Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Splunk report: Agentic AI takes centre stage in CISOs' path to digital resilience

Nearly all CISOs report they are now responsible for AI governance and risk management, cite the growing sophistication of threat actor capabilities as their greatest risk. Vast majority say AI enables more security events to be reviewed.

Sendmarc Releases DMARCbis Fireside Chat Featuring Co-Editor Todd Herr

In a recent DMARCbis fireside chat, email authentication leaders discussed upcoming DMARC changes and how teams can plan for 2026. Sendmarc has released a new fireside chat featuring Todd Herr, Principal Solutions Architect at GreenArrow Email and co-editor of DMARCbis, on the upcoming update to DMARC (Domain-based Message Authentication, Reporting, and Conformance).

Why CISOs should prioritize continuous control monitoring in 2026

In a recent roundup of strategic initiatives for CISOs, I argued that continuous assurance is the 2026 operating model. Across all ten initiatives, the pattern was clear. Security is no longer being evaluated by effort, it’s being evaluated by outcomes. Boards, customers, and regulators are no longer asking what tools you deployed or how busy your security team is. They are asking a simpler, harder question: Can you prove that your controls are working right now?

2026 State of Software Security: Risky Debt is Rising, But Your Strategy Starts Here

You can’t fix what you ignore. For years, organizations have raced to deploy software faster, often leaving a trail of unresolved vulnerabilities in their wake. We call this trail security debt, or flaws that are left unresolved over a year since being discovered, and it isn’t just a technical metric. It’s a compounding business risk that is growing harder to manage every year. Today, we are releasing the 2026 State of Software Security (SoSS) report.

The Vendor Tiering Series: Why Tier Your Vendors

The thing about blanket approaches is that they rarely work or scale. The same holds true for third-party cyber risk management. Treating every provider, stakeholder, or partner with the same intensity is neither productive nor cost-effective. While defaulting to treating every vendor at the same risk level is common, it is not a resilient security strategy.