Every CISO has sat in a budget meeting where the conversation quietly pivoted from risk to price. Not because the chief financial officer (CFO) was being difficult. Not because security stopped mattering. But because at some point in the discussion, two platforms started to look identical, and when things look identical, cost becomes the deciding factor. That pivot is where security investment decisions go wrong. Security leaders do not lose budget because financial leaders undervalue security.

Software composition analysis (SCA) tools have become essential in modern security programs. They continuously scan software supply chains and match component fingerprints against Common Vulnerabilities and Exposures (CVE) databases to surface vulnerabilities in dependencies. SCA tools are effective at scale, but they introduce a persistent challenge: Not every flagged vulnerability actually presents a risk.

CVE-2026-20182 is an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage). The flaw sits in the peering authentication path of the vdaemon service running over DTLS on UDP port 12346, the same control-plane service involved in CVE-2026-20127 earlier in 2026. It is not a patch bypass of that earlier issue, but a separate weakness in the device-type handling of the control connection handshake.

Every conversation I have with CIOs and IT leaders right now starts the same way. They're not short on activity. They've got pilots running, tools deployed, teams experimenting. What they don't have is much to show for it. The data backs it up: 92% of companies are ramping AI investment right now. Only 1% consider themselves mature.

CVE-2026-42945, nicknamed "NGINX Rift", is a heap buffer overflow in the ngx_http_rewrite_module component of NGINX. It has sat in the project's source code since 2008. F5 disclosed the flaw on May 13, 2026, after responsible disclosure by researchers at depthfirst, who reported finding it through an autonomous code scanning system.

The security industry spent a good chunk of early 2026 debating whether Anthropic’s Mythos and OpenAI’s Daybreak are truly dangerous or just good marketing. It's a reasonable debate. But while we're having it, attackers are asking a different question: how do we use tools like this to move faster than defenders can respond?

AI is widely used in exposure management, but most implementations stop at prioritization and analysis. While AI improves visibility and decision-making, remediation still depends heavily on manual ownership, coordination, and inconsistent processes. To truly improve vulnerability remediation outcomes, AI needs to extend into the execution layer, helping identify owners, define remediation plans, and deliver fix-ready work that turns decisions into action.

In 2012, the "Shadow IT" crisis was employees putting files in Dropbox for convenience. In 2026, the crisis is Shadow MCP. Instead of a simple file storage app, security teams are now facing unvetted AI agents with the power to read from and write to internal systems. These servers are often running on infrastructure that was never reviewed, never approved, and remains entirely invisible to governance.

There’s a question we get asked constantly, and it’s the right one to ask: “Can 1Password see the contents of my vault?”