including creation dates, last login dates, login counts, and the IP addresses used for the latest logins. “We have recently discovered that unauthorized access by a third party occurred to our online membership service “CAPCOM ID” (*1) , resulting in the leakage of some customer information.” reads the company’s notice. “Number of leaked email addresses and system-specific identification information: 11,774,247 (worldwide total)” In 43 cases, hackers exposed date of birth, gender, country/region, and nickname. Capcom also reported that attackers illegally changed passwords on 196 accounts, and the company has already reset them. The company said the incident exposed personal information belonging to a small number of individuals. Capcom has activated its incident response procedures and confirmed that services using CAPCOM ID remain operational. The company has notified the relevant authorities, is investigating the breach, and has begun contacting affected customers through a dedicated support channel. The company also urges users to watch out for phishing attempts involving emails impersonating Capcom or its partners, particularly those containing suspicious links or attachments. It says it will investigate the incident, address the identified causes, and strengthen its security measures to prevent similar breaches. “In response, we implemented emergency measures and began identifying and addressing the attack method.” states the notice.”A task force was established within the company to gather information and take measures to prevent further damage. The investigation revealed that some customer information registered with “CAPCOM ID” had been leaked. In addition, unauthorized password changes were confirmed for some accounts. On the same day, the incident was reported to the Security Oversight Committee, our external advisory organization.” Capcom was previously targeted by the Ragnar Locker ransomware gang in November 2020. The attackers claimed to have stolen 1 TB of data, potentially affecting up to 390,000 people. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data breach)
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set
INTERPOL’s Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered $105 million across 21 countries. INTERPOL announced the results of Operation Serengeti III, a multinational cybercrime crackdown that led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. The operation brought together law enforcement agencies from 21 countries between June 29 and August 31, 2026, targeting online fraud, ransomware, business email compromise (BEC), scams and digital extortion. “One of Africa’s largest cybercrime enforcement operations saw law enforcement agencies from 21 countries arrest 1,462 suspects, disrupt 10,909 malicious networks and recover more than USD 105 million in illicit funds.” reads the agency’s announcement. “Authorities identified 65,929 victims targeted by cybercriminal networks, underscoring the scale and sophistication of today’s digital threats. Financial investigations linked criminal activity to losses exceeding USD 385 million. ” The scale of the operation is striking. Investigators identified 65,929 victims, while financial investigations linked the criminal activity to losses exceeding $385 million. The figures highlight how cybercrime continues to generate substantial profits by combining technical capabilities with familiar forms of deception. The results also show why tackling these operations requires more than taking down websites or blocking malicious IP addresses. Investigators need to identify the people behind the infrastructure, follow the money and connect evidence collected across jurisdictions. Uganda saw one of the largest actions in the operation. Authorities broke up two international fraud networks and arrested 365 foreign nationals suspected of running online investment and pension scams targeting people across Asia. Investigators found call centres where staff followed prepared scripts to convince victims to invest through fake trading platforms and websites. The scams targeted people who believed they were making legitimate investments, including pensioners. These cases show how criminal groups combine technology with organized social engineering to deceive victims and steal their money. Source: Interpol – Suspected Scam Call centre in Uganda. In Angola, authorities shut down two illegal cryptocurrency mining centres, arrested nine suspects and seized over 2,000 mining devices and six illegal power stations. The electrical equipment was worth more than $1 million. In Nigeria, investigators arrested a suspect linked to phishing and business email compromise (BEC), which involved stealing software credentials and collecting about 2.1 million email addresses. They also recovered a luxury car suspected of being bought with criminal money. A separate Nigerian investigation traced over $2.4 million linked to an investment scam promoted through messaging apps, with much of the money laundered through cryptocurrency. Authorities also targeted loan app fraud in Tanzania, vehicle import scams in Gabon and arrested 30 suspects in the Republic of Congo. Operation Serengeti III relied on intelligence provided before the enforcement phase. Investigators from 20 African countries and the United States received information about suspicious domains, IP addresses and command-and-control infrastructure associated with criminal activity. Private-sector cybersecurity companies also supported the operation, providing threat intelligence, technical analysis and investigative expertise. INTERPOL listed Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas and Meta among the participating partners, alongside other organizations. This cooperation matters because criminal infrastructure rarely respects national boundaries. A phishing domain, a compromised account, a fraudulent investment platform and the bank accounts used to move stolen funds may all involve different countries and service providers. Investigators need to connect those elements quickly enough to identify suspects and preserve evidence. INTERPOL’s 2026 African Cyber Threat Assessment Report highlights the growing role of AI in cybercrime as financial losses rise. Criminals can use AI to create convincing messages, improve social engineering and target more victims. While AI does not replace the need for criminal infrastructure or ways to move stolen money, it can make scams easier to repeat and harder for victims to recognize. INTERPOL said several investigations remain active. Authorities are continuing to identify suspects, trace illicit proceeds and analyze digital evidence recovered during the operation. That qualification is important. Arrests and infrastructure disruptions are meaningful enforcement results, but they don’t automatically establish how many criminal organizations have been dismantled permanently, how much of the stolen money will reach victims, or whether other operators will rebuild the disrupted services. “Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale.” INTERPOL Director of Cybercrime Neal Jetton said. “Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Operation Serengeti)
Cloud hosting provider Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. The company says its investigation indicates that, in some cases, an unauthorized third party may have obtained decrypted variables and urges all users to proactively rotate secrets and credentials. “Our investigation to date indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents,” Railway says. “Environment variables may contain secrets such as API keys or database and registry credentials,” the company clarifies. Railway is a cloud platform for developers to deploy and run applications, APIs, databases, and various backend services. It has around 4.8 million users and hosts more than 16 million services.
China-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed. Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind the ConnectWise Cloud Backup supply chain compromise. The group used ARTEX, an open-source AI-driven penetration testing framework, to run attacks at machine speed against hundreds of organizations across aerospace, defense, energy, financial services, government, manufacturing, and more. “Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours.” reads the report. “Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.” Storm-0940 has been active since 2021 and has historically relied on password spraying and OAuth application abuse to get into Microsoft 365 environments. Adding ARTEX changed the scale of what they could do. In some attacks, the time between initial targeting and achieving privileged cloud access was under three hours. Before obtaining the ConnectWise credentials, Storm-0940 launched a password spraying attack between October 10 and 14. The attack came from the IP address 144.172.64[.]99. Microsoft recorded more than 151,000 failed login attempts against 327 accounts at eight organizations. Activity peaked on October 11, with 2,900 failed attempts per minute. Forty-eight accounts each received more than 1,000 failed attempts. None of these attempts succeeded. The situation changed on October 15, one day after the ConnectWise breach became public. The AI agents stopped trying passwords and switched to a different attack method. By then, Storm-0940 had obtained the credentials of several ConnectWise cloud application accounts. The agents used these credentials to log directly into customer Microsoft 365 environments. “Storm-0940’s use of ARTEX accelerated the speed of compromised application abuse to authenticate to Microsoft 365 customer environments through applications that had already been granted access.” Microsoft continues. “This allowed the threat actor to operate without requiring an interactive user sign-in. “ The agents used applications that already had permission to access their targets. This allowed the attackers to enter customer environments without requiring users to sign in interactively. In a subset of environments where authentication succeeded, the agents didn’t stop there. They moved into Microsoft Graph and ran directory reconnaissance, modified application credentials to establish persistence, and attempted changes to identities, groups, and privileged roles. Microsoft identified multiple customer environments with evidence of this follow-on activity. The persistence mechanism is the part defenders need to act on now, even if they’ve already disabled the ConnectWise connections. “These changes can remain active as a backdoor even after the original compromised application is mediated.” says the IT giant. An attacker who added their own credentials to a trusted application before you revoked access still has a working key. Reviewing all service principal credential additions since at least October 1 is the right starting point, not October 15 when the public breach was announced. ARTEX is not a tool used only by Storm-0940. Microsoft says threat actors in several regions have used the same framework. Originally open-source, ARTEX was written in Go and can use different AI models to plan and carry out tasks. Researchers at Zscaler and Recorded Future also found a Chinese-speaking group using it to target South Korean financial institutions. The setup used DeepSeek, GLM, and Grok as coordinated AI agents, with GLM checking DeepSeek’s work. After these attacks became public, the project went closed-source. However, anyone who already has a copy can still use it. The speed point is what Microsoft keeps coming back to in its report. Agents don’t take weekends, don’t sleep, and can run multiple attack paths simultaneously. “This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially.” Microsoft concludes. “Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises.” When Storm-0940 had valid application credentials, they didn’t have to iterate slowly. They hit 2,250 tenants with 2,900 sign-in attempts per minute, a pace at which manual detection and response simply can’t keep up. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ARTEX)
Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity tool?
Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42.
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical.
Confirm this action.
Leaving now will discard your changes.