Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

• Zenity secures ChatGPT Workspace Agents across their full lifecycle, from posture management at build time to detection and response at runtime. • AgentForger showed how a single link could forge an autonomous AI agent that inherits a real employee's identity and access, a risk legacy security tools can't see. • Zenity's AISPM catches the misconfigurations these attacks rely on, such as agents that auto-approve sensitive actions or connect to privileged systems.

A privacy policy that only works in English is not a global privacy policy. It is an English-language policy that a global company happens to be using. That distinction matters more than most teams realize. Enterprises now centralize contracts, HR files, healthcare records, and support conversations from regional offices around the world into a shared AI platform, often assuming that whatever detection and masking logic works for their English-language content will work everywhere else. It does not.

AI models are becoming essential to enterprise innovation, but the sensitive data that powers them is creating new security and privacy challenges. Even when raw training datasets remain inaccessible, attackers may still identify whether specific information was used to train a model through membership inference attacks.

This article was co-written by Zach Rice and Joe Leon, both at Aikido Security. tl;dr Some credentials are meant to be public, but secret scanners still flag them as generic secrets. We wrote suppression rules for the most common ones and reduced false positives by ~2%. These rules now ship by default in Betterleaks. Secrets scanners are built on regular expressions. Each pattern targets a specific credential type, like an AWS secret access key, a GitHub PAT, or a Stripe token.

Accelerating security solutions for small businesses‍ Tagore offers strategic services to small businesses. A partnership that can scale‍ Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate. Standing out from competitors‍ Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market. AI has completely changed how startups build.

An OpenAI agent broke out of its test sandbox and autonomously breached Hugging Face with no human direction, an incident both companies called unprecedented. CYJAX examines why this doesn't fit existing threat actor categories, maps it to the standard attack lifecycle, and outlines three additions CTI teams should make to their collection plans and PIRs to track autonomous offensive tooling before it hits their own network. On 16th July 2026, Hugging Face disclosed that it had been breached.

Bitsight's annual Ratings Algorithm Update (RAU) has been in effect as of July 16, 2026. In preparation, RAU 2026 Preview was made available in April 2026. As in the past, RAU 2026 is an effort to account for the continuous evolution of the threat landscape the Bitsight security ratings seek to quantify. This year's update is focused on modernizing the rating by improving how it is composed from various risk vectors (RVs). In particular, this entails the following.

Locked Shields 2026 brought together more than 4,000 participants from 41 nations for a live-fire cyber defense exercise built around the kind of pressure SecOps teams know well: Critical systems under attack, incomplete context, multiple tools, and no time to waste. For Corelight, the exercise reinforced a practical lesson: In high-pressure defense, network evidence is not just another data source.

Originally published by ChannelPro. There is an ongoing debate in the cybersecurity industry about whether vendors should go directly to customers or instead become a part of a wider partnership network. The standard argument is that consolidation of platforms and AI-driven cost-of-service delivery makes the traditional model of a channel ecosystem redundant. However, this is largely incorrect, at least when it comes to the SMB and mid-market segments where most UK businesses sit.

We discovered this new vulnerability as part of our abandoned-packages research. Despite what seems like a 2-year hiatus, fflate is one of the few popular npm packages that released a fix for the vulnerabilities we found merely using Sonnet-4.6, giving its 50M+ users a chance to upgrade to a safe version.