Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Every secure web gateway on the market works the same way: traffic matches a condition. A terminal action fires. Allow, Block, Isolate, Log. This model has been the foundation of network security for nearly 30 years, and it handles the common case well. But it has a ceiling, and customers with complex environments hit that ceiling regularly.

Sophos ITDR now delivers deeper AI identity visibility, expanded Microsoft support, faster response, and seamless deployment. Identity has become one of the most targeted attack surfaces in cybersecurity, with attackers increasingly relying on stolen credentials, compromised sessions, excessive privileges, and identity misconfigurations to gain access.

AI is changing how software gets built. Coding agents produce more code than teams can review, and current models introduce several times more vulnerabilities per line than human developers. Many of those flaws involve business logic, access control, and authentication, areas where pattern-based scanners have limited visibility.

Can AI agents fix vulnerable dependencies without breaking the build? The fix itself is rarely the mystery. Over six months in 2026, Snyk Open Source recorded 459 million vulnerability findings across ~300,000 organizations. 94% of these vulnerabilities had a known fixed version, yet only about 10% had been resolved.

On October 14, 2026, Bank of America's CEO said the bank brought in 1,000 contractors to patch software flaws surfaced by frontier AI models, including Anthropic's Mythos. "We put on 1,000 contractors to help us do the patching work in the second quarter," Brian Moynihan told CNBC. Those contractors work on top of the 3,000 people the bank already has in that area (ITPro, The Next Web). That is what the new normal looks like.

In the first post in this series, Wade shared how our team laid the foundation for using AI in detection engineering. The short version is that an LLM doesn't know your stack. Without documentation and workflow context, it can produce plausible results that are difficult to trust, regardless of which model you use.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break!

Security teams face a demanding balancing act: keeping pace with evolving threats, managing complex environments, and demonstrating how their investments reduce risk. At LevelBlue, helping organizations meet those challenges is central to our work. That commitment is reflected in Frost & Sullivan’s recognition of LevelBlue as its 2026 Global Company of the Year in Managed Security Services.

A coding agent on a laptop runs as the developer. It reads the same keychain, carries the same tokens and appears in every downstream log under the same name. The identity record is accurate and it cannot answer the question governance needs answered. ‍ Every control keyed to identity therefore operates on a merged subject.

Interaction monitoring covers four of the ten risks in the 2025 Top 10 for LLMs and generative AI applications well, three partially and three not at all. The split is not arbitrary, and the line it follows tells a buyer more than the coverage count does. ‍ Monitoring observes systems being used. Several entries on the list describe defects in how a system was built, which no amount of observation at the point of use will surface.

Most register comparisons rank products on fields, workflow and integrations. A more useful test is which decisions the register can settle, because a register that cannot settle a decision is a record of one made elsewhere. ‍ Five decisions get asked of a register. Which risk to treat first, how much to spend treating it, whether to accept it, whether to transfer it, and whether the treatment worked.