Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

With my youthful good looks, it’s hard to believe that I’ve been in cybersecurity for almost two decades. : ) I’ve seen the industry go through some massive transformations. Each change brought its own set of challenges, failures (I’m looking at you XDR) and, more importantly, opportunities. As I am now entrenched in application security, I’m learning that we’re in the middle of another one of those moments, and it’s just as exciting.

Security teams require continuous innovation to defend against sophisticated attackers and support modern infrastructure. The January 2026 LogRhythm SIEM release delivers critical updates to your security operations, improving everything from detection and investigation to core platform stability.

The widespread adoption of AI agents creates a new, unmanaged attack surface. The Exabeam January New-Scale launch directly addresses this risk, providing a layered approach to secure your AI workforce from onboarding to automated threat response.

The Model Context Protocol (MCP) is emerging as a foundational interoperability layer for agentic AI, embraced by major platform providers. MCP simplifies how AI models connect to external tools and data. Think of it as a universal remote for security platforms: Instead of building fragile, one-off integrations, MCP allows AI to discover and use capabilities dynamically. For SIEM and detection providers, this shift is significant.

What are HIPAA disaster recovery requirements? Healthcare data breaches exposed over 276 million patient records in 2024, representing more than 80% of the US population according to the HHS Office for Civil Rights. For healthcare organizations, the question is no longer whether a disruption will occur, but when. The HIPAA Security Rule addresses this reality directly through its contingency planning requirements, yet many organizations still operate with significant compliance gaps.

In the race to deploy autonomous AI agents, organizations are inadvertently building on a foundation of shifting sand. While security teams have spent the last year focused on "Prompt Injection" and "Model Poisoning," a much older, more dangerous adversary has quietly become the primary attack vector for the agentic era: Broken Object Level Authorization (BOLA).

When application traffic fails to reach its destination, teams must determine whether the problem lies in routing, firewall rules, NAT behavior, or a combination of all three. In many environments, these components overlap in ways that make traditional troubleshooting slow and error-prone. Engineers often have to run repeated tests, stage changes, or temporarily disable rules to understand why a flow is being blocked.

Protecting sensitive data does require investment, and that mindset hasn’t been universal. Now, it isn’t an option. It’s time to move from debate to execution.

In most organizations, standing privileges don’t show up all at once. They accumulate quietly. A role is added “temporarily.” A contractor needs broad access to finish a project. A service account gets oversized permissions because no one has time to fine-tune them. None of these choices seem harmful in the moment, but over time they build into a privilege surface that’s far too large and far too easy to misuse.

Shai Hulud didn’t invent a new supply chain weakness. It took advantage of something most teams already struggle with: long-lived credentials sitting on developer laptops and CI runners. Once it landed in a workstation or pipeline, it went hunting for secrets, then moved into GitHub, npm, and cloud environments. The damage is huge.