Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

OpenAI recently introduced Daybreak, a cybersecurity initiative designed to apply frontier AI models to vulnerability discovery, secure code analysis, and earlier remediation across the software lifecycle. By combining advanced reasoning and planning capabilities, Daybreak aims to help organizations identify and address weaknesses before they reach production. This is a meaningful step forward, but it is also a continuation of a long-standing approach.

It usually starts the same way. The CISO comes back from a board meeting having signed off on agentic AI for production. The SOC lead is told, in roughly that many words, to build detection for the agents. And the security stack she has — CNAPP for posture, EDR on the nodes, container runtime sensors, a SIEM ingesting everything — was architected before AI agents existed as a workload class.

AI tools are moving faster than the security controls meant to govern them.In this episode of Defender Fridays, Cisco's Cybersecurity Technical Solutions Architect Katherine McNamara walks through changes in the threat landscape as organizations rush to integrate AI without applying basic security discipline. When Katherine meets with customers to discuss AI security, the conversation almost always starts and ends in the same place: data leakage. Someone might upload sensitive files to a public LLM.

Five years ago, enterprise ransomware risk was mostly a perimeter problem. Today it’s an identity problem, a visibility problem, and a cloud configuration problem, all at once. Hybrid work and cloud adoption didn’t just shift where people work. They fundamentally changed where ransomware attacks begin, how far they reach, and how long they go undetected.

The launch of platforms like Moltbook, OpenClaw, and RentAHuman in early 2026 has provided an unsettling glimpse into the future. We are entering a phase of the digital workplace where AI agents no longer just assist us, they interact with one another, act autonomously in the physical world, and even hire humans for manual labor. In this environment, the traditional lines of control and agency are being redrawn.

SaaS-only platforms are betting everything on automation. But when the threat landscape demands judgement, data volume alone is not the answer. For years, a certain category of threat intelligence vendor has sold the same idea: feed your data into our platform, let the AI process it, and your security team will have everything they need. It is a compelling proposition, particularly for organisations under pressure to demonstrate coverage without expanding headcount.

When a new vulnerability is announced, the race begins. Security teams jump into action, checking exposure, triaging events, identifying affected systems, and figuring out how quickly they can patch. The clock is ticking and they know it. At the same moment, threat actors are doing their own version of that work. They’re reading the same advisories, watching the same feeds, and asking a much simpler question: Who is still vulnerable?