Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Author: Alexander Ivanyuk, Senior Director, Technology For many MSPs, AI still looks like an extra tool outside the real workflow: open a chatbot, paste in a ticket, ask for help, copy the answer back and continue working. It may save a few minutes, but it also creates more steps and more places where context can be lost.

Cursor and Claude Code now read source code, install packages, and push commits with much of the access a senior engineer has, and often with less oversight. Give an agent a prompt to fix a bug, and it may pull a private API key from a config file, pass a customer record into its context window, or send a snippet of proprietary logic to a third-party model provider to reason about the fix. Security teams built policy for developers typing code by hand.

A sophisticated supply chain attack has actively compromised multiple npm packages, including keyv, cacheable, cacheable-request, flat-cache, file-entry-cache, and possible related adapters. Attackers took control of a popular maintainer’s npm account on or before August 4, 2026, and began publishing trojanized package versions containing a preinstall hook (setup.mjs) as a loader.

Harness engineering is the practice of building the layer, including code, that turns an AI model from a text generator into an agent that can take actions. In short, an AI agent is a model plus a harness. The model decides what to do next, and the harness makes it happen, connecting the model to tools, context, external systems, and validation. In a lot of practical work, and especially in security work, the harness decides the quality of the output more than the choice of model does.

On July 30th, 2026, SolarWinds released fixes for a critical Authentication-Bypass vulnerability in Web Help Desk (WHD) tracked as CVE-2026-28323, and a related high-severity Denial-of-Service vulnerability, tracked as CVE-2026-28299. Although no active exploitation has been observed yet, WHD is commonly internet-facing and the authentication bypass requires no credentials, making it a likely target once exploit code becomes available.

Most security programs answer to three frameworks at once and document themselves three times. A customer questionnaire asks for ISO 27001 evidence, a cyber insurer asks for NIST CSF alignment, an assessor references CIS safeguards, and the same firewall rule gets described in three vocabularies for three audiences. The duplication is self-inflicted rather than required, and a holistic approach to cybersecurity GRC starts by recognizing that one program is being described repeatedly. ‍

On a Tuesday morning in Q3, a procurement agent at a mid-market manufacturer approved a $340,000 payment to a vendor account. The vendor name matched the approved-vendor list. The invoice format matched the standard template. The agent verified both, cross-checked the amount against historical purchase orders, and released the payment through the treasury API within eleven minutes of the invoice arriving. No human touched the transaction.