11 Nov 2026

N-able has taken hosted N-central environments offline and told on-premises customers to shut their servers down, after a researcher published 33 zero-days with working proof-of-concept exploits. The list runs from credential theft to root-level remote code execution. N-able says it has seen no active exploitation, but watchTowr has already seen attempts against its honeypots.

N-central is remote monitoring and management software, which means it sits with admin rights across every machine it looks after. Plenty of smaller firms never buy it directly. Their managed service provider does, and the firm only learns the name of the tool when something like this happens. That is the part worth worrying about. Your outsourcing register may list the MSP and stop there.

The test is simple. If your IT provider lost its management tooling for a week from this afternoon, could it still patch, reset passwords and restore a laptop for your collections team? Ask the MSP which RMM platform it runs, whether it is affected, and what its manual fallback is. For a lender with important business services and impact tolerances to meet, the answer belongs in the mapping, not in a supplier's incident email.

Google is rolling thread summaries and a non-personalised Help me write to every Workspace user aged 18 or over who has Gmail smart features enabled. The features are on by default, with user and admin controls to turn them off. Rollout started on 10 November and can take up to 15 days.

Default-on is the bit that matters. Most firms that have written an AI policy assumed they would choose when a tool arrived. Here it arrives inside the mailbox, where customer complaints, affordability conversations and vulnerability disclosures already live. A summary of a thread with a customer in financial difficulty is still processing of that customer's data, and it is now happening whether or not anyone signed it off.

Switching everything off would be an overreaction. The point is to make a decision rather than inherit one. Before the rollout finishes, someone should check the admin setting, decide whether it suits customer-facing teams, and write down why. If the FCA or a customer asked how AI touches complaint handling at your firm, a dated record of that choice is a far better answer than finding out from a release note.

OpenAI has put ChatGPT Enterprise on the AWS Marketplace. Customers can buy and manage it through their existing AWS accounts and billing, apply eligible spend towards their AWS commitments, and get access to specialised products including ChatGPT for Financial Services.

This is a commercial story more than a technology one. Burning down an AWS commitment is a strong incentive, and it moves the purchase from a new supplier decision to a line on a bill finance already pays. For a regulated firm that is convenient and risky in equal measure. A new tool handling customer data should go through due diligence, a data protection assessment and an outsourcing view, and marketplace buying makes it easy to skip all three because the contract appears to be with a supplier you have already approved.

Worth checking this month: who in your organisation can accept a marketplace subscription, and does anything stop them? If the answer is anyone with console access, tighten it before a team discovers that ChatGPT for Financial Services is a click away. Then decide deliberately whether the commitment discount is worth having. It may well be, but that should be the conclusion of a review rather than the reason to skip one.

Licence increases and support deadlines are pushing IT leaders to look for replacements for SAP, VMware and Oracle Java. The executives quoted are careful, though. Integration work, retraining, disruption and running two systems in parallel can easily cost more than the licence saving, and their advice is to price a realistic exit before negotiating and to tell plain dissatisfaction apart from a migration you can actually deliver.

That advice is right, and it lines up with something lenders already owe the regulator. Exit planning for material outsourcing is meant to be a working document, not a paragraph in a policy. In practice most firms find out what leaving would cost on the day the renewal quote lands, which is the moment they are weakest.

Take your largest platform contract, whether that is the virtualisation layer, the loan management system or the core ERP, and put three numbers on a page: cost of a like-for-like migration, months to run it, and the date you would need to start to land it before the next renewal. If nobody can produce those numbers in a fortnight, you are not negotiating with that supplier. You are waiting to be told the price.

Cisco is integrating Anthropic's Claude Mythos model into its AI Defense platform to add adaptive red teaming for enterprise AI agents. The aim is to help firms find security weaknesses and behavioural risks in agentic applications through controlled, authorised testing.

The interesting part is not the vendor pairing. It is that adversarial testing of agents is turning into something you can buy off the shelf. A year ago, testing an AI tool meant a few people trying to break it in a workshop. Once the testing is packaged and repeatable, auditors, partners and eventually supervisors start to treat it as the baseline. A firm with no testing evidence will struggle to argue that it was not available.

For anyone putting an agent near customers, say one that drafts responses in collections or answers eligibility questions at the point of sale, the question to ask now is what you would show if someone asked how you tested it. Try to get it to give a wrong affordability answer, ignore a vulnerability flag or leak another customer's details. Keep the test cases and the results. Consumer Duty asks you to evidence good outcomes, and a tested agent is a much easier case to make than a trusted one.