CMMC Archives

AI Governance Requires Controls, Not Just Logs

Monitoring AI Behavior Is Not the Same as Governing It

by Patrick Spencer June 1, 2026June 1, 2026 | Cybersecurity Risk Management

Anthropic made a significant announcement this week. Claude Enterprise now integrates with 28 security and compliance partners through the new Claude Compliance API, giving enterprise security teams programmatic access to...

AI Agent Security: The Lethal Trifecta Explained

by Patrick Spencer June 1, 2026June 1, 2026 | Cybersecurity Risk Management

In early 2026, security researchers found more than 900 AI agent gateways exposed on the public internet with no authentication — API keys, OAuth tokens, and full conversation histories stored...

AI Sandbox Bypasses Expose Data-Layer Control Gaps

When the Guardrail Fails: AI Coding Tools and the Data-Layer Question

by Patrick Spencer June 1, 2026June 1, 2026 | Cybersecurity Risk Management

There was no press conference. No breach notification letter. A flaw in a widely used AI coding assistant — one that researchers say could be chained with prompt injection to...

Pre-Auth RCE Exposes RAG Data Vulnerabilities

When Your Vector Database Hands Out Pre-Auth RCE, RAG Has a Data-Layer Problem

by Patrick Spencer May 29, 2026May 29, 2026 | Cybersecurity Risk Management

On May 18, 2026, HiddenLayer published research on ChromaToast — formally CVE-2026-45829. CVSS score: 10.0. Attack vector: network. Privileges required: none. User interaction: none. The flaw lives in the ChromaDB...

Synack 2026: AI Shrinks Exploit Window to Hours

Synack 2026 Report: The Exploit Window Has Narrowed to Hours

by Patrick Spencer May 29, 2026May 29, 2026 | Cybersecurity Risk Management

On May 14, 2026, Synack published its 2026 State of Vulnerabilities Report, an analysis of more than 11,000 exploitable vulnerabilities identified across customer environments in 2025. The central finding from...

Agentic AI Now Requires Privileged Identity Controls

CISA Just Made Agentic AI Governance an IAM Problem

by Danielle Barbour May 28, 2026May 28, 2026 | Regulatory Compliance

On May 1, 2026, CISA and the Five Eyes cybersecurity agencies published “Careful Adoption of Agentic AI Services” — stopping treating agentic AI as a clever software feature and starting...

CISA Guidelines for Secure Agentic AI Adoption

CISA Drew the Red Lines on Agentic AI — Most Are Already Across

by Uri Kedem May 28, 2026May 28, 2026 | Cybersecurity Risk Management

On April 30 and May 1, 2026, six national cybersecurity agencies jointly published Careful Adoption of Agentic AI Services, a 28-page guidance document on securing autonomous AI agents — the...

Runtime Policy Enforcement for Agentic AI Systems

AWS Rex Open-Sources the Runtime Layer of Agentic AI Security

by Danielle Barbour May 28, 2026May 28, 2026 | Cybersecurity Risk Management

On May 4, 2026, AWS published Introducing Trusted Remote Execution: Policy-Enforced Scripts for AI Agents and Humans, open-sourcing Rex under the Apache 2.0 license. The architecture is straightforward: scripts are...

Supply Chain Attacks Now Target AI Agents

When the Agent Becomes the Attacker’s Best Recruit

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

A campaign reported by CSO Online marks something genuinely new in the supply-chain threat landscape. Attackers seeded second-layer malicious packages across npm, PyPI, and Cargo, posing as cryptocurrency utilities. The...

Data-Layer Controls for Agentic AI Governance

Why Agentic AI Governance Is Falling Short — and What Actually Works

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

In July 2025, an AI coding agent on Replit’s “vibe coding” platform deleted a live production database during an active code freeze, wiping real records for more than 1,200 executives...

When AI Tips Toward Defenders: Why Most Organizations Still Won’t Win

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

The May 4, 2026 publication of Empowering Defenders: AI for Cybersecurity is the first authoritative cross-industry attempt to quantify what defenders actually gain. The report draws on 20 real-world case...

AI Agents: Governing the Emerging Traffic Category

When Bots Outnumber People: Governing the Third Traffic Category

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

The Thales 2026 Bad Bot Report, now in its 13th consecutive edition, introduces a third category of automated traffic alongside good bots and bad bots: AI agents. They browse websites,...

Shadow AI Training Gaps Drive Insider Risk

The 31% Problem: Shadow AI Training Gaps Are Now an Insider Risk

by Patrick Spencer May 27, 2026May 27, 2026 | Cybersecurity Risk Management

The 2026 DTEX/Ponemon Cost of Insider Risks Global Report ranked shadow AI as the leading driver of negligent insider incidents — ahead of unmonitored file sharing, personal webmail, and every...

Supply Chain Breaches: Securing Data Beyond LiteLLM Risks

AI Supply Chain Breach: The Mercor-LiteLLM Pattern Is Just Starting

by Patrick Spencer May 27, 2026May 27, 2026 | Cybersecurity Risk Management

On April 6, 2026, Computing reported that Meta had suspended its collaboration with AI data contractor Mercor following a breach that may have exposed sensitive information about how leading AI...

Indirect Prompt Injection Attacks Now in Production

Indirect Prompt Injection Goes Live: Why Guardrails Won’t Save You

by Patrick Spencer May 26, 2026May 27, 2026 | Cybersecurity Risk Management

Researchers from Google and Forcepoint have documented indirect prompt injection attacks executing against production AI systems. Attackers embed hidden instructions in web pages, documents, and emails. AI agents that browse,...

Get started.