An internal data breach is the exposure of confidential information to an unauthorized user in an organization. We tend to think of confidential information as private information about a patient, customer, employee, etc. After all, nearly every country in the world has regulations specifying how private data can be stored, accessed, and managed. And, they can assess sizeable fines for noncompliance.
Organizations typically store personal identifiable information (PII) as records in an application database. A patient’s medical information, for example, is structured across cells in a medical application’s database table. This is why it known as “structured data.”
Protect your unstructured data
But sensitive information is not just PII; it also includes an organization’s confidential or competitive proprietary data. For example, not-yet-released quarterly sales results, future marketing plans, legal documents, and more. These word processing files, spreadsheets, presentations, media files, etc., cannot be structured in a database. They are stored in folders in a network file system or in the cloud. This type of data is known as “unstructured data.” It comprises about 80 percent of an organization’s total stored data.
Organizations largely protect and manage structured data from unauthorized access through an automated process. An example is an identity and access management system (IAM) that provisions and restricts access based on user identity and role. Conversely, they will secure unstructured data through NTFS permissions assignments in Microsoft Active Directory and Microsoft Entra ID for network folders, shares, and document libraries.
NTFS permissions increase the complexity of protecting unstructured data
It’s these extensive and complex individual NTFS permissions assignments that can be so challenging to manage. Sure, a network administrator can check which groups, and associated members can access a specific folder by viewing the folder properties. But with potentially thousands of folders, subfolders, and document libraries storing files with confidential, sensitive, and high-value data, reviewing these permissions individually is impractical.
How OpenText can help
That’s where OpenText File Reporter, a component of OpenText Data Access Governance, comes in. It has extensive reporting and analytics capabilities. File Reporter can identify all users who can access individual folders, subfolders, Microsoft 365 document libraries, their NTFS permissions. It can also identify how that access is derived. With these findings, information and security officers, network administrators, and department data owners can determine potential risks for internal data breaches.
OpenText File Reporter can present these findings in a variety of permissions report types. That way you can have the information you need to make the necessary changes to access permissions.
This capability has been incredibly useful to customers needing to perform regular vulnerability assessments on all of their confidential, sensitive, and high-value unstructured data and protect themselves from everything from inappropriate insider knowledge to insider misconduct.
With so much to lose – data security, competitive advantages, customers, employees, and reputation, as well as the potential for fines and lawsuits, organizations cannot risk the possibility of an internal data breach, especially when those risks are so easy to identify with OpenText File Reporter.
We’re excited to announce the latest update in OpenText eDiscovery CE 25.2, introducing a powerful new tool that transforms how legal teams organize and analyze evidence. Here’s what’s new:
OpenText eDiscovery Chronology
In modern litigation and investigations, organizing massive volumes of digital evidence chronologically to understand the who, what, where, and when of a matter can be daunting, labor-intensive, expensive, and potentially risky. The new OpenText™ eDiscovery Chronology addresses this challenge head-on.
This interactive chronological narrative building tool helps legal teams track, organize, and analyze evidence by date—with full control of event metadata and complete audit trail capabilities. With Chronology, legal teams can leverage technology to streamline an otherwise manual task and quickly gain a clearer understanding of the sequence of events that may make or break a case.
With integrated visual Chronology, legal teams can:
Easily identify potential gaps or inconsistencies in evidence earlier, reducing risks and unpleasant surprises
Save time by organizing events and facts without having to copy and paste text and link documents in Excel, Word, or third-party software
Quickly zero in on specific events or facts at any time, for faster, easier, and more thorough client reporting, early case assessment, and preparation for depositions, hearings, settlement discussions, and trial
Chronology is a key feature that has been frequently requested by our customers and represents a significant enhancement to our platform’s capabilities.
In addition to the new Chronology feature, OpenText continues to release enhancements to our existing capabilities.
OpenText eDiscovery Aviator Key Document Summary – Now exportable!
Initially released in April 2024, Aviator Key Document Summary empowers legal teams to create an AI-generated summary of key documents, complete with links to the documents, for improved document review efficiency and rapid insight into the case. Now with CE 25.2, legal teams can more easily share document summaries with team members and clients with the ability to export Key Document Summaries, complete with working document links.
Aviator Review – More intuitive than ever
In our ongoing effort to increase efficiency and automate first-pass review, we have simplified the OpenText eDiscovery Aviator Review process to two simple steps:
Input your review criteria
Identify the designated document set on which you want Aviator Review to run
It is really that easy, and after the Aviator results are returned, legal teams have the option to quickly QC the document set using the “compare with human review toggle” and selecting the coded review field to be used for comparison.
Expanded bulk redaction capabilities
Accurate and consistent redaction of privileged, confidential, or sensitive information across all document formats is a critical component for reducing production risks. Inadvertent production of privileged or sensitive information is a legal team’s worst nightmare. As the type of data involved in litigation and investigations continues to become more diverse—going far beyond email and Word documents—it’s essential that bulk redaction tools keep pace. That’s why we’re pleased to expand OpenText eDiscovery bulk redaction to support the chat-specific redaction view. We have also added support for Social Security Number patterns in the Bulk Redaction wizard for the native Excel viewer, the audio/video viewer (Cloud only), and the HTML chat viewer.
Additional new redaction capabilities include:
New “change redaction” functionality for the near native Excel viewer, the audio/video viewer (Cloud only), and the HTML chat viewer
The ability to centrally manage the addition and deletion of redaction reasons from within the Review & Analysis module
The addition of a dedicated Regular Expressions (RegEx) tester to support users writing their own customized RegEx for bulk redaction
An improved RegEx pattern search for birthdates
These updates in OpenText eDiscovery CE 25.2 represent our ongoing commitment to providing powerful, user-friendly tools for modern eDiscovery workflows. By introducing new functionality and enhancing existing key features, we’re responding to our most frequent customer requests and helping legal teams work more efficiently and effectively than ever before, delivering better outcomes for their clients and organizations.
The landscape of VAT compliance in Europe is undergoing a seismic shift. The ViDA (VAT in the Digital Age) proposal, approved on March 11, 2025, signals a new era for multinational companies. This landmark initiative aims to modernize and streamline VAT processes across the EU, primarily through the widespread adoption of e-invoicing and digital reporting. While this promises greater efficiency and transparency, it also presents significant challenges for businesses operating across multiple European nations.
The three pillars of ViDA
The ViDA proposal rests on three key pillars:
E-Invoicing and Digital Reporting Requirements: This pillar focuses on real-time digital reporting of VAT transactions, mandating cross-border e-invoicing to ensure accuracy and reduce fraud. Restrictions on e-invoicing will be removed, paving the way for full digital adoption.
Single VAT Registration in the EU: ViDA simplifies VAT compliance by allowing businesses to register for VAT only once across the entire EU, streamlining operations and reducing administrative burdens.
Enhanced Rules Around Digital Platforms: The rules ensure VAT is correctly applied to transactions facilitated by online platforms, making platforms responsible for VAT collection and remittance.
The e-invoicing revolution: Obligations and timelines
The most immediate impact of ViDA will be on the world of e-invoicing. The proposal mandates that all cross-border transactions must be electronically invoiced and reported in near-real-time with the objective of streamlining VAT reporting and reducing fraud.
A key change is the removal of the “buyer acceptance” principle, which previously allowed buyers to refuse electronic invoices. This restriction has hindered the widespread adoption of e-invoicing and prevented countries from mandating it nationally. With these restrictions lifted, countries are expected to implement e-invoicing mandates more rapidly.
While the directive sets a deadline of July 1, 2030, for full integration of e-invoicing and digital reporting requirements into national legislation, many countries are expected to implement these changes much sooner.
The challenges for multinationals
Multinational companies face a complex challenge. With approximately ten EU member states already implementing their own e-invoicing mandates and the remaining seventeen expected to follow, businesses can anticipate dealing with an average of three to four new e-invoicing mandates per year until mid-2030. Given that implementing a single e-invoicing mandate can take enterprises up to two years, this represents a significant burden on resources.
OpenText’s commitment to ViDA compliance
As a leading provider of global e-invoicing services, OpenText is committed to supporting businesses through these changes. The OpenText Trading Grid e-Invoicing solution is already equipped to manage e-invoicing regulations in over fifty countries. OpenText provides a managed services approach to e-invoicing, offering an end-to-end solution that includes evaluating readiness and supporting integrations with internal systems, external stakeholders, and national e-invoicing portals, as well as maintaining ongoing compliance with any changes that follow.
The approval of the ViDA report marks a monumental step towards a more efficient and transparent VAT system in Europe. While the transition presents challenges, it also offers opportunities for businesses to streamline their operations and reduce costs. Companies that proactively prepare for these changes will be best positioned to thrive in the new digital landscape. Stay tuned for further updates as the ViDA proposal is implemented and its impact unfolds.
In an era where cyber threats are relentless and constantly evolving, where regulatory and industry requirements keep increasing, and where unstaffed information security roles remain a challenge, businesses cannot afford to rely solely on traditional security measures. The complexity of modern security operations requires a proactive approach—one that ensures round-the-clock protection, augments internal capabilities, and seamlessly integrates with multiple vendor products. This is precisely where Managed Security Services (MSS), SOC-as-a-Service, and Managed Detection & Response (MDR) come into play.
Industry trends and statistics
Recent data highlights the growing reliance on managed security services to address cybersecurity challenges. According to industry research*, a significant number – 29% – of organizations have added MSS solutions to augment their security teams:
23% of organizations are centralizing resources to optimize security operations.
28% are divesting the security team or reducing staff.
37% report no significant changes, indicating a potential gap in security preparedness.
These trends underscore the critical need for MSS, SOC-as-a-Service, and MDR solutions to enhance security resilience and mitigate risks effectively.
24×7 Managed Security Services monitoring: why it’s a must
Cyber threats don’t take breaks, and neither should your security. Organizations often struggle with maintaining a fully operational Security Operations Center (SOC) that runs efficiently 24/7. MSS and SOC-as-a-Service provide continuous monitoring, threat detection, and incident response, ensuring that potential risks are identified and mitigated before they cause damage.
Cost savings: a smarter approach to cybersecurity
Maintaining an in-house SOC can be prohibitively expensive, requiring investments in:
Technology stack costs including SIEM
Retaining skilled personnel for 24×7 operation
Certifications, training and compliance
Threat research, threat intelligence and forensic capabilities
High availability infrastructure and facilities
Many organizations, particularly small and mid-sized businesses (SMBs), struggle to allocate resources for full-scale SOC operations. MSS, SOC-as-a-Service and MDR allow companies to outsource cybersecurity expertise without sacrificing quality, often cutting costs by up to 50% compared to an in-house SOC. Additionally, with predictable monthly pricing, organizations can scale security operations efficiently without unexpected budget overruns.
Managed Security Servicescomplementing internal teams
Many businesses have IT teams tasked with security, but these teams often lack specialized cybersecurity expertise or resources to handle advanced persistent threats (APTs) and complex attack vectors. MSS, SOC-as-a-Service, and MDR solutions complement internal staff by acting as an extension of their security operations, providing additional expertise, automation, and threat intelligence that would otherwise be difficult to maintain in-house.
Seamless integration with vendor products
With a myriad of cybersecurity tools available today, businesses often struggle with product compatibility and integration. The right MSS, SOC-as-a-Service and MDR providers ensure that your security architecture works harmoniously with vendor products, eliminating gaps in visibility and enforcement while maximizing the value of existing security investments.
As cybersecurity risks increase, regulatory compliance has become a top priority for businesses across industries. Organizations handling sensitive data must adhere to frameworks such as:
General Data Protection Regulation (GDPR)
Health Insurance Portability and Accountability Act (HIPAA)
Payment Card Industry Data Security Standard (PCI DSS)
Failure to comply with security regulations can result in hefty fines, legal consequences, and reputational damage. MSS, SOC-as-a-Service and MDR help businesses stay compliant by ensuring continuous monitoring, risk assessments, and detailed security reporting. Additionally, many outsourced services enhance audit readiness by offering forensic analysis capabilities, ensuring organizations can respond effectively to regulatory inquiries.
The MSS power of OpenText MxDR
One standout solution in the MDR space is OpenText Managed Extended Detection and Response (MxDR). OpenText MxDR provides comprehensive 24x7x365 security monitoring, leveraging machine learning and MITRE ATT&CK® behavioral analytics to detect and respond to threats in real time. With a 99% detection rate and low false positives, OpenText MxDR ensures businesses can identify and neutralize cyber threats before they escalate.
Additionally, OpenText MxDR boasts an impressive mean time to detect with its EDR Agents, significantly reducing the window of opportunity for attackers. By integrating advanced threat intelligence and endpoint security, OpenText MxDR delivers proactive defense mechanisms that safeguard businesses from emerging threats.
Want to learn more about how OpenText MxDR protects your endpoints? Discover how it delivers real-time response, advanced analytics, and endpoint resilience in today’s complex cyber landscape—read the full article.
Final thoughts: proactive security is the future
Cybersecurity is no longer just about reacting to threats—it’s about proactively defending against them. Managed Security Services, SOC-as-a-Service, and MDR are indispensable components of a modern security strategy, enabling businesses to stay ahead of threats while optimizing internal resources.
If your organization hasn’t yet considered these solutions, now is the time. Investing in expert-led security services can mean the difference between a resilient security posture and a costly breach. Ready to take the next step? Let’s secure the future, together. Contact us to learn more.
* Source: S&P Global Market Intelligence presentation at RSAC 2025
When we look at evolving customer communications, we often focus on improving the experience by adding new delivery channels, improving content by adding color and variable images based on the audience or improving self-service. Some organizations focus on making the communications interactive in digital channels, adding video or improving self-serve preference management to encourage digital adoption and reduce print costs.
Despite efforts over the years to merge transactional and promotional (marketing) communications, it’s still more common than not that these communications continue to be managed and generated in siloed systems, separating their stakeholders in name of privacy and security of the data. Marketing needs to have the freedom to explore any and all options when it comes to lead generation and customer nurturing while transactional communications need to maintain guardrails to retain trust with existing customers by protecting their sensitive data.
Unfortunately, this approach often impacts the customer experience. Inconsistencies in communication look and feel, silos by line of business, disconnected or limited integration between systems ultimately leaves gaps in the customer’s ability to navigate the vast web pages and content available through self-serve. This causes them to turn to support channels such as the contact center, customer service, agents, chats, etc. More often than not, these employees in the front lines of customer support often request patience from the customer as they need to navigate several internal systems in an effort to find the desired information or answers.
While many strategies look to new software, business process automation or to redesign communications as a way to improve the overall experience, the goldmine at the root of every experience is the customer data.
“Customer data is a goldmine of information that holds the power to make experiences impactful and engaging.”
Customer data management is done in a variety of ways within an organization, even within individual lines of business. CRMs are often used to capture information for preference management, CDPs (customer data platforms) are used for website tracking and personalization, often missing the full omnichannel experience tracking. Marketing automation has included lightweight CRMs which are evolving to CDPs but are sometimes just their own database specific to their content-focused used cases. Campaign management is often separate as well, holding its own set of data used for personalizing campaigns and understanding customer behavior within them. Journey management solutions also have a unique set of data not stored elsewhere around the events, actions and behaviors, both planned and reality, that reflect customer interactions. Segmentation is another function that is often solved through custom scripting or home-grown systems or is embedded within other marketing systems but holds valuable insights.
The result is a vast system of siloed data sources that customer experience executives and communication centers of excellence (COE) see a need to address, but it requires a level of attention and effort to sort through. At best, go forward efforts such as zero copy policies helps reduce complexity, but can slow down adoption of new technologies.
Adding more complexity are AI and LLMs. Generative or Content AI is really where many communications and data tools have focused to generate or tweak content. However, concerns around intellectual property can limit how organizations want to use these tools. In communications management, assisting content creators to craft messages has shown some value, but is only the tip of the iceberg of the potential value AI can provide to communications experiences. The more data available to be fed into an LLM, the more we can leverage other AI variations such as Insights AI and Responsive AI, which have the potential to analyze the vast amount of data available in these siloed systems and make recommendations for improving customer experiences from individual touch points to the overall sentiment of the business relationship.
Knowing that this data exists today within organizations but in disparate systems is a good problem to start with. Many have attempted to solve this through business process management/automation and integration, but that approach can create complexities of its own. Aggregating all of this data to persist in a single, centralized database is an unrealistic effort that will get shut down by every CIO and IT department. So, how can we address this?
The first step is understanding where this data exists today. A few questions to ask… What systems exist and where? What type of data is stored in these systems? Is it usable? Is it actionable? Where and when is it used and to what extent? For example, can it be used for personalization of content within a communication, personalization of an experience touchpoint or automating orchestration follow ups?
Once you begin to understand the complexity of your organization’s data infrastructure and the valuable data it holds, you open the door to the opportunity to connect these systems with a customer data solution that can provide a powerful, complete view of the customer that is both actionable and insightful.
The work is not done yet. Understanding the personas who need to use this data, creating a data governance strategy and aligning key stakeholders are also critical steps to success. What are the desired outcomes and their respective priorities of this data once it’s aggregated, normalized, analyzed and able to provide a more complete view of your customers and their behaviors? This goldmine of data is powerful and desirable, so having clear priorities is key.
As we know in customer communications, data is sensitive and must be protected but can provide powerful insights that can improve business outcomes and enhance personalized experiences when used correctly. New solutions are becoming readily available that are approaching disparate enterprise data systems with a different approach that does not require ripping out the existing infrastructure. It is important to remember that the software and solutions are only as good as the strategy that is driving the ROI and outcomes of centralizing customer data.
At OpenText, we believe in taking steps to support a more sustainable and fair future. Our employees are at the heart of this effort, dedicating their time and energy to making a lasting impact in their communities. Whether volunteering their time with the help of three paid volunteer days each year or fundraising for global causes, OpenTexters across the globe are committed to creating positive change. At OpenText we call this: #OT4Good.
In this blog post, we shine a spotlight on the employee-led initiatives in Bengaluru, India, that are helping to drive progress in education and climate action.
Spreading Joy with Every Kit
In July 2024, the OpenText Bengaluru office partnered with Youth for Seva, a nation-wide movement that inspires youth to volunteer and drive positive change. OpenText sponsored approximately 950 school kits, each containing essentials like backpacks, books, and stationary products. High school kits also included a geometry box, while nursery kits featured colored pencils in addition to their books.
Our employee volunteers helped assemble and distribute the kits across four schools in Bengaluru city.
“It was an incredible opportunity to volunteer with Youth for Seva. Our team felt a great sense of fulfillment and joy knowing that we could make a difference in the lives of so many youth and children that will hopefully have a lasting impact and inspire them to give back to society as they grow up and accomplish great things.” – Moby
OpenText employees pose with children at Youth for Seva volunteering event
Stationery Drive with Samarthanam Trust for the Disabled
As the school year began in Bengaluru, our volunteers organized a drive to collect unused stationery materials, gently used clothing and toys for families in need. They then visited Samarthanam Trust for the Disabled to distribute the donations and spend time with the children.
“Our collective efforts have reached the hearts of 350 children at Samarthanam Trust. The entire OpenText Bengaluru family united to contribute and deliver over 23 cartons filled with stationery, toys, and clothes. The meaningful impact we’ve made fills us with immense pride and gratitude. This experience reminds us of the transformative power of kindness and teamwork.” – Amudha
OpenText employees participating in the stationary drive
Tree Planting Drive
In October, OpenText India partnered with United Way of Bengaluru for a tree planting drive as part of the Sidlaghatta Social Forestry project, located in the outskirts of the city.
Sixty passionate OpenText volunteers gathered to dig the pits, add manure, and carefully plant and water each sapling, resulting in 200 saplings successfully planted that day!
OpenText Bengaluru team tree planting
This project was chosen by our team to fulfill a long-term vision: reforesting 100 acres of land while supporting local families through future fruit sales. This initiative will help restore green cover and strengthen the livelihoods of nearby villages.
“Sustainability reflects the core values of responsibility and innovation that we embrace at OpenText. It’s fulfilling to be part of an organization that prioritizes creating a positive environmental impact.” – Gaurav
“I chose to participate in the event because I deeply believe that each of us has a role to play in protecting and preserving the environment. Taking small, proactive steps today can lead to a more sustainable future. Beyond the cause itself, the event also offered a unique chance to interact with my colleagues in a more relaxed and meaningful setting, strengthening our sense of community and shared purpose.” – Pushpanjali
At OpenText, our employees recognize the importance of giving back to the communities where they live and work. Over the past months, the OpenText team in Bengaluru focused their impact on quality education, aiding the well-being of underprivileged students, and supporting the environment around us. If you want to learn more about life at OpenText, visit our careers page at careers.opentext.com.
Digital asset management is having a moment. Industries that traditionally create high volumes of rich media enjoy the productivity advantages of AI-led innovation in usability and automation. At the same time, new use cases for images, video, audio, 3D models, and other rich media formats have emerged in industry verticals such as manufacturing, transportation, and utilities, adding to the need in the market for both specialized and versatile DAM solutions.
OpenText™ Digital Asset Management is a leading Enterprise DAM solution that excels in securely handling multiple use cases and user communities across any organization. One of the pillars of the OpenText DAM team is relentless innovation. Let’s look at the top capabilities unlocked in the latest updates.
Generative AI Search
Helping colleagues find the perfect assets for their project is one of the biggest benefits of digital asset management. A skilled user can craft the ideal search query for any situation with OpenText DAM’s industry-leading Advanced Search. However, Generative AI search using RAG (retrieval augmented generation) is a powerful asset discovery assistant for occasional DAM users, releasing super-users to focus on higher-value tasks.
Natural Language Search enables users to find assets using their own words
Reverse Image Search enables users to find assets using a local or online image
AI Asset Summary adds natural language descriptive metadata, ideal for SEO and GEO
Unlike most alternatives, OpenText Knowledge Discovery is available as a Private Cloud or on-premises solution, so all your data stays securely under your control in the same location as OpenText Digital Asset Management.
Video and 3D model enhancements
Recent releases have further improved the video and 3D model management capabilities of OpenText Digital Asset Management.
Use AI auto-tagging to analyze 3D model previews, improving discoverability
Export video transcripts in VTT format, providing more options for translation and subtitles
Improved video and audio analysis when using OpenText Knowledge Discovery for AI Media Analysis
Continual improvement
While those are the top highlights, every update keeps OpenText Digital Asset Management at the leading edge of usability and security. Recent versions have included improvements in accessibility, watermarking, asset linking, project management, API functionality and many other areas. With an exciting roadmap and a powerful vision, OpenText continues to lead the market for Enterprise DAM.
February 2024: Product content integrations, new file formats, AI and more
For a category that has been around for over 30 years, digital asset management (DAM) is surprisingly dynamic. However, it remains challenging to manage the increasing volume and complexity of rich media that organizations and individuals create and consume. Whether it is new formats, like 3D models, new channels, like social short-form video, or new technologies like Generative AI, DAM innovation must keep up the pace.
At OpenText™, we are proud of our track-record of relentless innovation. But we spend so much time looking forward that we are sometimes guilty of not considering the milestones we have achieved. So this is a look at the highlights that were achieved over the last year in digital asset management.
Product content integrations
For many online retailers, DAM and product information management (PIM) have been a power-couple for years. We have integrated OpenText DAM with leaders like SAP, Stibo, Riversand, and Salsify. But as more brands market their products directly, the PIM market has expanded rapidly. That’s why we introduced a PIM Integration Framework to OpenText DAM in 2023, making it easy and fast to integrate with (almost) any PIM.
More file format support
As is typical with emerging content types, the number of file formats for 3D assets continues to grow. In 2023, OpenText added support for GLB/GLTF, WRL/VRML, and 3DS. This is in addition to the existing support for PLY, FBX, STL, DAE and OBJ file formats. Our objective is to eliminate the need for dedicated 3D editing software when it is only necessary to view and rotate the object.
Also in 2023, we introduced support for viewing animated GIFs in the user interface and delivery through Adaptive Media Delivery (AMD). In addition, we won’t disagree with how you pronounce GIF.
Dynamic search experience
Keyword search now dynamically displays thumbnails of top results. This accelerates the discovery of key resources and reduces the friction that decreases user engagement.
Automated workflows
Automation is more than a way to increase productivity, it also drives compliance and consistency. The workflow engine in OpenText DAM was improved to allow easy scheduling and recurrence of automated jobs. New actions were added including watermarking and unpublishing from collections. A sample expiration workflow, developed in collaboration with our customers, is now provided to show how to use the new capabilities.
AI and ML
OpenText completed the acquisition of Micro Focus in February 2023, and that included the powerful and flexible IDOL Media Analysis. We wasted no time in adding support for IDOL into OpenText DAM, adding to the options available to customers looking for world-class AI image and video analysis. Key to some customers, IDOL can be installed as a private service for security-conscious organizations, so training sets and assets needing analysis do not need to be sent outside the organization.
But the big buzz of 2023 was generative AI (GenAI). We partnered with Google Vertex Imagen to add this exciting new capability into the creative request workflow as inspiration images that clarify the requirement. Listening to the needs and concerns of our customers, we added governance options such as automatic tagging, watermarking, and clean-up of images, to avoid accidental or unapproved use of assets created by AI.
A big year
It has been a big year for OpenText DAM innovation, and these were just the highlights. We’ve continued to improve usability, security, and connectivity in ways that deliver success for our customers and help them deliver success to their customers.
2024 is set to be even bigger, so stay tuned for more!
In today’s digital landscape, the most dangerous cybersecurity threats aren’t always sophisticated hackers in hoodies writing malware in the dark. Sometimes, they’re employees or contractors who already have legitimate access. They may not even realize they’re part of the problem. Insider threats, malicious or unintentional, are increasingly becoming the easiest path into an organization’s network.
On Episode 150 of the Reimagining Cyber podcast, host Ben welcomed back Tyler Moffitt, Senior Security Analyst at OpenText Cybersecurity, to explore the complex and growing issue of insider threats. From third-party vendor risks to phishing schemes and ransomware partnerships, this conversation highlighted why insider threats must be a top concern for every organization.
Reimagining Cyber, EP# 150 The enemy within: the hidden risks of insider threats
Breaking down insider threats
Tyler began by categorizing insider threats into two key types:
Malicious insiders – These individuals knowingly exploit their access for personal gain or revenge. Whether disgruntled employees, collaborators with threat actors, or simply susceptible to bribery, their insider knowledge can make them extremely dangerous.
Unintentional insiders – Far more common, these are employees or contractors who fall victim to phishing, social engineering, or other manipulative tactics. They may unknowingly click malicious links, give up credentials, or fall for voice phishing (“vishing”) scams.
While both types are damaging, unintentional insider threats are easier to scale through social engineering campaigns and represent a broader risk surface.
Case study: Coinbase and the price of access
A chilling real-world example came from a recent breach at Coinbase, the popular cryptocurrency exchange. The attack was facilitated through a third-party contractor at an outsourced call center. Cybercriminals impersonated internal IT staff, contacted the contractor via a vishing campaign, and bribed them to gain access internal systems.
The result? Criminals exfiltrated sensitive customer data and targeted those individuals with phishing campaigns, successfully defrauding them of cryptocurrency.
However, the company’s response makes the Coinbase case particularly notable. Instead of quietly paying off the attackers to keep the breach under wraps, Coinbase went public, disclosed the breach, and offered a $20 million bounty for information leading to the perpetrators. Even more impressively, they committed to reimbursing affected customers—an unusual and commendable move in the often murky world of crypto.
This breach affected internal operations and highlighted serious risks in third-party vendor management. As Tyler points out, even if your company maintains rigorous security controls, you’re only as secure as your least secure partner. Your entire infrastructure could be compromised if a contractor can be bribed or tricked into granting access.
Scattered Spider: Masters of social engineering
If Coinbase illustrates the risk of malicious insiders, the UK-based retail breaches show how unintentional insiders can be just as dangerous.
Retail giants like Marks & Spencer, Co-Op, and Harrods recently suffered outages and data exposure linked to a notorious cybercriminal group known as Scattered Spider (Octo Tempest or UNC3944). This group specializes in social engineering. It tricks internal employees—often native English speakers—into giving up credentials or resetting multi-factor authentication (MFA), which allows further infiltration.
Tyler explains that these groups act as “access brokers,” working within a broader ransomware economy. Once they’ve gained access, they sell it to ransomware affiliates, who then deploy the actual payloads and extort companies for millions. It’s a well-oiled criminal operation, and companies worldwide struggle to keep up.
Marks & Spencer, for instance, has been battling system issues for over a month following the breach. It continues to struggle with online orders, contactless payments, and even inventory shortages. The Co-Op took a more decisive approach by shutting down its systems early to cut off the attack, preventing deeper damage.
Which insider threat is worse: Malicious or unintentional?
Tyler’s answer is clearly unintentional insiders represent the bigger threat. Why? Because malicious insiders, while severe, are limited in scale. Bribing or turning an employee takes effort and coordination. But unintentional insiders? They’re everywhere, and they’re vulnerable. With phishing and social engineering attacks, threat actors can target thousands at once, hoping that even a small percentage will fall for it.
And with AI now empowering scammers to create deepfake voices, realistic spoofed emails, and convincing fake Slack messages, it’s getting harder for employees to detect fraud.
Remote work adds fuel to the fire
Remote and hybrid work environments, which have become the norm since the pandemic, further complicate the insider threat landscape. Verifying identities and intentions is more challenging when employees aren’t physically present. Tyler notes that the decentralized nature of remote work makes impersonation schemes more plausible and successful.
Defending against insider threats
Despite the doom and gloom, there are practical defenses organizations can deploy. Tyler emphasizes the importance of layered security, including:
Zero-trust mindset: Don’t assume that just because someone is inside the network, they’re trustworthy. Validate everything, especially identity and access.
Least privilege access: Only give employees and contractors the minimal level of access necessary for their roles. Implement secure escalation protocols for sensitive actions like MFA resets.
MFA hardening: Require multiple levels of identity verification, especially for support or admin-level users. Video verification and secure PINs can provide additional safeguards.
Training: Regularly educate all employees, especially those in support roles, on recognizing phishing, social engineering attempts, and internal impersonation scams.
Vendor security: Vet your third-party vendors thoroughly. Ensure their security standards match yours, especially if they handle customer data or sensitive internal systems.
The insider threat will grow
As cybercriminals become more creative and organizations become more distributed, the insider threat will only grow. Whether it’s a bribed contractor or a tricked help desk agent, people have become the new perimeter—and that perimeter is fragile.
The solution? Invest in people-first security strategies, harden your identity controls, and never underestimate the importance of awareness and training. In the world of cybersecurity, trust must be earned continuously.
As Tyler put it, “Identity is the new perimeter.”
Listen to this latest episode of Cybersecurity Reimagined on your favorite podcast app by clicking on the share button below. You can also listen to any of our previous episodes on demand.
Are you headed to the 2025 Gartner Application Innovation & Business Solutions Summit in Las Vegas, June 3-5? If accelerating software delivery, taming hybrid-cloud complexity, and hardening supply-chain security are on your 2025 agenda, carve out time for the OpenText® DevOps Cloud team. We’re bringing our experts, our latest platform innovations, and a packed schedule of live demos and information sessions designed to help you turn DevOps from a hopeful initiative into a predictable engine of value.
Why stop by the OpenText DevOps booth at Gartner® Application Innovation & Business Solutions Summit?
1. See a true end‑to‑end DevOps cloud in action
Most “DevOps” toolchains are stitched together with brittle scripts and tribal knowledge. OpenText DevOps Cloud unifies planning, version control, release orchestration, application security, and observability in a single SaaS experience. Watch our architects push a code change from commit to production—with automated policy checks, SBOM generation, container signing, and instant rollback—before your coffee gets cold.
2. Learn how global enterprises ship 4× faster
Whether you’re in finance, healthcare, manufacturing, or the public sector, you’ll find real‑world patterns you can steal. We’ll showcase:
a reduction in audit prep time via traceable pipelines
fewer production defects thanks to AI‑powered test automation
annual savings through environment-as‑code and dynamic provisioning
3. Experience AI‑assisted DevSecOps
Catch our live demo on “Gen AI automation across DevOps” featuring our innovative AI and LLM-powered solution, OpenText DevOps Aviator. Generate compliance reports with a prompt, surface the root cause of flaky tests in seconds, and let policy‑aware AI recommend the safest remediation path.
Can’t‑miss session
When: June 5 @ 11.15 AM PST Topic: Learn how leading teams are scaling intelligence across the pipeline with GenAI and agentic AI. Speaker: Gabriel Martinez, Director, Product Marketing, OpenText DevOps Cloud
Arrive early—seating is limited.
Meet the brains behind the OpenText DevOps platform
Gartner events are legendary for hallway insights, and our bench is ready. Schedule a 1:1 to dig into:
Regulated‑industry compliance – PCI DSS, ISO 27001
SAP integration – DevOps for heritage systems
FinOps optimization – Cutting CI/CD infrastructure costs without slowing teams
Swing by the booth to chat about how OpenText Core Software Delivery Platform, powered by AI, is making testing smarter, forecasting more accurate, and release decisions more confident across your entire SDLC.
Plan your visit to see OpenText DevOps at Gartner® Application Innovation & Business Solutions Summit
📍 Expo Hall—look for the carnival! 🗓️ June 3 – 5, 2025 at Caesars Forum Conference Center, Las Vegas 💻 Add our sessions in the Gartner event app under “Exhibitor Sessions > OpenText”
Ready to run DevOps like a business?
Register for the Gartner Application Innovation & Business Solutions Summit, book a 1:1 with an OpenText DevOps expert, and follow@OpenTextDevOps on LinkedIn for live updates and swag alerts. The future of high‑velocity, audit‑ready software delivery is here—and it’s running on OpenText DevOps Cloud. See you in Vegas!
Our daughter was diagnosed with diabetes at a young age. To keep her glucose at an acceptable level, my wife and I had to understand the effects that food, play, bedtime, the weather, and a number of other factors would have.
“To measure is to know,” became our mantra.
Before a sporting event, exam, or anything that required our daughter to perform optimally, there was a lot of preparation, orchestration, and, pun intended, examination. If we didn’t prepare, concern for her health would take center stage, resulting in undesirable mental pressure on the entire family. Not to mention the (obviously less important) potential for poor results caused by diabetes symptoms.
Fast forward through her childhood: Our independent, cheerful, and loving daughter is now travelling the globe by herself in between her studies with constant (and automated) monitoring to measure her intake and resulting glucose levels.
Which reminds me…
Obviously it’s not the same, but I can’t help but notice similarities between giving her the best possible chances for optimal performance and ultimate success to rolling out an enterprise-wide information management solution.
“To measure is to know” is still the mantra.
We require enterprise solutions to be stable, performant, and ultimately deliver on (or above) expectations. To ensure success, organizations will often use a dedicated team to manage operations. Consumers of these solutions can just do their work without having to worry about operational excellence.
I’m describing a private managed service that caters to specific use cases. (Not to be confused with the term adolescent daughter.)
Customer success with OpenText
At OpenText all our privately managed information management cloud solutions are constantly monitored, measured, and assessed during their operational lifecycle, including and especially before they go into production. We call this the Production Readiness Assessment (PRA).
As part of our promise to deliver on our L.O.V.E. model and ensure customer success we prepare, orchestrate, and examine all our managed solutions before releasing them into the world. PRA involves a thorough evaluation of various elements such as performance, security, the application of best practices, and adherence to requirements, both functional and technical.
Gartner highlighted that businesses who adopt a solid production readiness practice are 30% less likely to experience any form of downtime.
This blog introduces PRA as a standard deliverable for all OpenText private managed cloud solutions. Please stay tuned for my follow-up blogs with more detail on the reasons, goals, benefits, and specific checks the PRA delivers.
Until then please access our Production Readiness Best Practices and many more cloud and product-success resources on the OpenText Customer Success Portal (login required) and be part of our L.O.V.E. journey.
