Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Enterprise cybersecurity is no longer confined to a fixed network perimeter. Security teams now have to protect users, devices, applications, cloud services, and third-party access across increasingly distributed environments. Attackers are also targeting identities, unpatched systems, exposed services, and gaps in visibility rather than relying on a single attack method. Cybersecurity therefore needs to be treated as an ongoing program, not a project that is completed once and revisited later.

AI coding agents need access to real development context to be useful. They read repositories, modify files, execute commands, call tools, and communicate with external models. Docker Sandboxes gives those agents an isolated environment where they can work without unrestricted access to the developer’s host. But consider a simple scenario. An agent running entirely inside its sandbox reads a credential from a project configuration file and includes it in an otherwise legitimate request to its LLM.

In the recently released 2026 SANS AI in Cybersecurity Survey, nearly two out of three security professionals said they have been given AI-generated guidance that later turned out to be wrong. Not from an experimental tool off in a sandbox, but from systems built into the security stack they were told to rely on. Security teams should not have to live with that.

Every secure web gateway on the market works the same way: traffic matches a condition. A terminal action fires. Allow, Block, Isolate, Log. This model has been the foundation of network security for nearly 30 years, and it handles the common case well. But it has a ceiling, and customers with complex environments hit that ceiling regularly.

Sophos ITDR now delivers deeper AI identity visibility, expanded Microsoft support, faster response, and seamless deployment. Identity has become one of the most targeted attack surfaces in cybersecurity, with attackers increasingly relying on stolen credentials, compromised sessions, excessive privileges, and identity misconfigurations to gain access.

AI is changing how software gets built. Coding agents produce more code than teams can review, and current models introduce several times more vulnerabilities per line than human developers. Many of those flaws involve business logic, access control, and authentication, areas where pattern-based scanners have limited visibility.

Can AI agents fix vulnerable dependencies without breaking the build? The fix itself is rarely the mystery. Over six months in 2026, Snyk Open Source recorded 459 million vulnerability findings across ~300,000 organizations. 94% of these vulnerabilities had a known fixed version, yet only about 10% had been resolved.

On October 14, 2026, Bank of America's CEO said the bank brought in 1,000 contractors to patch software flaws surfaced by frontier AI models, including Anthropic's Mythos. "We put on 1,000 contractors to help us do the patching work in the second quarter," Brian Moynihan told CNBC. Those contractors work on top of the 3,000 people the bank already has in that area (ITPro, The Next Web). That is what the new normal looks like.

In the first post in this series, Wade shared how our team laid the foundation for using AI in detection engineering. The short version is that an LLM doesn't know your stack. Without documentation and workflow context, it can produce plausible results that are difficult to trust, regardless of which model you use.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break!