← Back to Security Blog

Directrices de seguridad 6G por diseño, el riesgo de amenazas internas con IA alcanza niveles críticos, zero-days empresariales en máximos históricos — Resumen regulatorio 9 de marzo de 2026

La coalición GCOT lanza principios de ciberseguridad 6G. Las amenazas internas impulsadas por IA alcanzan niveles críticos bajo el escrutinio de la Ley de IA de la UE. Google reporta 90 zero-days en 2025 dirigidos a software empresarial. Microsoft refuerza protecciones de datos en Copilot. Se analizan implicaciones de NIS2 y DORA.

---

📡 GCOT Launches 6G Security-by-Design Principles

Why This Matters Before 6G Exists

With 6G commercial rollouts not expected until 2029-2030, this is one of the earliest instances of security-by-design regulation preceding the technology it governs. The coalition assessed that 6G will bring more virtualized network functions, disaggregated architectures with standardized interfaces, and native AI integration — each creating new superficie de ataques that must be addressed at the standards level, not retrofitted after deployment.

The Eight Principles

GCOT defined four security and four resilience objectives:

Category	Principle	Key Requirement
Security	Containment	Limit propagation of malicious actors through the network
Security	Confidentiality	Privacy-by-design for user data, secure against eavesdropping
Security	Integrity	Data integrity guarantees across network transit and infrastructure
Security	Access Control	Authentication and authorization for all network components
Resilience	Service Continuity	Maintain availability under challenging circumstances
Resilience	Supply Chain	Multi-vendor security with trusted supplier assurance
Resilience	Physical Security	Resilience against physical and environmental threats
Resilience	Recovery	Rapid restoration after security incidents or disruptions

Regulatory Alignment

These principles directly map to existing and emerging EU regulations:

• NIS2 Article 21: The security principles mirror NIS2's gestión de riesgos measures for essential entities in the telecommunications sector — containment, integrity, and access control are core NIS2 requirements
• EU Cyber Resilience Act (CRA): The cadena de suministro and security-by-design principles align with CRA's product security requirements, which will apply to 6G network equipment when commercialized
• European Electronic Communications Code (EECC): GCOT's resilience principles complement EECC Articles 40-41 on network security and integrity
• EU AI Act: With AI natively integrated into 6G networks, the AI governance requirements under Articles 6-49 will apply to AI components in 6G infrastructure classified as high-risk

---

🤖 AI-Driven Insider Risk: A "Critical Business Threat"

Key Findings

• 42% increase in malicious insider incidents: Employees deliberately stealing, manipulating, or destroying data — often using AI tools to locate and exfiltrate sensitive information at scale
• 42% increase in negligent incidents: Employees using personal cloud accounts, weak passwords, or falling for AI-enhanced phishing — carelessness amplified by the false sense of security that AI productivity tools provide
• 10% year-over-year growth in CISO concern about malicious insiders, with security leaders now expecting an average of six insider-driven threats per month
• AI as both weapon and vulnerability: Attackers use AI to craft more convincing phishing lures, while insiders use AI to search for and extract sensitive data more efficiently

EU AI Act Implications

The EU AI Act's risk-based framework has direct relevance to AI-driven insider threats:

• Article 9 (Risk Management): High-risk AI systems deployed in workplace environments must include gestión de riesgos systems that address misuse scenarios — including deliberate abuse by authorized users
• Article 14 (Human Oversight): AI tools used in corporate environments must maintain human oversight capabilities, including the ability to detect and prevent data exfiltration patterns
• Article 13 (Transparency): Organizations deploying AI productivity tools must inform users about the system's capabilities and limitations — employees must understand what data AI tools can access
• Article 52 (Specific Transparency): AI systems generating content or interacting with humans must be identifiable as AI — this applies to AI-crafted phishing emails targeting employees

NIS2 and DORA Requirements

Insider threats are explicitly within scope of both frameworks:

• NIS2 Article 21(2)(i): Requires "human resources security" measures, including background checks, security awareness, and access management — AI tool governance must now be part of this
• NIS2 Article 21(2)(a): Risk analysis and information system security policies must account for AI-amplified insider risk scenarios
• DORA Article 5: Financial entities must include insider threat scenarios in their ICT gestión de riesgos frameworks, with AI-driven threats requiring specific detection and response capabilities
• DORA Article 13: Learning and evolving requirements mean financial entities must update their threat intelligence to include AI-enabled insider attack patterns

---

🎯 Enterprise Zero-Days Reach All-Time High: 90 in 2025

The Enterprise Shift

Google's analysis reveals a structural change in the panorama de amenazas:

• 43 zero-days targeted enterprise products — security appliances, networking equipment, virtualization platforms, and enterprise applications
• 21 of those (nearly half) targeted security and networking solutions — firewalls, VPNs, routers, and security gateways that sit at the network edge
• Edge devices are blind spots: Security appliances often lack endpoint detection and response (EDR) coverage, making zero-day exploitation harder to detect
• Attackers are embedding deeply in critical business infrastructure, using compromised enterprise tools for escalada de privilegios and lateral movement

Additional GTIG Findings

• Windows remains most targeted OS: Of the 47 end-user zero-days, 24 (27% of total) targeted operating systems, with Microsoft Windows leading
• Mobile zero-days surged: 15 mobile OS zero-days in 2025, up from 9 in 2024 — a 67% increase
• Browser zero-days hit historic low: As browser sandboxing improves, attackers are shifting to less hardened targets
• CVE-2026-0628 (Gemini AI in Chrome): A High-severity (CVSS 8.8) elevación de privilegios vulnerability allowing malicious extensions to hijack Gemini Live in the Chrome browser panel

Regulatory Implications

Framework	Requirement	Impact of Zero-Day Surge
NIS2	Art. 21(2)(e) — Vulnerability handling	Essential entities must have processes for zero-day detection, triage, and emergency patching of enterprise infrastructure
DORA	Art. 9 — ICT gestión de riesgos	Financial entities must include enterprise zero-day scenarios in evaluación de riesgoss and maintain emergency patching procedures
CRA	Art. 11 — Vulnerability reporting	Product manufacturers face mandatory 24-hour reporting of activamente explotado vulnerabilities starting September 2026
EU AI Act	Art. 15 — Accuracy, robustness, security	AI systems must be resilient to exploitation — the Gemini Chrome CVE demonstrates AI components create new vulnerability classes

---

🛡️ Microsoft Copilot Data Protection: AI Governance in Practice

What Changed

The core issue: Microsoft 365 Copilot's AI assistant could access and process files stored locally on users' machines, even when DLP policies restricted those same files on OneDrive and SharePoint. This gap meant confidential documents — marked as sensitive by DLP rules — could be summarized, quoted, or referenced in Copilot-generated reports without any protection applied.

• New default behavior (April 2026): DLP policies will apply to all files Copilot accesses, regardless of storage location
• Applied by default: Organizations do not need to opt in — the protection will be automatic
• Retroactive enforcement: Existing DLP policies will extend to cover Copilot's local file access

Regulatory Significance

This episode illustrates a regulatory pattern that compliance teams must internalize:

• GDPR Article 25 (Data Protection by Design): Copilot's original behavior — processing confidential data without applying existing DLP rules — arguably violated the principle of data protection by design and by default. Organizations that deployed Copilot without verifying DLP coverage may face controller liability
• EU AI Act Article 9 (Risk Management): AI systems that process personal or confidential data must include controls to prevent unauthorized exposición de datos. Copilot's DLP gap is exactly the type of risk that Article 9 gestión de riesgos systems must identify and mitigate
• DORA Article 28 (Third-Party ICT Risk): Financial entities using Microsoft 365 Copilot must treat this DLP gap as a material ICT risk event. Document the gap, the timeline for remediation (April 2026), and any interim compensating controls in your third-party risk register
• NIS2 Article 21(2)(d) — Cadena de suministro security: Copilot is a third-party AI component in your ICT environment. Its data handling behavior is a cadena de suministro risk that must be continuously assessed

---

⚠️ Fake AI Browser Extensions: Consumer Protection Gap

The Regulatory Gap

This trend exposes critical gaps in existing regulatory frameworks:

• EU AI Act Article 52 (Transparency): AI systems interacting with users must be identifiable as AI and disclose their purpose. Fake AI extensions violate both transparency and purpose limitation requirements, but enforcement mechanisms for app store distribution are undefined
• Digital Services Act (DSA): App stores qualify as "online platforms" under the DSA and must implement measures to prevent the distribution of malicious extensions. This includes proactive security review obligations for Very Large Online Platforms (VLOPs)
• GDPR Article 5(1)(b) — Purpose Limitation: Extensions that collect data beyond their stated AI functionality violate the purpose limitation principle. Data protection authorities should prioritize enforcement against these actors
• CRA Product Security: When CRA reporting obligations take effect in September 2026, app stores may face requirements to report activamente explotado vulnerabilities in distributed software, including malicious extensions

---

📅 Regulatory Calendar: Key Dates Ahead

Date	Framework	Milestone
11 de marzo de 2026	Patch Tuesday	Microsoft March 2026 release — after 90 zero-days in 2025, prepare for significant patches
April 2026	Microsoft	Copilot DLP local file protection applied by default — verify your DLP policies cover all data categories
2 de mayo de 2026	EU AI Act	GPAI model transparency obligations take effect — AI providers must publish training data summaries
2 de agosto de 2026	EU AI Act	High-risk AI system requirements enforceable (Articles 6-49) — full compliance stack required
11 de septiembre de 2026	CRA	Mandatory reporting of activamente explotado vulnerabilities begins — 24-hour notification requirement
17 de octubre de 2026	NIS2	Member state transposition deadline — all 27 EU countries must have NIS2 in national law
2029-2030	GCOT/6G	Expected initial 6G commercial rollouts — security-by-design principles must be embedded in standards by then

---

🔑 Conclusiones clave for Compliance Teams

1. 6G security standards are being shaped now. GCOT's eight principles set expectations that will become mandatory requirements. Telecom operators and equipment manufacturers should align their security-by-design processes with these principles today — waiting for final standards means playing catch-up.
2. AI insider risk is a compliance obligation, not an HR issue. With 42% of organizations reporting increases in AI-driven insider threats, NIS2 and DORA compliance programs must include specific AI tool governance controls — shadow AI audits, DLP for AI-assisted access, and insider threat baselines that account for AI capabilities.
3. Your security infrastructure is the target. Google's 90 zero-days finding, with nearly half targeting enterprise security and networking appliances, means vulnerability management programs must prioritize the tools meant to protect you. Assume compromise of edge devices and implement out-of-band monitoring.
4. Microsoft Copilot's DLP gap is a preview of AI governance failures. Organizations deploying AI productivity tools without verifying data handling controls face GDPR, EU AI Act, and NIS2 liability. Audit AI tool data access before regulators ask questions.
5. Fake AI extensions are a consumer protection crisis. Until DSA and CRA enforcement catches up, enterprise browser extension allowlisting is your only reliable defense. Implement it now.
6. Patch Tuesday preparation is not optional. After a record year of enterprise zero-days, DORA and NIS2 entities without documented, tested emergency patching procedures are running a compliance deficit that supervisors will identify.