Cyber Resilience: Closing the CEO-CISO Perception Gap
A company can pass every compliance audit, deploy every recommended control, and still take six months to get back on its feet after a serious cyber incident. That is the...
Technology
AI Confidence Just Fell 17 Points. Non-Human Identity Governance Is Why.
A 17-point drop in self-reported AI maturity sounds like bad news. It isn’t. It’s what happens when IT leaders stop grading their AI programs on ambition and start grading them...
MFT vs. SFTP: Key Differences and Which Is More Secure
SFTP is a protocol that encrypts files as they move between two systems, while Managed File Transfer (MFT) is a platform that uses SFTP and other protocols while adding governance,...
GitLost Proves Your AI Agent Doesn’t Need to Be Hacked to Leak Your Data
An attacker needed no stolen password, no phishing email, and no exploit chain to pull private source code out of a GitHub organization. A single sentence, typed into a public...
81 Million Azure CLI Password Spray Attempts. The Attackers Weren’t Trying to Break MFA. They Were Going Around It.
Eighty-one million password spray attempts. Seventy-eight compromised accounts. Thirty-nine organizations affected. Those are the numbers Huntress published on July 1, 2026, from an active campaign targeting Microsoft Azure environments –...
AI Agents Are the New Attack Surface
Security researchers just demonstrated that your AI coding assistant can be turned into an exfiltration tool – and your existing detection controls won’t catch it. Not as a theoretical concern....
OpenAI Codex Authentication Tokens Stolen in npm Supply Chain Attack
Supply chain risk has traditionally focused on software dependencies that introduce vulnerabilities into compiled products — the type of compromise represented by SolarWinds and XZ Utils. The Codex token theft...
When the Guardrail Fails: AI Coding Tools and the Data-Layer Question
There was no press conference. No breach notification letter. A flaw in a widely used AI coding assistant — one that researchers say could be chained with prompt injection to...
Synack 2026 Report: The Exploit Window Has Narrowed to Hours
On May 14, 2026, Synack published its 2026 State of Vulnerabilities Report, an analysis of more than 11,000 exploitable vulnerabilities identified across customer environments in 2025. The central finding from...
The 2.5x Problem: Why AI Pen Tests Just Reframed the Data Security Conversation
When your application security pen test returns a 13% severe-flaw rate, you treat it as a Tuesday. When it returns 32%, you stop the deployment. Cobalt’s 2026 State of Pentesting...
When the Agent Becomes the Attacker’s Best Recruit
A campaign reported by CSO Online marks something genuinely new in the supply-chain threat landscape. Attackers seeded second-layer malicious packages across npm, PyPI, and Cargo, posing as cryptocurrency utilities. The...
CVE-2026-3854: When AI Finds the Bug Before You Patch It
On April 28, 2026, Wiz Research publicly disclosed CVE-2026-3854, a critical command injection vulnerability in GitHub’s internal git infrastructure with a CVSS score of 8.7. The exploitation chain is alarmingly...
AI Supply Chain Breach: The Mercor-LiteLLM Pattern Is Just Starting
On April 6, 2026, Computing reported that Meta had suspended its collaboration with AI data contractor Mercor following a breach that may have exposed sensitive information about how leading AI...
GDPR at Ten: The AI Decade Will Test Whether the Rules Can Hold
5 Key Takeaways The first decade of GDPR was a data-at-rest decade. Inventories, RoPAs, breach notices, DPIAs. The next decade will be a data-in-motion decade — prompts, training corpora, model...
Three Laws, One Deadline: Chile’s AI Reckoning Arrives in 2026
Key Takeaways Converging 2026 Deadlines. Cybersecurity, privacy, and AI laws impose simultaneous obligations on Chilean operators, with no sequential compliance window. 732 OIVs Already Designated. ANCI has named operators across...