Zero trust isn’t broken. Most companies just do it wrong.
Kindervag, currently chief evangelist at Illumio, concurs. “AI doesn’t change the fundamentals of zero trust. It reinforces them. Zero trust is the strategy that allows…
Category: CISOOnline
Cisco patches SD-WAN flaw amid evidence of active exploitation
“CISA and NSA have issued guidance about architecture, exposure, and management-plane hygiene, which goes beyond typical CVE-by-CVE patching,” Prabhu said. “Attackers are targeting the SD-WAN…
China-linked hackers target US, Canada research using legacy REDCap exploits
Parallelly, the other two modules inject credential harvester code into the authentication system file, and backdoor code into the custom hooks configuration file, respectively. “Upon…
Sovereign cloud won’t fix your AI risk. Identity governance will
US enterprises are not far behind. The SEC’s cybersecurity disclosure rules, CISA’s AI security guidance, proposed state-level AI regulations and growing board-level scrutiny of AI…
5 runtime signals for catching a compromised AI agent
The trifecta worked as a signal because, at the time, agents were mostly narrowly scoped. An agent capable of performing only one or two of…
Governing the ghost workforce | CSO Online
The security industry has had plenty of warnings. It just has not acted on it. Cast your mind back to SolarWinds story. The attackers did…
Attackers can turn AI agent guardrails into denial-of-service weapons
They added that “a single poisoned document can saturate shared guardrail infrastructures, effectively starving co-located agents and paralyzing the entire system,” describing a reasoning-extension denial-of-service…
Langflow RCE under active attack months after a patch was shipped
An added complexity is that Langflow is shipping with an auto-login behavior, allowing unauthenticated users with a valid session to reach the vulnerable endpoint without…
Autonomous AI agents duped into leaking sensitive data in phishing test
The test used two configurations: a generic productivity profile and a stricter profile that included email safety instructions telling the agent to be cautious of…
Ivanti patches critical Sentry flaws that lead to full device takeover
The second flaw, CVE-2026-10520, is a command injection issue that can lead to remote code execution with root privileges on the underlying OS. Because the…
‘Harvest now, decipher later’: The quantum threat few are preparing for
How to protect yourself From the banking sector, CaixaBank addresses the quantum threat “understanding that it is a real risk and, as such, must be…
AI is exposing the biggest weakness in cybersecurity: We never built a health model. Until now!
But here is the uncomfortable truth that artificial intelligence is now forcing into the open: An emergency room does not produce a healthy population. Healthcare…