|
By Dina Durutlic
Claude Code, Cursor, GitHub Copilot, and Gemini CLI are running on developer machines across your enterprise right now. They're browsing the web, writing to your filesystem, committing code to your repositories, and calling external APIs under the identity of your engineers. Most security teams have no visibility into any of it. This isn't a future problem.
|
By Anna Schibli
Enterprise AI agents stopped being a pilot project a while ago. They read email, touch source code, operate browsers, and increasingly make decisions inside production systems, which means the security model built for chatbots and prompts no longer covers what is actually happening inside the enterprise. Black Hat USA 2026 turned out to be the week that gap became impossible to ignore.
|
By Taylor Roberts
Between April and August 2026, at least six distinct AI-security efforts launched across North America, Europe, and Asia, several in the same week as one another and some for contradictory reasons. This piece maps 18 of them: what each says it's trying to achieve, who founded and backs it, and what it has actually shipped versus only announced.
A developer installs a skill to make their coding agent less chatty. It works. It also, the first time the agent uses it, reads the AWS credentials on that laptop and sends them to a domain no one recognizes. No one wrote obviously malicious code and no one approved a change. A file landed in a folder, the agent loaded it on the next run, and production credentials were gone.
|
By Cinthia Portugal
There's a widespread assumption in enterprise security that identity is a problem IAM programs know how to solve. Provision the right access, enforce least privilege, audit the credential chain, and you've addressed the identity risk. For human users and traditional service accounts, that's approximately correct. For coding agents, it misses two-thirds of the problem. Coding agents don't have a single identity. They operate across a layered identity surface, and each layer carries its own risk profile.
|
By Joseph Geiser
AI agents have moved from pilots into broad enterprise use. They read email, query systems of record, take actions, invoke tools, and coordinate with other agents on behalf of employees. Every line of business wants more of them, and security teams are being asked to enable that expansion without losing visibility or control.
|
By Ben Kliger
A few years ago, when Michael and I started Zenity, most of the industry was not ready to hear what we believed. Software itself was changing. AI would let millions of people, not just engineers, build and automate real work. And securing that world would take a completely new approach, because we would no longer be protecting software. We would be protecting systems that think, decide, and act on their own.
|
By Michael Bargury
We built agents to act on their own. We're somehow surprised when they do. Two weeks ago, OpenAI ran a cyber eval with the model's guardrails turned down. The model got hyperfocused on solving the benchmark. So it broke out of its sandbox exploiting a zero-day in jFrog Artifactory, reached the open internet, exploited another zero-day to break into HuggingFace, all to steal the answers and cheat on the test.
|
By Dina Durutlic
Coding agents have a misconfiguration problem. YOLO mode enabled to reduce approval friction, sandbox enforcement disabled, Model Context Protocol (MCP) servers installed from public marketplaces without security review. These are common configurations in enterprise developer environments, and remediating them is genuinely valuable work. AI Security Posture Management (AISPM) addresses exactly this class of risk, surfacing misconfigurations before they create the conditions for a successful attack.
|
By Dina Durutlic
For the past couple of years, most of the industry’s attention has gone toward agents that respond to a single prompt. They ask a question, get an answer, and move on. Enterprises are now deploying long-horizon agents; autonomous systems that execute extended, multi-step tasks across hours or days, without a human checking in on every step. These agents plan, reason, and improvise their way toward a goal, and that changes what security has to protect against.
|
By Zenity
Zenity's low-code security research team is exposed to real world low-code applications on a daily basis, and we're glad to share our knowledge in this domain in order to help you to design and develop secure low-code applications.
- August 2026 (8)
- July 2026 (9)
- June 2026 (14)
- May 2026 (6)
- April 2026 (11)
- March 2026 (9)
- February 2026 (3)
- January 2026 (6)
- December 2025 (7)
- November 2025 (6)
- October 2025 (8)
- September 2025 (7)
- August 2025 (1)
- July 2025 (2)
- June 2025 (7)
- May 2025 (5)
- April 2025 (6)
- March 2025 (1)
- February 2025 (3)
- January 2025 (4)
- December 2024 (5)
- November 2024 (2)
- October 2024 (2)
- September 2024 (4)
- July 2024 (3)
- June 2024 (2)
- May 2024 (6)
- April 2024 (2)
- March 2024 (2)
- February 2024 (2)
- January 2024 (3)
- December 2023 (2)
- November 2023 (4)
- October 2023 (1)
- September 2023 (5)
- July 2023 (2)
- June 2023 (3)
- May 2023 (7)
- April 2023 (4)
- March 2023 (3)
- February 2023 (3)
- January 2023 (1)
- December 2022 (1)
- November 2022 (2)
- September 2022 (2)
- August 2022 (1)
- July 2022 (2)
- June 2022 (1)
- May 2022 (3)
- April 2022 (2)
- February 2022 (1)
- January 2022 (3)
- December 2021 (2)
- November 2021 (3)
- October 2021 (3)
Continuously protecting all low-code/no-code applications and components! Design and implement governance policies, identify security risks, detect emerging threats and drive automatic mitigation and response.
Low-code/no-code development and automation platforms are the wave of the future. The largest companies in the world are already adopting low-code/no-code development for their core business units. But with all their benefits, low-code/no-code development brings with it a host of governance challenges and risks that are unaddressed by existing InfoSec and AppSec solutions.
Zenity, the first and only governance and security platform for low-code/no-code applications, creates a win-win environment where IT and information security can give business and pro developers the freedom and independence they want in order to continue pushing their business forward while retaining full visibility and control.
Our Platform:
- Discover: Identify shadow-IT business applications across your low-code/no-code fleet and track sensitive and business data movement.
- Mitigate: Identify insecure, vulnerable and risky configurations. Drive mitigation and remediation immediately.
- Govern: Design policies and implement automatic enforcement. Eliminate risks without disrupting business.
- Protect: Detect suspicious and malicious activity, such as supply-chain attacks, malware obfuscation and data leakage.
Governance and Security for Low-Code/No-Code Applications.