Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Researchers pulled real, leaked API keys out of three LLMs using only API output. Here is how AI agents carry secrets from developer laptops into model context, and how to stop them before the model sees them.

When MSPs evaluate MDR services, the conversation usually starts in the same place: Tell me about your SOC and how quickly you respond. Those are good to know, but they don't tell you one thing that determines whether the service works: how much of your clients' environments the provider can see and act on. A SOC that's available 24/7 but only watching half the environment isn't protecting your clients. It's giving your clients a false sense of security.

A local password manager stores your credentials in an encrypted vault on your own device or server. You control your data and backups, but you also manage keys and updates yourself. That works for one person. Teams need role-based access, approvals for sensitive accounts, and logs that show who accessed what.

As AI agents spread across IT environments, organizations struggle to see what agents they have and what data those agents can access. For Cybersecurity Awareness Month, we wanted to share what Netwrix is doing to help IT and security teams improve agentic AI visibility and governance to keep their sensitive data secure. I recently sat down with Jeff Warren, our chief product officer, who has been working through this problem with customers for a while.

For years, identity governance has had a useful shorthand: Every identity needs an owner. This works reasonably well when the identity represents a person. There may be managers, application owners, entitlement owners, data owners and security teams surrounding the identity, but there is still a human being at the center. For example, Sarah in Finance has an identity. The organization determines what Sarah is permitted to access and execute, but Sarah will also be held accountable for her actions.

TL;DR: Active-active runs every node live so traffic distributes across the pool and failover is near-instant, but it forces you to solve multi-writer conflicts through last-writer-wins, vector clocks, CRDTs, or consensus protocols. Active-passive keeps one authoritative primary with an idle standby, trading seconds to minutes of promotion time for predictable behavior, simpler troubleshooting, and lower cost under steady load.

Successful executive leadership goes beyond monitoring employees’ every move; it also needs a clear, factual picture of digital workflows, which apps are being used, and how much work available talent can do. Today, when many organizations are dealing with a shift to hybrid work, soaring software subscription pricing, and new productivity requirements, executive workforce activity and app consumption reporting are helping leaders stay on top of it all.

Continuous control monitoring and a once-a-year, point-in-time pentest don't sit well together. A manual test means scoping, waiting for a slot, and holding up the audit window for the report. Teams choose Drata to get audit-ready quickly: controls monitored continuously, evidence collected automatically. The pentest is the part that doesn't move at that speed.

Development teams ship faster than ever with AI-assisted coding. Features that previously took weeks can now be delivered in days. But security testing still runs on the old schedule. In Aikido's 2026 State of AI in Pentesting report, we found that 76% of organizations deploy significant production changes weekly or faster, while just 21% validate security on every release. Katie Norton, Senior Research Manager at IDC, summed it up.