Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

For the last few years, when somebody says “AI,” what they are usually referring to is a Large Language Model, or LLM for short. You chuck some text in, it has a think, and it gives you some more text back. This is brilliant if you want code written, documents summarised, or quantum physics explained to you in a limerick, but while this is great for humans, most software doesn’t actually want a beautifully written paragraph. Software just wants an answer so it can make a decision.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! A popular shopping site hit as we get closer to a holiday season. Might want to watch out for the usual escalation then.

AI coding assistants are unpredictable by design. Learn how AI hooks add deterministic controls and how GitGuardian ggshield blocks secrets before agents can use them.

Start with what the current backlog already costs: analyst hours spent on triage, developer time lost to duplicate tickets, slow MTTR, and manual reporting. Then tie each benefit of ASPM software to one of those costs, such as fewer tickets per fix or faster remediation. Compare pricing models on your real numbers, including integration upkeep, and propose a measurable pilot on five to ten high-value applications. Most AppSec teams don’t need to be sold on ASPM software.

Every quarter, your board asks the same question, just phrased differently: Are we more secure than we were last time? A point-in-time assessment can't answer it, because it shows where you stood on the day someone ran it, not which way things are moving. Security posture monitoring is the correct response to give to the board. This guide answers the three questions behind every board pack: what goes in front of the board, where the number comes from, and how you show it moved.

In late July 2026, 36 municipal waste and water systems across Minnesota were targeted in a cyber attack. The attackers targeted Programmable Logic Controllers (PLCs) that were in control of pressure, pumps, and chemical dosing. When the news broke, it felt like it was everywhere. This was an attack on critical systems, systems that we require and use daily. But cyberattacks on U.S. critical infrastructure systems like water, hospitals, sewage, gas, and electricity aren’t new.