Volume 343, Issue 3 · 7 articles from 3 issues
Tenable shares the governance framework it uses to let non-technical 'citizen coder' employees build AI-generated apps securely.
Tenable warns that apps built by non-technical employees with AI tools often skip QA and security review, becoming shadow AI assets with vulnerabilities, misconfigurations and weak data protection.
It argues that governance works better than blanket bans, which simply push the activity out of sight.
In Tenable's own multi-tiered framework, departmental AI leaders oversee tool approvals, manage app request queues and track ROI, while citizen coders receive mandatory security and compliance training.
Tenable explains how its Exchange Inspector vets AI agents, skills and MCP servers for the CyberAgents Exchange using OpenAI GPT cyber models.
Tenable describes the Exchange Inspector, the review that listings must pass to earn a vetted tag on the CyberAgents Exchange, an open-source, vendor-agnostic directory of security AI agents, skills and MCP servers.
Each listing passes three gates covering 15 issue types: Tenable One AI Exposure screening for prompt injection and exposed secrets, code and threat model assessment using OpenAI GPT Cyber models, and runtime verification by Tenable researchers.
Three listings are vetted so far, two from Tenable and one from Splunk, and Tenable says SOC Hunter cut its hunt times by 75%.
Tenable says critical infrastructure faces destructive Iran-linked attacks and AI-boosted threats during Cybersecurity Awareness Month.
Tenable reports that critical infrastructure organizations face a particularly daunting risk landscape in 2026, as Iran-affiliated APT groups have attacked US water, energy and government facilities since February, shifting from espionage to destructive attacks.
Attackers are also using AI to gain the know-how to breach complex industrial control systems.
CISA is urging operators to reduce vulnerabilities, replace unsupported legacy devices and prepare rapid recovery plans.
Microsoft patched a record 1,407 CVEs in October 2026, including two zero-days, one exploited in the wild.
Tenable's analysis covers Microsoft's October 2026 Patch Tuesday, which fixed 1,407 CVEs, the second consecutive month to set a record.
Sixty-nine were rated critical, 1,337 important and one low, across 301 products and components, and the release includes two zero-days, one exploited in the wild.
Excel, DNS Server and the Windows Kernel had the most CVEs patched.
Tenable explains why AI agents need their own identity model and how Tenable One secures Microsoft Entra Agent ID.
Tenable argues that treating AI agents as ordinary non-human identities is risky because agents are non-deterministic and take flexible, outcome-driven actions.
Major cloud providers have introduced dedicated agent identity models, and the post examines Microsoft Entra Agent ID.
Tenable says native identity tools offer only basic information about these agents.
It describes how Tenable One Cloud Exposure helps discover agent identities and shares best practices for securing them.
Tenable explains how it trained AI security detectors on nine more languages without a translation model in production.
Tenable explains how it made its AI security detectors natively multilingual, since prompt attacks in other languages are as dangerous as English ones.
It first used a translate-then-detect process but found it added cost and latency.
Tenable instead trained detectors on high-quality multilingual data covering nine additional languages.
The company says the key was keeping data labels intact, because translation can flip a malicious sample to benign or soften it.
Tenable explains how training, AI usage governance and exposure management can help contain fast-spreading shadow AI.
Tenable says shadow AI has grown from employees using personal chatbots and browser extensions into a wide range of complex vectors, including autonomous AI agents.
As part of its Cybersecurity Awareness Month series, it describes how shadow AI spreads across the attack surface unnoticed.
Tenable cites IBM data showing security incidents involving shadow AI assets rose to 43% from 20% last year.
It recommends employee training, AI usage governance and exposure management.