Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Somewhere in the first nine months of 2026, AI stopped being a talking point in ransomware and became part of how the work actually gets done. Tracking new ransomware-as-a-service (RaaS) launches, darknet recruitment ads and public incident reporting through this period shows a three-step progression: AI as advertising, AI as an assistant, and AI built directly into ransomware.

With inboxes increasingly well guarded, cybercriminals are turning to a more vulnerable front in their attacks against your digital workforce. Voice is the fastest-growing attack vector, and it’s because it’s dangerously effective. According to Verizon’s 2026 Data Breach Investigation Report, phone-centric attacks are 40% more successful than traditional email-based phishing.

An employee at your company receives an email from hr@yourcompany.com. The domain matches. There is no warning banner. The message asks them to review a payment approval document. They click. That email was never sent by your HR team. An attacker sent it, and your own Microsoft email infrastructure delivered it, with no password and no credentials required.

Agentic AI has moved from experimental research to live production environments at unprecedented speed, outpacing nearly every technology security leaders have encountered in recent history. Distinguishing themselves from standard chatbots that merely respond and pause, autonomous agents architect multi-step workflows, interface with tools and APIs, maintain contextual memory, and execute operations with minimal human intervention.

As AI accelerates vulnerability discovery and exploitation, exposure management can’t stop at visibility and prioritization. Gartner’s post-Mythos outlook points toward more preemptive, autonomous security, and Seemplicity’s Response Options puts that into practice by giving teams multiple context-aware ways to reduce risk quickly, safely, and without waiting for the full fix.

If you manage vendors, supplier drift looks familiar. A delivery arrives late. A vendor misses a service-level agreement (SLA) target, and nobody flags it. Tickets sit unresolved, and quality dips just enough that it never makes the weekly stand-up. The problem is timing. Most teams find out a vendor missed its uptime or response-time targets at renewal, months after anyone could’ve fixed it.

The tricky thing about AI compliance is that most organizations are going to experience it from both sides. You need to be able to explain how AI is being used inside your own organization, what it can access, and how you're managing the risk. At the same time, you need to understand how your vendors are using AI and whether that introduces new risk into your environment.

The European Commission has published its first official guidance to help businesses implement the Cyber Resilience Act (CRA)—the EU regulation establishing cybersecurity requirements for products with digital elements. The timeline is critical: reporting obligations for actively exploited vulnerabilities and severe incidents take effect on September 11, 2026, while the core CRA requirements will become mandatory from December 11, 2027.

Somewhere in your vendor list, right now, there is a door you have never checked. You didn’t build it, you don’t hold the key, and yet if someone walks through it, the breach notification goes out on your letterhead. The numbers too aren’t subtle. Verizon’s 2026 Data Breach Investigations Report found that 48% of breaches now involve a third party, up from 30% just a year earlier, the sharpest rise the report has ever recorded. Your vendors are your attack surface now.

CVE-2026-44756, tracked by SAP under the name OVERPASS, is a memory corruption vulnerability in the SAP kernel code that processes the Extended Passport (EPP), a standard SAP tracing structure used to follow call sequences across distributed system landscapes. The flaw stems from missing boundary validation during deserialization of EPP data, which causes unsafe memory behavior when the kernel processes externally supplied length fields. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical).