Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Sophos X-Ops presents a working taxonomy for attacks using, and targeting, AI Conversations about ‘AI threats’ typically collapse into one of two extremes. On the one hand, hype: unverified claims that don’t hold up to scrutiny and invite significant criticism. On the other, dismissal: it’s just old tradecraft with new branding.

This article was authored by Cristhian Parrot from the Kroll Offensive Security Team. Kroll’s Offensive Security Team recently discovered a new vulnerability within Microsoft’s Azure Monitor Agent Metrics Extension, which demonstrates how subtle configuration issues can introduce significant security risks in widely deployed infrastructure components.

The CLOUD Act compels US-incorporated vendors to hand over data on request, regardless of where it's hosted. Here's why vendor jurisdiction matters for CTI.

Most security programs have a working model for responding to shadow AI: identify the unsanctioned tools employees are using, sanction or block them, and update the acceptable use policy. That model worked, however imperfectly, when the threat was limited to web-based GenAI applications. It does not work when the threat is an autonomous agent, running locally on an endpoint, that reads the file system, calls external APIs, and transmits internal data.

If you’re a service provider, you’ve probably felt the shift already. Clients are asking tougher questions about cost. Some are frustrated with hyperscaler bills. Others are rethinking VMware. And more are paying attention to where their data lives and who controls it. Put all of that together, and it’s clear: Infrastructure is becoming a strategic conversation again. One that creates both pressure and opportunity. eBook How to build a profitable IaaS business with Acronis Cyber Frame.

Shadow AI is the term for AI tools, models, and capabilities that operate within an organization without formal approval, oversight, or governance. It is the enterprise AI equivalent of shadow IT, which is the unauthorized software and cloud services that proliferated as employees found faster ways to get work done than waiting for IT procurement cycles. The difference is that the consequences of unmanaged AI are considerably more significant than those of unmanaged software.

Privileged accounts are the crown jewels of any IT environment. Admin credentials, root access, service accounts. These are what attackers go after first, because compromising one can hand them the entire organization. Forrester puts the number at 80% of security breaches involving privileged accounts. NIST frameworks, particularly SP 800-53, exist to make sure you're not leaving that door unlocked.

How do you ensure AI agents authenticate when they interact with your entire enterprise ecosystem when you aren’t there to watch their every move? Today, AI agents can do many things autonomously. They can update CRM records, create tickets, trigger workflows, modify data, and just about anything. The importance of authentication increases as they become more autonomous day by day. For years, API keys were the easy default for connecting applications to APIs.