Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Most organizations can't answer three basic auditor questions simultaneously: where PII lives, who can access it, and how it's protected. One-off scans and manual classification go stale as data volumes grow. A repeatable, eight-step PII protection program from initial discovery through ongoing governance is what separates a defensible compliance posture from a snapshot that collapses under scrutiny.

Most AI deployments run without formal controls over what data they can reach, what decisions they make, or how they behave in production, yet regulators now require answers to all three. AI governance tools address these risks across three distinct layers: model governance, data access governance, and observability. Most enterprises need coverage across more than one layer. AI governance has shifted from a voluntary best practice into a formal compliance requirement.

At the World Economic Forum cyber meeting in Geneva recently, I had an interesting conversation with Vinh Nguyen, who is a strategic security advisor and Senior Fellow for AI at CFR. I wanted to know from him how he sees runtime governance in agentic AI working out practically and what approaches actually work. One of the challenges he mentioned was that yes, we need runtime governance to provide continuous and real time assurance that agents are doing what they are supposed to be doing.

Your last pentest probably took 2 weeks, cost 5 figures, and tested a fraction of your actual attack surface. Meanwhile, your team shipped 47 deployments in the same window, with each one almost completely untested for security. That gap between how fast you ship and how slowly you test is exactly where autonomous AI agents for penetration testing come in, especially with hackers getting smarter and faster each day (They are not using AI to summarize PDFs!).

Security teams are drowning in vulnerabilities. FIRST’s 2026 Vulnerability Forecast projects a median of approximately 59,000 new CVEs this year, following the 48,185 released in 2025. That is equivalent to more than 130 new disclosures each day. No team, big or small, regardless of budget, can patch all these vulnerabilities. Given no deliberate way of deciding what to patch first, organizations waste resources on low-risk findings and allow truly dangerous exposures to go unpatched.

As more businesses switch to online operations, it becomes increasingly important to have safe, secure websites. Cyber attackers are targeting websites to steal sensitive data, demand ransom payments, and disrupt business operations. To prevent this, organizations must invest in website penetration testing. Penetration testing, also called pentesting, is a process of simulating cyberattacks to identify security gaps in a website.

By rewriting our secret detection engine in Rust, we made our engine more than three times as fast. But not without making it four times slower along the way.

CVE-2026-0257 is an authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software that lets a remote attacker forge an authentication override cookie and establish an unauthorized VPN connection. The vulnerability carries a CVSS base score of 7.8 (High). It is tracked under CWE-565, reliance on cookies without validation and integrity checking. Exploitation is unauthenticated and requires no user interaction.