AI Agent Security: The Lethal Trifecta Explained
In early 2026, security researchers found more than 900 AI agent gateways exposed on the public internet with no authentication — API keys, OAuth tokens, and full conversation histories stored...
Government
The AI Security Paradox: Same Technology, Opposite Verdicts
In a survey of 16,029 cybersecurity professionals by ISC2, AI was named the emerging technology with the greatest positive impact on security — and simultaneously the technology with by far...
Sovereign AI Is a Governance Problem, Not a Geography Problem
Ninety-six percent of organizations are considering relocating AI infrastructure to specific regions — not because they want to, but because geopolitical pressure and supply-chain risk are forcing the question. Sovereign...
When Your Vector Database Hands Out Pre-Auth RCE, RAG Has a Data-Layer Problem
On May 18, 2026, HiddenLayer published research on ChromaToast — formally CVE-2026-45829. CVSS score: 10.0. Attack vector: network. Privileges required: none. User interaction: none. The flaw lives in the ChromaDB...
ITAR Export Control Requirements for Netherlands Defense Contractors
Defense contractors in the Netherlands face a complex landscape when implementing ITAR compliance export control requirements within their operational frameworks. The International Traffic in Arms Regulations establish stringent controls on...
Internal Data Is the #1 Stolen Asset. Your Employees Are Exporting It Voluntarily.
The 2026 DBIR includes a sentence worth quoting in every board-level risk briefing: “Internal mostly means emails, plans and reports — the kind of material you’d expect to be lying...
Vulnerability Exploitation Just Overtook Credentials. The Patch Model Is Quietly Failing.
For nineteen years, the Verizon DBIR documented the same uncomfortable truth: most attackers get in by stealing credentials. The 2026 DBIR has published the first year-over-year inversion of that pattern....
CISA Just Made Agentic AI Governance an IAM Problem
On May 1, 2026, CISA and the Five Eyes cybersecurity agencies published “Careful Adoption of Agentic AI Services” — stopping treating agentic AI as a clever software feature and starting...
CISA Drew the Red Lines on Agentic AI — Most Are Already Across
On April 30 and May 1, 2026, six national cybersecurity agencies jointly published Careful Adoption of Agentic AI Services, a 28-page guidance document on securing autonomous AI agents — the...
AWS Rex Open-Sources the Runtime Layer of Agentic AI Security
On May 4, 2026, AWS published Introducing Trusted Remote Execution: Policy-Enforced Scripts for AI Agents and Humans, open-sourcing Rex under the Apache 2.0 license. The architecture is straightforward: scripts are...
Why Agentic AI Governance Is Falling Short — and What Actually Works
In July 2025, an AI coding agent on Replit’s “vibe coding” platform deleted a live production database during an active code freeze, wiping real records for more than 1,200 executives...
When Bots Outnumber People: Governing the Third Traffic Category
The Thales 2026 Bad Bot Report, now in its 13th consecutive edition, introduces a third category of automated traffic alongside good bots and bad bots: AI agents. They browse websites,...
The 31% Problem: Shadow AI Training Gaps Are Now an Insider Risk
The 2026 DTEX/Ponemon Cost of Insider Risks Global Report ranked shadow AI as the leading driver of negligent insider incidents — ahead of unmonitored file sharing, personal webmail, and every...
The AI You Can’t See: Why Visibility Has Become the Defining Governance Problem of 2026
A Reflectiz analysis of Pentera’s AI Security & Exposure Benchmark 2026 — a survey of 300 U.S. CISOs — confirmed what security leaders have suspected for the better part of...
GDPR Article 32 Technical Measures: What UK Defence Contractors Must Implement
UK defence contractors face unprecedented scrutiny over their data protection practices as regulatory authorities intensify enforcement of GDPR Article 32’s technical and organisational measures. The defence sector’s handling of sensitive...