Articles by Category: Security_compliance

The next layer of AI security

2026-03-19 00:00
In June 2025, Microsoft addressed a serious zero-click vulnerability in Microsoft 365 Copilot, known as EchoLeak. This flaw allowed attackers to extract sensitive data without user interaction. The incident highlights a crucial point: even with proper authentication and authorization, AI systems can produce harmful outcomes due to how they process untrusted content. Researchers have identified systemic risks related to prompt injection across AI-assisted workflows. As AI systems evolve,...
info@1password.com (Jacob DePriest, Nancy Wang, Jeff Malnick)

Your AI incident response success relies on security architecture

2026-03-18 21:08
Understanding AI's impact on security requires a clear grasp of data protection in enterprise contexts. Data has a lifecycle: collected with consent, processed for specific purposes, retained for set periods, and deleted when necessary. This lifecycle is crucial for compliance with regulations like GDPR and CCPA. Traditional security systems enforce these lifecycles through controls like retention policies and access restrictions. However, AI challenges these assumptions, making incident...
Yuri Kramarz

Securing Production Debugging in Kubernetes

2026-03-18 18:00
🔒 During production debugging in Kubernetes, broad access can lead to challenges in auditing and security. The article highlights three key practices for improving security: 1️⃣ Implement least privilege with RBAC. 2️⃣ Use short-lived, identity-bound credentials. 3️⃣ Utilize a just-in-time access gateway for secure debugging. These strategies help control access and ensure sessions are temporary and accountable. #Kubernetes #DevOps #Security #RBAC #CloudNative

Chainguard has a fix for the open source packages your AI agents keep grabbing

2026-03-18 16:24
🚀 Chainguard is tackling a growing security issue in software development caused by AI coding assistants. These tools often rely on outdated training data, leading to the use of older, insecure library versions. 🔍 As AI accelerates code generation, attackers are also leveraging AI to exploit vulnerabilities faster than ever. A recent breach of the Trivy project highlights this risk, showcasing how AI can automate the discovery of misconfigurations. 🛡️ To combat these challenges, Chainguard...
Darryl K. Taft

Cisco and Microsoft: Co-engineering Security for Cloud and AI Journeys

2026-03-18 14:58
Cisco and Microsoft are collaborating to create a unified security solution tailored for cloud and AI environments. This partnership aims to simplify procurement and enhance protection for customers and partners. 🌐🔐 Key innovations include native Azure solutions like Isovalent and AI Defense, along with integrations of Duo and XDR within the Microsoft Security Store. This approach addresses security challenges across diverse environments and helps organizations capitalize on new...
Brian Feeney

The security hole that every enterprise AI deployment has (but nobody looks for)

2026-03-17 16:42
🌐 AI in enterprise software is growing, but security risks are often overlooked. Developers must recognize that AI agents can access sensitive data and execute actions in real-time, potentially exposing vulnerabilities. Virtue AI’s new Agent ForgingGround offers tools to simulate adversarial attacks, helping identify these risks before deployment. Dynamic agents require ongoing security testing to prevent misuse and unauthorized actions. #Cybersecurity #AI #EnterpriseSoftware #DataProtection...
Adrian Bridgwater

Cisco Access Manager: Identity-Based Access Control That Lean IT Teams Can Actually Deploy

2026-03-17 12:00
🌐 Cisco Access Manager simplifies identity-based access control for lean IT teams using Meraki. It eliminates the complexity of traditional solutions, offering a cloud-native approach that integrates seamlessly into the Meraki Dashboard. This ensures every connection—whether employee, guest, or IoT—is authenticated based on identity, aligning with zero trust principles. Learn more about enhancing network security without the operational burden. 🔐✨ #CiscoAccessManager #IdentityAccess...
Amith Ronad

AI use cases for security analysts

2026-03-17 00:00
AI is reshaping cybersecurity for both attackers and defenders. In 2025, generic threats surged by 15.5%, as adversaries utilized LLMs to create malware efficiently. On the defense side, AI tools like behavioral analytics and anomaly detection are enhancing real-time threat identification and response. Elastic Security is integrating AI into SOC workflows, minimizing alert noise and prioritizing critical threats. To effectively implement AI, organizations should audit tools, automate high-...
Source: Elastic Blog
Joe DeFever

Secure Your AI: Stop Managing API Keys by Hand

2026-03-17 00:00
🚀 Building AI agents can be straightforward, but managing API keys securely is complex. Auth0’s Token Vault and CIBA offer solutions for efficient token management and secure authorization without manual oversight. This ensures agents can execute tasks seamlessly while keeping sensitive information safe. Discover how to simplify your AI agent's architecture and enhance security. 🔒✨ #AI #TokenManagement #Auth0 #Cybersecurity #TechSolutions
Source: Auth0 Blog

Securing Enterprise Agents with NVIDIA OpenShell and Cisco AI Defense

2026-03-16 20:30
🚀 Enterprise Autonomous Agents are transforming software capabilities with NVIDIA’s Open Source AI Runtime and Cisco AI Defense. These agents are active, managing configurations and compliance workflows. However, without proper governance, they pose risks. NVIDIA OpenShell provides essential safeguards, while Cisco AI Defense ensures agents operate within set policies. Together, they establish trust and security in enterprise environments. #AI #CyberSecurity #EnterpriseSolutions #Innovation...
Vikram Varakantam

Cursor built a fleet of security agents to solve a familiar frustration

2026-03-16 18:17
🚀 Cursor has developed a fleet of AI agents to enhance security within its codebase. This initiative addresses the limitations of traditional security tools that struggle to keep pace with rapid code changes. Travis McPeak, Head of Security at Cursor, highlights the need for precise monitoring to avoid irrelevant alerts and missed critical changes. The new agents can analyze code changes more effectively, focusing on meaningful insights. Cursor has released templates for four security agents:...
Frederic Lardinois

NanoClaw and Docker team up to isolate AI agents inside MicroVM sandboxes

2026-03-13 19:26
🚀 Exciting news in AI security! NanoClaw has partnered with Docker to enhance the safety of AI agents by isolating them within MicroVM sandboxes. This collaboration aims to address the security flaws associated with OpenClaw by providing a more secure, minimalistic runtime environment. Docker's new Sandboxes allow each agent to operate in its own lightweight MicroVM, ensuring actions are confined and do not affect the host system. This approach enhances protection against potential...
Steven J. Vaughan-Nichols

Patch Me If You Can: AI Codemods for Secure-by-Default Android Apps

2026-03-13 16:00
🚀 Meta's Product Security team tackles the challenges of mobile security by developing secure-by-default frameworks for Android. They aim to make security updates easier for developers, using generative AI to automate code migration at scale. This innovative approach helps address vulnerabilities efficiently across vast codebases. Tune in to the latest episode of the Meta Tech Podcast to hear insights from the team! 🎧 #MobileSecurity #AI #MetaTech #Podcast #Engineering

Secure Agent Execution with NanoClaw and Docker Sandboxes

2026-03-13 12:01
🚀 Agents are evolving into powerful, personal AI assistants that automate tasks and workflows. 🔒 NanoClaw, a lightweight framework, is now integrating with Docker Sandboxes to ensure secure agent execution. Each agent runs in a disposable MicroVM, enhancing isolation and security. 💡 This shift emphasizes transparency and controlled environments, allowing teams to inspect code easily while minimizing risks. With this approach, agents can operate autonomously without compromising security. #AI...
Source: Docker Blog
Jin Kim

Zero trust GitOps: Build a secure, secretless GitOps pipeline

2026-03-13 07:01
🔍 Discover how OpenShift GitOps enhances security with short-lived tokens! This integration with the external secrets operator allows for secure management of credentials, minimizing the risk of breaches. Short-lived tokens provide limited access and ensure continuous authentication. Learn more about this innovative approach to secure GitOps pipelines! #OpenShift #GitOps #Cybersecurity #DevOps #Kubernetes
Nick Png

Before you let AI agents loose, you’d better know what they’re capable of

2026-03-12 20:22
🌐 Agentic AI systems can shift enterprise staff roles from execution to oversight and strategy. However, this shift carries significant risks. 🔍 Key concerns include loss of human control, security vulnerabilities, and unpredictable actions that may be hard to reverse. An early mistake can escalate quickly, complicating accountability. 🤖 As the field is new, understanding and managing these risks is essential. Testing and sharing knowledge among IT professionals are crucial for safe...
Charles Humble

SurePath AI advances MCP policy controls to tighten the cable on AI’s USB-C

2026-03-12 19:54
AI governance is crucial as the technology continues to evolve. SurePath AI has introduced its MCP Policy Controls to enhance security in AI interactions. This new service aims to manage which Model Context Protocol (MCP) servers can be used, addressing potential risks like data leakage and supply chain attacks. As adoption accelerates, oversight remains a challenge. SurePath’s co-founder emphasizes the need for secure management of MCP tools to prevent misuse within organizations. 🔒💡🛡️...
Adrian Bridgwater

Why AI-driven operations are pushing governance beyond a compliance issue and into an operational priority

2026-03-12 16:21
📊 AI adoption is accelerating, with 95% of US companies now using generative AI. Organizations are experimenting with AI agents, which enhance operational efficiency. However, as deployment speeds up, governance becomes crucial to manage risks effectively. A strong framework should focus on: 1️⃣ People-first governance 2️⃣ Clear guardrails for AI actions Ensuring human oversight and defined responsibilities will help maintain control and accountability in AI operations. #AIGovernance...
João Freitas

Your Model’s Memory Has Been Compromised: Adversarial Hubness in RAG Systems

2026-03-12 16:00
🚨 AI security is facing significant challenges with prompt injections and jailbreaks. These tactics can trick models into bypassing safeguards or leaking sensitive information. RAG systems, which allow AI to access external data, introduce new vulnerabilities known as adversarial hubness. This can lead to harmful content influencing search results. Cisco has responded by launching the Adversarial Hubness Detector to help address these security gaps. Stay informed about AI security! 🔐🛡️ #AI...
Idan Habler

Deprecating the DHE cipher suite for TLS connections

2026-03-12 13:00
On June 30, 2026, Vercel will discontinue support for the DHE-RSA-AES256-GCM-SHA384 cipher suite. After this date, TLS 1.2 clients must use one of Vercel's six supported cipher suites to connect. Modern clients using TLS 1.3 remain unaffected. Ensure your integrations comply by checking TLS client compatibility. 🔒💻 #CyberSecurity #TLS #Vercel #TechUpdates #CipherSuites
Source: Vercel Blog
Matthew Stanciu

4 Ways Businesses Use CrowdStrike Charlotte AI to Transform Security Operations

2026-03-12 00:00
🚀 Discover how CrowdStrike Charlotte AI is transforming security operations for businesses! Charlotte AI functions as an embedded security analyst, enhancing alert triage and threat investigation for security teams struggling with rising alert volumes. Organizations like Blackbaud have reported a 3x improvement in mean time to resolve (MTTR) by integrating this AI into their workflows, allowing analysts to focus on critical tasks. Learn more about how Charlotte AI is changing the game!...
Scott Wotring

The National Cyber Strategy for America: 3 takeaways for government security leaders

2026-03-12 00:00
🚀 The White House's March 2026 "Cyber Strategy for America" emphasizes the need for AI-driven cybersecurity. Key points include: 1️⃣ Adoption of modern security tech with fewer barriers. 2️⃣ Integration of agentic and generative AI. 3️⃣ Unified visibility across IT and OT environments. Elastic's open-source platform is positioned to assist agencies in implementing these pillars effectively. #Cybersecurity #AI #Government #Innovation #Elastic
Source: Elastic Blog
John Harmon

Mitigating The Risk of Prompt Injection for AI Agents on Databricks

2026-03-11 19:00
Databricks has introduced measures to address the risk of prompt injection for AI agents, part of their AI Security Framework (DASF) launched in 2024. The article discusses strategies to enhance security and trust in AI systems, focusing on safeguarding against potential vulnerabilities. For those interested in AI security, this development is significant. 🔒🤖 #AISecurity #Databricks #AITrust #Cybersecurity #TechNews

Cisco LiveProtect: Bringing eBPF-Powered Protection into Network Infrastructure

2026-03-11 17:09
🚀 Cisco LiveProtect is leveraging eBPF-powered technology to enhance security in modern network infrastructure. As cyber threats evolve, traditional methods of securing network devices are no longer adequate. The focus is shifting towards protecting the control-plane software that manages crucial network functions. This innovative approach aims to provide real-time, in-kernel security and address vulnerabilities in network hardware. Learn more about how this technology could redefine network...
Thomas Graf

The 2 failures with AI coding that are creating security bottlenecks

2026-03-11 16:15
AI coding tools have not met expectations, as a recent GitLab survey reveals. While over one-third of code is AI-generated, quality control and security vulnerabilities are major concerns for developers. ⚠️ As AI contributes to larger codebases, security teams face overwhelming review demands, creating bottlenecks. 🚧 Attackers are exploiting these vulnerabilities faster than teams can respond. To address these challenges, organizations must rethink their approach. It's important to integrate...
Julie Davila

Gain web control with browser isolation

2026-03-11 12:00
Enhance your organization's web security with Cisco's advanced Remote Browser Isolation (RBI) controls. 🌐 As businesses rely more on web platforms, protecting user interactions is crucial. Cisco's new capabilities offer precise control over how data is handled in web applications, going beyond just blocking threats. Isolation helps keep endpoints secure while allowing safe navigation and interaction with sensitive information. This evolution in security addresses the need for managing data...
Steve Brunetto

Social media impersonation: The brand threat DMARC can’t see

2026-03-10 19:17
Social media impersonation poses a significant threat to brands, as attackers exploit platforms like Facebook, LinkedIn, and Instagram. While DMARC helps secure email domains, it doesn't protect against fraudulent social media profiles that mimic companies and executives. These fake accounts can mislead customers and spread misinformation quickly. Organizations need to enhance their security strategies to address this gap and protect their brand reputation in these critical engagement spaces....
Gabrielle Bridgers

Strengthening Bot Detection with JA4 Signals

2026-03-10 14:42
Auth0 is enhancing bot detection using JA4 fingerprinting to combat sophisticated bots and improve TLS security. By integrating JA4 into their Bot Detection model, Auth0 adds a high-fidelity layer of identification. This helps distinguish between legitimate users and attackers, even when traditional signals are spoofed. JA4 analyzes the TLS handshake, providing a consistent fingerprint regardless of randomization in modern browsers. This approach strengthens security without requiring code...
Source: Auth0 Blog

Investigating multi-vector attacks in Log Explorer

2026-03-10 13:00
🚨 Log Explorer now enables users to identify and investigate multi-vector attacks with 360-degree visibility through 14 new Cloudflare datasets. In cybersecurity, understanding the full landscape is crucial. Cloudflare Log Explorer centralizes logs, allowing security teams to detect and analyze threats efficiently. Key log types supported include website traffic, security events, DNS logs, and more, aiding in rapid forensic investigations. Stay ahead of sophisticated attacks! 🔍💻...
Nico Gutierrez

What’s Holding Back AI Agents? It’s Still Security

2026-03-10 12:59
AI agents are becoming a key focus for organizations, with 95% of surveyed developers prioritizing their development. 🚀 While 60% report having AI agents in production, security remains a significant barrier. 40% cite it as the top challenge, affecting infrastructure, operations, and governance. ⚖️ Organizations seek secure, trustworthy tools to enable scalability and efficiency. Current solutions, like Model Context Protocol (MCP), show promise but are not yet fully enterprise-ready. 🔒...
Source: Docker Blog
Yiwen Xu

Next-gen supply chain security with HashiCorp Vault and Tekton Chains

2026-03-10 09:24
🚀 In the realm of cloud-native development, securing the software supply chain is crucial. High-profile attacks have highlighted vulnerabilities not in applications but in their build processes. 🔑 Key technologies like HashiCorp Vault and Tekton Chains work together to enhance security by providing provenance and integrity for software artifacts. Key benefits include: 1. **Cryptographic integrity** ensures artifacts remain untampered. 2. **SLSA provenance** offers standardized metadata for...
David Cañadillas

Agent Skills: Explore security threats and controls

2026-03-10 07:16
📢 Anthropic has launched Agent Skills, a new functionality now available across various agents, including Goose. This feature allows agents to perform tasks tailored to user needs using structured skills organized in folders. 🔍 The article discusses the importance of managing security threats and access controls with Agent Skills. Key considerations include proper folder permissions, vulnerability management, and the risks associated with executable scripts. 🔒 To mitigate potential risks like...
Florencio Cano Gabarda

Translating risk insights into actionable protection: leveling up security posture with Cloudflare and Mastercard

2026-03-10 05:00
🚀 Cloudflare is set to enhance security by integrating Mastercard’s RiskRecon attack surface intelligence. This partnership will help organizations identify and remediate Internet-facing vulnerabilities effectively. 🔍 With automated monitoring, security teams can discover hidden assets and close gaps before attackers exploit them. Mastercard’s data reveals that companies with improved cybersecurity practices face significantly fewer risks. 💻 The integration will be available for preview in Q3...
Kelly White (Guest author)

March 2026 Patch Tuesday: Eight Critical Vulnerabilities and Two Publicly Disclosed Among 82 CVEs Patched

2026-03-10 00:00
🔒 March 2026 Patch Tuesday has seen Microsoft address 82 vulnerabilities, including eight critical ones. Among these, two were publicly disclosed. The primary risk types include elevation of privilege (56%), remote code execution (20%), and information disclosure (12%). Windows received the most patches (48), followed by Azure (13). #Microsoft #PatchTuesday #CyberSecurity #Vulnerabilities #TechUpdate
Falcon Exposure Management Team

Prompt injection is the new SQL injection, and guardrails aren’t enough

2026-03-09 20:15
🚨 Prompt injection is emerging as a serious vulnerability in AI systems, similar to the early days of SQL injection. In 2024, a job applicant cleverly manipulated an AI screening tool by embedding invisible text in their resume, leading to compliance from the model. OWASP has ranked prompt injection as a top risk for LLM applications for two consecutive years. Unlike SQL injection, no architectural fix is currently available, making it critical to enhance infrastructure defenses. Implementing...
Dr. Giannis Tziakouris

Fixing request smuggling vulnerabilities in Pingora OSS deployments

2026-03-09 14:00
🚨 We have disclosed request smuggling vulnerabilities in the Pingora open source framework, specifically when used as an ingress proxy. The vulnerabilities, identified as CVE-2026-2833, CVE-2026-2835, and CVE-2026-2836, were responsibly reported by Rajat Raghav through our Bug Bounty Program. No impact was detected on Cloudflare’s CDN or customer traffic, but users of standalone Pingora deployments should upgrade to version 0.8.0 for fixes and hardening. For details on how these...
Andrew Hauck

Encrypted Visibility Engine: The Security Analyst’s New Superpower

2026-03-09 12:00
🚀 Cisco Live Amsterdam showcased the Encrypted Visibility Engine (EVE), a significant advancement for security analysts. EVE allows inspection of encrypted traffic without decryption, addressing challenges posed by TLS and QUIC protocols. It identifies client applications through fingerprinting, enhancing visibility into network activity and detecting malicious processes. #CyberSecurity #CiscoLive #EncryptedTraffic #NetworkSecurity #Innovation
Christopher Grabowski

From Firehoses to Flutes – Mastering the Art of Drinking Our OwnChampagne

2026-03-09 12:00
🚀 In cybersecurity, Cisco emphasizes "drinking our own champagne," meaning they rigorously test their security tools in real-world conditions. 🔍 The article shares insights from a Systems Engineer on the challenges of establishing a fully functional Security Operations Center (SOC) in just 48 hours. 🌊 The analogy of the Dutch defense against flooding highlights the importance of layered defenses in cybersecurity. #Cybersecurity #Cisco #SOC #Innovation #TechInsights
Mark Pleunes

From Flood to Focus: Finding Signal in an “Overflow Attempt” Alert Storm

2026-03-09 12:00
🚨 At Cisco Live EMEA, a spike in security alerts prompted an investigation using Cisco XDR, Splunk, Cisco Secure Firewall, and Endace (Zeek). The focus was on distinguishing genuine threats from environmental noise. Cisco XDR effectively grouped related incidents, allowing for quicker validation and tuning of alerts. This process led to the identification of six false positives, which helped suppress 17 additional similar incidents. #CyberSecurity #CiscoLive #ThreatDetection #IncidentResponse...
Bilal Qamar

NanoClaw can stuff each AI agent into its own Docker container to deal with OpenClaw’s security mess

2026-03-07 18:00
🌐 NanoClaw addresses security concerns with OpenClaw by isolating each AI agent in its own Docker container. This approach ensures that agents operate independently, enhancing security measures. 📦 The application uses minimal code rather than large configuration files, allowing for efficient operations. Claude can adapt its code as needed, keeping the overall size manageable. 🔗 However, connecting to platforms like WhatsApp poses challenges due to strict policies. The preferred method for...
David Eastman