NetScaler is under active exploitation, one more KEV item lands, and AI governance is still the conversation you need to have

NetScaler is one of those products that sits quietly at the edge of your network doing critical work until it becomes the fastest way in. It handles remote access, load balancing, and authentication flows. When CISA flags active exploitation of zero-day vulnerabilities in NetScaler ADC and Gateway, the risk is not abstract. Attackers are already using these flaws to get into organisations, and the access they gain is often deep, because NetScaler sits between users and everything they connect to.

For Channel Islands regulated firms, the practical question is straightforward. Do you run NetScaler anywhere, including at managed service providers or legacy remote access setups? If yes, confirm the version, confirm the patch status, and confirm you have a tested rollback plan before making changes. If you cannot answer those three things quickly, that is the gap to close first. Do not wait for the next change window. This is an emergency change conversation.

Then there is the weekly KEV signal. CISA added one more exploited CVE to the Known Exploited Vulnerabilities catalogue on 1 October. For those less familiar, CISA is the US Cybersecurity and Infrastructure Security Agency, and their KEV catalogue is a public register of software flaws confirmed to be actively exploited in the wild. Every entry means someone, somewhere, is already using that vulnerability to break into organisations. The reason it matters outside the US is simple: attackers do not respect borders. If the affected product is in your estate, it should jump the queue. Patch or mitigate immediately, then validate the fix took effect. The organisations that handle this well are the ones where someone owns each system, someone owns each patch decision, and someone can prove what happened afterwards. Evidence, not intent.

And then there is AI. The JCSC published guidance on AI-enabled security risks earlier in the summer, and it remains a live conversation across the Channel Islands. We covered this topic a few weeks ago, and it is worth revisiting because the landscape is moving. AI adoption is accelerating in regulated firms, often informally, and the gap between what staff are doing and what the organisation has formally governed is widening. The near-term risk is not a rogue model. It is sensitive client data being pasted into an external AI tool by someone trying to be productive. A simple, plain English policy that says what is allowed, what is not, and where to go with questions is more effective than a 40-page framework nobody reads. Boards and regulators will increasingly expect you to show how you govern AI-enabled risk, not just how you use AI tools. If you do not have a position yet, now is the time to set one.