The security stories enterprise IT leaders actually read.
Volume 342, Issue 1 · 20 articles from 4 issues
Agents are neither service accounts nor extensions of the human who launched them, and need first-class identities.
Britive CEO Art Poghosyan cites two incidents: AWS coding agent Kiro deleted and recreated a production environment in December 2025, causing 13 hours of downtime after inheriting an engineer's elevated permissions, and an internal Meta agent autonomously posted technical guidance in March 2026, exposing sensitive data for nearly two hours.
Gartner predicts 40% of enterprise applications will ship with task-specific agents by the end of 2026. Treating an agent as a service account underestimates its velocity; treating it as the human who launched it misunderstands its autonomy.
The recommended architecture gives agents first-class identities, zero standing privileges with just-in-time scoped access, and runtime authorization decided in infrastructure the agent cannot talk its way past.
An interview tracing Jesse McGraw's path from notorious black hat hacker and federal prisoner to cybersecurity advocate.
This interview profiles Jesse McGraw, known online as GhostExodus, who moved from notorious black hat hacking to cybersecurity advocacy.
His interest began in high school when a friend introduced him to programming and network penetration, and he attributes his early path partly to social isolation from a lack of parental bonding, progressing from teenage social engineering to increasingly ambitious targets driven by thrill rather than money.
While leading the Electronik Tribulation Army, he attempted in 2009 to hack medical facility computers to retaliate against Anonymous; researcher Wesley McGrew recognized equipment in an uploaded video and helped the FBI identify him, leading to a 110-month sentence.
Passkeys have reached mainstream adoption with 5 billion in active use and 75% consumer enablement, yet most organizations still run passwords in.
FIDO Alliance data shows passkeys hitting major milestones, including 90% consumer awareness and roughly half of consumers using them regularly.
Performance metrics favor passkeys strongly, with a 93% login success rate versus about 63% for password-based authentication, plus documented reductions in support tickets and login times.
Passwords persist not from preference but organizational capacity constraints: 87% of organizations still use passwords while only 2% believe they balance security and experience, and most lack dedicated CIAM engineers.
The pragmatic path is hybrid deployment, introducing passkeys at lower-stakes touchpoints before expanding. This lets teams demonstrate measurable business benefits internally before committing to a full transition.
Time to revoke measures how long an exposed credential stays usable after its validity is confirmed.
The article introduces time to revoke as a security metric for CISOs, defined as the interval between the validation timestamp and confirmed invalidation.
Organizations should track median and P90 time to revoke, the percentage of secrets revoked within SLA, owner coverage, and the number of incidents requiring manual escalation.
These measurements help security teams shrink exposure windows by separating detection from actual credential neutralization, addressing the limitations of traditional MTTD and MTTR metrics.
Fortra's Bob Erdman makes the case for disciplined threat intelligence sharing through ISACs, peers and law enforcement.
No security team can see everything, so structured information sharing lets organizations augment their own visibility with intelligence from peers.
Sharing happens CISO to CISO, between companies and law enforcement agencies, and through industry ISACs, each governed by codes of conduct, NDAs and the Traffic Light Protocol that defines how far information may travel.
Useful sharing is actionable and relevant to the group, such as fraud accounts among financial institutions or impersonation phishing in aviation. Uncertainty around renewal of the US Cybersecurity Information Sharing Act's legal protections may narrow sharing to the most trusted partners.
Recommended steps: join a relevant ISAC, adopt TLP classification, and build relationships with peers and LEAs for rapid escalation.
[fetch failed] A New York Times Magazine long-form feature on a heist targeting a data center.
This New York Times Magazine feature appears to recount a heist involving a data center, a category of crime that has grown in prominence as data centers concentrate enormous value in GPUs, servers, and the data they hold.
Physical security of data center facilities has become a rising concern alongside cyber risk, given the AI-driven hardware boom and the resale value of high-end computing equipment.
The piece is presented as narrative magazine journalism rather than a technical security analysis. Content could not be retrieved directly, so this summary is inferred from the URL and publication context.
Ping Identity's CISO discusses passion, leadership, and AI concerns driving cybersecurity careers.
Russ Kirby, CISO at Ping Identity, attributes his career trajectory to passion for cybersecurity and a willingness to seize opportunities.
He emphasizes that genuine enthusiasm matters more than certifications when building teams, and advocates not letting perfect be the enemy of good.
Kirby views the CISO role as primarily proactive despite security's reactive nature, using vulnerability management to prevent exploitation.
He counters burnout through job enjoyment and peer support, protecting team members from unreasonable demands. Rapid AI adoption keeps him alert, though he frames it as part of cybersecurity's ongoing cycle of managing emerging technological risk.
Credential stuffing exploits password reuse to hijack accounts, and eliminating reusable passwords via passkeys is the most effective defense.
Credential stuffing accounts for roughly one in five login attempts on a typical service according to Verizon's 2025 DBIR.
The attack works because users reuse passwords widely, with only 49% of typical passwords being distinct.
Account takeover breaches are costly and hard to detect since attackers use legitimate credentials, taking around 292 days to identify and contain. Layered defenses such as phishing-resistant multi-factor authentication, breached-password detection, and bot detection reduce risk.
However, deploying phishing-resistant passkeys that eliminate shared secrets entirely is the most fundamental fix for credential-based account takeover.
Organizations need AI Bills of Materials to inventory AI components as the foundation for effective AI security and governance.
AI investment is surging, with 86% of C-suite leaders planning increased spending in 2026, but security practices have not kept pace and a gap persists between confidence in AI governance and actual formal processes.
An AIBOM extends the Software Bill of Materials concept to document the full AI stack, including large language models, training data, and external data sources.
Keeping AIBOMs accurate is difficult in fast-moving development environments, yet it is critical for identifying vulnerabilities as exploitation timelines shrink after public disclosure. Emerging government and industry guidance is likely to make AIBOMs increasingly important.
Organizations that already maintain clear component inventories will be better placed to manage security, compliance, and operational risk.
Researchers warn CSS alone is now powerful enough to build working keyloggers and exfiltrate webmail data.
PortSwigger web security researcher Gareth Heyes told Black Hat USA 2026 that CSS has grown powerful enough to function almost like a programming language, and that CSS plus HTML alone, with no JavaScript or attachments, suffice to build a working keylogger.
CSS-based attacks take more effort than traditional email exploits but bypass script execution controls and attract far less scrutiny. Users cannot turn CSS off, so responsibility falls on webmail vendors to isolate messages and sanitize CSS so it cannot break out of a message's trust boundary.
Heyes found hijacking bugs and advanced attack methods in well-known platforms, and reports that some vendors fixed the issues quietly after initially dismissing his disclosures.
US and 13 allied nations released updated SBOM minimum elements guidance to reflect evolving supply chain security needs.
Government agencies from the US and 13 allied countries released refreshed guidance on Software Bill of Materials (SBOM) minimum elements, building on the 2021 NTIA framework.
The update introduces new components like Component Hash Algorithm, Author Signature, and Tool Version while removing Access Control and SWID Tags elements.
The guidance emphasizes that SBOMs serve as key building blocks of software security and supply chain risk management, enabling organizations to better understand their software supply chain and manage vulnerabilities.
The authoring agencies note that tooling advancements now allow organizations to demand more detailed supply chain information than previously possible.
MIND launches autonomous AI agents to automate time-consuming DLP tasks and reduce security team workload by 80%.
MIND introduces five AI DLP Agents-Custom Classifier, Issue Investigator, Policy Producer, Rapid Response, and Reason Reviewer-that automate the most labor-intensive aspects of data loss prevention programs.
These agents work autonomously through MIND's Model Context Protocol interface, allowing security teams to direct them using plain language from existing AI clients.
Customers report an 80% reduction in DLP program effort and 25-50% time savings per incident investigation, enabling security teams to focus on strategic decisions rather than routine operational tasks.
Vulnerability prioritisation, not patching everything, is the route to cyber resilience amid overwhelming UK threat volumes.
Alexander Leslie of Recorded Future argues that vulnerability prioritisation is becoming crucial to strengthening cyber security and resilience.
The Cyber Security Breaches Survey 2025/2026 found UK businesses experienced 5.19 million cyber crimes in the last 12 months-an average of over 14,000 incidents per day.
Security teams cannot patch every vulnerability or investigate every threat, so cyber resilience is no longer about fixing everything but about fixing what matters most, in a timely way, before attack intent becomes a breach. Prioritisation enables teams to consistently identify and address the highest-risk threats.
Forescout researchers disclose 15 TP-Link Omada flaws that question blind trust in zero-touch provisioning.
At Black Hat USA 2026, Forescout Vedere Labs researchers Stanislav Dashevskyi and Francesco La Spina revealed 15 vulnerabilities in TP-Link's Omada software-defined networking ecosystem.
The bugs fall into four buckets: device hijacking and spoofing, client-side code execution, information disclosure, and chain-of-trust compromise.
Because TP-Link serial numbers are sequential and predictable, an external attacker could impersonate a device about to be adopted, win a race condition, and authenticate with default admin credentials to obtain cleartext configuration and secrets.
The researchers argue zero-touch provisioning collapses many trust decisions into one automated flow, making the provisioning server a high-blast-radius target.
Agentic artificial intelligence is creating enough risks for organizations to demand a security reframe.
This Dark Reading piece contends that agentic AI systems are inherently difficult to tame because they act autonomously, chain tools, and make decisions without step-by-step human approval.
Rather than seeking complete control, security leaders are encouraged to ask better questions about what agents can access, what actions they can take, and how their behavior is monitored and constrained.
The framing suggests evaluating agentic deployments through governance, identity, and blast-radius questions instead of assuming traditional controls apply.
Exploitation now precedes patch availability, making delayed patching a board-level business risk rather than a backlog problem.
Mandiant M-Trends 2026 puts mean time-to-exploit at roughly 7 days, meaning exploitation typically precedes patch availability, versus a 63-day buffer in 2018, while defenders take about 14 days to remediate half of CISA KEV entries.
Costs stack up across breach likelihood (vulnerability exploitation was the initial vector in about 20% of 2025 breaches, 60% with a patch already available), direct exposure (IBM's $4.88 million average), ransomware amplification (about a third of attacks), and hidden operational drag.
Roughly 81% of CIOs and CISOs admit deliberately delaying patches to protect operations.
The three structural misses are prioritizing by CVSS instead of exploitability, treating patching as periodic, and coverage gaps across hybrid estates.
Employee trust in AI assistants is creating a new security perimeter as staff overshare sensitive company data with conversational AI tools.
Widespread generative AI adoption in workplaces is creating a perfect storm of security risk that goes beyond technical threats like prompt injection and data poisoning.
The deeper problem is human psychology: employees conditioned to trust personal AI tools inadvertently expose sensitive information at work. Research cited shows 78% of users bring their own AI tools to work and 43% send sensitive data to AI applications without employer knowledge.
Samsung's 2023 incidents, where employees leaked proprietary code and business intelligence into ChatGPT, illustrate the consequences.
Experts recommend governance controls such as data compartmentalization, access restrictions, and telemetry monitoring, treating AI tools as corporate digital assets requiring oversight.
Mandiant warns that unauthenticated, publicly exposed serverless functions are becoming a major cloud attack vector amid rapid AI adoption.
Google Mandiant has identified a growing threat from publicly accessible serverless applications that lack proper authentication controls.
The proliferation of AI-driven workflows such as chatbots and image generation tools has accelerated deployment of these vulnerable functions.
Attackers exploit common flaws like file inclusion and command injection for initial access, then escalate by extracting secrets and stealing service account credentials to move laterally through cloud environments.
Mandiant recommends security scanning and code review in CI/CD pipelines, sandboxing AI experimentation, and least-privilege access controls. Public-facing services should be hosted in isolated projects with restricted network traffic as part of a defense-in-depth strategy.
Guide comparing MFA solutions including Silverfort, Microsoft Entra ID, Okta, and others as alternatives to Cisco Duo.
This article examines leading MFA alternatives to Cisco Duo, which has limitations in protecting legacy systems and on-premises infrastructure.
Key selection criteria include user experience, offline MFA support, adaptive authentication, integration capabilities, and robust reporting.
The comparison covers seven solutions: Silverfort (comprehensive identity-layer MFA), Microsoft Entra ID (cloud-centric), Okta MFA, ManageEngine ADSelfService Plus, Thales SafeNet, IBM Verify, and SecureAuth Arculix, each with distinct strengths for different organizational needs.
AI training costs are small next to inference expenses, which compound with user growth and dominate spending.
While training a frontier model costs roughly $100 million, serving it at scale costs hundreds of millions monthly.
At ChatGPT-level usage with 100 million daily users, inference spending overtakes training cost in nine days and reaches 97.7% of total expense within a year. Price cuts and efficiency improvements matter far less than the rate of user growth.
The conclusion is that success in AI deployment depends on controlling inference cost, making serving efficiency the real competitive moat rather than training budget.