Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Short answer. AI data leakage now includes policy-enforcement failure, not only undetected values. When a protection layer assigns a sensitive value the wrong specific data type, downstream masking, retention, and access rules select confidently on a false premise. The control exists and runs. It is pointed at the wrong category of data.

In my last post I used an AI agent to work out the blast radius of a compromise, and the agent found something I had not been looking for: other AI agents inside the blast radius. On an administrator's workstation, AI coding assistants were running Model Context Protocol (MCP) servers that the administrator had set up, and those servers held privileged credentials for security tools and other administrative resources.

Key Takeaways: Reachability determines exposure. Systems with the same vulnerability can face different levels of risk depending on accessible attack paths and existing protections. Security configurations determine which protections apply. Firewall rules and inspection settings can leave vulnerable systems exposed even when exploit-blocking controls are available. Compensating controls can mitigate vulnerabilities.

When we announced that MCP Governance is generally available in Evo Agentic Development Security (ADS), the most common follow-up was practical: "Great. Where do I start on Monday?" It’s a fair question; across 10,000 developer environments, Snyk found 4,524 unique MCP servers in active use, and 1 in 12 developers with an MCP server installed had a confirmed high or critical finding.

31,088 secrets in Claude Code’s.claude/settings.local.json on public GitHub, 5,343 valid at detection, 23,276 repositories. 613 more in Docker Hub images, 99 valid. Validity, timeline, Docker Hub, who is affected.

ARTEX was one framework. The field around it holds about 45 more, each an open-source project that wires a language model into a loop that runs tools and acts on their output. We read the code and used Shodan to find every one accessible. Four ship a secret scanner wired to the agent by default. Dozens of operator consoles answered a Shodan query today. This post is the catalog: where each tool's code lives, what it ships for hunting secrets on public GitHub, and how it looks on the Internet.

Exposure management starts with reachability. Can an attacker reach the vulnerable service? If so, what protection applies along that path, and what can the team change now? Those questions turn a critical PHP2Shell finding into a practical prioritization and mitigation decision. Reach’s new app for ServiceNow Unified Security Exposure Management (USEM) brings current and achievable protection assessments and mitigation recommendations into the vulnerable-item workflow.

Accelerating security solutions for small businesses‍ Tagore offers strategic services to small businesses. A partnership that can scale‍ Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate. Standing out from competitors‍ Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market.