CMMC Archives

Pre-Auth RCE Exposes RAG Data Vulnerabilities

When Your Vector Database Hands Out Pre-Auth RCE, RAG Has a Data-Layer Problem

by Patrick Spencer May 29, 2026May 29, 2026 | Cybersecurity Risk Management

On May 18, 2026, HiddenLayer published research on ChromaToast — formally CVE-2026-45829. CVSS score: 10.0. Attack vector: network. Privileges required: none. User interaction: none. The flaw lives in the ChromaDB...

Synack 2026: AI Shrinks Exploit Window to Hours

Synack 2026 Report: The Exploit Window Has Narrowed to Hours

by Patrick Spencer May 29, 2026May 29, 2026 | Cybersecurity Risk Management

On May 14, 2026, Synack published its 2026 State of Vulnerabilities Report, an analysis of more than 11,000 exploitable vulnerabilities identified across customer environments in 2025. The central finding from...

Agentic AI Now Requires Privileged Identity Controls

CISA Just Made Agentic AI Governance an IAM Problem

by Danielle Barbour May 28, 2026May 28, 2026 | Regulatory Compliance

On May 1, 2026, CISA and the Five Eyes cybersecurity agencies published “Careful Adoption of Agentic AI Services” — stopping treating agentic AI as a clever software feature and starting...

CISA Guidelines for Secure Agentic AI Adoption

CISA Drew the Red Lines on Agentic AI — Most Are Already Across

by Uri Kedem May 28, 2026May 28, 2026 | Cybersecurity Risk Management

On April 30 and May 1, 2026, six national cybersecurity agencies jointly published Careful Adoption of Agentic AI Services, a 28-page guidance document on securing autonomous AI agents — the...

Runtime Policy Enforcement for Agentic AI Systems

AWS Rex Open-Sources the Runtime Layer of Agentic AI Security

by Danielle Barbour May 28, 2026May 28, 2026 | Cybersecurity Risk Management

On May 4, 2026, AWS published Introducing Trusted Remote Execution: Policy-Enforced Scripts for AI Agents and Humans, open-sourcing Rex under the Apache 2.0 license. The architecture is straightforward: scripts are...

Supply Chain Attacks Now Target AI Agents

When the Agent Becomes the Attacker’s Best Recruit

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

A campaign reported by CSO Online marks something genuinely new in the supply-chain threat landscape. Attackers seeded second-layer malicious packages across npm, PyPI, and Cargo, posing as cryptocurrency utilities. The...

Data-Layer Controls for Agentic AI Governance

Why Agentic AI Governance Is Falling Short — and What Actually Works

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

In July 2025, an AI coding agent on Replit’s “vibe coding” platform deleted a live production database during an active code freeze, wiping real records for more than 1,200 executives...

When AI Tips Toward Defenders: Why Most Organizations Still Won’t Win

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

The May 4, 2026 publication of Empowering Defenders: AI for Cybersecurity is the first authoritative cross-industry attempt to quantify what defenders actually gain. The report draws on 20 real-world case...

AI Agents: Governing the Emerging Traffic Category

When Bots Outnumber People: Governing the Third Traffic Category

by Patrick Spencer May 28, 2026May 28, 2026 | Cybersecurity Risk Management

The Thales 2026 Bad Bot Report, now in its 13th consecutive edition, introduces a third category of automated traffic alongside good bots and bad bots: AI agents. They browse websites,...

Shadow AI Training Gaps Drive Insider Risk

The 31% Problem: Shadow AI Training Gaps Are Now an Insider Risk

by Patrick Spencer May 27, 2026May 27, 2026 | Cybersecurity Risk Management

The 2026 DTEX/Ponemon Cost of Insider Risks Global Report ranked shadow AI as the leading driver of negligent insider incidents — ahead of unmonitored file sharing, personal webmail, and every...

Supply Chain Breaches: Securing Data Beyond LiteLLM Risks

AI Supply Chain Breach: The Mercor-LiteLLM Pattern Is Just Starting

by Patrick Spencer May 27, 2026May 27, 2026 | Cybersecurity Risk Management

On April 6, 2026, Computing reported that Meta had suspended its collaboration with AI data contractor Mercor following a breach that may have exposed sensitive information about how leading AI...

Indirect Prompt Injection Attacks Now in Production

Indirect Prompt Injection Goes Live: Why Guardrails Won’t Save You

by Patrick Spencer May 26, 2026May 27, 2026 | Cybersecurity Risk Management

Researchers from Google and Forcepoint have documented indirect prompt injection attacks executing against production AI systems. Attackers embed hidden instructions in web pages, documents, and emails. AI agents that browse,...

AI Agent Credentials: The Next Breach Risk

Agentic AI’s Identity Crisis: Why Machine Credentials Are Your Next Breach Vector

by Patrick Spencer May 20, 2026May 20, 2026 | Cybersecurity Risk Management

Key Takeaways AI Agents Get Over-Privileged Credentials. Enterprises grant machine identities broad access without applying human-level hygiene like rotation or least privilege. Forrester Predicts a Major Breach by End of...

Device Code Phishing: AI's Silent M365 Breach

M365 Device Code Phishing: The AI-Assisted Kill Chain Compromising Hundreds of Organizations Daily

by Uri Kedem May 20, 2026May 20, 2026 | Secure Email

Key Takeaways Daily Mass Compromises. Hundreds of M365 tenants are breached daily through an automated, AI-driven phishing campaign abusing device code authentication. Legitimate Flow Exploitation. Attackers weaponize Microsoft’s device code...

AI Attack Autonomy Doubles Every 4.7 Months

AI Attacker Doubling Rate Hits 4.7 Months: Govern Data Now

by Marc ten Eikelder May 19, 2026May 19, 2026 | Cybersecurity Risk Management

The U.K. government just published the most uncomfortable benchmark in cybersecurity. The AI Security Institute (AISI), a research arm of the Department for Science, Innovation and Technology, has been tracking...

Get started.