CISA Just Made Agentic AI Governance an IAM Problem
On May 1, 2026, CISA and the Five Eyes cybersecurity agencies published “Careful Adoption of Agentic AI Services” — stopping treating agentic AI as a clever software feature and starting...
CMMC
CISA Drew the Red Lines on Agentic AI — Most Are Already Across
On April 30 and May 1, 2026, six national cybersecurity agencies jointly published Careful Adoption of Agentic AI Services, a 28-page guidance document on securing autonomous AI agents — the...
AWS Rex Open-Sources the Runtime Layer of Agentic AI Security
On May 4, 2026, AWS published Introducing Trusted Remote Execution: Policy-Enforced Scripts for AI Agents and Humans, open-sourcing Rex under the Apache 2.0 license. The architecture is straightforward: scripts are...
When the Agent Becomes the Attacker’s Best Recruit
A campaign reported by CSO Online marks something genuinely new in the supply-chain threat landscape. Attackers seeded second-layer malicious packages across npm, PyPI, and Cargo, posing as cryptocurrency utilities. The...
Why Agentic AI Governance Is Falling Short — and What Actually Works
In July 2025, an AI coding agent on Replit’s “vibe coding” platform deleted a live production database during an active code freeze, wiping real records for more than 1,200 executives...
When AI Tips Toward Defenders: Why Most Organizations Still Won’t Win
The May 4, 2026 publication of Empowering Defenders: AI for Cybersecurity is the first authoritative cross-industry attempt to quantify what defenders actually gain. The report draws on 20 real-world case...
When Bots Outnumber People: Governing the Third Traffic Category
The Thales 2026 Bad Bot Report, now in its 13th consecutive edition, introduces a third category of automated traffic alongside good bots and bad bots: AI agents. They browse websites,...
The 31% Problem: Shadow AI Training Gaps Are Now an Insider Risk
The 2026 DTEX/Ponemon Cost of Insider Risks Global Report ranked shadow AI as the leading driver of negligent insider incidents — ahead of unmonitored file sharing, personal webmail, and every...
AI Supply Chain Breach: The Mercor-LiteLLM Pattern Is Just Starting
On April 6, 2026, Computing reported that Meta had suspended its collaboration with AI data contractor Mercor following a breach that may have exposed sensitive information about how leading AI...
Indirect Prompt Injection Goes Live: Why Guardrails Won’t Save You
Researchers from Google and Forcepoint have documented indirect prompt injection attacks executing against production AI systems. Attackers embed hidden instructions in web pages, documents, and emails. AI agents that browse,...
Agentic AI’s Identity Crisis: Why Machine Credentials Are Your Next Breach Vector
Key Takeaways AI Agents Get Over-Privileged Credentials. Enterprises grant machine identities broad access without applying human-level hygiene like rotation or least privilege. Forrester Predicts a Major Breach by End of...
M365 Device Code Phishing: The AI-Assisted Kill Chain Compromising Hundreds of Organizations Daily
Key Takeaways Daily Mass Compromises. Hundreds of M365 tenants are breached daily through an automated, AI-driven phishing campaign abusing device code authentication. Legitimate Flow Exploitation. Attackers weaponize Microsoft’s device code...
AI Attacker Doubling Rate Hits 4.7 Months: Govern Data Now
The U.K. government just published the most uncomfortable benchmark in cybersecurity. The AI Security Institute (AISI), a research arm of the Department for Science, Innovation and Technology, has been tracking...
Why CVE-2026-42897 Is the Email Architecture Wake-Up Call
On May 14, 2026, Microsoft disclosed CVE-2026-42897, an actively exploited critical cross-site scripting vulnerability in Microsoft Exchange Server. CVSS 8.1. Affects Exchange Server 2016, Exchange Server 2019, and Exchange Server...
Another MOVEit Vulnerability. Same Pattern. Different Stakes.
On April 30, 2026, Progress Software disclosed two vulnerabilities in MOVEit Automation, the workflow and scheduling engine that thousands of organizations use to automate enterprise file transfers. The National Vulnerability...