|
By Greg Zemlin
• Zenity secures ChatGPT Workspace Agents across their full lifecycle, from posture management at build time to detection and response at runtime. • AgentForger showed how a single link could forge an autonomous AI agent that inherits a real employee's identity and access, a risk legacy security tools can't see. • Zenity's AISPM catches the misconfigurations these attacks rely on, such as agents that auto-approve sensitive actions or connect to privileged systems.
|
By Rock Lambros
When Hugging Face's security team sat down to reconstruct what had torn through their production infrastructure in mid-July, they had more than 17,000 recorded attacker actions to sort through, spread across a swarm of short-lived sandboxes with decoy activity planted to slow them down. They did what any competent team would do in 2026 and reached for a frontier model to help triage the logs. However, the commercial APIs refused.
|
By Kayla Underkoffler
Every tool in the enterprise security stack was designed to answer a specific question about a specific threat model.
|
By Dina Durutlic
Coding agent security has a framing problem. Most security conversations around these tools center on the wrong question. 'Did the agent have permission to do that?' is a reasonable place to start, but in the context of autonomous AI systems, it's not where the risk actually lives. In Zenity Labs' research into the coding agent threat model, the pattern that keeps surfacing isn't that agents are doing things they aren't allowed to do.
|
By Cinthia Portugal
The discussion during our recent webinar made one thing clear. Security teams aren't asking whether coding agents will become part of the enterprise. They're asking how to adopt them safely. The audience questions focused on practical concerns that many organizations are facing today, from autonomous execution to supply chain risk and governance. Here are the five questions that generated the most discussion.
|
By Cinthia Portugal
Coding agents have become one of the fastest-adopted AI technologies in the enterprise. They help developers write code, debug applications, automate repetitive tasks, and ship software faster than ever before. They also introduce a security challenge unlike anything most organizations have faced. Unlike traditional AI assistants that generate content, coding agents take action.
|
By Keren Katz
A few years ago, I was sitting across from a security leader at a large enterprise. They had just deployed their first wave of AI agents. When I asked how they were thinking about the security of it, they paused for a moment and then said something I haven’t forgotten. I felt that. Not just as a researcher, but as someone who had been in enough of those rooms to know it was not one person’s gap. It was the whole industry’s gap.
|
By Greg Zemlin
Customer telemetry shows how AI agents behave in a limited set of production environments and what risks they carry. Vulnerability research surfaces how those environments can be attacked. Both sources are valuable, but neither shows actual attacker behavior or how quickly they operationalize a new vulnerability once it's public.
|
By Cinthia Portugal
Anthropic’s Claude Tag represents a meaningful shift in how AI agents operate inside the enterprise. Unlike traditional AI assistants that act on behalf of an individual user, Claude Tag introduces a shared AI agent with its own identity, credentials, service accounts, and permissions. That shared agent lives inside a Slack channel, builds context over time, connects to enterprise systems, and performs work for everyone in the conversation.
|
By Cinthia Portugal
For the past two decades, enterprise security has evolved around a relatively stable assumption: software executes instructions, people take actions, and security teams are responsible for understanding and governing the interaction between the two. The technologies have changed. Infrastructure moved to the cloud. Applications became distributed. Identities expanded beyond employees to include partners, contractors, and machines. Yet the underlying model remained remarkably consistent.
|
By Zenity
Zenity's low-code security research team is exposed to real world low-code applications on a daily basis, and we're glad to share our knowledge in this domain in order to help you to design and develop secure low-code applications.
- July 2026 (7)
- June 2026 (14)
- May 2026 (6)
- April 2026 (11)
- March 2026 (9)
- February 2026 (3)
- January 2026 (6)
- December 2025 (7)
- November 2025 (6)
- October 2025 (8)
- September 2025 (7)
- August 2025 (1)
- July 2025 (2)
- June 2025 (7)
- May 2025 (5)
- April 2025 (6)
- March 2025 (1)
- February 2025 (3)
- January 2025 (4)
- December 2024 (5)
- November 2024 (2)
- October 2024 (2)
- September 2024 (4)
- July 2024 (3)
- June 2024 (2)
- May 2024 (6)
- April 2024 (2)
- March 2024 (2)
- February 2024 (2)
- January 2024 (3)
- December 2023 (2)
- November 2023 (4)
- October 2023 (1)
- September 2023 (5)
- July 2023 (2)
- June 2023 (3)
- May 2023 (7)
- April 2023 (4)
- March 2023 (3)
- February 2023 (3)
- January 2023 (1)
- December 2022 (1)
- November 2022 (2)
- September 2022 (2)
- August 2022 (1)
- July 2022 (2)
- June 2022 (1)
- May 2022 (3)
- April 2022 (2)
- February 2022 (1)
- January 2022 (3)
- December 2021 (2)
- November 2021 (3)
- October 2021 (3)
Continuously protecting all low-code/no-code applications and components! Design and implement governance policies, identify security risks, detect emerging threats and drive automatic mitigation and response.
Low-code/no-code development and automation platforms are the wave of the future. The largest companies in the world are already adopting low-code/no-code development for their core business units. But with all their benefits, low-code/no-code development brings with it a host of governance challenges and risks that are unaddressed by existing InfoSec and AppSec solutions.
Zenity, the first and only governance and security platform for low-code/no-code applications, creates a win-win environment where IT and information security can give business and pro developers the freedom and independence they want in order to continue pushing their business forward while retaining full visibility and control.
Our Platform:
- Discover: Identify shadow-IT business applications across your low-code/no-code fleet and track sensitive and business data movement.
- Mitigate: Identify insecure, vulnerable and risky configurations. Drive mitigation and remediation immediately.
- Govern: Design policies and implement automatic enforcement. Eliminate risks without disrupting business.
- Protect: Detect suspicious and malicious activity, such as supply-chain attacks, malware obfuscation and data leakage.
Governance and Security for Low-Code/No-Code Applications.