Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

An employee pastes a customer contract into ChatGPT to summarize it. Nothing gets attached, nothing crosses the network in a file, and no alert fires. That is the gap most LLM security advice does not address. Prompt security is not the same problem as prompt injection or model hardening. It is a data problem consisting of what enters a prompt, what an agent does with it, and what comes back out.

Security teams researching CTEM vendors in 2026 tend to run into the same problem. Search results mix analyst reports, vendor marketing, and outdated "top 10" lists that treat the framework like a single tool category instead of the five-stage program Gartner designed it to be. This guide breaks down what CTEM actually covers, where Gartner's research currently stands, and which vendors are worth evaluating depending on where your program needs the most help.

Agentic attacks are changing the speed and scale of the defensive challenge. This post explains the challenge, Cato’s new purpose-built capability for addressing it, and what we observed in an end-to-end demonstration.

AI governance reduces security risk by enforcing least-privilege access, protecting the data and credentials AI systems handle and making every AI action auditable. This matters because most organizations deploy AI faster than they can govern it. Employees adopt unsanctioned tools, and autonomous AI agents are created under existing user identities. Each one adds unmonitored machine identities that expand your attack surface – the exact gap that governance closes.

Two weeks after Hugging Face disclosed an AI-driven intrusion into part of its production infrastructure, Anthropic said it had found three incidents from its own cyber evaluations. Hugging Face traced its compromise through a data-processing pipeline, where a malicious dataset abused a remote-code dataset loader and a template-injection issue in a dataset configuration.

The EU AI Act reached a turning point this summer, and the headlines got it half right. Obligations for high-risk AI systems were postponed to December 2027 under the Digital Omnibus, adopted in June 2026. The transparency rules under Article 50 were not postponed, and they apply from August 2, 2026. ‍ Enterprises reading spring 2026 guidance are working from a timeline that no longer exists, and enterprises reading the headline about a delay may believe nothing is due.

A support coordinator has a difficult letter to write. The customer record is open in one tab, a consumer AI assistant in another, and the deadline is this afternoon. She selects the record, copies it, pastes it into the prompt box, and asks for a polite draft. Thirty seconds later she has a good letter and a regulatory problem, and nobody in the organization knows about either. ‍ The sequence below traces that single action through to its consequences.