Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Who actually controls your data, your infrastructure, and the software your organization runs on? That question is on the agenda of every CIO and DevOps lead. Digital sovereignty has become a strategic priority, but what does it look like in practice? And why should IT teams care beyond the policy headlines?

If you're shipping software these days, there's a good chance an agent is in your development workflow. In fact, 84% of software developers say they use AI to write code, open pull requests, and push to production regularly; that number is only expected to grow. Some teams have gone further: they're designing loops, or recurring systems that direct agents continuously, without a human writing a new prompt at each step.

We ran 300 vulnerability-finding scans to measure how repeatable an agentic LLM security review is on the same code, prompt, and harness. The headline result is not that one scanner "wins" a self-referential leaderboard. It is that LLM security findings are unevenly repeatable: reference-matched findings were stable, but extra-model reports varied widely from run to run.

AI did not create data exposure. It changed the consequences of it. Sensitive data, excessive permissions, and broad access policies have long existed across cloud environments. In the AI era, those issues are no longer passive governance concerns. They directly influence what AI users, copilots, agents, and applications can access, process, and expose. AI has turned a posture problem into operational risk. The challenge is not simply that more data is available.

On June 2, 2026, President Trump signed Executive Order 14409, "Promoting Advanced Artificial Intelligence Innovation and Security." The framing is innovation first. But for federal network and security teams, the practical reality is a short, specific timeline to harden government systems, with AI now active on both sides of the cybersecurity equation. The deadlines are not aspirational.

The developers and engineers here at 1Password are always working to improve our products. With all the active development to introduce features, fix bugs, and enhance the overall user experience, numerous code changes go into every release. We strive to ensure each iteration is better than the last and that new code doesn’t introduce vulnerabilities. A key part of this process is our Product Security (ProdSec) team’s review of all code changes that may have security implications.

For oil and gas operators, operational technology (OT) is a lifeline, sometimes literally. OT systems are essential to maintaining not just reliable and efficient operations but also safe environments for workers. In upstream production sites, offshore platforms, pipelines, terminals and refineries, critical processes depend on a complex network of OT assets that organizations use to control and optimize operations. Cybersecurity programs for OT often focus heavily on prevention.

Under normal conditions, experiencing our digital reflection can feel surreal or even uncomfortable. So first off, we commend our participating execs for allowing us to use their publicly available personal data to create live audio/visual doppelgangers – as we found out just how advanced, believable, and potentially malicious our identity cloning tools currently are.

Identities, permissions, exposed resources, and sensitive data can all contribute to risk regardless of whether they reside in AWS, Microsoft Azure, or Google Cloud. However, security teams often encounter uneven visibility and coverage across disparate cloud environments, and face difficulty in consistently understanding risk across a multi-cloud estate.

Memorandum M-26-14 from the Office of Management and Budget (OMB) marks a significant evolution in federal cybersecurity guidance, establishing a new risk-based framework for logging and network visibility across the United States federal government. The memo replaces the prescriptive requirements of Memorandum M-21-31 with an approach that emphasizes continuous monitoring, threat detection, investigation, and forensic readiness.