82% of Attacks Skip Malware Entirely

27 seconds. That’s how fast an adversary can move to your critical systems. In this clip, you’ll learn: How adversaries blend in using everyday admin tools Why traditional, reactive security models fall behind What makes modern intrusions so hard to detect Watch the full video to see how teams are shifting to proactive hunting.

Rogue AI App Use

HungryClaw… OpenLobster… KrillBox? Shout out to @AlexisGay for shining a light on the fact that shadow IT tools are getting more (shell)fishy—and dangerous—by the minute. According to our own findings, within 90 days of connecting to Vanta, organizations discover ~140 shadow IT tools accessing their environment. That's a lot of claws grabbing at your data. More insights to come! Stay tuned for our new Trust Signals series.

You Can't Trust What You Can't Trace

Picture this: Your security team finishes an AI vendor evaluation. The offering looks ironclad, with content filtering, output guardrails, and a stellar red-teaming report. Everyone leaves the meeting satisfied, and another governance box is checked. Six months later, a production incident hits. An AI agent, powered by a model your team “vetted,” starts executing unauthorized deletions in your CRM.

Can AI Replace a QSA?

The question circling boardrooms and compliance departments in 2026 is no longer hypothetical: Can AI replace a QSA? After nearly two decades guiding organizations through PCI DSS audits, gap assessments, and remediation programs, the answer is clear — No, AI cannot replace a Qualified Security Assessor in 2026. But it is fundamentally reshaping what being a QSA means, and professionals who ignore that shift do so at their own peril.

SBOMs That Actually Matter

Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.

5 Themes From a Candid Discussion

The Eskenzi IT Security Analyst & CISO Forum wasn’t a typical security event. This forum was a gathering of CISOs, analysts, and security leaders speaking candidly under Chatham House Rule about what’s actually breaking, what’s working, and where things are heading. Here are 5 key themes that came through loud and clear. None of them were surprising. But together, they paint a pretty stark picture of where security and AI are right now.

Scaling Your Security Program to Match the Speed of Mythos

Anthropic’s Project Glasswing and the Claude Mythos model represents a fundamental change in the physics of cyber defense. With the gap between patch releases and weaponized exploits shrinking to hours, traditional manual security triage is now obsolete. Organizations must adopt AI-driven automated remediation.

GitHub Token Recycing #github #tokenrecycling #tokens

Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.