Posts by Patrick Spencer

Patrick Spencer, Senior Vice President, Americas Marketing & Industry Research, Kiteworks

Patrick is charged with building thought leadership and communications programs that increase brand awareness and engagement and propel lead-generation programs. He has nearly two decades of experience in various senior marketing roles within cybersecurity at Contrast Security, Fortinet, and Symantec.

He holds a doctorate from the University of Durham and two masters and a bachelor’s degree from Abilene Christian University.

Employees Exporting Internal Data via Shadow AI

Internal Data Is the #1 Stolen Asset. Your Employees Are Exporting It Voluntarily.

by Patrick Spencer May 29, 2026May 29, 2026 | Cybersecurity Risk Management

The 2026 DBIR includes a sentence worth quoting in every board-level risk briefing: “Internal mostly means emails, plans and reports — the kind of material you’d expect to be lying...

Exploitation Now Tops Credential Theft in Breaches

Vulnerability Exploitation Just Overtook Credentials. The Patch Model Is Quietly Failing.

by Patrick Spencer May 29, 2026May 29, 2026 | Cybersecurity Risk Management

For nineteen years, the Verizon DBIR documented the same uncomfortable truth: most attackers get in by stealing credentials. The 2026 DBIR has published the first year-over-year inversion of that pattern....

Synack 2026: AI Shrinks Exploit Window to Hours

Synack 2026 Report: The Exploit Window Has Narrowed to Hours

by Patrick Spencer May 29, 2026May 29, 2026 | Cybersecurity Risk Management

On May 14, 2026, Synack published its 2026 State of Vulnerabilities Report, an analysis of more than 11,000 exploitable vulnerabilities identified across customer environments in 2025. The central finding from...

PraisonAI Lesson: Why AI Agents Ship Insecure by Default

When AI Agents Ship Insecure by Default: The PraisonAI Lesson Every CISO Needs to Read

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

On May 11, 2026, at 13:56 UTC, GitHub published advisory GHSA-6rmh-7xcm-cpxj for CVE-2026-44338, an authentication-bypass flaw in PraisonAI. At 17:40 UTC — three hours, 44 minutes, and 39 seconds later...

AI Now Crafts Working Zero-Day Exploits

Google Confirmed the First AI-Crafted Zero-Day. What Changes Now.

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

On May 11, 2026, Google’s Threat Intelligence Group (GTIG) published evidence that a cybercrime group used an AI model to identify a zero-day vulnerability and write a Python exploit for...

AI Pen Tests Expose 2.5x Flaw Density

The 2.5x Problem: Why AI Pen Tests Just Reframed the Data Security Conversation

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

When your application security pen test returns a 13% severe-flaw rate, you treat it as a Tuesday. When it returns 32%, you stop the deployment. Cobalt’s 2026 State of Pentesting...

AI Adoption Outpaces Governance and Policy Controls

The AI Policy Gap: When 90% Use AI and 25% Have No Rules

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

ISACA’s 2026 AI Pulse Poll surveyed 3,400 digital trust professionals across IT audit, governance, cybersecurity, privacy, and emerging technology roles. Three numbers tell a story most security leaders already know...

Supply Chain Attacks Now Target AI Agents

When the Agent Becomes the Attacker’s Best Recruit

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

A campaign reported by CSO Online marks something genuinely new in the supply-chain threat landscape. Attackers seeded second-layer malicious packages across npm, PyPI, and Cargo, posing as cryptocurrency utilities. The...

Shadow AI Surge: Data-Layer Governance Required

Shadow AI Governance: Why a 509% Surge Isn’t a DLP Problem

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

Industry research published in May 2026 found that enterprise adoption of endpoint-based AI-native apps grew 509% in the past year, and adoption of coding assistants jumped 357% year-over-year. This is...

Data-Layer Controls for Agentic AI Governance

Why Agentic AI Governance Is Falling Short — and What Actually Works

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

In July 2025, an AI coding agent on Replit’s “vibe coding” platform deleted a live production database during an active code freeze, wiping real records for more than 1,200 executives...

AI Defender Gains Depend on Governance

When AI Tips Toward Defenders: Why Most Organizations Still Won’t Win

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

The May 4, 2026 publication of Empowering Defenders: AI for Cybersecurity is the first authoritative cross-industry attempt to quantify what defenders actually gain. The report draws on 20 real-world case...

AI Agents: Governing the Emerging Traffic Category

When Bots Outnumber People: Governing the Third Traffic Category

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

The Thales 2026 Bad Bot Report, now in its 13th consecutive edition, introduces a third category of automated traffic alongside good bots and bad bots: AI agents. They browse websites,...

Shadow AI Training Gaps Drive Insider Risk

The 31% Problem: Shadow AI Training Gaps Are Now an Insider Risk

by Patrick Spencer May 27, 2026May 27, 2026 | Cybersecurity Risk Management

The 2026 DTEX/Ponemon Cost of Insider Risks Global Report ranked shadow AI as the leading driver of negligent insider incidents — ahead of unmonitored file sharing, personal webmail, and every...

AI Uncovers Critical GitHub Flaws via Reverse Engineering

CVE-2026-3854: When AI Finds the Bug Before You Patch It

by Patrick Spencer May 27, 2026May 27, 2026 | Cybersecurity Risk Management

On April 28, 2026, Wiz Research publicly disclosed CVE-2026-3854, a critical command injection vulnerability in GitHub’s internal git infrastructure with a CVSS score of 8.7. The exploitation chain is alarmingly...

Explore Kiteworks