How to Create an AI Acceptable Use Policy Employees Will Follow
Telling employees to “use AI responsibly” leaves too much open to interpretation.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Sophos To Bring OpenAI GPT Cyber Models Into Managed Risk Offering, Helping Defenders Validate Exploit Paths
The company is building a new Exploit Path Verification (EPV) capability that will tell security teams which vulnerabilities an attacker can reach in their environment, turning long exposure lists into evidence-backed priorities.
Securing autonomous AI agents: regulatory risk and governance for modern AppSec
Autonomous AI agents writing and executing code at machine speed present an urgent compliance challenge for modern software organizations. As global regulations tighten, engineering leaders must establish clear governance layers over agentic workflows, external tool calls, and Model Context Protocol integrations to ensure full accountability. In this session, Mend.io experts Asaf Saar and Ben Goldberg unpack the intersection of AI compliance, software supply chain security, and enterprise risk management. Learn how to bridge the accountability gap without sacrificing development velocity.
September 7, 2026 Emerging Threats Weekly
This week’s briefing covers: Dive deeper.
When the AI Arrives Inside Software You Already Bought
An application that was AI-free at the last audit may be processing corporate data through a language model today. Nobody procured it, nobody approved it and nobody was asked. A vendor shipped a release. Third-party AI governance is built almost entirely around procurement. Assess the vendor, negotiate terms, sign a data processing agreement, add the tool to a register. The apparatus requires a purchasing event, and an embedded feature produces none, so the apparatus never engages.
Quantifying Cyber Risk Without Revenue to Lose
A public body has no revenue to lose, no share price to move and no insurance market pricing it the way one prices a manufacturer. It faces the same regulatory pressure to quantify cyber exposure as anyone else, and the standard model's central input does not exist. Substituting the loss categories is the easy half and it is where most guidance stops. The harder question is what the resulting figure is for, because the decisions a private company makes with it are mostly unavailable.
Indusface WAS AI-Assisted Pentest: Comprehensive Vulnerability Assessment Across Web, API and AI Apps
For years, our security team has run pentests against business-critical applications across industries, and one pattern stands out. The vulnerabilities that are the most difficult to remediate are business logic vulnerabilities: IDOR, broken access control, privilege escalation, and multi-step workflow abuse. These are the kind of vulnerabilities pentest experts find by noticing a broken assumption behind one API call and chasing it until the full exploit path becomes clear.
What is cyber due diligence?
Due diligence in a merger or acquisition is, by design, exhaustive. It brings a level of scrutiny that touches almost every part of a business. From financial audits and legal reviews to commercial assessments, buyers work hard to make sure nothing important gets missed. And yet there’s one area that continues to catch organisations off guard, even in the most professionally run due diligence processes: The cost of a data breach has never been higher. Digital estates have never been more complex.
NIS2 and GDPR Compliance: How European Companies Can Reduce Duplicate Compliance Efforts
NIS2 and GDPR cannot be merged into one legal obligation, but much of the compliance work behind them can be consolidated. Organisations can use one control framework, shared asset and risk information, common supplier assessments and a single incident record while maintaining separate legal registers and notification workflows. The key is to consolidate evidence and operational processes — not the obligations themselves.
From MSP to Strategic Advisor: Lead with Risk
The MSP landscape is evolving. Customers increasingly expect more than technology management, they want trusted partners who can help them understand, reduce, and manage cybersecurity risk. WatchGuard's upcoming “Provider to Advisor: The MSP Shift Toward Risk Leadership” webinar explores exactly this opportunity.