Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

I recently had the opportunity to speak at the ISACA GRC Conference in San Diego about a challenge I see becoming increasingly important for governance, risk, and compliance teams: How do you prove your controls are actually working in digital environments that never stop changing?

Ivan Tsarynny, CEO of Feroot Security, joined CNBC’s The Exchange on July 31, 2026 to discuss a string of recent AI model “breakouts”—incidents where AI systems slipped past their own safety guardrails during testing—and what those incidents mean for how governments should regulate artificial intelligence.

Cookie consent banners have become the public face of GDPR compliance. Nearly every organization operating in Europe has one, and many privacy teams have invested heavily in Consent Management Platforms (CMPs) to capture user preferences and satisfy regulatory requirements. The problem is that a consent banner only asks a question. It doesn’t prove the website honors the answer.

As Canada strengthens privacy protections and enforcement, organizations must find a way to accelerate AI innovation while maintaining continuous visibility into how customer data is collected, shared, and protected. Canada’s proposed Bill C-36 is about more than privacy regulation. It reflects a broader challenge facing governments, regulators, and businesses around the world.

Google Tag Manager is one of the most trusted tools on the modern web. Marketing teams rely on it daily. Ecommerce teams use it to move quickly. And most security teams rarely question it because it sits under the umbrella of a globally trusted platform. That’s exactly why attackers continue finding ways to abuse it.

I was on ABC News recently discussing why banks are on alert as new AI systems like Anthropic’s Claude Mythos raise cybersecurity concerns. What struck me most is how quickly the conversation has shifted. This is no longer a hypothetical risk or something we are planning for in the future. Financial institutions and regulators are reacting in real time to what AI is already capable of doing. From my perspective, we are still underestimating how fast this is moving.

Organizations have invested heavily in consent management. Consent Management Platforms (CMPs) are standard infrastructure for privacy programs, and for good reason. Regulations like GDPR, CCPA/CPRA, LGPD, PDPA, and HIPAA require organizations to obtain, record, and honor user consent before collecting or processing personal data. CMPs provide the framework to do that. Most organizations have done the right thing, they just don’t know if they’ve done the right thing right.

Consent management platforms were a reasonable first answer to GDPR. Capture the choice, log it, and move on. For a while, that felt like compliance. It wasn’t. A logged preference and an enforced preference are two different things. When a user clicks reject all, the legal obligation isn’t just to record that click, but it’s also to ensure no tracking script executes after that. Tags, pixels, analytics calls, behavioral trackers, they all need to stop.

When a patient logs into a billing portal, two of the most heavily regulated data types in the U.S. end up in the same browser session. PHI like health history, insurance providers, and diagnoses, renders right alongside the card entry fields they’ll use to pay. And with them load the third-party scripts that marketing manages. Analytics, heatmaps, A/B testing, conversion tracking. These tools are how growth teams optimize revenue and product teams improve the experience.

AppsFlyer’s JavaScript SDK has been compromised in an active supply chain attack. Websites loading the script are serving malicious code to their users without any changes to their own codebase.