Patrick Spencer, Author at Kiteworks

84% of Attacks Exploit the LOTL Blind Spot

The 2026 Cybersecurity Awareness-Resilience Gap: How 84% of High-Severity Attacks Still Catch Security Teams Off-Guard

by Patrick Spencer July 2, 2026July 2, 2026 | Cybersecurity Risk Management

Security organizations have never understood cyber risk better than they do right now. They have invested in frameworks, in tooling, in awareness campaigns. They have built CISO functions that report...

Azure CLI ROPC Attacks Bypassing MFA Controls

81 Million Azure CLI Password Spray Attempts. The Attackers Weren’t Trying to Break MFA. They Were Going Around It.

by Patrick Spencer July 2, 2026July 2, 2026 | Cybersecurity Risk Management

Eighty-one million password spray attempts. Seventy-eight compromised accounts. Thirty-nine organizations affected. Those are the numbers Huntress published on July 1, 2026, from an active campaign targeting Microsoft Azure environments –...

AI Agents Are the New Attack Surface

by Patrick Spencer June 30, 2026June 30, 2026 | Cybersecurity Risk Management

Security researchers just demonstrated that your AI coding assistant can be turned into an exfiltration tool – and your existing detection controls won’t catch it. Not as a theoretical concern....

Securing Agentic AI: Governing the Context Gap

Agentic AI Security: Context Is the New Attack Surface

by Patrick Spencer June 26, 2026June 26, 2026 | Cybersecurity Risk Management

Autonomous AI agents are taking actions in your security environment right now – and in many cases, they are acting on the wrong data. That is not a hypothetical risk...

AI Cyberattacks: Five Eyes Timeline Warning

Five Eyes Intelligence Alliance Warns AI-Fueled Cyberattacks Are Just Months Away

by Patrick Spencer June 26, 2026June 26, 2026 | Cybersecurity Risk Management

The Five Eyes intelligence alliance — the cybersecurity agencies of Australia, Canada, New Zealand, the United Kingdom, and the United States — issued a joint advisory on June 23, 2026...

AI Red Teaming: Enterprise Security Lessons from NSA Exercise

When AI Becomes the Red Team: What the NSA-Mythos Story Reveals About Your Enterprise Security

by Patrick Spencer June 23, 2026June 23, 2026 | Cybersecurity Risk Management

A single sentence traveled from an intelligence agency director to a Senate floor speech to a magazine article to global social media – and by the time it arrived, it...

Third-Party Breaches: GCs' Top Liability Concern

Third-Party Vendor Data Breaches Are Now the Top Legal Liability Vector for General Counsel

by Patrick Spencer June 23, 2026June 23, 2026 | Third Party Risk

General Counsel used to worry about their own organization’s security posture. That has changed. According to the Verizon 2026 Data Breach Investigations Report (DBIR), third-party breaches have surged 60% year-over-year...

Third-Party Storage: The Hidden PHI Breach Risk

The Amazon One Medical Breach: When Third-Party File Storage Becomes a PHI Liability

by Patrick Spencer June 23, 2026June 23, 2026 | Cybersecurity Risk Management

The Amazon One Medical breach illustrates a truth the healthcare security community knows but struggles to operationalize: it does not matter how strong your clinical systems are if the data...

SearchLeak: Copilot's Hidden Data Exfiltration Risk Exposed

Microsoft 365 Copilot SearchLeak (CVE-2026-42824): When Your AI Assistant Becomes an Exfiltration Tool

by Patrick Spencer June 23, 2026June 23, 2026 | Cybersecurity Risk Management

Security researchers just demonstrated that an enterprise AI assistant can be turned into a precision data exfiltration tool using nothing more than a crafted link – and the enterprise’s own...

Lockdown Mode Confirms Threat, Not Governance

OpenAI Lockdown Mode Is a Warning, Not a Solution

by Patrick Spencer June 10, 2026June 10, 2026 | Cybersecurity Risk Management

When OpenAI announced the general rollout of Lockdown Mode for ChatGPT in June 2026, the more consequential read is organizational. OpenAI has concluded that prompt injection-driven data exfiltration is a...

145 AI Laws Intensify Privacy Compliance Pressures

145 AI Laws Were Passed in 2025. Privacy Teams Are Not Catching a Break.

by Patrick Spencer June 10, 2026June 10, 2026 | Regulatory Compliance

Most enterprise discussions of shadow AI focus on employees using unauthorized tools. The DataGrail Privacy and AI Trends Report 2026 identifies a more fundamental problem: shadow AI embedded inside authorized...

Microsoft Named 7 Ways Your AI Agents Can Be Hacked. One Is Already Happening in Production.

by Patrick Spencer June 8, 2026June 8, 2026 | Cybersecurity Risk Management

At Microsoft Build 2026, the security research team extended its existing AI agent threat taxonomy with seven new categories reflecting what adversaries are doing — and what defenders are missing...

Defending AI Agents from Memory Poisoning Attacks

OWASP Agent Memory Guard: Stop AI Agents from Being Weaponized Through Their Own Memory

by Patrick Spencer June 5, 2026June 5, 2026 | Cybersecurity Risk Management

AI agent memory poisoning exploits the fact that agents are stateful. Unlike a traditional API call that processes input and returns output without remembering anything, an agent maintains persistent state...

npm Package Silently Steals Codex Authentication Tokens

OpenAI Codex Authentication Tokens Stolen in npm Supply Chain Attack

by Patrick Spencer June 5, 2026June 5, 2026 | Cybersecurity Risk Management

Supply chain risk has traditionally focused on software dependencies that introduce vulnerabilities into compiled products — the type of compromise represented by SolarWinds and XZ Utils. The Codex token theft...

Content Layer Controls for Shadow AI Risks

How to Govern Shadow AI Without Killing Innovation

by Patrick Spencer June 5, 2026June 5, 2026 | Cybersecurity Risk Management

The 8-K filing matters because it resets the risk calculus. SEC cybersecurity disclosure rules require public companies to report material cybersecurity incidents within four business days of determining materiality —...

Security and Compliance Blog

Learn security strategies, compare vendors, and implement best practices to prevent breaches and compliance violations from risky third party communications.

Posts by Patrick Spencer

The 2026 Cybersecurity Awareness-Resilience Gap: How 84% of High-Severity Attacks Still Catch Security Teams Off-Guard

81 Million Azure CLI Password Spray Attempts. The Attackers Weren’t Trying to Break MFA. They Were Going Around It.

AI Agents Are the New Attack Surface

Agentic AI Security: Context Is the New Attack Surface

Five Eyes Intelligence Alliance Warns AI-Fueled Cyberattacks Are Just Months Away

When AI Becomes the Red Team: What the NSA-Mythos Story Reveals About Your Enterprise Security

Third-Party Vendor Data Breaches Are Now the Top Legal Liability Vector for General Counsel

The Amazon One Medical Breach: When Third-Party File Storage Becomes a PHI Liability

Microsoft 365 Copilot SearchLeak (CVE-2026-42824): When Your AI Assistant Becomes an Exfiltration Tool

OpenAI Lockdown Mode Is a Warning, Not a Solution

Microsoft Named 7 Ways Your AI Agents Can Be Hacked. One Is Already Happening in Production.

OWASP Agent Memory Guard: Stop AI Agents from Being Weaponized Through Their Own Memory

OpenAI Codex Authentication Tokens Stolen in npm Supply Chain Attack

Get started.