AI Agent Security: The Lethal Trifecta Explained
In early 2026, security researchers found more than 900 AI agent gateways exposed on the public internet with no authentication — API keys, OAuth tokens, and full conversation histories stored...
Security and Compliance Blog
Learn security strategies, compare vendors, and implement best practices to prevent breaches and compliance violations from risky third party communications.
Posts by Patrick Spencer
Patrick Spencer, Senior Vice President, Americas Marketing & Industry Research, Kiteworks
Patrick is charged with building thought leadership and communications programs that increase brand awareness and engagement and propel lead-generation programs. He has nearly two decades of experience in various senior marketing roles within cybersecurity at Contrast Security, Fortinet, and Symantec.
He holds a doctorate from the University of Durham and two masters and a bachelor’s degree from Abilene Christian University.
When the Guardrail Fails: AI Coding Tools and the Data-Layer Question
There was no press conference. No breach notification letter. A flaw in a widely used AI coding assistant — one that researchers say could be chained with prompt injection to...
The AI Security Paradox: Same Technology, Opposite Verdicts
In a survey of 16,029 cybersecurity professionals by ISC2, AI was named the emerging technology with the greatest positive impact on security — and simultaneously the technology with by far...
When Your Vector Database Hands Out Pre-Auth RCE, RAG Has a Data-Layer Problem
On May 18, 2026, HiddenLayer published research on ChromaToast — formally CVE-2026-45829. CVSS score: 10.0. Attack vector: network. Privileges required: none. User interaction: none. The flaw lives in the ChromaDB...
Internal Data Is the #1 Stolen Asset. Your Employees Are Exporting It Voluntarily.
The 2026 DBIR includes a sentence worth quoting in every board-level risk briefing: “Internal mostly means emails, plans and reports — the kind of material you’d expect to be lying...
When the Vendor Is the Breach: Why the 60% Surge in Third-Party Compromise Demands a Control Plane
The 2026 DBIR breaks third-party breaches into three archetypes. Archetype 1: a vendor’s product vulnerability provides initial access to the customer’s environment — the classic software supply chain attack. Archetype...
Vulnerability Exploitation Just Overtook Credentials. The Patch Model Is Quietly Failing.
For nineteen years, the Verizon DBIR documented the same uncomfortable truth: most attackers get in by stealing credentials. The 2026 DBIR has published the first year-over-year inversion of that pattern....
Synack 2026 Report: The Exploit Window Has Narrowed to Hours
On May 14, 2026, Synack published its 2026 State of Vulnerabilities Report, an analysis of more than 11,000 exploitable vulnerabilities identified across customer environments in 2025. The central finding from...
When AI Agents Ship Insecure by Default: The PraisonAI Lesson Every CISO Needs to Read
On May 11, 2026, at 13:56 UTC, GitHub published advisory GHSA-6rmh-7xcm-cpxj for CVE-2026-44338, an authentication-bypass flaw in PraisonAI. At 17:40 UTC — three hours, 44 minutes, and 39 seconds later...
Google Confirmed the First AI-Crafted Zero-Day. What Changes Now.
On May 11, 2026, Google’s Threat Intelligence Group (GTIG) published evidence that a cybercrime group used an AI model to identify a zero-day vulnerability and write a Python exploit for...
The 2.5x Problem: Why AI Pen Tests Just Reframed the Data Security Conversation
When your application security pen test returns a 13% severe-flaw rate, you treat it as a Tuesday. When it returns 32%, you stop the deployment. Cobalt’s 2026 State of Pentesting...
The AI Policy Gap: When 90% Use AI and 25% Have No Rules
ISACA’s 2026 AI Pulse Poll surveyed 3,400 digital trust professionals across IT audit, governance, cybersecurity, privacy, and emerging technology roles. Three numbers tell a story most security leaders already know...
When the Agent Becomes the Attacker’s Best Recruit
A campaign reported by CSO Online marks something genuinely new in the supply-chain threat landscape. Attackers seeded second-layer malicious packages across npm, PyPI, and Cargo, posing as cryptocurrency utilities. The...
Shadow AI Governance: Why a 509% Surge Isn’t a DLP Problem
Industry research published in May 2026 found that enterprise adoption of endpoint-based AI-native apps grew 509% in the past year, and adoption of coding assistants jumped 357% year-over-year. This is...
Why Agentic AI Governance Is Falling Short — and What Actually Works
In July 2025, an AI coding agent on Replit’s “vibe coding” platform deleted a live production database during an active code freeze, wiping real records for more than 1,200 executives...