The Security Strategist

Rolling out artificial intelligence across a business sounds pretty straightforward until security enters the conversation. On a recent episode of the Security Strategist Podcast, host Richard Stiennon sat down with Omar Khawaja, Field Chief Information Security Officer at Databricks, and Danny Healy, the company's Lead Data & AI Strategist, to explore why so many organisations fail when moving AI from pilot to production. Everything always looks good in theory, but it's harder to execute in reality. This discussion offers a practical take on AI governance, risk and the cultural shifts security teams need to make to protect their business at scale.Why Shadow AI Grows on IndecisionKhawaja opens with a warning that should resonate with any CISO watching AI adoption outpace their controls. The instinct to "wait and figure it out" is, in his view, the single biggest misconception in AI security. Every month spent deliberating is a month in which employees quietly adopt unsanctioned tools themselves, and that delay creates a wider window for shadow AI to spread unchecked.The bigger issue, he explains, is that security teams keep reaching for playbooks built for deterministic systems, basically software that behaves predictably every time. However, AI doesn't work in this manner. It's probabilistic, which means outcomes are very different, and organisations that expect old-world controls to transfer seamlessly are setting themselves up for failure. This mismatch tends to push companies toward one of two extremes, which is either drowning use cases in exhaustive control lists or quietly ignoring the problem until it becomes unavoidable.Khawaja’s solution is straightforward, despite the complexity of the problem. Before writing a single policy, he asks leadership teams a question: can your architects actually draw what your AI system looks like? Without a shared view of the main components, which range from data pipelines and models to agents and permissions, different governance teams can end up solving different problems, all while thinking they are on the same page when they are not.He also takes a pragmatic view of AI adoption. Drawing on Thomas Aquinas, if the job of a ship's captain was to keep it from sinking, he would never leave harbour. He suggests that while avoiding all risk may seem safe, it also limits what can be achieved. The goal for security, he argues, is to help organisations find a safe and defensible path to using AI effectively.Why Trust Comes Before SpeedMeanwhile, Healy brings the conversation back to a more fundamental issue: trust. Databricks learned this the hard way inside its own operations. An early attempt at agentic threat triage used a single generalist model across multiple data sources and produced far too many false negatives. Swapping in smaller, specialist models for each source improved accuracy, a reminder that AI security maturity is built through iteration, not theory.Healy breaks trust down into three main areas: auditability, so teams can understand how an agent reached a decision; limited data access, so agents only access what they need; and resilience against manipulation, particularly as agents combine multiple actions that could create greater risks.That last point echoes something Khawaja raises later: the concept of contextual policies. Rather than static, role-based permissions that struggle to scale, contextual policies assess the actual risk of a sequence of actions in real time. Instead of users robotically approving every access request until they switch on "auto mode" out of fatigue, the system flags genuinely risky actions and lets routine ones pass - a smarter, more human-centred approach to access management.From 97 Risks to a Focused ShortlistThe most useful takeaway from the episode is how Databricks approaches AI governance frameworks. Rather than starting with controls, the company's open, vendor-agnostic AI Security Framework, now in its third version, starts by mapping the AI system itself, then cataloguing the risks that could affect it. The list currently runs to 97 risks, nearly double what it was three years ago, largely due to the rise of agentic AI.In practice, organisations are not expected to address all 97. Khawaja notes that a well-governed, modern data platform already neutralises a large chunk of them, leaving perhaps five to fifteen genuine concerns per use case. In this regard, each is mapped to specific, actionable controls rather than vague objectives. It's a philosophy borrowed from Khawaja's OODA loop framework (observe, orient, decide, act). This means most organisations are competent at observing problems and acting on them, but weak at the orientation and decision-making in between- the stage where risk triage happens.Healy makes a clear case that a well-governed data layer is about more than compliance. It's a competitive advantage. Organisations with clean, contextual, well-governed data give their AI agents an edge that attackers who lack that internal context simply don't have.The message from both guests is consistent throughout, and that is securing AI isn't about building the longest possible list of controls. It's about shrinking an intimidating problem down to something teams can actually solve, deliberately, iteratively, and without grinding the business to a halt. If you would like to find out more, please visit databricks.com or follow Omar Khawaja and Danny Healy on LinkedIn.TakeawaysChallenges of deploying AI securely at enterprise scale.Evolving security strategies for probabilistic AI systems.Importance of AI governance and risk management.Drawing a system picture for AI security.Implementing controls and permissions for AI agents.AI governance frameworks and standards.Chapters00:00 Introduction to AI security challenges in the enterprise01:00 Misconceptions about securing AI and shadow AI risks02:12 Learning from organisations that have secured AI03:25 How AI changes cybersecurity strategies04:52 The importance of understanding AI system architecture06:50 The risks of banning AI versus managing it responsibly08:37 Obstacles in operationalising AI securely10:00 Building trust through model auditability and control12:00 The role of external consultants and frameworks13:03 Databricks' approach to AI security and governance15:11 AI governance complexities and the UDA loop17:27 Using risk-based controls instead of exhaustive controls18:46 Designing permission controls for AI agents21:52 Content and intent analysis for agent security24:35 Developing effective AI security frameworks27:47 Key takeaways for AI security and governance29:28 Final thoughts on making AI security manageable

AI has changed how fast software gets written. What it hasn't changed is how fast organisations can find and fix what's wrong with it. This gap is the subject of a recent episode of the Security Strategist Podcast, hosted by Christopher Steffen, Vice President of Research at Enterprise Management Associates (EMA), with guests Chris Wysopal, Co-Founder and Chief Security Evangelist at Veracode, and Sohail Iqbal, the company’s Chief Information Security Officer. This conversation lands on a simple but uncomfortable idea that security teams don't have a detection problem anymore. They have a capacity problem, and it's getting worse every day as AI writes more of the code running in production.AI Code Is Creating a Security CrisisWysopal opened the discussion by reframing the industry's biggest AI worry. Static analysis, fuzzing, and AI-assisted scanning already do a solid job of surfacing vulnerabilities, and humans still know how to fix what gets found. The real issue that has now been created is the volume. As Wysopal put it, the problem is one of capacity, not detection or fixing. He estimated that roughly half of new code committed daily is now AI-generated, a figure he expects to keep climbing.Steffen pushed the point further, framing it as a maturity problem rather than a purely technical one. When a developer writes their own buggy code, they understand the context well enough to fix it. When AI generates that code, the organisation may not even know where to start looking for the flaw, let alone how to remediate it safely without breaking something else.Iqbal agreed, describing it less as a capacity issue and more as a scale-and-velocity issue that has overwhelmed capacity that was already stretched thin. This is due to AI models which learn from existing code repositories and open-source projects. As a result, they tend to reproduce the same flaw density found in that training data. The models are just as capable of finding and exploiting those flaws, and Iqbal noted that the window between a vulnerability's disclosure and an active exploit has shrunk to somewhere between four and eight hours. Fixing code, he explained, requires understanding business context and dependencies, since a careless patch can break twenty other things just as easily as it fixes one.Regulation Is Slowing AI AdoptionHighly regulated sectors such as banking, healthcare and government are the most cautious about AI-written code, and for good reason. Wysopal pointed out that regulations like Sarbanes-Oxley or HIPAA will definitely require a human to review every code change. Those review processes were built for the speed of human developers, not machines producing changes around the clock.This mismatch can appear in unexpected places. Steffen recalled hearing CISOs at Black Hat explain that any vendor product with an AI component now has to undergo additional risk and governance reviews before it can be approved. While these checks are necessary, they also introduce another human checkpoint into the adoption process, potentially slowing how quickly organisations can put AI-enabled tools into production.Iqbal said the bigger problem is that security rules and processes were designed for people, not AI systems that can develop software themselves. As companies increasingly use AI to write code, those rules are creating friction because it’s still unclear who is responsible when something goes wrong. If a human gives an AI a prompt and the system produces the code, who is ultimately accountable? Wysopal pointed to another challenge, which is visibility across the supply chain. Companies may rely on SaaS vendors that use AI to generate code, making it harder to know where the code came from and who is responsible for it.Building Trust in the Software Supply ChainIf accountability is going to mean anything in an AI-driven pipeline, both guests agreed the industry needs to build assurance and trust directly into the development process. Iqbal said security is now paying more attention to the third part of the security triad: integrity. Companies have spent years protecting data from being exposed and keeping systems running. Now, they are focusing more on making sure data, transactions and code have not been changed or tampered with. On the defensive side, Wysopal was honest about the asymmetry security teams face. This means attackers can afford to break things while testing exploits, but defenders cannot. He pointed to an incident at Amazon where an AI-driven production fix caused a multi-hour outage as a cautionary example of why automated remediation in live environments still requires extreme care.Their closing advice for security leaders was practical. Wysopal urged organisations to measure their actual remediation capacity, comparing bugs closed against bugs introduced, and to fund people and tooling accordingly, while moving security controls as close as possible to the moment code is generated. Iqbal emphasised breaking down tooling and telemetry silos so security teams can see risk in full business context rather than in isolated domains.The takeaway from both guests is consistent: AI isn't going to slow down, and neither can the defences built around it. Organisations that treat security funding and remediation capacity as afterthoughts will find themselves falling further behind with every sprint. If you would like to find out more, follow Chris Wysopal and Sohail Iqbal on LinkedIn. Alternatively, visit Veracode for more information.TakeawaysAI's impact on development velocity and security.Capacity and maturity challenges in AI-generated code.Security risks and vulnerabilities from AI and open source.Regulatory and compliance hurdles in AI adoption.Accountability and data provenance in AI security.Chapters00:00 Introduction to AI's role in cybersecurity and development01:20 Guest introductions: Chris Wysopal and Sohail Iqbal03:07 Significant changes AI brings to attack surfaces04:20 Capacity versus detection and fixing problems in AI coding05:29 Maturity challenges in fixing AI-generated code08:26 Security in AI-generated code and regulatory concerns09:54 Speed of AI exploits and the challenge of rapid response11:08 Security's reactionary role and AI's impact on response times12:35 Barriers to AI adoption in regulated industries14:30 Accountability, data provenance, and black box issues in AI24:40 AI's role in offensive and defensive cybersecurity strategies28:19 Lessons from hacking your own environment for security32:14 Practical advice for security leaders adopting AI in development

Although AI is currently in control of the boardroom agenda, a discussion on the latest The Security Strategist podcast suggests that enterprises might be posing the wrong first question.The real AI problem isn't just how many AI models an enterprise can deploy, but whether the data that powers the AI model is protected, can be recovered, is affordable, and is, in fact, usable.Chris Steffen, Host and Vice President of Information Security at Enterprise Management Associates (EMA), is joined by Randy De Meno, Vice President of Business Development and responsible for the Microsoft practice at CrashPlan, on The Security Strategist podcast. They claim that data strategy should come before AI strategy since enterprises are facing rising storage costs, token sprawl and ever more complex cloud environments.They particularly talk about the growing relationship between AI, Microsoft 365 storage, SaaS data, backup, archiving, data recovery and AI token sprawl.As enterprises generate increasing volumes of data and deploy more AI applications, the cost and security implications are becoming harder to ignore. Microsoft 365 and other SaaS platforms may keep applications running, but organisations remain responsible for protecting and recovering their data.The conversation explores why enterprises need to think about data strategy before AI strategy, including how to control storage overages, protect business-critical data, make protected data usable with AI, and ensure data can actually be found and recovered when needed.In this episode:00:00 Introduction to Data and AI Challenges in Cybersecurity01:23 CrashPlan's Role in Data Resiliency and AI03:49 The Cost of SaaS Storage and Data Overages07:31 The Evolution of Backup and Data Usage with AI12:29 The Impact of Token Sprawl on AI and Budgeting18:57 Understanding the Shared Responsibility Model in Cloud Security23:28 Making Data Easy to Find and Use24:52 Closing Remarks and Future OutlookKey topics• Microsoft 365 storage costs and overages• AI data storage and enterprise AI costs• AI token sprawl and technology budgets• Microsoft 365 backup and data protection• SaaS data archiving• Enterprise data recovery and resilience• AI data security and governance• Making protected data searchable and usable• Cloud shared responsibility• Microsoft 365 and Google Workspace data protectionThe discussion highlights a critical question for IT and security leaders: Is your enterprise protecting the data that its AI strategy depends on — and can you recover it when you need it?Learn more about CrashPlan's approach to Microsoft 365 data archiving and protection:https://www.crashplan.com/resources/crashplan-archiving-for-microsoft-365/Read the guide:https://www.crashplan.com/resources/guide/are-you-headed-for-a-microsoft-365-storage-overage/Visit CrashPlan:https://www.crashplan.com/#Microsoft365 #AI #DataProtection #Cybersecurity #DataBackup #AIData #TokenSprawl #CloudSecurity #DataRecovery #EnterpriseAI

Especially as rogue AI agents are increasingly escaping safe testing environments, such as OpenAI’s rogue AI agent attacking Hugging Face, it’s now more important than ever for enterprises to implement AI agent identity governance strategies that prevent unauthorised access to their systems.As AI agents seem to be turning into employees in enterprises, the majority of identity security strategies were never created with software that can act on its own.As a result, a new security issue has emerged concerning AI agent identity governance and the security of non-human identities (NHI). Since enterprises are now using agents who can access data and choose tools while carrying out actions on the employee's behalf, the conventional approach of granting access once and then reviewing it later is starting to appear increasingly unsuitable.Levent Besik, Chief Product Officer at SailPoint, believes that the solution is continuous authorisation. It means evaluating, as soon as an AI agent tries to carry out a particular action, whether it should be allowed to do so.In the recent episode of The Security Strategist podcast, Besik joined host Nitish Deshpande, a Senior Analyst at KuppingerCole, to talk about why AI agent governance needs restrategising, starting with continuous authorisation for non-human identities. Besik said that identity had to be something that you assessed at every action rather than something that you could check simply at the door.“The question most security leaders are asking is: Is this AI agent authorised with one-time permission?” Besik added, “It should be: Is this specific action by this agent on behalf of this human that has access to this data still authorised right now, in that very moment?”However, it goes to show a pivot from the static provisioning time process to a continuous, real-time plane of authorisation. “Identity has to be evaluated at every action, not something you can check once at the door,” Besik said. The change is necessary in a rapidly changing technology environment in the cybersecurity industry. In the past, human identities have been the main focus in the area of identity and access management (IAM), but the growing influence of agentic AI is quickly increasing the number of non-human identities working within enterprise environments.Why does AI Agent Governance Need an Audit Trail?According to Besik, businesses need three basic principles: human ownership coupled with deep context, an unchangeable record of agent activity, and constant risk assessment.A real-time ledger of all the agentic activities is what’s needed, the Saipaint Chief Product Officer notes. “An immutable record that agents cannot alter, because we've seen these agents erasing their tracks.”It’s like "something which you would have read about in a science fiction book ten years ago is now actually taking place."Without such an unchangeable record, enterprises run the risk of establishing what Besik refers to as "autonomy without accountability".The other option is what SailPoint refers to as “governed autonomy.” This comes in because an agent should never have the capability to exceed the permissions of a human.While AI agents can function on their own, they cannot go beyond the permissions granted to the human user they represent; all of their activities can be monitored, and their level of risk is constantly assessed.For Besik, this eventually leads to a convergence of the governance of human and non-human identities.He says that the identity, human governance and agentic NHI governance should all be brought together since each side needs the context from the other side. As enterprises go from experimenting with AI agents to putting them into use across their business-critical processes, AI agent identity governance may well serve as the link between AI autonomy and enterprise security.TakeawaysAI agent governance must go beyond discovery.Agents need clear human ownership and context.Authorisation should be validated continuously.AI security must cover prompts, planning/MCP actions and runtime.Human oversight should match the level of risk.Immutable logs are key to agent accountability.Human and non-human identity governance will converge.Chapters00:00 Introduction to the episode and guest01:01 Levent's background and expertise in identity and security02:05 Emerging challenges in AI trust and security03:22 The impact of AI waves on enterprise security04:21 From static to continuous trust in AI environments07:19 Discovery as a foundation for AI governance09:15 Lifecycle management of AI agents12:39 Real-time protection and continuous authorisation16:29 Layered security model for AI agents21:35 Balancing autonomy and human oversight in AI23:46 Converging human and AI governance strategies25:37 Final thoughts and industry outlookVisit sailpoint.com for further information on AI agent governance when dealing with non-human identities (NHI). AI Agent Identity Governance, AI Agent Security, AI Agent Governance, Non-Human Identity, NHI Governance, NHI Security, Continuous Authorisation, AI Identity Security, Enterprise AI Security, Agentic AI, Autonomous AI, Identity Governance, Identity Security, IAM, AI Access Governance, Shadow AI, AI Agent Lifecycle, AI Agent Discovery, AI Agent Accountability, Runtime Authorisation, MCP Security, AI Governance, Governed Autonomy, SailPoint, KuppingerCole, Security Strategist

AI adoption is moving faster than ever, and many organisations are struggling to put controls in place. Employees are already using AI to analyse information, write content, support decisions and solve problems. As a result, this often happens before security teams have had the opportunity to understand which tools are being used or what data is being shared with them.For Alan Hamilton, Global Chief Information Security Officer at GAM Investments, this is where the security challenge begins. With more than 20 years in security and responsibility spanning 16 jurisdictions and 32 regulators, Hamilton has seen how quickly a technology can move from experimentation to becoming part of everyday operations. In conversation with EM360Tech Head of Content and Podcast Host Trisha Pillay, he shares that organisations cannot secure what they cannot see.The issue is not simply whether employees are using AI. It is whether security teams understand how it is being used, what information is entering these systems, and what happens as AI begins to act rather than simply provide answers.AI Has Already Entered the WorkplaceThe speed of AI adoption is creating a visibility problem for security teams. Employees can access public AI services with very little friction, meaning the technology can become embedded in workflows before an organisation has established policies, approved tools or monitoring.Hamilton points to data exposure as one of the immediate concerns. Without appropriate controls, security teams have limited visibility into which AI services employees are using or what information they are putting into them. He describes examples where sensitive financial information was uploaded to a public AI service, forcing an organisation to release results earlier than planned. He also recounts a case where proprietary development code was entered into a public AI tool and subsequently reproduced by the service, compromising what had been a competitive advantage. This makes AI governance a practical security issue rather than a policy exercise.Hamilton's answer is not to block AI altogether. In his view, attempting to prohibit its use can simply push employees towards less visible services, potentially increasing rather than reducing the risk. Instead, security teams need visibility into AI activity, including the ability to monitor prompts and apply data loss prevention controls to web-based AI services.This is an important distinction for organisations moving into a more AI-dependent operating model: control does not necessarily mean prohibition.Security Has to Understand What the Business NeedsVisibility alone is not enough. Security teams also need to understand why employees are turning to particular AI tools in the first place.Hamilton describes how GAM has approached requests for AI tools outside its approved environment by examining the underlying business requirement. In some cases, a requested capability can be brought into an existing controlled environment. In others, particularly where investment professionals require specialised AI capabilities, the organisation can conduct due diligence and bring appropriate tools into its approved framework.That approach recognises an uncomfortable reality: the most secure tool on paper is not necessarily the tool that employees will use.If security departments simply dictate which tools employees can use without understanding their requirements, Hamilton warns that users will look for workarounds. The result is a familiar security problem, but with AI making it easier to create: technology operating outside the organisation's visibility and control.This becomes particularly important as AI moves beyond conventional chatbots. Once systems are given the ability to take actions, organisations can no longer treat them like ordinary software.Hamilton argues that AI systems need to be onboarded with clear boundaries, much like a new employee. Organisations need to establish what a system is allowed to do, which patterns it should follow, and what falls outside acceptable behaviour. The reason is straightforward: an AI system does not apply the same ethical judgement as a person. If an action appears to solve the problem it has been given, it may pursue that route unless appropriate restrictions are in place.And responsibility does not disappear simply because an AI system made the decision. Hamilton stresses that organisations and their executives can still be held accountable for actions taken by AI, particularly in regulated environments.AI Is Changing the Speed of the Security GameThe other side of the equation is that organisations are not only defending against AI-assisted activity; they are also facing attackers who can use AI to operate faster.Phishing provides one of the clearest examples. Hamilton describes a dramatic increase in phishing activity, with attacks now changing rapidly in response to defensive controls. On one occasion, his organisation received 17,000 phishing emails between 7 am and 11 am, with hundreds of new rules generated to respond to the changing attacks.For security teams, this changes the economics of response. A human team cannot manually analyse and respond to thousands of evolving attacks at machine speed. Hamilton's organisation has therefore introduced AI-based email security capable of analysing messages and adapting its rules as attacks change.The same acceleration is affecting vulnerability management. AI-assisted discovery can uncover large numbers of vulnerabilities in a short period, creating substantial testing and patching workloads. At the same time, attackers can use AI to develop exploits much faster than before, putting pressure on organisations that still operate lengthy patch cycles.This is where the broader question of operationalising intelligence becomes particularly relevant. As enterprise systems become faster, more autonomous and harder to reason about end-to-end, security teams cannot rely solely on processes designed for a slower environment.The challenge is not simply adopting AI or defending against it. It is maintaining enough visibility and control to understand what these systems are doing, while building the capability to respond at the speed at which threats now evolve.For Hamilton, one of the next major security problems will be determining what is real. As AI-generated voices, video and other forms of impersonation become harder to distinguish from genuine interactions, organisations will need better ways to verify identity and establish trust before sensitive actions are taken.That may ultimately be the central security lesson of AI adoption: what organisations cannot see, understand or verify can quickly become what puts them at risk.TakeawaysAI adoption in organisations.Security risks of AI use.Data and information security challenges.AI-generated phishing and impersonation.Security controls and monitoring for AI tools.Impact of AI on patch management and vulnerability response.Managing autonomous AI systems and accountability.Chapters00:00 Introduction to Alan Hamilton and his role at GAM Investments01:00 Alan's career background and experience in security02:20 The rapid adoption of AI and associated security risks03:15 Data risks from unregulated AI use in organisations04:33 The impact of AI on competitive advantage and code security05:23 Visibility and control challenges with employee use of AI tools08:34 Balancing employee needs and security controls for AI tools11:12 The rise of AI-generated phishing and its implications13:00 AI in email security and phishing detection tools15:20 AI's influence on security response speed and patch management19:19 Managing autonomous AI systems and their unpredictable actions22:05 The biggest security challenges as AI becomes more autonomous23:00 The importance of detecting AI-generated content and impersonation24:24 Future needs for AI detection tools and security practices

Cybersecurity faces the continued onslaught of distributed denial-of-service (DDoS) attacks. Websites, applications, and online services flooded with junk traffic are unable to serve legitimate users. Businesses lose revenue, budgets are strained, and customers lose faith. DDoS may not get the attention of ransomware headlines, but attackers are changing their tactics to launch larger, more sophisticated attacks. In this day and age, it’s easier to orchestrate for a range of purposes, including extortion, disruption, hacktivism, or hurting competitors’ bottom lines.Many are also powered by massive botnets made up of millions of compromised IoT devices. In this podcast episode of Security Strategist, host Richard Stiennon talks with Qrator Labs CTO Andrey Leskin about how these attacks are evolving and what organisations need to do to keep pace. They explore the growing scale and complexity of attacks, the role of massive botnets, practical approaches to DDoS mitigation, and how AI could accelerate existing attack capabilities.The Biggest Trend is ScaleLeskin started at Qrator Labs as a developer 14 years ago and worked his way up to chief technology officer. “I started off as the guy in IT who woke up at 3 a.m. because something stopped working,” Leskin tells Stiennon. “Now I’m the lucky guy who gets to wake up and try to fix things for our clients.”Today Qrator Labs manages cloud scrubbing infrastructure, bot management tools, and network monitoring services for hundreds of banks, betting platforms, e-commerce firms, media, education, tourism, and telcos throughout North and South America, Europe, the Middle East and Asia. That broad exposure gives him insight into the latest attack patterns. “Scale is the biggest trend,” Leskin says. An attack earlier this year topped two terabits per second and nearly one billion packets per second. It sustained that traffic rate for more than 40 minutes. During Q2, the company saw a doubling in terabit attacks (meaning attacks of one trillion bits per second or greater) year-over-year.“That used to be a super-rare once-a-quarter type of thing,” Leskin said. “Twelve is not unique. Bandwidth that used to be exceptional is now just regular Tuesday.” Botnets powering these attacks are getting bigger, too. One botnet monitored by Qrator since March of last year grew from around 1.5 million bots to over 13 million within about a year. The geographic diversity of infected hosts also continues to expand, making filtering traffic based on region less effective as an automated mitigation technique.Attacks are also easier to launch than ever before. Today attackers can find DDoS-for-hire services that simplify everything except deciding how much money they want to spend. Make the payment in cryptocurrency, paste in a target IP address or URL, and press launch. Many don’t need advanced technical knowledge. Decentralised command and control systems, including botnets using blockchain technology to coordinate activity, are complicating mitigation efforts further.Existing Mitigations Fall ShortA common DDoS myth, Leskin says, is the idea that hosting with a cloud provider or CDN somehow provides adequate protection from DDoS attacks. While a website or app might remain available, those services are designed to maximise uptime and performance, not fend off attacks specifically. Organisations are still on the hook for all of the network resources an attack consumes. “And then when the monthly bill arrives you realise you were DDoS’ed on your wallet,” Leskin said.Attackers are also leveraging multiple attack vectors more frequently. Instead of a single volumetric flood or application-layer attack, defenders might see both plus attempts to overwhelm other dependencies like a firm’s merchant processor. Leskin highlights how betting platforms saw an onslaught of attacks during the recent World Cup. Financial-services firms and fintech companies made up 44 per cent of DDoS attacks in Q1. That figure fell to 22 per cent in Q2 as attackers shifted their focus to gambling platforms, where attacks reached 1.5 terabits per second.Tips for Defending Against Tomorrow’s AttacksPreparing for these evolving threats starts with being operationally prepared, rather than buying into any one silver-bullet technology, Leskin said:Know and understand your normal traffic profile down to the protocol level and by time of day or season. Traffic during a World Cup final will look very different to normal operations for a betting platform.Expect blended attacks that use more than one vector designed to evade traditional DDoS mitigation systems.Botnets are nothing new, but blocking them is still important. In the first quarter of 2026, Qrator blocked an average of 2.5 billion malicious bot requests each month. While not considered DDoS, these attacks can still have a significant impact on performance.Have an incident response plan that you’ve practised so you can respond as quickly as possible when an attack happens.From a tech perspective, there are two main categories of DDoS mitigation, each with advantages and disadvantages:DNS-based protectionEasy to implement; works well at mitigating attacks against websites and web applicationsDoesn’t work for everything routed outside of DNS, like voice services or game serversBGP-based mitigationHandles any type of network traffic at the network layer.You need to own your own network; can take up to one full day to implement.AI and DDoS AttacksLeskin says that he doesn't expect AI to introduce new types of attacks. Instead, he sees it accelerating what already exists, helping attackers scan for vulnerable devices faster, automate reconnaissance, and grow botnets more efficiently. In other words, AI mostly lowers the cost and skill threshold for doing what attackers already do. Combined with the rise of DDoS-for-hire services, pushes more of the "easy attack" trend described earlier. His closing point was less about tools than posture: "Security isn't a state you achieve one time. It's a process you maintain, because whatever you're defending against is actively evolving against you."The figures cited reflect Qrator Labs’ own network telemetry and provide a view into the attack trends observed across its protected infrastructure. While they do not represent the entire global DDoS landscape, they highlight a clear direction. For most organisations, the practical implication isn't "buy more bandwidth." It's building the muscle memory, traffic baselines, tested response plans, and mitigation that matches how you actually operate before an attack forces the issue. If you would like to learn more, visit qrator.net or follow Andrey Leskin on LinkedIn.TakeawaysThe scale and evolution of DDoS attacks from 2020 to 2026.The role of botnets and their growth in size and geographic diversity.Common motivations behind DDoS attacks.Limitations of CDN and cloud provider protections against DDoS.Best practices for organisations to assess and improve their DDoS resilience.Technical mitigation techniques including DNS and BGP-based protections.The importance of continuous security posture review.Future trends including AI-driven attack methods and multi-vector incidentsChapters00:00 Introduction to the episode and guest Andrey Leskin01:04 Overview of Qrator Labs and their cybersecurity services02:46 The evolution and scale of DDoS attacks from 2020 to 202604:09 Growth of botnets and their geographic diversification05:22 Motivations behind DDoS attacks and attacker profiles07:49 Limitations of CDN and cloud protections against DDoS09:16 Technical mitigation strategies: DNS and BGP protections11:21 Proactive customer acquisition and security readiness13:06 Key checklist items for organisations to improve resilience17:24 Technical defences: DNS and BGP mitigation explained21:07 Current threat landscape across industries and sectors24:16 Future of DDoS attacks and AI-driven threats

The biggest cybersecurity challenges when it comes to integrating AI platforms like Microsoft Copilot, ChatGPT Enterprise or any other AI agents for enterprises may seem to be pertinent to governance, acceptable use policies and employee training in AI. However, that is not always the case. Ultimately, it comes down to a challenge with the data.In the recent episode of The Security Strategist podcast, host Shubhangi Dua, Podcast Producer and B2B Tech Journalist, is joined by Itay Maor, Head of Product at Orion Security. They address the foundational issue with deploying agentic AI to enterprise workflows, which comes down to Data Loss Prevention (DLP).Maor begins the conversation with the statement: “Data loss is preventable. It's not just observable.”He adds that only by dropping assumptions built over 20 years of ineffective DLP can teams successfully make Data Loss Prevention work.What Is Hindering Enterprise Security from Adapting to an AI-First World?For enterprises to become a core part of an AI-first world, data must be protected from an early start. As soon as tools like Copilot or ChatGPT Enterprise enter the picture, sensitive data begins flowing into prompts. The issue is that security teams often lack visibility into what employees are inputting, such as customer records, deal terms, or source code.Firstly, blocking the AI is not going to work in this scenario because AI is here to stay. The issue that needs addressing is that security teams need to be able to see where the enterprise data is flowing.Maor believes AI hasn't created an entirely new security problem; it has exposed one that has existed for years.“Customer records, source code, deal terms- legacy DLP doesn’t help much because they were built to match patterns, credit card numbers, keywords. Pasting a Q3 revenue forecast into a chatbot won't trigger standard security alerts,” he says, putting it into context.“You approve ChatGPT Enterprise, but what if your employee just logged in using their personal account? Same URL, same interface, same browser, and your network controls say chatgpt.com and waves it through,” Maor adds.Security teams need to know which identity the data is flowing to. Right now, it's difficult for them to differentiate.The third layer, however, is where the market is heading because it depicts where the AI is connected to the data. For instance, Microsoft Copilot is wired into SharePoint and ChatGPT. Cloud connects to Google Drive, to Slack, and to email through native connectors. Meanwhile, the agents query internal systems on their own autonomously.“There is no upload, no paste, no human action to inspect at all,” the Head of Product at Orion tells Dua.AI agents end up inheriting 10 years of over-permisioning, he says; “it happily surfaces an M&A document to anyone with access that was never cleaned up, making it searchable in plain English.”Each of these three layers widens the gap that all controls can cover. So, the first challenge isn't blocking AI; it's that you can no longer answer where your data is going, and everything else in AI security starts with that question.How Security Teams Must Move From Detection to Data Loss PreventionMaor proposes that enterprises need to shift their mindset from detection to prevention, asserting that "Prevention is the goal, not just detection with good reporting.“Lead with the mindset before the tactics,” he advises enterprises, “data loss is preventable, and that should be the mindset, not just observable.”This means security teams must stop enumerating every risk as a policy up front, unlike before. Policies are essential for deterministic rules, and they’re not going away. If a rule says ‘PCI data never leaves production’, but the era of managing hundreds of policies is over.Another mindset shift is needed around false positives. Teams need to stop treating high false-positive rates as simply the cost of doing business. They're not some unavoidable force of nature. “They don't have to live with them. The problem is that when false positives become the norm, you train your team to ignore alerts—including the ones that actually matter,” he says to Dua.And finally, enterprises need to stop staffing around the problem instead of solving it. Adding more analysts to a queue that's growing faster than your headcount isn't a scalable strategy. It's better to reduce the noise than to keep expanding the team that's trying to manage it.As enterprises continue embracing AI, Orion's view is that the future of data security won't be defined by more dashboards or more point solutions. It will be defined by knowing where data is moving, understanding why it's moving and preventing loss before it happens.TakeawaysDLP tools are overwhelmed with false positives.AI can provide real-time contextual understanding.Traditional DLP systems are not equipped for modern data challenges.The future of data security relies on AI-driven solutions.Guardrails are essential for safe AI usage in enterprises.Real-time monitoring is crucial for effective data protection.Policies should be limited and focused on specific use cases.AI can recognise sensitive data patterns that traditional methods cannot.Data security must adapt to the rapid evolution of AI technologies.Education on new risks is vital for enterprises.Chapters00:00 The Evolution of Data Loss Prevention (DLP)02:54 AI's Role in Redefining Data Security06:12 Challenges of Traditional DLP Systems09:02 The Need for Contextual Understanding in DLP12:07 Guardrails for AI in Data Security15:04 Transitioning from Policies to AI-Driven Solutions17:54 Real-World Examples of Data Protection20:49 The Future of DLP and Data SecurityWatch the full episode of The Security Strategist podcast to hear Itay Maor, Head of Product at Orion, discuss how AI is reshaping enterprise DLP and what security leaders should act on next. Visit orionsec.io.AI-native DLP, Data Loss Prevention, DLP, Enterprise DLP, AI Security, Enterprise AI Security, AI Data Security, Data Security, Microsoft Copilot, ChatGPT Enterprise, AI Agents, Agentic AI, Enterprise Data Protection, Sensitive Data, Cybersecurity, CISO, Contextual DLP, AI-Driven DLP, Data Loss Prevention AI, AI Security Strategy

You’re in an argument with your AI bot on ChatGPT; suddenly, your screen is locked. None of the keys on your keyboard work, and then you see a ransom note displayed on the screen. The systems have been encrypted, and the incident response team has been activated. The executives go to the one thing they had been told would save them, which is the backups.Enterprises may believe their data is safe because of their immutable backups. But according to Mark Grazman, CEO of Fenix24, they are likely mistaken and often realise this after ransomware has already hit them.At some stage of a ransomware attack, the assumptions of cybersecurity come up against reality.In the recent episode of The Security Strategist podcast, host Richard Stiennon, Chief Research Analyst at IT-Harvest, is joined by Mark Grazman, CEO and Co-Founder of the ransomware recovery company Fenix24. They discuss the critical aspects of ransomware resiliency, including the four pillars of recoverability—survivability, completeness, speed, and assurance. They also talk about how enterprises can better prepare for and respond to attacks.When Stiennon asked Grazman what's the thing he would assess that incident response playbooks miss if he walked into an active incident right now. Grazman says after a scoping call, he would ask the affected enterprise if their data was immutable. Most people say yes. “There’s an 84 per cent chance that they’re wrong,” he adds. “The attack already happened, the data's already gone, and they don't even know it yet.”The issue, he says that enterprises are practising and simulating that the data’s gone along with the infrastructure. “They're practising that there was a hurricane or a fire or a replication or an event as opposed to a true ransomware.”Also Read: Ransomware Attacks: What You Need to KnowFind the latest cybersecurity insights, podcast episodes, and expert analysis on EM360Tech.cpm. Visit fenix24.com for more information.Takeaways84% of enterprises may be wrong about backup immutability.Surviving backups do not guarantee successful recovery.Ransomware recovery depends on four pillars: survivability, completeness, speed, and assurance.Critical applications rely on more infrastructure than enterprises often realise.Traditional disaster recovery tests may not reflect a ransomware attack.Cybersecurity budgets need more investment in recovery readiness.Chapters00:00 Introduction to ransomware resiliency and Mark Grazman's expertise01:20 Assessing incident response priorities in real-time attacks02:06 The myth of immutable data and common misconceptions03:06 Breaking down the four pillars of resiliency04:03 Survivability: Protecting critical data and dependencies05:02 Completeness: Ensuring full data and infrastructure recovery07:32 Speed: Rehydration, containment, and infrastructure considerations09:30 The importance of assurance and continuous testing11:09 Applying resiliency principles to other disasters12:37 The gap between enterprise expectations and reality13:05 Evolving offence and defence in ransomware protection14:39 Pre-attack preparedness and the Argos platform16:06 The process of resiliency assessment and tuning19:18 Organisational roles and collaboration for effective recovery21:18 Key message for CISOs, CIOs, and CEOs on resiliency23:30 Closing remarks and resources for further information

Security teams around the world have always tried to play a balancing act when it comes to authentication. If there are too many measures put in place, people will always find a way to get through it. In the world of rapid AI advancement, this balancing act is proving to be more difficult for organisations. The reason is that AI agents proliferate; they're now able to perform tasks on behalf of employees and customers without a human overseeing every action. So what needs to be done to prevent your organisation from being exposed?On this episode of the Security Strategist Podcast, host Trisha Pillay talks with Dan Moore, Senior Director of CIAM Strategy and Identity Standards at FusionAuth, about how and why identity has become the new security perimeter. Moore has worked for almost six years at FusionAuth, starting in developer relations before stints in sales engineering and implementation prior to his current role. At FusionAuth, he helps track standards bodies like the IETF and OpenID Foundation and determines which fledgling methods are ready for adoption into the product.The Security-Usability Tension Gets SharperFinding the right balance between strong security and a smooth user experience is a challenge organisations have faced for years. Moore traces it back to the invention of the first password field in the 1960s. Various industries have adopted different approaches to ensure that there is a balancing act of strong security and a smooth user experience for their customers. For example, banks are willing to require more security checks than a consumer app because the risks are so much higher.The old methods of authentication were designed for a world where every login belonged to a person making decisions at human speed. This has all changed now because of AI agents. Unlike people, AI agents can work independently, run continuously, and complete thousands of tasks in seconds. This speed and scale mean they can also cause far more damage in a matter of seconds if something goes wrong. AI agents need to work independently, so traditional human-focused security measures like MFA and CAPTCHAs often get in the way. It's also important to know that removing those checks doesn't just eliminate the security risks. This simply means those risks can happen so much faster. At the same time, asking humans to approve everything isn't a solution either, because people quickly become overwhelmed and stop paying attention.Adaptive Authentication in PracticeThis is where identity is shifting from a single check at the door towards continuous and contextual verification. Moore describes it as moving away from a binary model, because risk no longer lives only at the login screen. It follows the session, the device and the ongoing behaviour within an application. FusionAuth worked with a platform connecting caregivers with families needing support, a sector handling sensitive data including that of minors. By adding enterprise single sign-on and multi-factor authentication, the company cut its authentication development time by 90 per cent and opened up business markets it previously couldn't serve, proof, Moore says, that tighter security and a better user experience aren't mutually exclusive when the approach is intelligent about context.Giving AI Agents Their Own IdentityOne of the biggest shifts discussed is the need to stop thinking of AI agents as just another user account. Instead, organisations need to manage them as separate digital identities with their own permissions and controls. Moore recounts a colleague mentioning they would let an AI assistant drive their browser while logged in as themselves. This becomes indistinguishable, from the system's perspective, from the person acting directly. Without a separate identity, there's no way to apply different policy, add extra checks, or restrict what an agent can do relative to its human counterpart. With all that said, it's no wonder that AI agents need their own identities, provisioning, and scope, along with their own audit trail. The risk comes down to velocity. A compromised employee can only do so much before they're detected, but a misbehaving AI agent can make thousands of decisions, access systems, and execute actions in the same amount of time.Moore frames trust as resting on three interlocking layers: identity validation, audit, and policy enforcement. Validation establishes who or what is acting; audit records what actually happened, which matters given how unpredictable agent behaviour can be; and policy enforcement, built on principles like least privilege and short-lived, task-scoped credentials, limits the damage if something goes wrong. All three layers work together to build trust, he says, because each one compensates for what the others struggle to catch alone.His advice for organisations still finding their footing is to start small rather than wait for a polished strategy: inventory the AI agents and automated processes already running, note what kind of credentials they rely on, and begin shifting static API keys towards short-lived, standardised grants. Above all, he argues, AI identities deserve their own category tied to an accountable human or team, but never simply reused from existing human or service accounts. If you would like to find out more about this, visit FusionAuth or connect with Moore on LinkedIn.TakeawaysThe changing role of identity in security.Challenges of AI-powered applications and autonomous agents.Adaptive authentication and risk-based security.Building trust through identity validation, audit, and policy enforcement.Practical steps for organisations to enhance security in AI environments.Chapters00:00 Introduction01:28 Guest background and role at Fusion Auth03:07 The security-usability tension in identity management04:13 Impact of AI and autonomous agents on security05:56 Balancing security controls with user experience09:02 The shift to adaptive, context-aware authentication11:48 Real-world example of security and usability balance14:04 AI identities versus human identities17:53 Building trust in AI systems with layered security23:34 Practical steps for organisations to prepare for AI security27:30 Closing remarks and resources

Prioritisation is the way to tackle enterprise data challenges. It may seem like a simple solution, and it might be too. If you’re an enterprise overwhelmed by vulnerabilities in data, especially with the evolution of AI and automation, this conversation is for you. In the recent episode of The Security Strategist podcast, host Shubhangi Dua, Podcast Producer and B2B Tech Journalist at EM360Tech, sat down with James Walta, Vice President of Product Management at Brinqa. The agenda for this episode was to break down why enterprises are overwhelmed by vulnerability data. Additionally, Walta lays out a strategic plan of action to help enterprises prioritise vulnerabilities proactively rather than reactively. The discussion builds on the previous episode, where Brinqa CSO Brad Hibbert and host Richard Stiennon, Chief Research Analyst at IT-Harvest, talked about how AI is helping attackers with faster scanning, smarter exploit chaining, and machine-speed intrusions. Walta continues this conversation with EM360Tech’s Dua, focusing on prioritisation in exposure management strategies. He puts up a case noting AI will not rescue security teams from unorganisation unless the underlying data is ‘good’ and reliable.TakeawaysContext is crucial for effective cybersecurity management.The chaos in cybersecurity is amplified by AI-driven vulnerabilities.Data quality is foundational for prioritisation and remediation.Patching faster is not always the best approach; understanding risk is key.Operational clarity can be achieved by unifying asset visibility.Prioritisation must be based on business context and asset sensitivity.AI can help but may also amplify confusion if data is poor.CISOs should focus on outcome metrics rather than activity metrics.Effective vulnerability management requires a clear understanding of ownership.The conversation around cybersecurity must evolve to address real risk reduction.Chapters00:00 Navigating Cybersecurity Chaos02:52 The Importance of Context in Cybersecurity06:07 Bridging the Gap: From Vulnerability Detection to Remediation09:09 Understanding Risk Over Speed11:46 Enhancing Data Quality for Better Decision Making14:57 Operational Clarity: Transforming Overload into Insight18:05 Measuring Success Beyond Vulnerability CountsVisit brinqa.com for more information on how enterprises should prioritise vulnerabilities proactively.Vulnerability Management, Exposure Management, Cybersecurity Strategy, AI in Security, Risk Prioritisation, Brinqa, EM360Tech, The Security Strategist, Cyber Risk, Data Quality, CISO, Threat Exposure Management, Asset Visibility, IT Security, Risk Reduction, James Walta

Every CISO out there faces one key challenge: the challenge of getting the board to acknowledge cybersecurity as a top enterprise risk management priority. According to the ClearPoint Strategy Strategic Planning Report, only 51 per cent of active strategic and corporate projects maintain a steady Green status. The remaining 49 per cent fluctuate between Amber and Red, requiring varying levels of intervention.This goes to show that many investment decisions are reliant on red, amber and green dashboards and not on financial exposure. According to Mike Saxton, CRO at MyCiso, the issue relates to cyber reporting often lacking portability. “A director may be highly experienced and commercially sophisticated, but still struggle to compare risk posture between organisations because the underlying reporting models are inconsistent.”With AI also in the picture now, the speed and scale of attacks is rapidly rising; that gap is becoming harder to defend. This is why in the recent episode of The Security Strategist podcast, E360Tech’s host Shubhangi Dua, Tech Journalist and Podcast Producer, was joined by Asdrúbal Pichardo, CEO at Squalify, 3x SaaS CEO, Board Advisor, Start-Up Mentor, Non-Executive Director. This podcast breaks down how to actually turn technical risk into something the rest of the business can realistically manage, measure, and report on.Translating Cyber Risk for the Boardroom: A CISO’s Guide to Financial QuantificationPichardo says when it comes to cyber risk, it's time to avoid reporting based on qualitative metrics; instead, portray more quantitative metrics. This means really talking to the executives and the boards in the language of business “which is money.”"CISOs need to rely less on qualitative assessments. They need to translate the cyber risk into financial figures so the board will understand the implications of cyber."CISOs typically present cyber risk through technical metrics, maturity scores and vulnerability reports, but boardrooms tend to avoid making decisions based on technical language. This is why translating that cybersecurity technical jargon into metrics is essential for boardrooms. They think in terms of financial exposure, business resilience and return on investment (ROI).The CEO of Squalify explains why the future of cybersecurity leadership depends less on explaining threats and more on quantifying business impact. He puts up a case for enterprises requiring a common language that is comprehensible by both security teams and executives instead of relying on technical dashboard data.Leveraging AI Vulnerability Detection: The Strategic Advantage of MythosArtificial intelligence (AI) has made it more complex from every corner. AI-driven cyber attacks are on the rise. On the other side, AI is being deployed by defenders to protect their platforms as well as to optimise the speed and effectiveness of AI tools and integrate it into their workflows. Ultimately, AI has, for better or worse, blurred the line between cybersecurity, governance and business continuity. To put into perspective, Dua asked Pichardo about Anthropic's Mythos model’s incredible vulnerabilities-spotting capabilities. He said that Mythos is causing a lot of dialogue in the industry right now, but the vulnerability-discovering capabilities had existed for years, and those tools went unnoticed. While industry individuals may be concerned about attackers taking advantage of AI tools like Mythos, enterprises should be able to access the same technology to identify and fix those weaknesses before attackers exploit them. However, geopolitical tensions and other economic disparities have made it hard for enterprises to access.The key idea is that defenders have an advantage because they know their own systems. He says, “The hacker doesn't have the knowledge, or the source code from your enterprise. You already have it, so enterprises need to get there with Mythos before the hacker comes to you with Mythos.”The issue he spotlights is that American companies have been given access to Mythos, but the US government has restricted access outside of the nation. “At the end it should it should it should get into the right hands because it's probably already in the wrong hands,” the CEO states.The conversation around Anthropic’s Mythos model depicts a shift in the enterprise tech and cybersecurity industry. While much of the discussion has focused on how attackers might exploit increasingly capable AI, Pichardo sees the greater opportunity for defenders.Also Read: Fraud Tops CEO Cyber Concerns as Ransomware Attacks Continue to SurgeConverting Cyber Risk into Strategic InvestmentFor boardrooms, the new question they must pose is whether enterprises are optimising AI quickly, efficiently, and, most of all, safely to minimise risks before adversaries get to it. The recent cyberattack by a rogue OpenAI AI model on Hugging Face was an eye-opener for all. In a worst-case scenario, imagine if the hackers’ AI agents began penetrating secure enterprise tech platforms at a rate that’s hard to fend off their strikes.AI has moved from being a technical capability to a strategic investment decision one that should be measured in business impact rather than technology adoption.“If you can demonstrate that the likelihood of experiencing a disruption because of AI is higher in numbers, that will change the minds of any boardroom. This applies to any industry, from public sector and banking, financial, manufacturing, defence, energy,” notes Pichardo. He added that at Squalify’s mother company, Munich Re, the world's largest cyber reinsurer ensures that AI’s impact on cyber risk is visible not only from a technical perspective but a business perspective as well. "It goes beyond tech or IT; it's processes, governance, business operations.”Ultimately, enterprises need to quantify cyber risk so they are better able to defend against the AI-driven threat landscape at any given time. TakeawaysCyber risk quantification is becoming a boardroom necessityAI is increasing attack velocity, not just sophisticationDefensive AI can create a competitive advantageCyber and AI risk are converging into enterprise riskBoard AI literacy is becoming a strategic capabilityChapters00:00 Understanding Cyber Risk in Business02:42 The Differences in Cyber Risk Management: US vs Europe05:42 The Evolution of Risk Management with AI08:46 Quantifying Cyber Risk: The Role of Squalify11:34 Real-World Applications: Onboarding Clients at Squalify14:53 The Importance of Financial Metrics in Cybersecurity17:38 AI's Impact on Cybersecurity and Business Operations20:20 The Future of AI in Cyber Risk Management23:32 Key Takeaways for CISOs and Board MembersWatch the full episode of The Security Strategist Podcast to hear Asdrúbal Pichardo discuss cyber risk quantification, AI governance, boardroom communication and what enterprise leaders should prioritise next.

The one key thing that could aid enterprise success in the agentic AI cybersecurity space today is its ability to understand agents' intent. It’s easy to state but hard to convert into an actionable security strategy. This is why in the recent episode of The Security Strategist podcast, host John Tolbert is joined by Dror Zelber, VP Product Marketing at Radware and Dhanesh Ramachandran, Product Marketing Manager at Radware. They got together to discuss the emerging challenges of agentic AI security and how to tackle it realistically. More specifically, they break down what it actually means to secure AI agents, whether they are interacting with internet-facing applications on behalf of users or operating within enterprise environments, emphasising the importance of behavioural monitoring and visibility in managing AI agent interactions.The conversation further spotlighted the need for enterprises to establish trust and governance frameworks for AI agents while prioritising security budgets and strategies.Also Watch: Unmasking the Invisible Threat: Defend Your APIs Before Attackers DoTakeawaysAgentic AI introduces new security challenges compared to traditional applications.The attack surface for AI agents is significantly broader and easier to exploit.Behavioural monitoring is crucial for understanding AI agent actions and intent.Enterprises must prioritise visibility into AI agent activity.Trust and identity verification are key challenges in the agentic era.CISOs should allocate budgets for AI security solutions early in the deployment process.Strict policies and governance are necessary for deploying AI agents.Monitoring and auditing are essential to prevent unauthorised actions by agents.Enterprises need to distinguish between beneficial and risky AI agent behaviour.The future of security lies in enabling beneficial AI interactions while maintaining safeguards.Chapters00:00 Introduction to Agentic AI Security01:25 Emerging Security Challenges with Agentic AI05:37 Traditional Security Measures vs. Agentic AI10:44 Current Activity of AI Agents in Enterprises14:29 Distinguishing Beneficial vs. Risky AI Agent Activity17:13 Establishing Agent Identity and Authority23:18 Priorities for CISOs in the Agentic EraWatch the full episode for complete insights on autonomous AI agents, the future of AI cybersecurity and how enterprises can effectively manage risky AI agent behaviour while still taking advantage of the agentic technology. For further information, visit radware.com.

Autonomous AI agents are becoming a part of most enterprise workflows today. But how are enterprises protecting their platforms from rogue agents? For instance, the recent attack on Hugging Face was discovered to be carried out by an OpenAI rogue AI model that escaped testing from a secure environment. To answer how best enterprises can protect themselves from unique, unpredictable attacks by upcoming technologies such as rogue AI agents, Sagi Rodin, CEO and Co-Founder of Agen.co by Frontegg, joins host Alejandro Leal, Lead Analyst at Kuppinger Cole Analysts firm, on an episode of The Security Strategist podcast. They talk about the constantly changing nature of AI agent governance, identity management, and security in enterprise environments. They further explore how autonomous AI agents challenge traditional security models and what strategies enterprises need to adopt to stay secure.What is Agen.co?When asked about the dynamics of AI agents and how they individually carry risk, the focus seems to be moving to governance of specific actions in real-time. Instead of relying on the agent's initial authentication status, agents are going beyond identity to “per-action” governance. Rodin puts it into context: “We [Frontegg] released Agen.co, a product that governs runtime agentic activity. We take an identity-first approach by connecting to identity providers, agent repositories, and user directories. In addition to managing users, we now maintain a registry of AI agents.”The goal is to connect all those principles and manage unique identities in an enterprise. These include conventional automated machines, human users, user-controlled AI agents, autonomous AI agents that run on their own post-deployment, as well as malicious bots that need to be identified quickly and blocked. Rodin said that Frontegg is bringing all of those identities together under a single governance model.How to Stop AI Agent-Driven Malicious Actions in Real-Time?As an identity-native platform that connects to the IDP, the agent repository and user repositories, Agen.co by Frontegg has become a registry for agents. “The industry has a broken mental model today,” Rodin tells Leal. When asked why, he said that while identity tools pose the question of identity, they may not ask the purpose of entry. That means an agent with valid credentials passes every identity check. It’s called “role-based access”, originally designed for humans. An agent conducts thousands of actions per day, but each of those actions carries a risk. This is why individual governance of each action by those AI agents is critical. This is why Agen.co provides a very quick verdict in under thirty milliseconds to avoid obstructing workflows while stopping malicious actions in real-time.“We must operate on the runtime side because an agent can bypass static gates established during login or registration,” Rodin says. “We need to be present the moment an agent accesses organisational data, attempts a prompt, or executes a potentially damaging command, like 'rm -rf' on an endpoint.”Simply granting an agent a ticket at registration is insufficient to keep up with the dynamic and fast-paced scale of modern agent operations.While enterprises cannot be obstacles in the path of automation, they can use a platform to operate extremely quickly and efficiently to stop threats from occurring. As AI agents adapt with more autonomous capabilities and proliferate across departments in an enterprise, be it engineering, finance or marketing, these AI agents act without clear ownership.Rodin says there shouldn’t be any agents running without a named human owner. He says that with governance, enterprises must take accountability. “Every single action needs to be traced back to a person. AI agents don't get a pass on ownership.”“When the regulator, the board, or the department owner asks who was responsible for this action, at the end of the day you need a name, so this is a core principle we impose for our AI native activity,” he added.TakeawaysIdentity verifies who; runtime governance verifies every action.Identity proves who—runtime proves what's safe.Every AI agent action needs its own security decision.Static IAM can't govern autonomous AI behaviour.Every enterprise AI agent needs a named owner.Agent governance is becoming a runtime security challenge.Chapters00:00 Introduction to AI Agents and Security Challenges06:23 The Shift from Identity to Behaviour in Security10:09 The Importance of Continuous Validation16:09 Accountability in the Age of Autonomous Agents20:19 Key Takeaways for Security Leaders

The future of inequality in cybersecurity has been coming to light since the beginning of the AI evolution. Greg Notch, the Chief Technology Officer (CTO) at Expel, recently predicted that the “AI poverty line” is projected to be more severe than the traditional security line."The AI poverty line will be even crazier in some ways because you will either have the ability to understand and wield AI properly or you will not,” he stated. “That gulf is going to be interesting."In the recent episode of The Security Strategist podcast, host Brad LaPorte, Gartner Veteran and Advisor at Lionfish Tech Advisors, sat down with Greg Notch, CTO at Expel, to address the impact of AI on security operations. They discuss the AI poverty line and lay out a plan for how enterprises can adapt to the rapid pace of change introduced by AI.They also explore the balance between automation and human oversight, trust versus impact, and future trends in AI-driven security.What is the AI Poverty Line?According to Notch, the AI poverty line is the growing divide between security capabilities and one’s ability to effectively optimise AI.While a security poverty line has existed for a long time, an AI version will begin appearing. It could be more complex and niche. Security teams may face difficulties defining their roles and responsibilities, and only those who can wield AI skillfully and effectively.For instance, he alludes to an example of a large tech enterprise such as CrowdStrike, Palo Alto or even Microsoft. As a large enterprise employing AI-skilled professionals, “you would want to leverage as much of that as you can because your head count is is is limited. If you can't hire enough people to manage the operation, you may have to outsource that” to an AI-skilled professional.However, with attackers' increasing sophistication, the enterprise should be capable of equally able to detect and responding to vulnerabilities. This is why automation alone is not enough.A resilient cybersecurity strategy requires a team equipped to use AI-backed security tools to actively monitor, manage, and respond to threats, using automation. This should help human decisions rather than replace them with a bot.Also Read: What Is AI Value Management and Why Are Enterprises Suddenly Prioritising It?Where Does AI Belong in the Security Operations Centre (SOC)?AI and automation ultimately exist to aid Security Operations Centre (SOC) teams. Its capabilities allow assistance to human analysts, acting autonomously and contribute to how enterprises can effectively optimise AI to boost their security posture.Both LaPorte and Notch agree that the role of AI in SOC is collaborative. It’s a hybrid model where humans maintain control.LaPorte takes the example of a motorcycle, stating it’s like a motorcycle “with a sidecar.” “The human is riding the motorcycle, but the AI is along for the ride. It adds additional capability, additional storage and functionality.“It's a new world, but it's a hybrid world."While Notch rhetorically questions whether a SOC is needed. He asks the audience to imagine a scenario without SOC analysts. It’s not possible even if it’s intermediated by AI. “I believe we’ll have more humans in the loop.”Why Automation is Essential?As attackers become more sophisticated in their threat intelligence strategies, enterprises too have to keep up. That means they too need to leverage automation capabilities of AI.Some easy actions that can be automated without human intervention are to block known malicious IPs or contain compromised devices. This becomes extremely crucial during high-stakes situations where time is of the essence.Automation is essential to address two primary business and operational challenges – mitigating the risk of active attackers and resolving the inefficiency caused by alert fatigue.Notch argues that the risk of failing to stop an active attack outweighs the risks associated with introducing automation into the environment. "All security leadership decisions should be grounded in risk.”Security leadership should think about “what is the risk of not doing a particular task versus the risk of doing it? For instance, automation.”“We're accepting different risks, but we believe the risk of not being able to stop an active attacker in our environment is worth that. That's the trade-off you have to make,” Notch tells LaPorte.Where Expel comes in?Notch describes Expel's approach as a solution for security operations—specifically pertinent to auto-remediation before AI was a thing.Expel launched an auto-remediation feature about seven or eight years ago based on heuristics. It wasn't driven by AI back then. It was unclear whether Expel’s customers would adopt it, as trust had to be established before adoption.Notch explains that's because customers had to be comfortable letting a third-party security provider automatically take actions. For instance, letting the party isolate infected laptops, shutting down compromised cloud systems, stopping malicious programs, and responding to attacks without waiting for someone from the company to approve it.Expel discovered that customers were willing to trust this automation because it could stop attacks much faster than waiting for a person within the company to act.Today, many enterprises would rather let the system stop or contain an attack immediately and investigate what happened afterwards.By understanding where AI can effectively assist or act autonomously, enterprises can enhance their cybersecurity posture while managing risks.The key is to develop a thoughtful approach that balances automation with human expertise, ensuring that AI serves as a powerful ally in the fight against cyber threats.Watch the podcast on em360tech.com for a deeper understanding and expert thought leadership insights.For further information, visit expel.com.TakeawaysAI is transforming the speed and nature of cyber attacks.Automation in security must be balanced with human oversight.Trust is crucial when implementing AI in security operations.AI can enhance detection but requires careful implementation.The future of SOCs will involve more human-AI collaboration.Organisations must adapt to the evolving threat landscape.False positives remain a significant challenge in SOCs.AI can help streamline operations but is not a silver bullet.Security decisions should be grounded in risk management.The hype around AI in cybersecurity often oversells its capabilities.Chapters00:00 Introduction to AI in Cybersecurity03:03 The Speed of AI-Driven Attacks06:00 Automation and Trust in Security Operations09:01 AI's Role: Acting Alone vs. Assisting12:00 The Future of AI in Security Operations14:46 The Hype vs. Reality of AI in SOCs17:59 Navigating the AI Landscape in Cybersecurity20:51 Conclusion and Key TakeawaysCybersecurity, AI in Cybersecurity, SOC, Security Operations Centre, Expel, Greg Notch, Brad LaPorte, AI Poverty Line, Cyber Defence, Automated Security, Threat Intelligence, Security Leadership, Risk Management, Human-in-the-loop AI, Enterprise Cyber Strategy#AIPovertyLine #Cybersecurity #SOC #AISecurity #TheSecurityStrategist #InfoSec #Expel #EnterpriseSecurity

Key frontier models are now capable of spotting vulnerabilities that no one thought even existed. They are finding software vulnerabilities at scale without any prompting, presenting both opportunities and challenges for security teams. For instance, recently, the Associated Press reported on the Anthropic Mythos model, spotting vulnerabilities in highly sensitive U.S. government computer systems during a testing exercise. Security researchers describe this ability as dual-use.The Mythos model, part of Anthropic’s project Glasswing, partnered with national intelligence agencies to find and fix vulnerabilities in critical systems before attackers get to them, as per AP. The frontier AI model “broke into almost all of our classified systems, not in weeks, but in hours,” Joshua Rudd, National Security Agency (NSA) chief, seems to have informed Senator Mark Warner of Virginia.This kind of scanning capability helps defenders patch vulnerabilities faster, and also provides attackers with a more effective tool. As our guest noted in the recent The Security Strategist podcast episode, it's "almost like a new weapon." Both sides of the security battle believe they can leverage it to their advantage.This tension sets the stage for a conversation that has been growing in enterprise security circles throughout the year – Shadow AI.In this episode of The Security Strategist podcast, host Shubhangi Dua, Podcast Producer and B2B Tech Journalist at EM360Tech, sat down with Guru Sethupathy, Head of AI Governance at Optro, to break down Shadow AI and its looming threats in 2026 and beyond.Over the last couple of years, Shadow AI has mainly involved employees entering sensitive data into ChatGPT while IT teams rushed to respond. This summer, the narrative has changed. The EU AI Act's regulatory clock is ticking. Meanwhile, Shadow AI is transforming into autonomous "shadow agents" that operate without waiting for human approval at every step.Sethupathy believes many enterprises are about to realise they can't comply with regulations for systems they don’t even know they're using.Rogue Chatbots to Rogue AgentsShadow AI isn’t a new concept, but Sethupathy challenged the notion that enterprises have been aware of it for years. "Even into 2024, Shadow AI was not the main priority for enterprises," he said. It only gained traction heading into 2025, and "it has dramatically increased in 2026."Two factors are driving this shift, he explained. The first is the "democratisation of AI." Any employee within an enterprise can now access and interact with AI tools directly. The second factor is the countless ways AI can enter a company. AI can come through third-party vendor tools, web browsers, internal development, or no-code and low-code platforms. When you combine these entry points with the number of employees interacting with them, he noted, "you can see why there’s so much AI in an organisation that isn’t being tracked."However, the real change, Sethupathy argued, isn’t from chatbots but from what followed. "With chatbots, companies could exert control," he said, highlighting the relative ease of restricting the tools staff could use and controlling how data flowed through them. AI Agents present a different challenge entirely: "It’s not just about data leakage. It’s not just about data security. These agents are taking actions, making decisions, and acting."This, he said, poses "a level of risk that is much higher."Why is Governance Failing Against AI?If agentic AI is the new area of risk, why hasn’t governance caught up? Sethupathy attributes this to tempo. "Governance in the past has typically been a point-in-time exercise," he said. But autonomous agents operate constantly. They learn consistently and take actions, access tools, and data around the clock."Imagine you’re driving, and your car only informs you of your speed every half hour. That would be pointless,” the Head of AI explained. The same reasoning applies to agents, he argued. With their continuous work, oversight needs to be continuous as well. This creates two major problems for organisations: a process issue (rebuilding governance frameworks around ongoing review) and a technology issue. As Sethupathy plainly stated, "humans cannot do continuous monitoring. We have to sleep."AI needs to monitor other AIs.Why the EU AI Act to Shadow AI?The compliance deadline for high-risk systems under the EU AI Act has not simply been pushed to August 2026 and left there. Sethupathy clarified that the European Commission revised the timeline recently, dividing it into two separate tracks:The first is transparency and watermarking obligations; the rules requiring enterprises to disclose their AI usage have actually been moved forward to December 2026. Secondly, high-risk system obligations involving the detailed governance, risk assessment, and audit requirements for high-risk AI — have been pushed back to December 2027."There have been updates on the EU Act," Sethupathy told Dua. The rules "around transparency of AI use and watermarking have actually been moved forward to December of this year," while the high-risk governance requirements have "been pushed back to the latter half of next year, particularly December 2027."Alluding to the challenge of shadow AI challenge, he added that enterprises can't run a compliance process for high-risk systems they haven't identified. "You don’t know what high-risk systems you have if you have shadow AI," he said, adding that he doesn’t think most enterprises could have solved that discovery issue by the original August 2026 deadline.Sethupathy believes the extended timeline is a positive development, as long as companies take advantage of it. "I think it’s actually good that the EU has given folks more time. But they need to get started."Ultimately, he asks CISOs to "think of governance as your insurance against that investment," referring to the billions of enterprises that are investing in AI. Without buy-in from the top, Sethupathy warned, "governance will become just a side task. Eventually, something will break."Key TakeawaysShadow AI is becoming a significant concern for enterprises.The rise of AI democratisation has increased risk exposure.Governance must be continuous and real-time to be effective.The EU AI Act's compliance deadlines are crucial for enterprises.Enterprises need to identify high-risk AI systems to comply with regulations.Technology is essential for the continuous monitoring of AI systems.CISOs must take ownership of AI governance within enterprises.Training employees on AI risks is vital for effective governance.Investing in governance is an insurance against AI investments.Top-down support from leadership is necessary for successful governance.Chapters00:00 Introduction to Shadow AI and Its Implications03:12 Understanding the Rise of Shadow AI05:52 Governance Challenges in the Age of AI09:00 The EU AI Act and Its Impact on Enterprises12:09 Technological Solutions for Managing Shadow AI14:50 The Dual Nature of AI in Security17:34 Strategies for Effective AI Governance21:06 The Role of the C-Suite in AI GovernanceFor more on Optro’s approach to continuous AI governance, visit optro.ai.#ShadowAI #ShadowAgents #AIGovernance #AgenticAI #Cybersecurity #EUAIAct #EnterpriseTech #CISO #RiskManagement #DataSecurity #TheSecurityStrategist #EM360Tech #Optro

Two AI systems reached the offensive and defensive security space five weeks apart. Not because a vendor planned a product launch cycle, but because attackers and defenders are now using the same class of tool. The difference is that only one side built its own to fix things. Attackers are now weaponising a newly disclosed vulnerability in a median of under five days. Most organisations still take more than 60 days to remediate a critical one once a patch exists. In a growing share of cases, exploitation starts before the patch is even released. That gap isn't closing, and it has now become the whole problem. This is the subject of this episode of the Security Strategist Podcast, where host Richard Stiennon sits down with Brad Hibbert, COO and CSO at exposure management platform Brinqa, to talk about what changes when AI shows up on both sides of the fight. Mythos Thinks Like a Pen TesterMythos, one of the offensive AI tools now circulating, doesn't just scan for known flaws. It reasons through a codebase the way a skilled human pen tester would analyse binaries, builds, and source across hundreds of instances simultaneously, around the clock. "It's like having a whole team of pen testers looking at things 24 by seven," Hibbert says.The speed isn't the part that should worry security leaders most, but it's the composition. According to Hibbert, tools like Mythos are chaining together vulnerabilities that individually rate as medium or low severity, combining them into a full system compromise. The exact flaws of a traditional scanner would rank near the bottom of the remediation queue. Stiennon draws the comparison to his own red-teaming days at PwC, when finding an exploit meant manually Googling a known CVE. What's different now, he notes, is that the AI is often generating something that's never been seen before, off the cuff.Five weeks after Mythos, Daybreak arrived, built for the other side of the fight. Instead of exploiting what it finds, it recommends remediations, aiming squarely at the gap that tools like Mythos are built to open. Hibbert expects this pattern to continue as agentic AI is moving into the software development lifecycle itself. This means it's reviewing code the moment it's checked in, flagging weaknesses before release, and eventually applying its own fixes before a developer even sees the pull request on Monday morning.What Is the Main Challenge of Vulnerability Management?The instinct across the industry has been to treat vulnerability management as a volume problem. This means scanning further, uncovering more vulnerabilities, and closing tickets faster. Hibbert offers a different perspective on that framing. Finding vulnerabilities, he argues, has always been the easier half of the job. The real bottleneck is knowing which ones actually matter to your business, and then acting on that knowledge fast enough to outrun both the attacker and your own change-management process.He points to a familiar scenario where a scan turns up an outdated firmware version on a casino's fish-tank temperature sensor. On paper, it's considered low severity and non-critical, exactly the kind of finding that sits at the bottom of a ticket queue indefinitely. This is treated as an entry point into a broader attack path; that same low-severity finding becomes the opening move in a full breach. The fix isn't scanning harder, but now it's asking a different question of every finding, like what could an attacker reach from here, and how far could they go?This reframing from counting vulnerabilities to mapping attack paths is, in Hibbert's view, the actual job of modern exposure management. It also explains why patch counts make for a misleading scoreboard. Remediation itself is often slower than the finding, not because teams are careless, but because patching carries real operational risk. A fix validated in a lab can still take down a banking system or a trading floor in production. Some systems, like that fish-tank controller, may never receive a vendor patch at all, forcing teams toward compensating controls instead.What Should CISOs Prioritise to Reduce Cyber Risk? Hibbert encourages CISOs to look beyond weekly patch counts and focus on whether security efforts are reducing risk. He advises leaders to ask their teams what would happen if their top critical exposures were exploited right now; what an attacker could reach, and how far the blast radius would spread. If the team can answer that clearly, the prioritisation program is working. If they can't, the problem isn't remediation speed; it's visibility.The uncomfortable implication, which Stiennon raises toward the end of the conversation, is that this shift will widen the gap between organisations that adopt AI-driven exposure management and those that don't, and the latter group won't disappear from the threat landscape. They'll just keep generating the breaches that fund the next generation of attacker tooling.AI has already changed the exploitation timeline. The real question is whether your team is still being measured by the number of tickets it closes or by how quickly it eliminates real attack-path risk. If you would like to learn more about Brinqa's approach to exposure management, visit their website.TakeawaysAI is making vulnerability discovery and exploitation much faster.Attackers are chaining smaller flaws into major breaches.Fixing vulnerabilities remains harder than finding them.Attack paths matter more than individual CVE scores.Patch counts are a poor metric; risk reduction is a better one.Chapters00:00 Welcome to the Cybersecurity space02:54 Challenges in Vulnerability Management05:59 The Role of AI in Cybersecurity08:56 Vulnerabilities: Fixing and Prioritising12:09 The Future of AI in Offensive and Defensive Security14:57 Strategic Insights for CISOs and CIOs#CyberSecurity #CISO #ExposureManagement #AI #RiskManagement #InfoSec #Brinqa #SecurityStrategist #CyberThreats #VulnerabilityManagement #TechPodcast #CyberRisk

As demand for artificial intelligence (AI) increases and investment rises, AI is being used to spot threats more quickly.In the recent episode of The Security Strategist podcast, host Richard Stiennon, Chief Research Analyst at IT-Harvest, an author, and a trusted advisor to vendors, VCs and private Equity Firms, conversed with Sandeep Kamble, Founder and CTO at SecureLayer7. Kamble explained how traditional penetration testing and autonomous security testing are changing offensive security. He highlighted how these tools are designed to empower security teams. Kamble told Stiennon that this shift was a logical next step. Years of building manual penetration testing skills, cloud security practices, and vulnerability research at SecureLayer7 formed the basis for AI to enhance that expertise. The goal is to create a tool that security professionals can use to be more effective in pentesting using AI.Why Traditional Security Scanners Are Outdated For years, security testing has relied on rule-based scanners, signatures, and checklists. While these tools could spot known weaknesses, they often faced challenges with complex vulnerabilities, business logic flaws, and context-specific risks. Kamble said that this traditional method often led to lengthy vulnerability reports filled with false positives. This made it hard for security teams to determine what truly needed action. The real challenge was understanding which ones posed real risks in a specific company's environment in addition to identifying vulnerabilities. SecureLayer7's autonomous penetration testing platform was designed to fill that gap. It combines AI agents with deep security expertise that allows the platform to analyse application architecture, understand context, and identify vulnerabilities through reasoning.Does Human Expertise Need to Expand?Autonomous pen testing means providing security professionals with additional capabilities, not replacing them. Kamble emphasised that human expertise is still vital, but how that expertise is applied is changing. Instead of an external team conducting tests in isolation, the platform empowers an enterprise’s pentesters and security experts. This gives them a powerful tool to scale testing on their own terms and timelines. With repetitive tasks such as reconnaissance and report writing handled by the AI agent, internal teams can focus on in-depth analysis, prioritisation, and strategic security decisions. Kamble noted significant productivity improvements among security professionals using this AI-supported process. AI removes obstacles, allowing security teams to concentrate on the important tasks. The SecureLayer7 CTO envisions a future where skilled professionals work with a more robust toolkit. A toolkit that’s equipped with a more powerful toolkit, capable of continuous testing at a scale that manual methods cannot achieve, at a faster, more accurate pace. What CISOs Should PrioritiseAlluding to C-suites and CISOs, Kamble asks them to look beyond current vulnerabilities. For instance, they should prioritise the ongoing changes within their environments, such as the changes brought on by AI. Additionally, modern enterprises release thousands of updates, services, and applications quickly. Each change presents new opportunities for attackers, who are also using advanced technologies to speed up their efforts. For CIOs and CISOs, this means that having real-time visibility into infrastructure changes is becoming as important as tracking known vulnerabilities. It also means providing internal security teams with tools that allow them to keep up with that pace of change, rather than relying only on periodic, external assessments. As AI-driven threats progress, enabling internal teams to conduct continuous testing at scale may become one of the most crucial defences an enterprise can develop.Key Takeaways:AI is reshaping penetration testing with smarter automation.AI agents help uncover complex vulnerabilities faster.Human expertise remains vital in cybersecurity.Continuous testing helps manage growing attack surfaces.AI security needs control and human oversight.Chapters00:00 The Rise of Autonomous Pen Testing03:00 AI-Driven Security Testing: A New Era05:50 Complex Vulnerabilities and Human Expertise09:11 Scaling Autonomous Pen Testing12:08 The Future of Red Teaming and Social Engineering16:05 Key Takeaways for CIOs and CISOsFor further information, please visit securelayer7.net and em360tech.com.Follow @enterprisemanagement360 on YouTube for further thought leadership insights on B2B enterprise tech across AI, emerging tech, cybersecurity and data. Follow @SecureLayer7 for cybersecurity solutions specialising in autonomous pen testing. #CyberSecurity #AutonomousPentesting #AIinSecurity #SecureLayer7 #PenetrationTesting #InfoSec #CISO #CloudSecurity #RedTeaming #TheSecurityStrategist #techinnovation

Walk the floor of any security conference, and you'll hear the same story that AI is transforming threat detection, closing the vulnerability gap, and redefining cyber defence. But the data suggests security professionals aren't buying into the hype as much as vendors might expect.According to Oliver Spence, CEO of Cybaverse and a former Royal Marine, the cybersecurity industry has a marketing problem, and that problem is making organisations less secure. In this episode of the Security Strategist Podcast, Spencer sits down with Trisha Pillay to examine where security leaders are being misled, why buzzwords are replacing meaningful outcomes, and what organisations should be focusing on instead.Why AI Falls ShortResearch conducted with security professionals at Infosec Security found that 87 per cent of respondents believe AI increases risk rather than mitigates it. Six in ten said their organisation didn't have the resources to manage the threats AI introduces. These aren't the numbers of an industry confidently embracing a new era. They're the numbers of a sector that's been oversold.Spence puts it plainly: "There's a lot of money from VCs being pumped into cybersecurity, and cybersecurity does marketing extremely well. Which means people end up buying tools. And quite often, tools are purchased, and they barely make it out of the onboarding phase." The hype, in other words, is moving faster than reality, and security leaders are paying the price.What the Mythos Release Actually Taught UsTo understand where AI hype collides hardest with security reality, look at what happened with Mythos. The frontier AI model was made available to a limited group of organisations through Anthropic's Project Glasswing initially around 12 companies, including Microsoft and CrowdStrike, and later expanded to more security businesses. The intent was to test and validate a security-focused AI capability at the highest level.Within 24 to 48 hours of Fable's release, the security solution built on Mythos was being released, and someone had already found a prompt that bypassed its controls. Shortly after, the US government restricted access to the model for organisations outside the United States.For Spence, the lesson isn't that AI is useless. It's that the hype around AI security outpaces what even the best-resourced organisations can actually control."If the top security companies in the world, dedicated to testing and securing these AI frameworks, still haven't been able to secure it, how does a smaller mid-market business take on that security challenge?"His answer cuts against the grain of most vendor messaging that nothing about AI development, including Mythos, has actually changed what organisations should be doing. "If you look at the NCSC's top ten steps, it's all about fundamentals. And if you have those right, you will still be secure from AI-driven attacks." That's not a comfortable message for vendors selling AI-native security platforms, but it's the one the data supports.Where Security Leaders Are Getting It WrongThe most common mistake Spence sees is organisations acquiring tools in response to fear rather than strategy. AI marketing is particularly effective at generating that fear, which is exactly why the cycle keeps repeating."There's a culture that a product is just going to do everything for you and save your bacon in a time of issues. The magic fairy dust of: buy this product and it solves all your problems."The result is tool sprawl at a scale most boards don't realise. The average mid-market company runs between 30 and 40 security products. Enterprise organisations frequently exceed 80 or 90. And yet breaches persist. Operational complexity grows. Security teams burn out managing tools rather than managing threats.Six in ten security professionals surveyed said AI hype was pushing them to fixate on the volume of vulnerabilities rather than how to manage them. That's a direct consequence of marketing designed to create urgency, and it's causing leaders to make reactive purchasing decisions instead of strategic ones.The fix isn't complicated, but it requires discipline: define the outcome you need to achieve before you look at a single product. "What is the outcome that we need to achieve as a business? Make sure you have those written down. Then look at which tool maps to solving those outcomes." Tool mapping, not tool accumulation, is what an effective security strategy looks like.The Vulnerability Volume TrapOne of the clearest examples of hype distorting reality is how organisations are handling vulnerability management or failing to. AI has made vulnerability discovery faster and more accessible, both for defenders and attackers. The next wave of AI-enabled attacks, beyond the phishing use cases that became widespread first, is exploitation at scale. AI scanning infrastructure for gaps faster than human teams can identify and close them. That's a real threat but the response many organisations have is to treat every vulnerability finding as equally urgent, which is where the hype machine takes over.Spence gives a concrete example: a vulnerability scanner might flag four instances of an outdated version of Chrome as four separate critical findings. Teams see four criticals. Boards panic. In reality, there's one action update Chrome. The noise generated by poorly configured tools inflates urgency and slows down the teams trying to respond."People can get so overwhelmed and go, there's so much to do here, it's going to be impossible. But it's about putting a system and structure in place to deal with it. It doesn't matter whether it's one vulnerability or a thousand; it's the same process."A healthcare client Spence worked with had a board furious at the IT team over the volume of critical vulnerabilities appearing in reports. The team hadn't done anything wrong. They'd simply never run structured vulnerability management before, so when they started, everything surfaced at once. The fix wasn't faster patching, it was building a process: identify assets, prioritise by actual business risk, remediate in order, track progress. Once the board understood they were closing gaps rather than chasing an impossible zero, the relationship between leadership and the security team stabilised.Patch management isn't a solved problem. For businesses running tens of thousands of endpoints with hundreds of applications across their estate, keeping up with remediation at scale is genuinely hard. AI-driven discovery doesn't solve that it amplifies the pressure if there's no management system underneath it.How to Evaluate AI Security Claims Given the pace of AI development and the volume of vendor claims, security leaders need a practical filter. Spence's is straightforward with his sentiments like does this address a specific outcome your organisation has already identified as a gap?Not "does this solve the broad threat category of AI-driven attacks." Not "does this give us AI-powered detection." But specifically, does this map to something we know we need to fix in our environment?The same filter applies to internal AI adoption. Two questions should come before anything else: what business risk are you accepting by giving AI agents access to your data, and is that access read-only, or can the agent execute actions? The risk profile of those two scenarios is dramatically different, and most organisations haven't explicitly defined which one they're operating under.What Security Leaders Should Do DifferentlyThe practical takeaways from Spence's position are less about new tools and more about clearer thinking:Lead with outcomes, not products. Define what your organisation needs to achieve before engaging with any vendor. Map tools to outcomes, not the other way around.Treat vulnerability volume as noise, not signal. Build a prioritisation and remediation process. A thousand vulnerabilities managed systematically is less dangerous than ten vulnerabilities with no process behind them.Ask the data access question first. Before any AI deployment, define what it can access and whether it can act on that access. That decision shapes your entire risk profile.Consolidate rather than accumulate. The industry is moving toward fewer, better-integrated tools for good reason. Thirty security products that no one fully configures is not a security strategy.Stay on the fundamentals. AI hasn't invalidated the NCSC's core steps. If anything, AI-driven threats make...

Security operations centres have always been a numbers game with too many alerts, few analysts, and never enough hours in a shift. But something has changed. The arrival of AI models capable of identifying vulnerabilities and generating working exploits at machine speed has quietly shifted the terms of engagement between attackers and defenders. In this episode of the Security Strategist podcast, Richard Stiennon sits down with Edward Wu, founder and CEO of Dropzone AI, to unpack what the Mythos era actually means for the SOC and what defenders need to do about it right now.The Alert Problem That AI Was Always Going to SolveWu didn't come to this conversation theoretically. Before founding Dropzone AI, he spent eight years at ExtraHop building AI and machine learning detection products, systems that generated millions of security alerts. The conclusion he walked away with was that most security teams don't need another alert cannon. What they need is help processing the ones they already have.That insight shaped everything about Dropzone's approach. The problem in most SOCs isn't a lack of signals, but it's analytical capacity. SIEMs stack-rank alerts by criticality, which sounds helpful until you realise that even a well-tuned system routinely surfaces 150 critical alerts per shift. No team handles that volume consistently. The alerts at the bottom of the queue, the ones that often contain the earliest indicators of a breach, simply never get looked at."AI can look at 50 alerts in parallel," Wu explains, and that's not a trivial capability. It means the lows, mediums, and informational alerts that security teams have historically deprioritised out of necessity can finally get attention. Several of Dropzone's customers have gone further; they've actually reversed years of detection tuning alerts that were switched off because they were deemed too noisy, because AI augmentation means the team now has the capacity to handle the volume. The aperture widens. Coverage improves, and holes in the detection fabric get closed rather than quietly accepted.Mythos Changed the Timeline, Not the OutcomeWhen Anthropic published its findings on Mythos, the cybersecurity community took notice. Here was a model demonstrably capable of analysing code, discovering vulnerabilities, and writing working exploits with tasks that had previously required significant human expertise and time. Wu was watching closely, and his take is more measured than most of the commentary that followed.He wasn't surprised. Models had been trending in this direction for some time, and when researchers revisited older models with better prompt engineering after the Mythos announcement, many found comparable outputs. What Mythos represented wasn't a sudden leap into unknown territory; it was confirmation that a step-function in attacker capability had arrived, and that the timeline for impact was no longer theoretical. "It was never a question of if," Wu says. "Mythos made the answer to when very concrete within the next couple of months."The strategic implication is important to sit with. Vulnerability management is a slow-moving discipline with significant organisational friction. Patching schedules, competing priorities, and legacy infrastructure, these constraints don't bend quickly, regardless of how capable AI becomes on the offensive side. If attackers can now discover and weaponise vulnerabilities faster than defenders can patch them, the perimeter becomes harder to hold. Initial footholds become easier to gain.This shifts the weight of the entire security programme toward detection and response. Wu frames it as a change in where the statistical advantage lies. Before a breach, attackers only need to be right once. But once they're inside, the math flips. On average, an attacker needs to make seven to ten moves to reach their objective. Detection and response teams have multiple opportunities to catch them, if the tripwires are sensitive enough, and if someone is actually paying attention to them.Fighting AI with AIThe phrase "fighting AI with AI" risks sounding abstract. Wu brings it back to operational reality. The most immediate application is alert investigation, still the most labour-intensive function in any detection and response team. AI agents can begin processing an alert within seconds of it being created. Mean time to response drops. Mean time to disposition drops. The window of opportunity for an attacker to move laterally, escalate privileges, or exfiltrate data gets materially smaller.For larger teams, this translates into improved coverage and faster response. For smaller teams, it functions as genuine force multiplication; analysts spend less time on repetitive investigation work and more time on detection engineering, threat hunting, and closing gaps in the broader security architecture.Wu also addresses the hallucination concern that comes up whenever AI is proposed for high-stakes environments. His answer is direct: "Hallucinations are caused by poor context engineering." Feed a model insufficient or irrelevant information, and it fills in the gaps. Feed it the right data, the specific logs, the relevant threat intelligence, and the contextual detail it needs, and it performs the analytical task accurately. The model isn't the problem. The scaffolding around it is what determines the outcome.For CISOs considering where to start, Wu's advice is practical. Audit where the team is actually spending its time. Identify the bottlenecks. Then evaluate vendors — at least three, in production, in your own environment, against three criteria: does the technology work now, is the company's roadmap aligned with where you're trying to get to, and can you trust the engineering team to deliver it?The Mythos era hasn't changed the fundamental cat-and-mouse dynamic of cybersecurity. But it has raised the stakes and raised the ceiling on what AI-augmented defence can deliver. If you want to find out more, visit Dropzone AI or connect with Edward Wu on LinkedIn.TakeawaysAI models like Mythos and their capabilitiesImpact of AI on vulnerability discovery and exploit creationEnhancing SOC efficiency with AI augmentationChapters00:00 Introduction to AI in Cybersecurity02:04 The Challenge of Alert Overload07:00 The Impact of Mythos on Vulnerability Management11:58 Detection and Response as the New Frontline16:27 Fighting AI with AI: Practical Implications22:00 Customer Experiences and Success Stories25:15 Preparing for Automation in SOCs

Podcast: The Security StrategistGuest: Nitay Milner, Co-Founder & CEO at ORION SecurityHost: Richard Stiennon, Chief Research Analyst at IT Harvest, Author, and Advisor to Vendors, VCs, and Private Equity FirmsCybersecurity is evolving every second, and Data Loss Prevention (DLP) has become a key focus for enterprises seeking to protect sensitive data. However, traditional DLP systems often struggle to keep pace with the scale of data in motion. In this episode of The Security Strategist Podcast, host Richard Stiennon, Chief Research Analyst at IT Harvest, Author, and Advisor to Vendors, VCs, and Private Equity Firms, sits down with Nitay Milner, Co-Founder & CEO at ORION Security. They discuss how DLP has changed and the new dynamics of AI for data security and data security for AI. They explore the challenges faced by traditional DLP systems, the need for deep contextual insights in data protection, and the implications of AI as both an enabler and a risk. The conversation highlights the shift from static, policy-based approaches to dynamic, AI-driven solutions, emphasising the importance of real-time monitoring and accurate, enforceable data exfiltration prevention.What are the Limitations of Traditional DLPTraditional DLP systems have existed for decades, but they mainly aim to protect stored data. These systems rely on fixed policies and rules that usually lack the context needed for smart security decisions. According to Milner, these systems cannot effectively manage data in motion, which is where data leakage typically occurs.Traditional DLP notoriously generates high numbers of false positive alerts. Milner cites an alarming statistic stating that some enterprises employ as many as 60 DLP analysts just to triage these alerts, creating a bottleneck in security processes resulting in critical alerts slipping through the cracks due to unmanageable signal-to-noise ratios.What are the Key Challenges in Real-World ApplicationsMilner shares his experiences at Cisco, where he worked with large enterprises like T-Mobile and Chevron. Even after putting traditional DLP measures in place, these enterprises continually struggled to protect their data effectively. Their challenges included the lack of real-time monitoring and an excessive focus on compliance instead of true data protection.AI and agentic approaches to cybersecurity are helping enterprise data security teams today win the fight against data loss. Agentic DLP can analyse data in context, understanding both the data itself and the circumstances of its movement.Milner notes that AI can interpret the source, destination, and nature of the data being handled. This allows AI systems to distinguish between legitimate business activities and potential data leaks. For example, if a financial analyst accesses sensitive information to complete a report, AI can identify this as a valid action rather than flagging it as suspicious.How is AI Impacting DLPA major benefit of adding AI to DLP systems is the decrease in false positives. Traditional methods often depend on deviations from set baselines, resulting in thousands of alerts lacking context. AI, particularly through Large Language Models (LLMs), can offer a better understanding, leading to smarter alerts and more efficient security responses.As enterprises increasingly adopt AI technologies, it becomes essential to have strong DLP systems that can incorporate AI innovations. Security professionals need to focus not only on protecting data but also on enabling the safe use of AI within enterprises.However, Milner spotlights the need to set guardrails around AI applications. As employees use AI tools for a variety of tasks, they can unintentionally expose sensitive information. By creating clear guidelines and monitoring systems, enterprises can keep data secure while still benefiting from AI.Introducing AI into business processes brings new challenges, especially regarding data exploitation. Milner cautions that as AI systems become more common, the risk of sensitive data being shared with untrusted third-party applications rises. Enterprises must be careful about what data is shared and with whom to effectively reduce these risks.Leveraging AI is not a question anymore; it’s how you do it that matters. Enterprises can create smarter, more efficient DLP systems that reduce noise, improve real-time data protection, and allow businesses to use AI safely. As we move into this new era of cybersecurity, the partnership between AI and DLP will be vital in protecting sensitive data.Key TakeawaysLegacy DLP tools generate an overwhelming number of false positives.AI can provide real-time contextual understanding.Traditional DLP systems are not equipped for the scale or movement of modern data.The future of data security relies on AI-native and agentic solutions.Guardrails are essential for safe AI usage in enterprises.Real-time monitoring is crucial for effective data protection.Policies should be limited and focused on specific use cases.AI can recognise risky data patterns that traditional methods cannot.Data security must adapt to the rapid evolution and adoption of AI tools and agents.Education on new risks is vital for enterprises. Chapters00:00 The Evolution of Data Loss Prevention (DLP)02:54 AI's Role in Redefining Data Security06:12 Challenges of Traditional DLP Systems09:02 The Need for Contextual Understanding in DLP12:07 Guardrails for AI in Data Security15:04 Transitioning from Policies to AI-Driven Solutions17:54 Real-World Examples of Data Protection20:49 The Future of DLP and Data SecurityFor more enterprise AI in cybersecurity and DLP insights, please follow Orion Security across its official channels:Website: ORION SecurityYouTube: @ORION-dlpLinkedIn: ORION SecurityFor more information on enterprise tech analyst-led insights, please visit em360tech.com EM360Tech YouTube: @enterprisemanagement360EM360Tech LinkedIn: @EM360TechEM360Tech X: @EM360Tech

Artificial intelligence has moved well beyond the chatbot era. The systems being deployed today don't just respond to questions; they plan, decide, and act. In this episode of the Security Strategist, host Trisha Pillay sits down with Kevin Curran, Professor of Cybersecurity at Ulster University and IEEE senior member, to unpack what this shift means for organisations, security teams, and the people responsible for keeping data safe. From prompt injection to privacy by design, this conversation covers the full spectrum of what agentic AI brings to the cybersecurity table and what it demands of us in return.From Chatbots to Autonomous AgentsFor years, AI in the enterprise context meant tools that waited for instructions. You asked, it answered. The dynamic was predictable, and security teams could build controls around it. Fast forward today, that world is rapidly becoming a memory.Agentic AI represents a step-change. These systems don't sit idle waiting for a prompt; they pursue goals, interact with APIs, browse the web, execute code, and coordinate with other AI agents, often with minimal human involvement. As Curran explains, this autonomy is both the point and the problem. "Our surface area has dramatically expanded," he notes, capturing in a single phrase what security architects are grappling with across industries.The implications are immediate. Traditional security frameworks were designed around human actors, meaning slow-moving, auditable, and accountable. Agentic systems operate at machine speed, across multiple endpoints simultaneously, and can chain together dozens of actions before a human reviewer even knows a task has begun. The perimeter, as security professionals understood it, has effectively dissolved.For organisations still thinking about AI security in terms of data privacy policies and acceptable use clauses, this is a wake-up call. The threat model has changed. The question is no longer just what data an AI can access, but what actions it can take and on whose behalf.The Vulnerabilities Nobody Warned You AboutAs the capabilities of agentic AI grow, so does the attack surface. Curran highlights prompt injection as one of the most pressing and underappreciated threats in this new landscape. Unlike traditional software vulnerabilities that exploit code, prompt injection attacks exploit the AI's core function: its ability to read and follow instructions.The attack is deceptively simple. A malicious actor embeds hidden instructions in content that the AI will encounter, a webpage it browses, a document it processes, or an email it reads. The agent is unable to distinguish between legitimate directives and injected commands, following the hidden instruction. It might exfiltrate data, take an unauthorised action, or silently alter its behaviour. The user never knows.This vulnerability is particularly dangerous in agentic contexts precisely because these systems have broader permissions and longer action chains. An AI agent with access to calendars, emails, file systems, and external APIs is a high-value target. A successfully injected prompt doesn't just compromise a single response but it can compromise an entire workflow.The accountability question compounds the problem. As Curran puts it: "Who's responsible when AI acts autonomously?" When an AI agent makes a decision that causes harm, whether through a security breach, a compliance violation, or an erroneous action. The lines of responsibility blur in ways that existing legal and organisational frameworks aren't equipped to handle. Boards, legal teams, and CISOs need to be asking this question now, before an incident forces the issue.The principle of least privilege emerges here as a critical mitigation. Curran is clear that AI agents should operate with the minimum access necessary for any given task, not a blanket set of enterprise-wide permissions. Limiting scope limits damage. If a compromised agent can only touch what it needs for a specific transaction, the blast radius of any attack is contained.Secure by DesignThe answer to agentic AI's security challenges isn't to slow down adoption, it's to build differently. Curran is a strong advocate for the secure by design philosophy, which holds that security must be an architectural decision made at the beginning of a system's life, not a layer of controls bolted on after deployment.This principle has been discussed in cybersecurity circles for years, but agentic AI gives it new urgency. When you're deploying systems that make autonomous decisions, the cost of a security oversight isn't a patching cycle, it can be an incident. Designing for security from day one means conducting AI-specific threat modelling before a system goes live, mapping out what an agent can access, what actions it can take, and where the failure points lie.Privacy by design sits alongside this as an equally vital framework. Curran points to ephemeral transaction models as a promising approach, structures in which AI agents handle sensitive data only for the duration of a specific task, with no persistent storage of information that isn't necessary. "Privacy by design minimises data collection," he explains, and in a world where autonomous systems are constantly processing personal and organisational data, minimisation isn't just good practice. It's good governance.Tools and platforms are beginning to emerge that support this approach. Signing room technologies, for instance, offer ways to conduct sensitive transactions with built-in auditability and access controls, worth exploring for organisations managing AI-assisted workflows involving contracts or identity verification. Security scanning platforms designed for AI-era codebases are also maturing, giving development teams the ability to identify vulnerabilities before they reach production.Organisations that treat security and privacy as foundational to AI deployment, rather than compliance requirements, will be better positioned as these systems become more capable and increasingly embedded in critical operations.TakeawaysAgentic AI and autonomous decision-makingSecurity vulnerabilities in AI systemsSecure by design principles for AI deploymentInvest in AI-specific threat modelingImplement security by design principles from the startAdopt ephemeral transaction frameworks for privacyChapters00:00 Introduction to Agentic AI and Cybersecurity04:07 Understanding Agentic AI and Its Implications09:50 The Shift from Assistive Tools to Autonomous Agents15:46 Emerging Threats in AI Security22:02 Secure by Design: Building Security into AI Systems27:51 Privacy by Design in Autonomous Transactions29:46 Conclusion and Future Outlook on AI Security

The moment an organisation's board starts asking how to prepare for autonomous AI attacks, the conversation has already shifted. What used to be a theoretical briefing topic is now a line item in risk registers and a direct question landing on CISOs' desks from the C-suite.Shachar Hirshberg and Dan Shiebler, co-founders of Artemis Security, an AI-Native Protection Platform for security operations, in production at Mercury, Lemonade, Wix, Upwork, and some of the largest enterprises in the world, have that conversation daily.Artemis raised $70M in series A, led by Felicis with First Round Capital and Brightmind Partners doubling down, alongside top VCs including Theory Ventures, Lockstep, Two Sigma Ventures, and prominent cybersecurity industry leaders, including the founders of Abnormal AI and Demisto, the former CEO and CTO of Splunk, and senior executives from CrowdStrike, Palo Alto Networks, Microsoft, and Okta.In a recent episode of the Security Strategist Podcast with host Richard Stiennon, Hirshberg and Shiebler laid out the strategic reality with unusual clarity, not as a product pitch, but as a candid assessment of where the threat environment stands and what it demands from security leadership.The Economics of Attack Have ChangedThe foundation of legacy security architecture rests on an assumption that no longer holds: that launching a sophisticated, targeted attack is expensive. Acquiring intelligence on a specific organisation, crafting adaptive exploits, and manually steering a multi-stage breach required time, skill, and resources. Defenders could lean on that cost. Understand attacker behaviour, get ahead of their patterns, and you impose meaningful friction.Shiebler identifies this as the core structural failure of traditional approaches today."AI really changes that. It's so much easier for attackers to craft new attacks, to explore different strategies, and make it much cheaper to send out radically different, really sophisticated attacks, which really means that trying to rely on approaches that involve just understanding attackers and trying to stay ahead of that is very, very challenging."The consequence is not simply faster attacks. It's the collapse of the distinction between opportunistic, broad-based threats and sophisticated targeted campaigns. What previously required nation-state resources or advanced persistent threat infrastructure can now be approximated by an attacker with limited technical knowledge and access to capable agentic tooling.The MTTR CalculationHirshberg frames the urgency in operational terms. The industry benchmark for mean time to respond sits at roughly four hours. The top 0.1 per cent of security operations globally measure in minutes. The frontier measures in seconds and adversaries are already in seconds."We are still talking in hours and need to bridge that gap because we will live in an era where it will have a hundred real zero days every single day in every organisation. If you're measuring your MTTR in hours and you have a hundred real attacks per day, you are fully overwhelmed with traditional tooling."The arithmetic is unambiguous, and no staffing model resolves it. No incremental tooling investment closes it. It requires a categorical shift in how detection, investigation, and response are architected, moving from human-executed to human-guided autonomous response.The Defender’s Unused AdvantageUnderneath the operational urgency Hirshberg and Shiebler describe, sits an architectural premise about how Artemis is built. In an AI era, both sides draw on the same technology. Whatever edge the defender once held in raw capability is gone. What remains, and what the attacker cannot acquire from outside, is knowledge of the defender's own environment. Who works where. What is normal for this user? Which systems matter to the business? Whether a 3 a.m. login is routine or the first in this person's history. That knowledge has always existed. What has never existed is a security platform that could assemble it, keep it continuously current, and detect against it at machine speed.Artemis is built around that advantage. The company calls it Environment Intelligence, and the practical effect for the security team is a qualitatively different output. Where most platforms produce alerts that an analyst then has to investigate, Artemis produces decision-grade cases: findings that arrive ready to act on.The Strategic Cybersecurity ImperativeHirshberg and Shiebler are blunt on timing, and it is the part that leaders miss. Deploying the technology is the fast part: Artemis connects in under an hour and produces real cases within 48 hours. The slow part is organisational: governance, and process maturity for a human-supervised AI to act at machine speed. That work compounds in months, not weeks. Organisations starting now will be operating in the new model when the threat tilts.For more information on this, visit https://artemissecurity.com/ or connect with the guests:Shachar Hirshberg | LinkedIn | Co-Founder and CEO ArtemisDan Shiebler | | Linkedln | Co-Founder and CTO ArtemisTakeawaysAI transforming cyber operationsAI-driven attacks and defenseLimitations of traditional security architecturesHow Artemis Is Shaping Autonomous Cyber DefenceChapters00:00 — The Evolving Cybersecurity Landscape03:40 — AI in Cyber Operations09:19 — Challenges of Traditional Security Architectures14:03 — The Future of Cyber Defence20:05 — Adapting to New Threats25:29 — Strategic Planning for CISOs

Most organisations believe they have a solid grip on their security posture. They invest in tools, run penetration tests, and build out security teams. Yet when a breach happens, the entry point is often an asset no one was monitoring, something unknown, unmanaged, and fully exposed.That gap between perceived security and actual exposure is the core challenge Rob Gurzeev has spent his career trying to solve. In this episode of Security Strategist, host Richard Stiennon speaks with Rob Gurzeev, CEO of CyCognito, to unpack the realities of external attack surface management and why many organisations continue to fall behind despite years of investment.The Attack Surface Has Outgrown The scale of the problem is difficult to overstate. Where an enterprise once managed a handful of websites and internal systems, it now contends with hundreds of thousands of applications, cloud assets, APIs, and connected devices, many of which were provisioned quickly, handed off between teams, or simply forgotten.Gurzeev points out that in large enterprises, the number of externally exposed assets can reach into the tens of millions. Up to 50 per cent of those assets are often entirely unknown to the security team. They are not in any inventory. Nobody is patching or monitoring them. From an attacker's perspective, they are the most attractive place to start. This is the nature of the modern external attack surface, not a defined perimeter, but a constantly shifting sprawl of exposure that grows faster than most teams can track it.Why Traditional Security Approaches Fall ShortThe instinct for many organisations is to run more penetration tests. It is a reasonable response, but it addresses only a fraction of the actual risk. Manual pen testing, by its nature, is scoped and time-limited. Gurzeev is direct on this point: in environments with hundreds of thousands of assets, traditional testing leaves the vast majority of the attack surface unexamined. The result is a false sense of security; teams believe they have assessed their exposure when, in practice, they have assessed a small and carefully selected slice of it. The big issue is visibility. Security investments have historically been built around known assets, things that are already in the inventory, already behind a firewall, already being monitored. The unknown assets fall outside that perimeter entirely, and it is precisely those assets that attackers seek out.The Shift AI Has Made PossibleThis is where the conversation turns. AI has fundamentally changed what is achievable in attack surface management, and Gurzeev is clear about the practical impact: real-time threat detection, at scale, across the entire external surface, not just the assets that are already known. Continuous automated testing now makes it possible to assess every exposed asset, not a curated sample of them. Vulnerabilities that would previously have gone undetected for months can now be surfaced within hours. The economics have shifted as well. The prohibitive cost of testing at scale, which once made comprehensive coverage impractical, has been dramatically reduced. For CISOs and CIOs operating under resource constraints, that matters. The question is no longer if comprehensive coverage is possible. It is whether the organisation has decided to pursue it.What Security Leaders Should Take AwayVisibility is not something organisations can assume; it has to be actively built and continuously maintained. In large enterprises, unknown assets often make up the bulk of real exposure, rather than being a marginal risk. AI-driven tools are now making it possible to assess this landscape continuously and at scale. In this context, mean time to remediation becomes the defining metric separating organisations that actively manage risk from those that only measure it. Thinking like an attacker means asking a simple question: which of our assets does nobody know about? The answer to that question is where the real work begins. For more on external attack surface management and enterprise cybersecurity, visit cycognito.com. Connect with the guest:Rob Gurzeev: LinkedIn | Co-Founder & CEO, CyCognitoTakeawaysExternal attack surface complexityImpact of AI on cybersecurityStrategies for attack surface visibilityContinuous monitoring is essential, not one-off assessmentsProactive exposure management reduces breach riskChapters00:00 – Introduction to External Attack Surface Challenges01:02 – Rob Gurzeev's Background and Focus on Attack Surface Management02:42 – From Intelligence to Cybersecurity: Rob's Journey04:51 – Why Organisations Lack Clear External Attack Surface Visibility07:43 – The Growing Complexity of IT Environments11:27 – Vulnerability Management vs Attack Surface Management13:20 – Challenges in External Attack Surface Discovery17:05 – The Role of AI in Cybersecurity and Attack Surface Management20:16 – Key Takeaways for CISOs and CIOs

Podcast: The Security Strategist Guest: Jasson Casey, CEO & Co-Founder, Beyond Identity Analyst: Richard Stiennon, Chief Research Analyst at IT-HarvestIn an enterprise technology market that’s saturated with AI copilots and coding agents, most enterprise security strategies are already outdated. On the recent episode of The Security Strategist podcast, analyst Richard Stiennon, Co-Founder and Chief Research Analyst at IT-Harvests, presses Jasson Casey, CEO & Co-Founder, Ceros by Beyond Identity, on a question few vendors are answering clearly. “How do you actually control autonomous agents once they’re inside your environment?” posed Stiennon. Casey’s answer is architectural, focusing on Ceros – a new control plane from Beyond Identity built specifically for agentic workflows.What is Ceros built for? The problem Ceros addresses is practically faced by enterprises. For instance, enterprises deploying tools like Claude, Codex, or Copilot for coding and workflow automation are effectively granting agents the same privileges as human operators, but without equivalent oversight. These agents write code, call APIs, and interact with sensitive systems, often across long-lived sessions where risk can evolve in real time.Casey points out that most enterprises fall into one of two active camps: those moving fast and accepting the risk, and those slowed by governance concerns. What both groups lack is visibility. Not logs after the fact, but live, session-level awareness of what agents are doing, what tools they’re invoking, and how their behaviour changes over time.Ceros is designed to sit directly in that gap. Rather than acting as a perimeter control or identity gateway, it operates in tandem with agent sessions, exposing granular telemetry on tool calls, device posture, and execution context. The emphasis is not on blocking upfront, but on establishing a real-time inventory of agent activity—a prerequisite for any meaningful governance model.Moving Beyond Passwordless to Agent-Bound TrustBeyond Identity built its reputation on eliminating passwords, but Casey makes it clear that passwordless authentication was only the first step. The deeper issue is the portability of credentials themselves. Whether it’s a password, API key, or session token, anything that can be copied can be abused—and in agentic systems, that risk multiplies.Ceros extends the company’s device-bound identity model into AI workflows. Instead of relying on bearer tokens, which Casey likens to “Willy Wonka golden tickets,” Ceros enforces cryptographic, device-bound sessions where every API request is uniquely signed. This approach draws on emerging standards like DPoP but applies them in a way that doesn’t require upstream API providers to change their architecture.The result is a subtle but important shift. Security is no longer tied to possession of a token, but to the integrity of the device and session generating each request. For agents, this means their actions are continuously attributable, and any attempt to export or replay credentials simply fails. In practical terms, it collapses the blast radius of an incident to a single device and makes lateral movement significantly harder.Why Casey Says the Time to Deploy Is “Immediately”Perhaps the most striking moment in the discussion comes when Stiennon asks when organisations should introduce controls like Ceros into their agent pipelines. Casey’s answer is blunt: immediately. Not after pilots, not post-deployment hardening, but at the same time, agents are introduced.That urgency reflects a broader shift in how enterprise risk is accumulating. AI agents are active participants in systems, capable of chaining actions, interacting with multiple tools, and amplifying both productivity and exposure. Retrofitting security after these patterns are established is, in Casey’s view, a losing strategy.Ceros has been intentionally designed to avoid the friction that typically delays security adoption. Developers running AI-based workflows see no change in their experience, while security teams gain visibility and policy controls through the same interface. The initial deployment phase focuses on observation rather than enforcement, allowing enterprises to understand their agent footprint before introducing restrictions.Ultimately, identity security must evolve from authenticating users to governing actions—human or otherwise—in real time. With Ceros, Beyond Identity believes that the future of enterprise security will be defined not by who logs in, but by what autonomous systems are allowed to do once they’re already inside. Teams can get their AI governance started on ceros.sh. Key TakeawaysAI agents are introducing major identity and visibility gaps across enterprise systems.Traditional “authenticate then trust” models fail in dynamic, long-running agent sessions.AI agents have no real identity. Ceros binds every agent action cryptographically to hardware, making credential theft pointless and every action attributable to a specific user and device.Ceros gives security teams identity, visibility, and control over AI agents — enforcing policies at the proxy layer before agents can act, not after. Get started at ceros.sh. Chapters00:00 Emerging Security Gaps in AI Coding Agents03:03 The Role of Governance in AI Deployment05:58 Beyond Identity: The Passwordless Revolution09:00 Device-Bound Credentials and API Security11:59 Integrating Security Solutions for AI AgentsTo learn more about Ceros and how agentic workflows in cybersecurity enterprises are changing, follow:Beyond Identity LinkedIn: @Beyond Identity Beyond Identity X: @beyondidentityBeyond Identity YouTube: @BeyondIdentityEM360Tech YouTube: @enterprisemanagement360EM360Tech LinkedIn: @EM360TechEM360Tech X: @EM360TechFollow: @EM360Tech on YouTube, LinkedIn and XStay connected for more expert insights, podcast episodes, and enterprise data strategy discussions.

Podcast: The Security StrategistGuest: Garrett Hamilton, CEO, Reach Security, and Jay Wilson, CIO &amp; CISO, InsurityHost: Shubhangi Dua, Podcast Producer and B2B Tech Journalist, EM360TechThere’s a growing disconnect at the core of enterprise cybersecurity, and most enterprise leadership teams don’t recognise it yet. With budgets increasing, tools improving more than ever, and AI quickly being integrated into both offensive and defensive strategies. On paper, this should be a golden era for cyber resilience. However, many enterprises feel more exposed, not less. The issue isn’t a lack of innovation, rather it’s something harder to see—and far more dangerous.In this episode of The Security Strategist podcast, host Shubhangi Dua, Podcast Producer and B2B Tech Journalist at EM360Tech, sits down with Garrett Hamilton, CEO of Reach Security, and Reach customer, Jay Wilson, CIO &amp; CISO at Insurity. They unpack why enterprises are still getting breached despite record security spend—and how configuration drift, AI-driven threats, and operational blind spots are quietly reshaping the future of cyber defence.They address the key issues enterprises are playing with in the industry today – whether what enterprises configured yesterday is still protecting them now. The reality is that it isn't safeguarding them.“The surface area of the problem is just continuing to increase,” says Wilson. “But security teams aren’t growing at the same rate.” This mismatch is creating a new kind of exposure—one that doesn’t show up in dashboards.Also Read: Ten Hidden Cybersecurity MisconfigurationsWhat Cybersecurity Enterprise Strategies are Missing?For years, cybersecurity strategies have focused on accumulation – collecting tools, more telemetry, and more layers of defence. For instance, respondents, on average, were dealing with 35 tools at a time. But as environments grow, they become harder to manage. The issue pertains to control, not to the visibility of risk. “You had one product expert acting as five or six experts in one,” Hamilton explains. “That approach never scaled well.”Today, this issue is worse. Teams inherit complex tools they can’t fully optimise or continuously validate. Over time, small changes—like exceptions, updates, and integrations—start to add up. No single change breaks the system, but together, they alter it.Also Read: Configuration Lifecycle Management (CLM) That Reduces Complexity And RiskIs Drift the Quiet Failure AI is Accelerating?This shift is what insiders are increasingly referring to as configuration drift. It’s becoming one of the most overlooked risks in cybersecurity. It’s not dramatic or invisible, but it’s constant.“If it isn’t broken, don’t touch it—that used to work,” Isurity CISO says. “Not so much anymore.” In a pre-AI world, misconfigurations could linger for months before being exploited. Now, that time frame has shrunk. “The adversary can find it faster than that three-month or six-month window,” Hamilton warns.The new reality is that enterprises are no longer just defending against external threats. They are now racing to keep up with changes within their own environments. AI too is making the problem worse. For example, rapid “vibe coding” can quickly create solutions, but those solutions tend to fail without ongoing maintenance.“It worked for two or three months,” the Reach CEO notes, alluding to customer experience pertinent to vibe coding. “Then I returned to it—and it wasn’t working as expected.”Drift isn’t a bug but a byproduct of speed.Where AI Offers Real ValueFor the past decade, cybersecurity investments have focused heavily on detection and response. However, that model is starting to show its weaknesses. There are too many alerts, too much noise, and too many problems that shouldn’t be there in the first place.“If you don’t emphasise the preventive side, you end up with a lot of unnecessary focus on detection and response,” Hamilton tells Dua.The current shift is subtle but significant, with leaders now asking not just how quickly they can respond, but how many of those incidents could have been completely avoided.This is where configuration integrity comes into play. It’s also where AI may finally offer real value—not as a substitute for analysts, but as a tool to continuously monitor, validate, and adjust security measures in real time.Still, both Hamilton and Wilson are wary of too much automation. “I would not use automated remediation in my production environment,” Wilson states. “What if it broke something?”The future shouldn’t be about fully autonomous security. Instead, it should focus on awareness, controlled automation—and that’s a much more complicated challenge to tackle.There’s a tendency in cybersecurity to chase the next big thing—AI, zero trust, platform consolidation. But this discussion points to a more fundamental issue. The biggest risk might not be what’s new but what’s actually changing quietly.“This is the most exciting time in 16 or 17 years of being in security,” Hamilton expresses. “But it’s also moving faster than we’ve ever seen.” For CISOs and CEOs alike, speed alters the dynamics.Building the right architecture is a part of the goal, but now cybersecurity leaders should ensure the strategies are aligned consistently at scale. This is where most enterprises are falling behind.Key TakeawaysConfiguration drift is the hidden cause of modern cyber riskAI is accelerating both cyberattacks and security failuresSecurity teams can’t keep up with expanding attack surfacesToo many cybersecurity tools are underused or misconfiguredPrevention is making a comeback in cybersecurity strategyAI-driven automation must be controlled, not fully autonomousChapters00:00 Introduction to Cybersecurity Challenges02:52 The Role of AI in Cybersecurity05:54 Configuration Drift: The Overlooked Risk11:47 The Impact of Configuration Drift on Security17:49 The Need for Visibility in Security Infrastructure23:57 Balancing Detection and Prevention29:49 The Future of AI and Automated RemediationTo hear how leaders are tackling configuration drift, AI-driven threats, and the growing control gap, listen to the full conversation with Reach Security on EM360Tech.com. Find Reach Security’s Configuration Drift Report here. For more information, visit reach.security. Reach Security LinkedIn: Reach SecurityReach Security X: @ReachSecurityReach Security YouTube: @ReachSecurityEM360Tech YouTube: @enterprisemanagement360EM360Tech LinkedIn: <a...

Podcast: The Security Strategist podcastGuest: Eric Schwake, Director of Cybersecurity Strategy, Salt SecurityHost: Shubhangi Dua, Podcast Producer and B2B Tech JournalistAdopting enterprise AI is often seen as a productivity boost. However, a subtler change is happening behind the scenes, and security leaders are still trying to understand it. Enterprises now not only optimise AI tools but are also bringing autonomous agents into their workplaces.“We would call AI agents an additional workforce that enterprises are deploying,” says Eric Schwake, Director of Cybersecurity Strategy at Salt Security.The description is more literal than it seems. These agents can access systems, interact with data, and perform multi-step tasks with little human input. Unlike employees, they lack intuition and caution.In the recent episode of The Security Strategist podcast, Schwake sat down with Shubhangi Dua, Podcast Producer and B2B Tech Journalist to discuss AI agents, shadow AI, and API security challenges are transforming enterprise cybersecurity. Schwake explains how to secure autonomous AI systems at scale today. Has AI Surpassed Experimentation Across Enterprises?AI is no longer in the experimental stage. Leadership teams across industries are actively promoting its use to boost innovation. Executives like Jensen Huang, Founder, President &amp; CEO of NVIDIA, are highlighting a larger trend where enterprises are measuring, incentivising, and expecting AI adoption.This urgency creates a familiar tension. Speed provides a competitive edge, but it also shortens the time available for governance. “You want them to use this innovation to do their work,” Schwake tells Dua. “But you don't want sensitive data leaking and getting into the wrong hands.”Also Watch: What Happens to API Security When AI Agents Go Autonomous?Key TakeawaysAI agents behave like employees and need the same level of security oversight.Most AI risk sits in the API layer where actions actually happen.Faster AI systems can turn small security gaps into major threats.Unmonitored “shadow AI” tools are quietly exposing sensitive data.Continuous visibility is the foundation of securing any AI ecosystem.Chapters00:00 Introduction to AI and Cybersecurity02:43 Insights from RSA Conference06:30 The Role of AI Agents in Security08:30 Transitioning from Discovery to Governance12:03 Protecting Sensitive Data in AI Systems15:21 Identifying Weak Points in AI Security18:54 The Need for Measured Security Approaches20:38 CISO Strategies for API Security23:22 The Future of AI in Cybersecurity25:14 Visibility as a Key Security MeasureFor more information, please visit em360tech.com and salt.security.To learn more about Salt Security and AI and API security, follow:Salt Security LinkedIn: Salt SecuritySalt Security X: @SaltSecuritySalt Security YouTube: @SaltSecurityEM360Tech YouTube: @enterprisemanagement360EM360Tech LinkedIn: @EM360TechEM360Tech X: @EM360TechEnterprise AI, AI Security, Cybersecurity, API Security, Autonomous Agents, Agentic AI, Shadow AI, AI Governance, Enterprise Technology, Digital Transformation, Security Leadership, AI Risk, Data Protection, AI Compliance, Cyber Risk, CISO Strategy, AI Infrastructure, Emerging Technology, Enterprise Security, Salt Security#AISecurity #EnterpriseAI #Cybersecurity #APISecurity #AgenticAI #AutonomousAI #ShadowAI #AIGovernance #EnterpriseSecurity #ArtificialIntelligence #AICompliance #DataSecurity #CyberRisk #TechPodcast #CISO #SecurityLeadership #GenerativeAI #AIInfrastructure #DigitalTransformation #CyberDefense #AIThreats #EnterpriseTech #SaltSecurity #EM360Tech #AIInnovation

Policy is the backbone of every effective cybersecurity framework. It defines how an organisation protects its data, governs access to critical resources, and dictates the rules that every firewall, endpoint, and identity system must enforce. Yet for most organisations, policy management is the one discipline they consistently get wrong.In this episode of&nbsp;The Security Strategist, Chief Research Analyst&nbsp;Richard Stiennon&nbsp;sits down with&nbsp;Jody Brazil, CEO of&nbsp;FireMon, and&nbsp;John Kindervag, Chief Evangelist at&nbsp;Illumio&nbsp;and the father of Zero Trust, to dissect why cybersecurity policies fail, where the rot begins, and what it genuinely takes to build a security posture that holds.Policy as the foundation of security architectureEvery discussion of cybersecurity eventually circles back to one uncomfortable truth, which is that technical controls are only as good as the policies that drive them. Firewalls, intrusion detection systems, and endpoint agents all execute instructions someone wrote down. If those instructions are incorrect, outdated, or in conflict, the tools become liabilities rather than defences.Stiennon opened the conversation by framing this in concrete terms, as most organisations have accumulated years, sometimes decades, of firewall rules written by engineers who have long since left. Nobody knows what the rules do. Nobody wants to remove them in case something breaks. So the attack surface quietly grows, rule by rule, misconfiguration by misconfiguration.Why cybersecurity policies failPolicy rules accumulate over the years, with no regular auditing or ownership.Engineers who wrote original rules leave, taking institutional knowledge with them.Implicit trust zones create blind spots between internal network segments.Manual management of distributed devices introduces critical human error.Organisations lack unified visibility across multi-vendor firewall estates.Compliance-driven policy creation prioritises documentation over real protection.One Misconfiguration Can Cost Millions of DollarsBrazil's journey into policy management began not in a boardroom but at a terminal in the late 1990s, watching a misconfigured firewall bring a major financial institution to its knees. A single incorrectly written rule, one that should have been straightforward, caused a cascading failure that resulted in significant financial losses and reputational damage that took years to repair. The Firemon CEO said:"It was that moment that it hit me. We need a solution to better manage the policies that are enforced on these devices. And that was the genesis of FireMon."Zero Trust Was Born From Bad PolicyKindervag's origin story is equally revealing, and it directly challenges a comfortable myth. Zero Trust is often described as a bold new philosophy, a paradigm shift invented in the halls of Forrester Research around 2010. Kindervag's account is more earthbound as the framework emerged from watching bad policy fail, over and over, in environments that assumed internal network traffic was inherently safe. The Illumio Chief Evangelist shared his thoughts:"It said that you didn't have to have a policy statement or rule when you went from a high-trust zone to a low-trust zone. I thought that was silly — and I started putting out firewall rules on all interfaces. All of these systems should have the same trust level. And it should be zero. That's where Zero Trust comes from. It comes from bad policy."Firewall Advanced ToolingBrazil and Kindervag converge on a shared conclusion that tools exist to solve this problem. The barriers are organisational inertia, institutional fear of breaking existing connectivity, and a lack of executive mandate to treat policy governance as a first-class security discipline.FireMon's platform approaches the problem from the management layer, giving security teams unified visibility across multi-vendor firewall estates, automated rule analysis, change workflow management, and compliance reporting. Illumio's micro-segmentation platform approaches it from the enforcement layer, applying granular policy controls workload-to-workload, whether on-premises or in the cloud, without requiring network reconfiguration.Together, they represent a maturity arc that Stiennon describes as increasingly urgent. As organisations migrate workloads to cloud environments, adopt containerisation, and expand their attack surface through remote work and third-party integrations, the traditional approach to policy management has been reactive, manual, and siloed by device, which is simply incompatible with operational reality.Want to learn more about cybersecurity strategies? Visit firemon.comTakeawaysThe evolution of cybersecurity policy and its impact on security architecture.The origins and importance of policy management in firewalls.Challenges of managing complex policies in large enterprises.The concept of zero trust and its relation to policy flaws.The role of micro-segmentation and graph databases in modern security.Chapters00:00 The Foundation of Cybersecurity Policy03:21 The Evolution of Network Security10:10 Challenges of Firewall Policies14:28 The Complexity of Network Segmentation19:12 Understanding the Security Graph23:24 AI and Vulnerability Management29:45 Conclusion and Key Takeaways

In the digital age, securing sensitive business information has never been more critical. Microsoft 365 has become the backbone of operations for organisations worldwide, and with that centrality comes an expanding attack surface that many security teams are only beginning to fully understand.&nbsp;In a recent episode of the&nbsp;Security Strategist&nbsp;podcast, host&nbsp;Richard Stiennon&nbsp;sat down with&nbsp;Rob Edmondson, Senior Director of Product Marketing at&nbsp;CoreView, to unpack the practical realities of Microsoft 365 security. The conversation covered configuration drift, excessive privilege, tenant hardening, and the emerging security challenges posed by AI agents offering actionable guidance for security professionals at every level.Microsoft 365 EnvironmentMicrosoft 365 has changed significantly from a simple productivity platform into a comprehensive security concern in its own right. As Edmondson points out, the transition from Office 365 to Microsoft 365 marked a pivotal shift in how organisations utilise these tools. What began as a suite of familiar applications, such as Word, Excel, and Outlook, has grown into an interconnected ecosystem of over 60 apps and services, from Teams and SharePoint to Power Automate, Defender, and Purview. That expansion has delivered enormous productivity gains, but it has also multiplied the potential vectors for security vulnerabilities exponentially. Every additional service is a new configuration surface, a new set of permissions to govern, and a new integration that must be secured. Understanding this evolution is the essential starting point for any organisation serious about Microsoft 365 security.Configuration Drift and Why It Puts Microsoft at RiskConfiguration drift is one of the most pervasive and underappreciated threats in Microsoft 365 environments. It refers to the gradual, often unnoticed divergence of system configurations from their original, secure baseline, which is a slow accumulation of small changes that individually seem harmless but collectively create significant vulnerabilities.Edmondson highlighted that most organisations lack adequate visibility into how their Microsoft 365 tenant is actually configured at any given moment. Many still rely on manual methods like spreadsheets, periodic snapshots, and ad hoc reviews to track configuration state. This approach is fundamentally inadequate in environments where settings can change daily, sometimes through automated processes or third-party integrations that bypass normal change management controls.The consequences of undetected configuration drift can be severe. Breaches have been traced directly to unauthorised or unintended configuration changes, a permissions setting quietly altered, an authentication policy weakened, or a data loss prevention rule inadvertently disabled.&nbsp;Microsoft 365 Security PostureExcessive privilege is consistently ranked among the leading contributors to security incidents in cloud environments, and Microsoft 365 is no exception. When users, service accounts, and applications hold more permissions than their role requires, the potential blast radius of any compromise — whether through phishing, credential theft, or insider threat — expands dramatically. Edmondson walked through the practical challenge: in large organisations, permissions accumulate over time. A user gets temporary admin access to complete a project, and that access is never revoked.AI Agents in Microsoft 365As organisations adopt AI-driven tools and agents within their Microsoft 365 environments, a new and largely uncharted security frontier is emerging. AI agents — automated systems capable of acting on behalf of users, reading emails, accessing files, and executing workflows — introduce permissions challenges that most security frameworks were not designed to handle.Edmondson was candid about the challenge: many organisations deploying AI agents do not have clear visibility into what those agents can access, what data they are interacting with, or whether the permissions they hold are appropriate. In an environment where an AI agent might have access to the entire Microsoft 365 data estate of a user or a team, the consequences of a misconfigured or compromised agent are significant.The same principles that govern human access with least privilege, continuous monitoring, and regular review must be extended to AI agents. This requires both the technical capability to enumerate agent permissions and the governance processes to enforce appropriate boundaries. Organisations that deploy AI capabilities without first establishing this control layer are trading short-term productivity gains for long-term security debt.Microsoft 365 SecurityIn the fast-moving threat landscape, understanding and proactively strengthening your Microsoft 365 security posture is no longer optional; it is a business imperative. Configuration drift, excessive privilege, and AI agent governance are not edge cases; they are mainstream risks affecting organisations of every size and sector. The insights shared by Edmondson on the Security Strategist podcast provide a practical foundation for addressing each of these challenges with clarity and urgency.By implementing continuous monitoring, enforcing least-privilege access, hardening your tenant configuration, and extending security governance to AI agents, organisations can significantly reduce their exposure and build a Microsoft 365 environment that is resilient by design. For further insights and tools to support your Microsoft 365 security journey, visit&nbsp;CoreView.TakeawaysConfiguration drift and its impact on security.Excessive privileges and how to mitigate them.Tenant hardening best practices.Managing AI agents and permissions in Microsoft 365.Strategies for continuous security monitoring.Chapters00:00 Introduction to Microsoft 365 Security02:25 The Shift to Security Priority in Microsoft 36504:30 Understanding Configuration Drift09:09 Excessive Privilege and Its Risks12:48 AI Agents and Identity Security16:20 Tenant Hardening and Common Misconfigurations18:36 Recommendations for Strengthening Security Posture

Financial crime is no longer a peripheral concern for banks and fintechs; it is a defining operational challenge. The pressure to grow transaction volumes, onboard customers quickly, and keep pace with increasingly sophisticated fraud actors has placed finance and compliance teams at the very heart of business strategy. For many institutions, the question is no longer how to use artificial intelligence in their fraud detection stack, but how to use it responsibly.In this&nbsp;Security Strategist&nbsp;podcast, hosted by&nbsp;Jonathan Care, Senior Lead Analyst at&nbsp;KuppingerCole, he speaks with&nbsp;Kunal Datta, Chief Product Officer at&nbsp;Unit21, about the changes in financial crime prevention technology and the gaps that remain in the industry.The role of AI in fraud detectionFor most of the past two decades, financial crime prevention operated on one of two tracks. Larger, data-rich institutions invested in machine learning models capable of identifying complex behavioural patterns across millions of transactions. Smaller players, or those entering new product categories with thin data histories, tended to rely on rules-based systems, which are explicit, human-authored logic that flags transactions meeting predefined criteria.Both approaches have genuine strengths. Rules-based systems are auditable, easy to explain to a regulator, and quick to update when a new fraud typology emerges. Machine learning systems are far more powerful at surfacing non-obvious correlations and adapting to evolving attack patterns, but they require substantial training data and significant engineering effort to deploy.The arrival of large language models and generative AI has introduced a third paradigm, one that is fundamentally non-deterministic. Unlike a rule that fires predictably on every run, or an ML model that produces a consistent probability score for a given feature vector, a generative AI system may reason differently across identical inputs. This has profound implications for how institutions build, test, and govern their fraud detection infrastructure.Balancing revenue growth and fraud riskPerhaps the most underappreciated tension in financial crime prevention is not technical; it is commercial. Every fraud control is also a friction point. A transaction declined as suspicious is, from the customer's perspective, simply a transaction that failed. Every false positive erodes trust, damages conversion rates, and risks losing a customer to a competitor with a more permissive onboarding flow. According to Datta:“Machine learning excels at identifying complex patterns, but rules-based systems can quickly adapt to new types of fraud that humans can spot with minimal examples.”This means that fraud teams are never simply optimising for fraud prevention in isolation. They are solving a constrained optimisation problem that is minimising fraud losses while simultaneously protecting revenue, preserving customer experience, and staying within the bounds of what regulators require. AI can shift that frontier, enabling more precise risk assessment that reduces both fraud and false positives simultaneously. But only if it is deployed and governed carefully.The future of AI in financial crimeLooking forward, Datta sees the trajectory of&nbsp;AI in financial crime prevention&nbsp;pointing towards systems that combine the pattern-recognition power of machine learning with increasingly robust mechanisms for transparency and accountability. The goal is not to choose between a powerful AI and an explainable one — it is to build infrastructure that delivers both.Several technical approaches are emerging to close this gap. Structured output formatting — requiring AI systems to return decisions in machine-readable formats like JSON, with explicit reasoning chains, makes it possible to audit AI behaviour at scale. Evaluation sets, which establish a curated baseline of labelled cases against which model performance is continuously benchmarked, allow institutions to detect drift and maintain defensible performance records.&nbsp;The institutions that will lead this space are those treating AI governance not as a compliance overhead but as a competitive advantage. A well-governed AI system is faster to get regulatory approval, faster to deploy new capabilities, and more resilient when regulatory scrutiny increases.The most striking thread in Datta's thinking is his insistence on placing financial crime prevention within a broader moral frame. Financial crime is not merely an operational risk; it is a conduit for some of the most serious harms in the world: human trafficking, modern slavery, terrorist financing, and the systematic exploitation of vulnerable people. Viewed through this lens, the deployment of better AI in financial crime prevention is not primarily a business efficiency story. It is a contribution to a more just and safer world. Datta says:“AI should be viewed not only as an efficiency driver but as a tool to address broader societal issues like human trafficking and exploitation. Better detection is a moral obligation.”This framing matters for how organisations think about investment in financial crime technology. If AI in fraud prevention is purely a cost centre, it will always lose budget battles to revenue-generating activities.&nbsp;If you would like to find out more, visit:&nbsp;Unit21.ai&nbsp;or read more about&nbsp;Rules vs. Machine Learning: Finding the Best of Both Worlds&nbsp;by Kunal Datta.If you are looking to strengthen how your organisation identifies and manages risk, you can request a&nbsp;personalised demo with Unit21.TakeawaysEvolution of financial crime detection over the last decadeDeterministic vs non-deterministic AI systems in fraud preventionThe role of generative AI and context engineering in complianceAccountability and explainability in AI-driven decision makingRegulatory perspectives on AI and risk management00:00 Navigating Financial Crime Prevention Challenges02:54 The Evolution of Fraud Detection Systems05:55 The Debate: Explainability vs. Performance in AI08:51 Balancing Accuracy and Regulatory Expectations12:01 Context Engineering in AI for Financial Crime15:04 Rethinking Accountability in AI Systems17:55 AI as a Societal Imperative in Risk and Compliance

Podcast: The Security StrategistGuest: Rick Wagner, Senior Director, Product Management at SailPointAnalyst: Jonathan Care, Lead Analyst, KuppingerColeThe identity security market is crowded, but a significant change is occurring below the surface. In a recent episode of The Security Strategist podcast, host Jonathan Care, Lead Analyst at KuppingerCole, sat down with Rick Wagner, Sr. Director Product Management at SailPoint. In this episode, Wagner pointed out a growing gap between how enterprises manage access and how modern systems operate. As AI and machine identities grow rapidly, traditional models no longer work.Static Access Reviews Are Breaking at ScaleFor years, enterprises have depended on periodic access certifications to manage access. However, such a model is proving to be weak. “Periodic access reviews only look at appropriate access at a point in time,” says Wagner, noting that “certification fatigue results in rubber stamping.”The challenge is both scale and accuracy. With machine identities often outnumbering humans, governance processes designed for manual oversight are quickly becoming outdated. “Doing those certifications at agent speed is literally impossible,” he adds, emphasising the need for change.Also Watch: Why AI Agents Demand a New Approach to Identity SecurityHow is Real-Time Authorisation &amp; AI Redefining Identity Security?The way ahead is real-time authorisation, which continuously checks if access is appropriate at the moment it is requested. “It’s not only appropriate— is it appropriate right now?” Wagner explains.This change depends on context, incorporating information such as device health, user behaviour, and risk level. Frameworks like the Shared Signals Framework help enterprises implement this by allowing real-time data sharing across the security ecosystem. This approach leads to more dynamic, policy-driven access that keeps pace with AI systems.How to Tackle Shadow AI?At the same time, CISOs face the rise of shadow AI, an expanding network of agents operating with little oversight. “You can’t manage what you can’t see or what you don’t know about,” says Wagner, highlighting visibility as the first line of defence.The long-term goal is autonomous identity governance, where systems continuously evaluate and adjust access based on risk. “As risk levels start to increase, we might add additional factors up to quarantining that access,” he explains.In this new framework, identity becomes the core of cybersecurity strategy. As Wagner puts it, the ongoing challenge is urgent – determining “who has access to what—and is that access appropriate right now.”Key TakeawaysReal-time identity governance replacing static access reviews AI and machine identities outpace human oversight“Certification fatigue” is weakening traditional access controls, increasing risk through unchecked approvals.Non-human identities (AI agents, bots) are now the fastest-growing and least visible attack surface.Context-aware access decisions—based on risk, behaviour, and environment—are becoming the new standard.Visibility into agents and their permissions is critical: “you can’t manage what you can’t see.”Autonomous, risk-adaptive identity security is emerging as the end-state for modern enterprise cybersecurity.Chapters00:00 Introduction to Identity Security in AI Era06:54 Managing Privileged Access Risks13:52 Real-Time Governance and Joiners, Movers, Leavers20:14 Strategic Moves for CISOs in Agent-Based OperationsFor more information, please visit em360tech.com and sailpoint.com. To stay updated on B2B Tech front and centre, follow EM360Tech:YouTube: @enterprisemanagement360LinkedIn: @EM360TechX: @EM360TechFollow SailPoint on all its major platforms:YouTube: @SailPointTechnologiesLinkedIn: @SailPointX: @SailPoint#IdentitySecurity #AIAgents #RealTimeGovernance #SailPoint #IAM #ShadowAI #Cybersecurity #EnterpriseTech #TechLeadership #CIOInsights #DigitalTransformation #MachineIdentities

Over 95 per cent of leaders now say identity security is core to their strategy. A decade ago, this wasn’t even part of the conversation. The awareness is there, but awareness alone isn’t enough. Many organisations feel secure, yet the metrics they track often tell a different story.&nbsp;In this episode of&nbsp;Security Strategist, EM360Tech’s&nbsp;Trisha Pillay&nbsp;sits down with&nbsp;Craig Ramsay, Senior Field Strategist, and&nbsp;Rod Simmons, VP of Product Strategy at&nbsp;Omada, to unpack the&nbsp;State of Identity Governance 2026&nbsp;report. Together, they explore why confidence in identity security doesn’t always equal true protection and how AI, non-human identities, and fragmented systems are changing the rules.Bridging the Gap Between Perception and RealityMany organisations focus on operational metrics that are easy to measure: provisioning speed, audit readiness, and compliance. These give a sense of efficiency but not necessarily security. Simmons explains: “We can provision identities faster, but that doesn’t tell us about inherent risks. Orphaned accounts, dormant privileges, unmanaged access—these risks often go unseen.”Ramsay adds, “It’s like home security. You might feel confident, but when was the last time you checked your back door?”The survey revealed a clear disconnect: strategic awareness exists, but organisations are not always measuring the right things. Security leaders should not only track completed tasks, but they must also understand where risk accumulates and how quickly they can respond to incidents. Risk-based metrics, rather than activity-based metrics, are the key to true governance.Zero Trust and the Challenge of IntegrationAlmost every organisation reports adopting Zero Trust principles. The execution often falls short. Policies may exist in pockets, but full implementation requires connected systems that can share signals in real time. Without this integration, Zero Trust becomes a concept rather than a functioning model.Rod highlights the issue: “It’s one thing to want continuous evaluation, but another to have systems that actually support it. Shared signal frameworks are essential for consistent enforcement across the enterprise.” Until Zero Trust principles are fully integrated across all platforms, access control and identity governance will remain reactive rather than proactive.Non-Human Identities, AI, and the New FrontlineIdentity is no longer just about people. Non-human identities, but API keys, service accounts, and AI agents, are multiplying at unprecedented rates. Some organisations see 150 non-human identities for every human. These identities act autonomously, persistently, and at scale. Simmons explains the challenge: “With human identities, we ask what access they have. With non-human identities, we ask what they can do, and what they’ve done.”Ramsay adds a crucial reminder: “Artificial intelligence still needs an accountable individual. Human oversight is essential, even as AI agents scale and operate independently.”These agents create both risk and opportunity. They can automate governance, improve provisioning, and flag anomalies—but without proper visibility and ownership, they become a blind spot. Over 40 per cent of surveyed organisations admitted their AI agents still use static credentials, a simple but serious vulnerability.One thing is for sure: you cannot govern what you cannot see. Visibility is the foundation. Only once organisations know what exists, who owns it, and how it behaves can they secure identities, human and non-human alike, effectively.Identity security is no longer a back-office concern—it’s strategic. Organisations must move from confidence to proof, from operational reporting to risk measurement, and from fragmented controls to integrated governance. AI and non-human identities are not just a challenge; they are an opportunity to rethink how identity security can truly enable business, not just protect it.For more insights on effective identity governance strategies, check out Omada's State of Identity Governance 2026 Report.TakeawaysOver 95 per cent of security leaders now see identity as a core strategy. Identity isn’t optional anymore.Feeling secure doesn’t equal being secure. Many organisations track efficiency, not actual risk.Non-human identities are multiplying fast.&nbsp;Zero Trust adoption is growing, but integration gaps remain.&nbsp;AI in identity governance works, but always keep a human in the loop.Chapters00:00 Introduction to Identity Governance and Security Challenges02:55 Insights from the State of Identity Governance Report05:53 The Gap in Security Confidence and Measurement08:53 Operational Metrics vs. Risk Indicators11:50 Zero Trust Adoption and Implementation Challenges14:54 The Role of AI in Identity Governance17:52 Non-Human Identities and Governance Challenges21:07 Key Takeaways for Security Leaders

Podcast series: The Security StrategistGuest: Amit Megiddo, CEO and Co-Founder, NativeHost: Richard Stiennon, Chief Analyst Researcher at IT-HarvestIn the recent episode of The Security Strategist Podcast, Amit Megiddo, CEO and Co-Founder, Native, joins host Richard Stiennon, Chief Research Analyst at IT-Harvest, to discuss a growing challenge in enterprise cloud security. Enterprises are investing heavily in cloud providers’ built-in controls, yet risk persists when those controls are not consistently enforced across complex environments.According to Megiddo, the problem isn't a lack of tools, but a failure to make them work effectively. Drawing on his experience launching Amazon GuardDuty at Amazon Web Services, the Native CEO explains that enterprises have hit a tipping point. The challenge is no longer about visibility. It is about executing at scale across complex multi-cloud environments.What is the Execution Gap in Cloud Security?Cloud providers such as Amazon Web Services, Microsoft Azure, Google Cloud, and Oracle Cloud offer a wide range of built-in security features. Yet, as Megiddo points out, most enterprises are only using a small part of what is available.“The easy part is turning controls on,” he says. “The hard part is making sure they consistently deliver security results.” This is where many enterprises struggle. Security teams create policies, but platform teams carry them out. In the process, vital context is lost. The result is a disjointed approach where risks are identified but not effectively managed.Megiddo calls this the “execution gap.” It is a fundamental issue in how enterprises handle cloud security. Even with sophisticated CSPM and CNAP tools, organisations remain mostly reactive. They are relying on detection and fixing problems instead of preventing them.How to Move From Detection to Policy-Driven EnforcementThe podcast spotlights a key shift in enterprise security strategy – moving from detection controls to proactive, policy-driven enforcement. Conventional methods focus on spotting issues—like unencrypted or publicly exposed data—and then starting remediation processes. However, as cloud environments grow, this method becomes untenable.Megiddo suggests embedding security directly into the architecture:Preventing non-compliant resources from being createdDesignating approved regions for workloadsEnforcing network isolation rules for sensitive environments, such as AI training workloadsThis “secure-by-design” approach turns security from a reactive task into a core operational control. However, implementing this is not easy. Enterprises must translate high-level policy goals into thousands of low-level settings across various cloud providers, each with its own APIs, services, and policy frameworks.“It’s not just about writing the policy,” Megiddo emphasises. “It’s about safely rolling it out, simulating impact, managing exceptions, and ensuring it stays enforced over time.”It creates new operational needs such as simulation tools, drift detection, real-time developer feedback, and automated exception handling. Essentially, cloud security becomes a continuous process rather than a one-time setup.Why is the Unified Control System Critical?The main takeaway for enterprise leaders is that cloud security is no longer just about managing risks; it is becoming an edge in the market. As major providers continue to invest heavily in native security features, the real differentiator will be the ability to coordinate and enforce those tools effectively.Megiddo’s vision is straightforward: a unified control system that lets enterprises define security intent once and apply it consistently across cloud and hybrid environments.In an industry shaped by AI, multi-cloud complexity, and rapid digital changes, this ability could determine how quickly—and securely—enterprises can progress. For CISOs and IT leaders, the message is clear: the future of cloud security lies not in observing more, but in doing more—with precision, consistency, and scale.Key TakeawaysShift from detection to proactive, policy-driven cloud security to reduce risk.Multi-cloud across Amazon Web Services, Microsoft Azure, and Google Cloud requires unified enforcement.CISOs need tools that turn security policy into automated controls.Secure-by-design cloud architecture protects AI and enterprise workloads.Strong cloud security execution drives scalability and resilience.Chapters00:00 The Cloud Security Landscape03:11 Challenges in Implementing Cloud Security08:00 Transitioning to Proactive Security12:26 The Evolving Role of Security Leaders16:42 Future Trends in Cloud SecurityFor more information, please visit em360tech.com and native.security. Follow: @EM360Tech on YouTube, LinkedIn and XNative LinkedIn: https://www.linkedin.com/company/native-security/#CloudSecurity #PolicyDrivenSecurity #CloudEnforcement #MultiCloudSecurity #SecurityByDesign #ExecutionGap #CISOs #TheSecurityStrategist #NativeSecurity #CSPM #CNAP #EnterpriseSecurity #NativeSecurity #AmitMegiddo

If you've ever tried to navigate the FedRAMP authorization process, you already know it's slow, expensive, and tedious when it comes to the documentation. For cloud service providers (CSPs) hoping to sell to the federal government, it has long been one of the biggest barriers to entry. That’s now changing. FedRAMP 20x is the most significant modernization of the Federal Risk and Authorization Management Program in its history and is reshaping how CSPs can achieve compliance.In this episode of the&nbsp;Security Strategist&nbsp;podcast,&nbsp;Kenny Scott, founder and CEO of&nbsp;Paramify, joins host&nbsp;Richard Stiennon, Chief Research Analyst at IT-Harvest, to unpack what’s changing, why it matters, and how it could redefine the path to federal authorization.FedRAMP 20x is set to help CSPs approach compliance by cutting costs, reducing timelines, and shifting the focus from paperwork to verifiable security evidence.What Is FedRAMP And Why Did It Need to Change?FedRAMP, the Federal Risk and Authorization Management Program, provides a standardised framework for the security assessment, authorisation, and continuous monitoring of cloud products and services used by U.S. federal agencies. In theory, it's a smart idea: one unified security standard that any agency can rely on.In practice, the traditional process became a bottleneck. Scott puts it bluntly: "FedRAMP's original design had a fatal flaw; it prioritized documentation over deterministic security evidence."The result? CSPs were spending months, sometimes years, and hundreds of thousands of dollars compiling documentation packages that didn't necessarily make their systems more secure. Agencies weren't getting the real-time, verifiable security assurance they needed. And smaller, innovative CSPs were priced out entirely.Problems with Traditional FedRAMPLengthy approval times as authorisation could take 12–18+ months, delaying market entry for cloud providers.High compliance costs with smaller CSPs often couldn't afford the financial burden of full FedRAMP authorization.Documentation overload with extensive paperwork, distracted from actual security practices and outcomes.FedRAMP 20xFedRAMP 20x goes beyond a version update; it signals a fundamental shift in how compliance is defined in modern cloud environments. Announced by the General Services Administration, the initiative is designed to make authorizations faster, cheaper, and more meaningful.Changes in FedRAMP 20x:Streamlined authorization processes, which means faster pathways to approval, reducing time-to-market for CSPs.Automation-first compliance that replaces manual documentation with automated, machine-readable security evidence.Risk-based flexibility that tailors requirements to the actual risk profile of a service, rather than a one-size-fits-all model.As Scott explains, the shift is from compliance as a paper exercise to compliance as a continuous, evidence-based practice. Agencies want real, deterministic security evidence, and FedRAMP 20x is built to deliver exactly that.What FedRAMP 20x Means for Cloud Service ProvidersFor CSPs, the modernization is a double-edged opportunity; those who adapt quickly will gain a significant competitive advantage; those who don't may find themselves falling behind as the compliance landscape evolves.On the opportunity side, the most immediate impact is a faster time to market. With streamlined approval processes, CSPs can move through authorisation more efficiently and reach federal customers sooner than before. This acceleration is paired with lower compliance costs, as reduced documentation and administrative burden free up resources that can instead be directed toward innovation and strengthening security capabilities. Perhaps most significantly, the changes help level the playing field, enabling smaller CSPs with strong security practices to compete more effectively against larger, established incumbents.At the same time, these benefits come with new demands. CSPs will need to stay closely aligned with an evolving framework, continuously tracking updates and guidance as FedRAMP 20x matures. In addition, fully realising the advantages of the new model will require investment in automation. Organizations that adopt compliance and security automation tooling will be better positioned to keep pace, reduce manual effort, and maintain consistent alignment with the updated requirements.If you would like to find out about this visit&nbsp;paramify.com&nbsp;and connect with Scott on&nbsp;LinkedIn.Chapters00:00 — Introduction to FedRAMP 20x13:42 — The Need for Change in FedRAMP20:20 — FedRAMP 20x: A New Approach28:27 — Success Stories with FedRAMP 20xTakeawaysFedRAMP 20x modernizes federal cloud security compliance by replacing documentation-heavy processes with automation and evidence-based security.The traditional FedRAMP process was slow, costly, and document-intensive — a barrier that limited innovation and market access for CSPs.CSPs that invest in automation and stay ahead of evolving requirements will gain a clear competitive edge in the federal marketplace.Kenny Scott and Paramify are at the forefront of helping organizations navigate this shift intelligently and efficiently.

Keeping your organisation’s systems secure can feel like an endless battle. Patch management and vulnerability mitigation are often seen as tedious tasks, but they form the backbone of effective cybersecurity. In this episode of the&nbsp;Security Strategist&nbsp;podcast, host&nbsp;Richard Stiennon&nbsp;and&nbsp;Mike Walters, co-founder of Action1, break down why patching remains challenging and share practical strategies to make the process simpler, smarter, and more effective.Patch Management Remains a ChallengePatch management has been a concern since the earliest days of computing, dating back to mainframes and early PCs. Despite technological advances, it remains a "busy work" task that many IT teams find overwhelming.&nbsp;So what makes patching so hard today? One of the main reasons patching is still so difficult is the constant evolution of IT ecosystems. As Walters explains, "The biggest challenge is the ever-evolving nature of software with different applications, sources, and methodologies."&nbsp;Operating systems, third-party apps, and custom configurations all require tailored approaches for updates and patches, making uniform processes impossible. Large organisations often have hundreds or thousands of devices, each running different software versions requiring specific patches and testing before deployment. The COVID-19 pandemic has dramatically shifted traditional patching strategies. Pre-pandemic, enterprises could rely on corporate networks and distribution points for patches. Now, a dispersed workforce, VPNs, and hybrid cloud architectures have made remote patching more complex.As Walters notes, "Remote endpoints become a big challenge. You need network-agnostic solutions that work regardless of whether a device is connected to the corporate network or a coffee shop." Connection issues, bandwidth limitations, and endpoint diversity all impact security teams' ability to apply patches swiftly.Innovative Solutions for Streamlining Patch ManagementTo address these challenges, organisations are moving towards more intelligent and automated patching strategies. As Walters puts it, the starting point is simple: automation. By removing repetitive manual tasks, teams reduce the risk of human error and create space to focus on higher-value security work. Done properly, automation allows for scheduled updates, controlled testing, and the ability to roll back quickly if something goes wrong.At the same time, how patches are delivered matters just as much as when. Large updates can put significant strain on networks if pushed out all at once, which is why approaches like peer-to-peer distribution are gaining traction. By allowing endpoints to share updates locally, organisations can reduce bandwidth pressure and avoid bottlenecks. Flexible “catch-up” windows also ensure that devices which miss an update cycle can still be brought into compliance without disrupting operations.Modern environments are also driving a shift towards cloud-native, agent-based architectures. Instead of relying on a fixed network or VPN, these agents connect directly to cloud services, allowing patches to be deployed consistently across remote, mobile, and distributed devices. This approach reflects the reality of how people work today, where endpoints are no longer confined to a single network.Finally, effective patching is as much about control as it is about speed. Progressive rollouts—testing updates on a small group before expanding—help organisations avoid widespread disruption. By identifying issues early and isolating them quickly, teams can maintain stability while still ensuring that critical vulnerabilities are addressed without delay.Action1’s Unique ApproachAction1’s innovative model offers 200 free endpoints forever with no feature limitations, facilitating all sizes and types of organisations to implement effective patching solutions. By removing entry barriers, Action1 enables organisations to test, scale, and secure their patches more affordably.&nbsp;As Walters shares, "Offering free endpoints helps small IT teams get started, and as they grow, they stay with the platform."This approach promotes widespread adoption, accelerates security improvements, and creates a community of organisations committed to better vulnerability management.As cybersecurity environments become more complex and distributed, patching will remain a critical task—if not the critical task—of your security strategy.If you would like to find out more, visit:&nbsp;https://www.action1.com/TakeawaysThe history and persistent nature of patch management issuesHow remote and hybrid work models impact patching strategiesThe importance of network-agnostic, agent-based patching solutionsHow to leverage automation and orchestration to reduce IT workloadPeer-to-peer distribution to optimise bandwidth during large-scale updatesDeveloping a phased, ring-based approach to patch deploymentReal-world challenges of patching high-availability systems and remote endpointsAction1’s unique offer of 200 free endpoints without feature limitationsThe significance of thinking like an attacker to anticipate vulnerabilitiesChapters:00:40 - Mike Walters’ background and company journey02:00 - Why patching remains a complex, evolving task04:35 - The need for specialisation and solving patching for good05:11 - Why patch management feels like busy work and its inherent difficulties06:44 - Lessons from early vulnerability management experiences09:38 - Handling patching challenges for remote and mobile users10:15 - The implementation of agent deployment and catch-up windows12:22 - Innovative bandwidth management using peer-to-peer distribution14:55 - The value of automation and trust in large-scale environments16:50 - Utilising update rings for safer, staged patch deployment17:45 - Prioritising patching for zero-day vulnerabilities and rapid response18:43 - Action1’s free tier for small IT environments supporting smaller organisations21:35 - Practical insights for IT leaders: automation, application patching, and attacker mindset24:53 - Closing thoughts: automation and proactive attack thinking

The way organizations access and use enterprise data has fundamentally changed. Knowledge workers now operate in browser-based environments, relying heavily on SaaS applications and increasingly experimenting with AI-powered tools to boost productivity.In the Security Strategist podcast,&nbsp;Chris Steffen, Vice President of Research at&nbsp;Enterprise Management Associates (EMA), spoke with&nbsp;Michael Leland, Field Chief Technology Officer at&nbsp;Island, about the growing cybersecurity challenges associated with browsers, SaaS platforms and AI tools and how organizations can adapt their enterprise security strategies.While this shift has accelerated innovation, it has also introduced new cybersecurity risks. Sensitive information now flows through consumer browsers, AI assistants, browser extensions and cloud platforms; often outside the visibility of traditional security controls. As a result, enterprise security teams must rethink how they approach data protection, governance and access control in a browser-driven workplace.Why Browser-Based Workflows Are Creating New Enterprise Security RisksEnterprise security models were historically built around network perimeters, firewalls and on-premise infrastructure. Today, however, most work happens inside web browsers, where employees interact with SaaS platforms, cloud storage systems and AI tools.According to Leland, this shift has significantly expanded the attack surface.“The majority of knowledge workers are accessing business applications primarily via the web, whether it’s a SaaS application or a web front end to a legacy application. But they’ve been doing so in a consumer browser,” he explains.&nbsp;Consumer-grade browsers were designed for convenience and personal use, not enterprise security. As a result, they often introduce vulnerabilities that can expose sensitive corporate data.Traditional enterprise controls such as VPNs, secure web gateways and zero trust architectures attempt to mitigate these risks. However, these tools frequently operate outside the browser itself, leaving gaps in visibility and control.The challenge becomes even more complex when browser extensions are added to the mix. Many extensions request extensive permissions and can access sensitive information inside SaaS applications.“In the last 18 months, almost 40 per cent of browser extensions published have something to do with AI. Some offer real productivity gains, but the provenance of many of these tools is questionable,” Leland notes.&nbsp;This growing ecosystem of extensions and cloud tools has created a new security frontier where enterprise data protection must operate directly at the user interaction layer.How AI Sprawl Is Complicating Data GovernanceAlongside browser-driven workflows, organizations are also dealing with a rapid surge in AI adoption. From tools like ChatGPT and Copilot to embedded AI features inside SaaS platforms, AI is becoming a standard part of the modern workplace.However, this rapid adoption is also creating a phenomenon known as AI sprawl. Knowledge workers increasingly select their own AI tools based on preference or convenience, leading to a patchwork of unsanctioned platforms operating across the enterprise.“Each knowledge worker may have their own AI tool of choice. So the whole BYO AI—bring your own AI—trend is becoming very real,” says Leland.&nbsp;While these tools can deliver productivity gains, they also create serious data governance risks. Many AI platforms process prompts and inputs in external cloud environments, meaning that sensitive information could be inadvertently shared or stored outside company-controlled systems. Even seemingly harmless productivity tools may capture user data.Why Visibility and Data Boundaries Are Critical for Protecting Enterprise DataWith browser usage and AI adoption accelerating, many cybersecurity teams are shifting their focus toward controlling data at the point of interaction rather than relying solely on network-based controls.One emerging concept is the use of data boundaries—defined environments where organizations can control how sensitive information moves between applications.A data boundary acts as a secure enclave that determines which applications are trusted and what data can flow between them.“If you trust application A and application B, you might allow data to move freely between them,” Leland explains. “But you still enforce guardrails that prevent data from leaving that boundary.”This approach allows organizations to balance security and productivity, an increasingly important consideration as knowledge workers rely on multiple SaaS platforms and AI assistants to complete daily tasks.Another critical component of modern enterprise security is visibility. Security leaders cannot govern AI tools or protect sensitive data if they do not understand how employees are using them. As enterprises continue to embrace cloud applications and AI tools, protecting sensitive data will require a shift in cybersecurity thinking.If you would like to find out more, visit&nbsp;island.ioTakeaways:Establish a secure data boundary to control data flow between trusted applications.Utilize AI to automate data protection and enhance real-time monitoring.Foster a culture of security awareness among employees to strengthen your organization’s security posture.Chapters00:00 Introduction to Cybersecurity and AI03:07 The Evolution of Browsers for Knowledge Workers06:03 Challenges in Enterprise Security09:04 Balancing Data Protection and Productivity11:48 Navigating AI Risks in the Workplace14:59 Understanding AI Sprawl and Governance17:50 The Role of Presentation Layer in Data Protection21:10 Real-World Applications in Financial Services23:57 Final Thoughts on Securing Knowledge Workers

Podcast Series: The Security StrategistHost: Richard Stiennon, Chief Research Analyst at IT-HarvestGuest: Dr Chris Pierson, Founder and CEO of BlackCloakThere has always been a boundary in the enterprise technology corporate network. However, that boundary has been fading for a while, and now it may have completely vanished.In the recent conversation on The Security Strategist podcast, cybersecurity expert Dr Chris Pierson, also the Founder and CEO of BlackCloak, joined host Richard Stiennon, Chief Research Analyst at IT-Harvest.The BlackCloak CEO presented a reality that many CISOs are only now facing. The most critical vulnerabilities in an enterprise may lie far beyond corporate control, embedded in the personal lives of its leadership.Why Attackers are After Soft Targets?Pierson explains that attackers are no longer focused on directly breaching secure enterprise systems. Instead, they are targeting individuals with the highest levels of access in a more effective way.Executives and board members have always been appealing targets, but the strategies have changed. Personal email accounts, home Wi-Fi networks, and even family members are now part of the attack surface. These environments generally lack the layered defences of corporate infrastructure, making them easier to exploit.The stakes are high. A compromised home network or personal device can quickly provide access to enterprise systems. Even simple attacks, such as text messages pretending to be from a CEO, can work when aimed at those outside formal security measures.What makes this trend especially dangerous is its subtlety. These attacks rarely look like the major breaches that make the news. Instead, they happen quietly, taking advantage of everyday behaviours in settings that were never meant to withstand sophisticated threats.Also Watch: How Do Attackers Exploit Executives’ Personal Lives to Breach Companies?Why Privacy Measures Aren’t EnoughIn response, many enterprises have implemented privacy-focused solutions to reduce the digital footprint of executives by removing personal data from broker sites. This is a logical first step, but as Pierson points out, it only offers partial protection.Today, personal data isn’t limited to a single source. It is constantly collected, sold, leaked, and reshuffled across many channels. Even when successfully removed from one platform, it often reappears elsewhere—sometimes accidentally, through everyday activities like online shopping or registration for accounts.More importantly, cutting down visibility does little to tackle active threats. An attacker doesn’t need complete information to succeed; they just need enough.This creates a misleading sense of progress for security leaders. Privacy efforts may reduce the attack surface, but they don’t eliminate the underlying risks. Without additional layers of protection, executives remain vulnerable in environments where attackers increasingly target them.Also Read: Deepfakes, Data Brokers, and Home Networks: The Executive Threat Landscape CISOs Can’t Ignore in 2026What is the New Layer of Enterprise Security?What is developing is not merely an extension of existing cybersecurity practices but a new discipline. It’s an approach that treats executives as a critical, high-risk perimeter on their own.The CEO of BlackCloak describes this as a more comprehensive protection model that covers all aspects of an executive’s digital life. It goes beyond corporate endpoints to include personal devices, home networks, and the wider ecosystem where executives and their families live.Enterprise security can no longer focus solely on corporate assets. The home network, personal devices, and even the family environment are now part of the overall risk landscape. At the same time, the line between cyber and physical threats continues to blur, increasing the stakes further.For IT leaders in enterprise technology, the question is no longer whether these risks exist but how they are being managed. As attackers continue to adapt, the path into the enterprise is not through the front door but through the people who have the keys and everything that surrounds them.Key TakeawaysExecutives are the new cybersecurity perimeter and top attack targets.Personal devices and home networks increase enterprise cyber risk.Data broker removal alone cannot protect executive privacy.Digital executive protection requires multi-layered security solutions.Cybersecurity strategies must address physical and cyber threat convergence.Chapters00:00 Introduction to Cybersecurity Challenges for Executives01:02 Understanding Executive Risk and Attack Surfaces06:31 The Role of Data Brokers in Cybersecurity10:13 Home Networks as New Battlegrounds13:00 Comprehensive Digital Executive Protection Strategies18:40 The Importance of Outsourcing Executive ProtectionFor more information, please visit em360tech.com and blackcloak.io.EM360Tech YouTube: @enterprisemanagement360EM360Tech LinkedIn: @EM360TechEM360Tech X: @EM360TechFollow: @EM360Tech on YouTube, LinkedIn and XBlackCloak YT: @blackcloakcyberLinkedIn: @BLACKCLOAKBlackCloak X: @BlackCloakCyber#ExecutiveCybersecurity #DigitalExecutiveProtection #CyberRisk #BlackCloak #CISO #HomeNetworkSecurity #Cybersecurity #ExecutiveRisk #CorporateBreaches #CyberStrategy #CEORisk #HomeNetwork #PersonalLives #AttackSurface #DataBrokers #CyberThreats #PhysicalThreats #TheSecurityStrategist #DrChrisPierson #RichardStiennon #EM360Tech #SecurityStrategy #CorporateSecurity #AccountTakeover #SoftTargets #HomeWiFiBreach

There is a moment in every investigation where time becomes the deciding factor.Not capability, not intent, but time. In modern counter-terrorism, that moment arrives faster than ever because the evidence is no longer waiting to be found. It already exists, scattered across devices, platforms, and networks, growing silently in volume.The question is no longer whether the data is there. It’s whether it can be understood quickly enough to matter.In this episode of&nbsp;Security Strategist, EM360Tech host&nbsp;Trisha Pillay&nbsp;and&nbsp;Chris Johnson, CEO of&nbsp;Cyacomb, explore how digital evidence is reshaping counter-terrorism and why the real challenge isn’t access to information, but the ability to act on it without crossing the line into overreach.Why Digital Evidence Is Reshaping Counter-TerrorismDigital evidence has become central to modern counter-terrorism investigations. From mobile devices and encrypted messaging platforms to online communities, nearly every case now involves large-scale digital analysis. The challenge is not access, it’s volume and complexity.A single device can hold vast amounts of data, and across thousands of investigations, this creates significant backlogs. Investigators must sift through irrelevant, fragmented, and often encrypted information to identify credible threats.At the same time, the threat landscape is changing drastically. Terrorist networks are more decentralised, digitally enabled, and adaptive in how they communicate. This forces law enforcement to rethink how investigations are conducted basically shifting toward digital forensics, data analysis, and real-time intelligence gathering. As Johnson highlights, the ability to deal with data quickly is not new, but the scale of the problem has changed dramatically.Managing Data, Risk and Operational PressureSpeed sits at the centre of modern counter-terrorism operations, where even minor delays in analysing digital evidence can result in missed warning signs or postponed intervention. The increasing speed is far from straightforward. Investigators must contend with vast volumes of data spread across multiple devices, alongside a growing diversity of formats and platforms that complicate analysis.&nbsp;Layered on top of this are manual processes that slow case progression and persistent operational backlogs that delay access to critical insights. The result is a bottleneck in which time-sensitive intelligence risks being lost in a sea of noise. In response, organisations are turning to advanced digital forensics tools and automation to&nbsp;streamline workflows, prioritise relevant data, and reduce the burden of manual investigation. However, efficiency alone does not solve the problem. Accelerating processes without robust controls introduces new risks, particularly when handling sensitive personal data, where speed must be carefully balanced with accuracy, oversight, and compliance.Privacy and Security with AI in Digital InvestigationsArtificial intelligence is becoming an increasingly significant tool in digital forensics and counter-terrorism investigations, largely due to its ability to process data at scale, identify patterns, and rapidly surface relevant insights. This capability enables faster identification of high-risk material, more informed decision-making during investigations, and a reduced dependence on manual data review, which has traditionally been time-consuming and resource-intensive.&nbsp;However, the&nbsp;integration of AI&nbsp;into law enforcement also introduces important ethical and legal challenges that cannot be overlooked. Counter-terrorism operations must remain firmly within established frameworks that safeguard privacy and civil liberties, as failing to do so risks undermining public trust in both the technology and the institutions that deploy it. In response, privacy-assured AI and specialist investigative tools are emerging, designed to minimise exposure to irrelevant personal data, concentrate only on content linked to potential threats, and support transparent, compliant investigative processes. As Johnson notes, while AI has a clear and valuable role in modern law enforcement, its effectiveness ultimately depends on the responsibility and governance with which it is implemented.The Future of Counter-TerrorismThe next phase of counter-terrorism will be defined by the ability to turn data into actionable intelligence quickly and responsibly.This means:Reducing investigative backlogs;Integrating AI into core workflows;Improving collaboration across systems and teams;Embedding privacy into the design of investigative technologies.Digital evidence will only continue to grow. The organisations that succeed will be those that can navigate the intersection of speed, scale, and privacy without compromising any one of them. In modern counter-terrorism, advantage is no longer just about access to information; it’s about how effectively you can act on it.TakeawaysDigital evidence and data volumes in investigationsEvolving threat landscape and global tensionsPrivacy, civil liberties, and ethical considerationsOperational efficiency and technological innovationsFuture trends in law enforcement technologyChapters00:00 The Evolving Role of Digital Evidence in Counter-Terrorism07:10 Challenges in Analysing Digital Evidence13:02 Balancing Privacy and Security in Investigations20:09 Future of Counter-Terrorism and Technology

AI isn’t introducing entirely new cyber threats, but it is changing how easily they can be executed, and by whom. In this episode of&nbsp;Security Strategist,&nbsp;EM360Tech&nbsp;host&nbsp;Trisha Pillay&nbsp;speaks with&nbsp;Darren Anstee, Chief Technology Officer for Security at&nbsp;NETSCOUT, about how conversational AI is lowering the barrier to entry for cyberattacks.&nbsp;Drawing on real-world telemetry from thousands of enterprises and service providers, Anstee outlines how the threat landscape is shifting not through new attack types, but through scale, speed, and accessibility. At the centre of that shift are two forces, in his words, simplification and automation.How AI is Changing Cyber AttacksFrom a Distributed Denial-of-Service (DDoS) perspective, Anstee says, “AI isn’t creating fundamentally new attack vectors. Instead, it’s making existing ones easier to execute”. Historically, launching a sophisticated attack required time, expertise, and intent. Attackers would need to scan a target, identify vulnerabilities, select the right attack vectors, and continuously adapt based on how defences responded. That process demanded both technical knowledge and active decision-making. Now, much of that can be abstracted away.As a result, conversational interfaces are increasingly being integrated into attack tools, allowing users to issue simple, natural language instructions. Behind the scenes, those tools can run reconnaissance, analyse results, select attack methods, and even adapt in real time if defences respond. As Anstee puts it, “the whole need for there being any knowledge in the seat has gone away.” The result is not necessarily more advanced attackers, but more attackers capable of attempting advanced techniques.The Democratisation of Cyber AttacksThis shift has direct implications for enterprise risk. As sophisticated capabilities become more accessible, the volume and distribution of attacks change. Organisations that were previously unlikely targets are now within scope, not because they are high-value, but because they are reachable.Anstee points to a growing trend, and that is attackers moving beyond heavily defended primary targets and focusing on secondary organisations within the digital supply chain. Suppliers, service providers, and partners often present a weaker entry point, while still offering indirect access to larger ecosystems. In practical terms, this expands the attack surface.It also exposes a gap in how many organisations think about risk. Dependencies are not always fully mapped, and the resilience of third-party services is often assumed rather than verified. When those dependencies fail, be it through DDoS disruption or another incident, the impact can cascade quickly. What’s changing is not just who gets targeted, but how risk propagates across interconnected systems. This shift is being accelerated by automation.Automation and Efficiency in CybercrimeAutomation is what turns accessibility into scale. The steps involved in launching an attack, reconnaissance, analysis, execution, and adaptation, can be structured as decision trees. AI systems can follow those paths quickly and consistently, removing the need for manual intervention at each stage. This has two consequences. First, it increases the frequency of attacks. More actors can launch them, and they can do so with less effort. Second, it compresses response time. Attacks can adapt dynamically, forcing defenders to react faster and with greater precision.For many organisations, this exposes a mismatch between perceived and actual readiness. As Anstee notes, having defensive tools in place is not the same as knowing how they perform under real conditions. Firewalls and baseline protections may handle simple attacks, but they are often insufficient against multi-vector, adaptive threats. This is where his emphasis on certainty becomes critical.Confidence—based on vendor claims or assumed coverage is not enough. Organisations need real visibility into how their defences behave in practice, across environments, and under pressure. Without that, decision-making is based on assumptions rather than evidence. In a landscape shaped by automation, that gap becomes harder to sustain.For more information, visit&nbsp;netscout.comTakeawaysAI is simplifying and automating cyber attacks, making them accessible to a broader range of attackersEnterprises must reassess their risk management strategies&nbsp;The cost of cybersecurity is likely to rise as organisations enhance their defencesAI's impact on cyber attack sophisticationDemocratisation of attack capabilitiesAutomation in attack executionSupply chain vulnerabilities and third-party risksCertainty vs. confidence in cybersecurity decision-making&nbsp;Chapters00:00 Introduction to Cybersecurity and AI02:28 The Evolving Threat Landscape06:36 Automation and Cost Implications of AI in Cybercrime11:20 AI's Role in Existing and New Attack Vectors13:36 Understanding Supply Chain Risks17:25 The Importance of Certainty Over Confidence20:33 Strategic Actions for C-Suite Leaders

Many organisations assume that moving to the cloud means much of their security posture is handled automatically. But that assumption can create blind spots. In the latest episode of the Security Strategist Podcast, Trisha Pillay from EM360Tech speaks with Rob Edmondson, Senior Director of Product Marketing at CoreView, about cyber resilience in Microsoft 365 environments and what tenant hardening means in practice.As organisations rely more heavily on Microsoft 365 for collaboration, identity management, and device control, understanding how the environment is configured becomes increasingly important for security teams.Microsoft 365 Has Grown Beyond Its Original ScopeWhen Microsoft first introduced Microsoft 365 as Office 365, it primarily focused on email and productivity tools. Security strategies often revolved around protecting inboxes and ensuring that business data was backed up. According to Edmondson, that model no longer reflects how the platform is used today. Microsoft 365 now includes a wide range of services that support identity management, device management, compliance, and collaboration. Many of these services sit at the centre of daily business operations.This shift means that security risks are no longer limited to email or file storage. Identity platforms, collaboration tools, and endpoint management capabilities all operate within the same tenant. If critical settings are misconfigured, the impact can extend across multiple systems at once. For security leaders, the challenge is recognising that the platform has evolved into something far more complex than many organisations initially planned for.Why Visibility Into Configurations Is Still LimitedOne of the main themes in the discussion is visibility. Edmondson explains that many organisations simply do not have a clear view of how configurations change within their Microsoft 365 tenants.Attackers often exploit these blind spots. If they gain access to an environment, they may modify configurations that allow them to regain access later. Because some of these changes are subtle, they may go unnoticed for long periods. However, not all configuration drift comes from attackers. Administrative errors or platform updates can also change settings in ways that affect security or operations.This is why documentation still plays a role. Edmondson suggests that even basic records of key configurations can help organisations understand their environment and recover faster during incidents. While documenting every setting in a large tenant may not always be practical, identifying and tracking the most critical configurations can provide a starting point for stronger oversight.Reducing Privilege and Strengthening Tenant ResilienceAnother concern discussed in the episode is the issue of excessive privileges. Many administrator roles in Microsoft 365 grant access across an entire tenant, which can increase risk if those accounts are compromised. Edmondson argues that reducing standing privileges should be a priority. Instead of granting broad permissions by default, organisations should consider limiting administrative access to only what is necessary.Tenant hardening plays an important role here. By tightening configuration controls and carefully managing privileges, organisations can reduce the likelihood that a single compromised account leads to a wider security incident.The goal is not simply to add more security controls, but to build a clearer understanding of how the tenant operates and how it could be restored if something goes wrong. The full conversation on the Security Strategist Podcast explores these challenges in greater depth, including configuration visibility, tenant recovery scenarios, and the practical steps security teams can take to improve resilience in Microsoft 365 environments.If you would like to find out more, visit coreview.comChapters00:00 Introduction to Cyber Resilience in Microsoft 36501:01 Guest Introduction: Rob Edmison and His Role at CoreView02:17 Why Confidence in Microsoft 365 Security Falls Short04:24 The Expanding Scope of Microsoft 365 Services05:27 Visibility Challenges in Microsoft 365 Security07:20 Bridging the Gap: Improving Visibility and Configuration Management11:05 Risks of Configuration Drift and Tenant Hardening16:23 Importance of Configuration Backup in Cyber Resilience21:28 Overprivileged Accounts and Tenant Security Risks26:04 Balancing Security and Innovation with AI and Automation28:37 Tips for Decision MakersTakeawaysMicrosoft 365 now covers identity, device, compliance, and collaboration tools.Security risks extend far beyond just email and file storage.Limited visibility into configuration changes creates blind spots.Excessive administrative privileges increase the potential impact of a compromise.Strengthening configurations and planning for recovery helps organisations respond more quickly.

Podcast: The Security StrategistHost: Richard Stiennon, Chief Research Analyst at IT-HarvestGuest: Michael Kennedy, Ostra Security FounderFor leaders in enterprise technology, the pressure to show measurable cybersecurity outcomes has never been greater. Boards are asking tougher questions, attackers are moving faster, and conventional security awareness metrics aren’t telling the whole story.In the recent episode of The Security Strategist podcast, host Richard Stiennon, Chief Research Analyst at IT-Harvest, is joined by Ostra Security Founder Michael Kennedy, who pointed out a growing gap in how enterprises measure success. Despite years of investment in phishing training and user awareness, breaches keep happening—not because employees are failing on a large scale, but because enterprise systems aren’t designed to handle inevitable mistakes.For CIOs, CISOs, and CTOs, this signals a major transition toward outcome-based security.Why Traditional Security Awareness Metrics Fall ShortPhishing simulations, reduced click rates, and increased reporting are often seen as proof of a strong cybersecurity strategy. The metrics are easy to track, too.However, as Kennedy notes, they provide limited insight into actual risk reduction. Even the most effective awareness programs leave some room for error. In reality, attackers only need one successful attempt to gain access. “If one gets through, that’s enough,” Kennedy suggests, highlighting a truth most security leaders understand but find difficult to measure.What these metrics don’t capture is the downstream impact of that failure.Two identical phishing attacks can lead to vastly different results depending on the enterprise security setup. In one situation, the threat is neutralised quickly. In another, it escalates into lateral movement, credential theft, or ransomware deployment. For enterprise settings, this gap reveals a basic problem – user-focused metrics assess behaviour.What Outcome-Based Cybersecurity Looks Like?The more effective approach, Kennedy argues, is to frame cybersecurity around engineering outcomes instead of user behaviour.This means evaluating how well systems perform during attacks—not how well users avoid making mistakes.The key markers of a strong enterprise cybersecurity strategy include how quickly threats are detected, how effectively security teams respond, and how well incidents are contained before they spread. These operational metrics give a clearer view of real-world readiness.This shift lines up with the growing adoption of zero trust architectures, extended detection and response (XDR), and AI-driven security operations. All these frameworks focus on containment, visibility, and fast responses rather than the unrealistic goal of perfect user behaviour.It also changes how breaches are examined. High-profile incidents are often simplified to stories about weak passwords or phishing clicks, while the more vital question—why controls failed to limit the impact—gets overlooked.For enterprise buyers and decision-makers, this can lead to misaligned investments, over-prioritising awareness training while underfunding detection engineering, identity controls, and network segmentation.Why is it Necessary to Create a No-Blame Culture?While the focus shifts away from blaming users, Kennedy emphasises that people still play a vital role in enterprise cybersecurity—just not in the way many enterprises think.In enterprise environments where employees fear blame, reporting delays are common. Suspicious emails go unreported, incidents remain unnoticed longer, and response times increase.In contrast, organisations that create a no-blame security culture see users acting as an extension of their detection capabilities. Employees who feel safe reporting anomalies can identify threats earlier, often before automated systems escalate them.This cultural change has measurable operational benefits. Faster reporting reduces dwell time, limits damage, and improves overall incident response effectiveness.Some enterprises are formalising this approach through internal collaboration platforms, enabling real-time threat sharing across teams. In doing so, they turn their workforce into a distributed security layer—one that complements, rather than replaces, technical controls.The enterprises that succeed in this next phase of cybersecurity maturity will be those that move beyond the “human error” narrative and embrace a truly outcome-based approach to security engineering.Because in modern enterprise environments, the question is no longer who clicked—it’s how well the system absorbed the impact.Key TakeawaysCybersecurity failures are system design issues—not user mistakes.Click-rate metrics are misleadingReal success is measured by containment speed and impact reduction.Strong security culture encourages users to report threats without fear of blame.Engineering outcomes (like detection speed and blast radius control) matter more than user behaviour metrics.AI is reshaping both attacks and defence, making faster, smarter response capabilities essential.Chapters00:00 Introduction to Cybersecurity's Human Element03:15 Reevaluating User Responsibility in Cybersecurity06:44 Creating a Culture of Reporting09:25 Measuring Security Outcomes Beyond Click Rates12:05 The Role of AI in Cybersecurity15:06 Adapting to Evolving Threats17:44 Key Takeaways for Decision MakersFor more information, please visit em360tech.com and ostrasecurity.com.Follow: EM360Tech YouTube: @enterprisemanagement360EM360Tech LinkedIn: @EM360TechEM360Tech X: @EM360TechOstra LinkedIn: Ostra SecurityOstra X: @ostra_securityOstra YouTube: @OstraCybersecurity#Cybersecurity #CISO #EnterpriseSecurity #OutcomeBasedSecurity #SecurityMetrics #Phishing #ZeroTrust #AIinSecurity #NoBlameCulture #SecurityStrategist #OstraSecurity

Podcast: The Security StrategistHost: Richard Stiennon, Chief Research Analyst at IT-HarvestGuest: Nathan Rollings, CISO at ZafranThe cybersecurity enterprise space has been transforming for years, going beyond traditional vulnerability management. According to Nathan Rollings, CISO at Zafran, the next shift is already underway in the B2B Enterprise technology space. It is being driven by automation, AI, and a deeper understanding of context within enterprise environments. Rollings sat down with host Richard Stiennon, also the Chief Research Analyst at IT-Harvest on The Security Strategist podcast to talk about the need for security teams to move beyond dashboards and risk scores to something more operational–agentic exposure management.“Attackers are already using automation and AI,” Stiennon says to Rollings during the podcast. “Meanwhile, most defenders are still focused on risk scores, dashboards, and ticket backlogs.”Rollings believes the real opportunity lies in allowing intelligent systems to analyse exposure continuously and act on it.The Discourse to Agentic ExposureExposure management often appears as a new discipline, but Rollings believes its roots are much older.“If you were to look at a vulnerability management maturity model five or 10 years ago, the characteristics of the most mature programs aligned with what we consider continuous threat exposure management today,” he said.Traditional vulnerability management focused heavily on scanning and prioritising flaws. Continuous threat exposure management (CTEM) builds on that by adding context such as internet reachability, compensating controls, and real-time telemetry from security tools.Agentic exposure management goes a step further, where autonomous systems help drive the processes themselves. “When we look back at the early days of vulnerability management, we did much of this manually,” Rollings said. “Then we moved toward automated processes. Now, we are moving toward autonomous.”Instead of security teams manually distributing vulnerability reports or setting rigid rules for ownership and remediation, AI agents can interpret available telemetry and handle those workflows dynamically. Over time, those same systems may even take remediation actions on their own.The challenge is trust, according to Zafran’s CISO. “Enterprises must trust that the actions taken by these systems are safe and effective within their environments.”Anthropic’s AI announcement sends industry ripplesThe podcast also covered a recent announcement from Anthropic regarding AI-driven code security. This move quickly sparked debate about how generative AI might reshape vulnerability management.Stiennon suggested the technology could disrupt parts of the market focused on application security. However, Rollings believes its impact on exposure management will be more limited. “Code analysis is incredibly powerful,” he said. “But it’s very much a shift-left capability."Exposure management operates on the opposite side of the lifecycle. It focuses on production environments, where context decides whether a vulnerability is actually exploitable.“A good exposure management platform considers your defence-in-depth strategy,” Rollings explained. “That means tens of integrations across an organisation to understand the residual risk of specific exposures.”Runtime behaviour, network paths to the internet, endpoint protection policies, and segmentation controls all influence whether a vulnerability is a real risk. Analysing source code alone cannot provide that operational picture.Why context matters more than another risk scoreFor many security teams, vulnerability prioritisation still relies heavily on numerical risk scoring. Rollings argues that this approach often misses the bigger picture. “You’re spending so much money on these security tools,” he said. “The real question is, what is the return? What is the business value?”Understanding the effectiveness of existing controls, such as intrusion prevention systems, endpoint detection, or micro-segmentation, can dramatically change how vulnerabilities are prioritised.Research cited by Rollings suggests that only around one in 50k vulnerabilities is truly exploitable in a given environment once contextual factors are taken into account. “That means organisations spend enormous effort remediating vulnerabilities that may never actually be reachable,” he added.Agentic systems that correlate telemetry across security tools could narrow that focus significantly. This would allow teams to prioritise the small subset of exposures that really matter.“Security teams were so focused on detection, assessment, and ticketing that they didn’t have time to dig deeper,” Rollings tells Stiennon. “Agentic capabilities free them to concentrate on the things that truly make a difference.”Key TakeawaysExposure management prioritises vulnerabilities using real-world context, not just CVSS scores.Agentic AI can analyse exposures and automate remediation workflows.Security context—controls, network paths, and runtime data—determines real exploitability.Only about 1 in 50,000 vulnerabilities are truly exploitable in most environments.AI-secured code won’t remove runtime risk in live infrastructure.Chapters00:00 Introduction to Cybersecurity Challenges03:19 The Evolution of Exposure Management07:31 Impact of AI on Vulnerability Management11:34 Contextual Understanding in Exposure Management15:37 Efficiency and Cost-Effectiveness in Security Teams18:08 Key Takeaways for Security PractitionersFor more information, please visit em360tech.com and www.zafran.io.Follow: EM360Tech YouTube: @enterprisemanagement360EM360Tech LinkedIn: @EM360TechEM360Tech X: @EM360TechZafran LinkedIn: Zafran SecurityZafran X: @Zafran_io#AgenticAI #ExposureManagement #VulnerabilityManagement #CTEM #Cybersecurity #CISO #SecurityStrategist #RichardStiennon #NathanRollings #Zafran

Podcast series: The Security StrategistGuest: Sam Woodcock, Senior Director of Solutions Architecture at 11:11 SystemsHost: Shubhangi Dua, Podcast Producer and B2B Tech Journalist at EM360TechIn the recent episode of The Security Strategist podcast, host Shubhangi Dua, Podcast Producer and B2B Tech Journalist at EM360Tech, spoke with Sam Woodcock, Senior Director of Solutions Architecture at 11:11 Systems. They discussed what he sees as one of the biggest issues in cybersecurity today: the gap between confidence and ability.Their conversation, based on findings from the company’s latest global survey, revealed a troubling fact. While 81 per cent of IT leaders believe they are ready to recover from a cyberattack, many have already faced serious incidents, sometimes more than once a year.Woodcock pointed out that this confidence can be misleading. “If you think about your cyber recovery planning, it often looks strong on paper,” he said. “That can create a false sense of security because cyber recovery is very complex.”Analyst Read: Forensic Recovery Is Central to Cyber Resilience Cyber Recovery is Not FixedWoodcock explained that many organisations confuse documented plans with actual readiness. Cyber recovery is not fixed; it must change with the infrastructure, applications, and threats.“Change is the only constant in this industry,” he noted. “Things are shifting daily and weekly. What you had in place today can quickly become outdated.”Testing often suffers from time and budget constraints. Many companies test just once a year, if at all. Woodcock advises that quarterly testing should be the minimum.“You’d rather find those issues now instead of during a real ransomware incident.”The costs of misplaced confidence are high, such as prolonged downtime, growing financial losses, regulatory fines, and damage to reputation. Some survey participants reported recovery times of one to two weeks, while others took over a month.The more alarming truth is the risk of getting reinfected. “Enterprises might recover from the first outage and then be hit again,” Woodcock warned. “That extends the recovery time and increases the risk and damage.”How Modern Attackers Hack?One of the most revealing points from the discussion was how modern attackers operate once they gain access. A common way in is through VPN flaws and social engineering. “One of the first things they will do is examine existing documentation within your organisation to understand your recovery strategy,” Woodcock tells Dua. “They’ll look at your company’s cyber incident recovery planning document.”Attackers often target backup systems directly to wipe out recovery options before launching ransomware.In one case, Woodcock mentioned, a company’s local backup systems were compromised. Luckily, they had maintained immutable cloud backups, allowing them to recover even after the primary backup environment was breached.In other cases, entire primary environments were taken offline, forcing organisations to switch to secondary, isolated environments.“You need a safe, trusted, clean space to recover your environment,” he said. “That way, you can understand how the attack happened and be confident that your recovery is clean.”The idea of the "clean room," or an isolated recovery environment, has become crucial to modern cyber resilience strategies.AI vs. AI: A Weapon &amp; a DefenceThe conversation also addressed artificial intelligence (AI), both as a weapon and a defence. Woodcock noted that cybercriminals are already using AI to refine phishing campaigns, increase attack frequency, and add complexity to evade detection.“They’re using AI to potentially improve the language in social engineering attacks or to raise the frequency of attacks,” he said.However, defenders are also making progress. 11:11 Systems collaborates with technology partners like Veeam, Cohesity, and Zerto, all of whom invest heavily in AI for spotting anomalies and providing real-time threat visibility.These tools can help organisations identify when an attack began and find the last known clean recovery point. “It helps them make quicker decisions,” Woodcock added. “They can make better choices by using AI to find the right recovery point.”However, he also cautioned against thinking that technology alone will solve the problem. “Technology by itself isn’t enough. It always comes down to the maturity level and expertise within the business.”Looking forward, Woodcock does not expect ransomware sophistication to slow down. Enterprises now face double extortion tactics—not just encrypted data but also threats of public exposure.“It’s not just ransomware encrypting data,” he said. “There’s also this evolving threat of being told that data will be made public.”In an era where attackers study your recovery plan before you implement it, resilience is about proof, not just documentation.Takeaways81% of IT leaders are overconfident in their recovery abilities.Cyber recovery is complex and requires a robust plan.Regular testing is essential for effective cyber recovery.Organisations often overlook recovery strategies in favour of prevention.AI is being used by cybercriminals to enhance attacks.The frequency of cyber attacks is increasing.Understanding application dependencies is crucial for recovery.A clean recovery environment is necessary to avoid reinfection.Decision-making during incidents can be time-consuming and impact recovery.Building a strong security culture is vital for organisations.Chapters00:00 Introduction to Cyber Resilience01:46 Understanding the Cyber Recovery Gap07:17 Overconfidence in Cybersecurity12:37 The Importance of Testing in Cyber Recovery13:37 Multi-layered Approach to Cyber Recovery17:17 Real-world Cyber Attack Examples20:19 AI and the Future of Cybersecurity24:00 Emerging Threats in Cybersecurity26:31 Key Takeaways for IT LeadersFor more information, please visit em360tech.com and <a href="http://1111systems.com/" rel="noopener noreferrer"...

Podcast series: The Security StrategistGuest: Chip Witt, Principal Security Analyst at RadwareHost: Richard Stiennon, Chief Analyst Researcher at IT-HarvestWhen attackers target modern enterprises, they don’t break in; they log in. This insight came from the recent episode of The Security Strategist Podcast, where host Richard Stiennon, a cybersecurity analyst and Chief Analyst Researcher at IT-Harvest, speaks to Chip Witt, Principal Security Analyst at Radware.The conversation spotlights a critical issue faced by most enterprises – defending APIs as if they are just infrastructure while attackers exploit them as part of the business logic. That gap represents the real risk.What’s the Core Misunderstanding with APIs?As per Witt, enterprise teams often view APIs as technical plumbing instead of business products. Security programs focus on endpoints and authentication, believing that a locked front door means the house is safe.However, the true risk lies deeper — in authorisation logic, identity sprawl, and how applications change over time. Modern development methods lead to constant API drift. New routes appear, fields change, and versions multiply. In many organisations, security leaders cannot confidently state which APIs are live in production. The uncertainty to many is theoretical, but in reality, it’s an operational risk.Also Watch: How Do You Stop an Encrypted DDoS Attack? How to Overcome HTTPS ChallengesHow are Enterprises Shifting Towards Intent-Aware Protection?As enterprises speed up their use of serverless architectures, microservices, and AI-driven applications, API sprawl intensifies. With sprawl, the security model cannot remain unchanged while the application structure evolves.According to Witt, the future of API security must be intent-aware. Protection should assess whether a sequence of calls makes sense within its context for the user, system, or resource initiating them. Simply confirming identity is not enough; security also needs to validate behaviour.Zero trust principles have reshaped strategies for networks and identities. APIs now require similar scrutiny—not just at the perimeter, but within the workflow itself.APIs are no longer just back-end connectors; instead, they are now the visible surface of the enterprise. The most concerning attacks are not brute-force attempts. Most distressing attacks, in fact, are authenticated actions carried out with malicious intent.Organisations that continuously track their APIs, enforce strict authorisation, and identify workflow misuse in real time can significantly reduce their risk of breaches. More importantly, they can align security with the business pace. In today’s digital economy, APIs are the product.TakeawaysAPIs are your primary business attack surface, not back-end infrastructure.Most damaging API attacks use valid credentials and exploit weak authorisation.Visibility gaps and API drift quietly expand your exposure over time.Machine-to-machine identities often carry excessive, unmonitored privileges.Runtime, intent-aware detection is now essential to stopping business logic abuse.Chapters00:00 Introduction to API Security02:04 Understanding API Misconceptions04:49 Current API Threat Landscape06:43 Business Logic Abuse in APIs09:11 Challenges in API Security12:03 Runtime Protection and Intent Detection13:40 Key Takeaways for IT Decision MakersFor more information, please visit em360tech.com and radware.comFollow: @EM360Tech on YouTube, LinkedIn and XRadware YT: @radwareRadware LinkedIn: https://www.linkedin.com/company/radware/Radware X: @radware#APISecurity #BusinessLogicAbuse #AuthenticatedAttacks #RuntimeProtection #IntentAwareSecurity #Radware #Cybersecurity2026 #OWASP #BusinessLogic #ZeroTrust #TechPodcast #EnterpriseSecurity #IntentAwareProtection #TheSecurityStrategist #Cybersecurity

In an era where enterprise data sprawls across cloud platforms, collaboration tools, and SaaS environments, CISOs are under constant pressure to reduce risk without becoming the department that slows everything down. That tension sits at the heart of a recent episode of the Security Strategist, where host Jonathan Care speaks with Ariel Zamir, founder and CEO of Ray Security, about what pragmatic, modern data security actually looks like.Their conversation cuts through the noise around cybersecurity tools and frameworks and focuses instead on how CISOs can think differently about enterprise data, risk management, and control.Understanding Enterprise Data Risk Starts With RealityOne of the most grounded points Zamir makes is also the simplest, and that is, most enterprise data is not being used. At any given time, around 98 per cent of enterprise data sits dormant. From a data security perspective, that should immediately raise questions. Why is data that no one needs today exposed in the same way as data actively driving the business?For CISOs, this reframes the challenge. Instead of trying to secure all data equally, the priority becomes understanding which data is actually accessed, by whom, and when. This shift matters because risk does not come from volume alone, but from unnecessary exposure. Dormant data with overly broad access control is often invisible to the business, yet highly visible to attackers.By grounding cybersecurity decisions in how data is really used, security teams can reduce enterprise data risk without introducing friction for employees who are simply trying to do their jobs.Permission Hygiene, Access Control, and Dynamic SecurityA recurring theme in the discussion is permission hygiene. Over time, access rights accumulate. People change roles, projects end, contractors leave, but permissions rarely get cleaned up. The result is an expanding attack surface that no amount of policy documentation can realistically govern.Zamir argues that improving permission hygiene and access monitoring should come before heavy data classification initiatives. Tightening access control, understanding access patterns, and removing unnecessary permissions can dramatically reduce risk with relatively low operational impact.Crucially, this does not mean locking everything down. Dynamic controls play a key role here. Instead of blocking access by default, organisations can monitor for unusual behaviour and respond in context. Alerts, step-up verification, or temporary restrictions allow security teams to manage risk while preserving user experience. From a business perspective, this approach aligns far better with how work actually happens.This is also where agentic AI and agentless monitoring enter the picture. As autonomous systems increasingly access data on behalf of users, traditional identity-based controls struggle to keep up. Agentless approaches help close coverage gaps without requiring intrusive deployments, while agentic AI introduces new questions about accountability and oversight that CISOs can no longer ignore.Just-in-Time Classification and the Legal Implications of AutomationTraditional data classification has long been treated as a foundational security activity, but the podcast challenges that assumption. Classifying vast amounts of dormant data upfront is expensive, slow, and often disconnected from real risk. Instead, Zamir advocates for just-in-time classification, applying context only when data is accessed.This approach supports more effective risk management while easing the burden on security teams. It also aligns better with regulatory expectations, where proportionality and intent increasingly matter.However, automation and agentic AI introduce legal implications that CISOs must consider when developing their strategies. When autonomous agents access, move, or transform data, organisations need clarity on responsibility, auditability, and compliance. Dynamic controls and temporal insights into data access are not just technical safeguards; they are essential for demonstrating governance in an environment where human and machine actions intersect.Taken together, the conversation highlights a more measured path forward. By focusing on how enterprise data is actually used, improving permission hygiene, and applying controls dynamically, CISOs can enhance data security without slowing down the business. It is less about adding more tools and more about making smarter, context-aware decisions in a landscape where risk is shaped by time, access, and intent.For more information on this, visit: https://raysecurity.io/TakeawaysAround 98 per cent of enterprise data sits idle, creating hidden security risks.Focusing on data dormancy helps prioritise protection and reduce exposure.Permission hygiene and dynamic controls reduce risk without slowing business workflows.Just-in-time classification cuts overhead by securing data only when accessed.Agentless monitoring and oversight of agentic AI improve coverage and accountability.Legal and governance frameworks must evolve to handle autonomous data access.Chapters00:00 Introduction to Cybersecurity Challenges01:38 Understanding Data Dormancy and Its Implications05:10 Focusing on Critical Data for Security08:21 The Importance of Permission Hygiene10:53 Just-in-Time Classification for Data Security12:28 Dynamic Controls for Business Needs16:43 Agentless Monitoring and Coverage Gaps19:32 Integrating Logs and APIs for Security21:34 Future Trends in Cybersecurity

In an environment where cyber threats evolve faster than regulation, UK organisations are being asked to defend themselves with rules written for a different era. That tension sits at the centre of a recent episode of the Security Strategist, where host Trisha Pillay speaks with William Wright, Chief Executive Officer of Closed Door Security and Scotland’s first accredited (chartered) hacker. Their conversation moves beyond headlines and funding announcements to examine why, despite growing awareness and investment, both public and private sector organisations in the UK continue to be compromised.The Biggest Cybersecurity Challenges Facing UK OrganisationsAs Wright explains, cybersecurity cannot be understood purely from policy documents or tooling dashboards. It has to be understood from the attacker’s point of view. From where he stands today, the UK cybersecurity landscape is marked by a growing gap between how organisations believe they are protected and how exposed they actually are.One of the most persistent misconceptions Wright highlights is the belief that buying cybersecurity tools automatically makes an organisation secure. Too many businesses, he argues, rely on poorly implemented services or procure technology they don’t fully understand.The result is a false sense of confidence. Organisations assume they are protected, but still fall victim to ransomware, business email compromise, and financial fraud. Often, the tools they’ve invested in are never properly tested, validated, or tuned to their environment.Awareness is another issue. Despite constant media coverage of cyber attacks, cybersecurity is still not consistently treated as a board-level risk. When it remains a technical afterthought rather than an operational priority, organisations struggle to respond effectively when incidents occur.Wright also challenges the idea of a simple “skills gap.” While much of the discussion focuses on a lack of junior talent, he argues the real problem sits at the top. Too many cybersecurity decisions are being made by individuals without deep, hands-on experience, particularly in senior or policy-shaping roles. This lack of expertise leads to misaligned strategies, both in organisations and in government.The UK Government’s Cyber Action PlanThe UK government’s £210 million cyber action plan is, in Wright’s view, a welcome signal but not a solution. Any investment in cybersecurity is positive, yet the plan largely reflects practices the private sector has been using for years.This creates a familiar pattern as the private sector absorbs the damage, while the public sector learns from it later. Economically, Wright argues, this approach is flawed. When businesses are repeatedly compromised, the impact extends far beyond individual organisations.Legislation is another weak point. Cyber threats evolve daily, but laws move slowly. The Computer Misuse Act, for example, has not been meaningfully updated in over a decade. In a world of cloud computing, automation, and AI-driven attacks, this leaves the UK operating with outdated guardrails.What Government Can Learn From Offensive SecurityAs the CEO of an offensive security firm, Wright sees the same pattern repeatedly that organisations are compromised using relatively unsophisticated methods. These are not advanced, state-of-the-art attacks. They are basic weaknesses that remain unaddressed. The problem, he suggests, is that policymakers are often advised by people who have never actively attacked real systems. This disconnect shows up in legislation and regulation that look sound on paper but fail in practice.Other governments have taken a different approach. Bug bounty programmes, for example, allow ethical hackers to test government infrastructure and responsibly disclose vulnerabilities. These programmes force transparency and accountability. Despite this, the UK has been slow to adopt similar models.Where Cyber Resilience Efforts Should Focus NextBeyond legislation, Wright points to funding and enforcement as critical gaps. Many public sector organisations know where their risks are, but lack the budget to fix them. Meanwhile, regulatory bodies often lack the authority to enforce remediation.Without both funding and enforcement, reports identifying serious vulnerabilities are filed away rather than acted upon. This cycle repeats until an attack forces emergency investment, which is often too late.Emerging Threats Organisations Must Prepare ForLooking ahead, Wright identifies two major areas of concern. The first is the use of AI in cyber attacks. AI is not replacing attackers, but it is dramatically accelerating them. Tasks that once took hours can now be completed in minutes, shrinking the window for detection and response.The second is technology supply chain risk. Attacks on widely used software tools can give attackers access to thousands of organisations at once. Past incidents involving widely trusted vendors show how devastating these compromises can be, particularly when they go unnoticed for long periods.Despite the scale of the challenge, Wright’s advice is grounded and practical. Multi-factor authentication is non-negotiable. Organisations without MFA are, in his words, “sailing blind.”He also urges businesses to validate their security investments. Spending heavily on defence while allocating minimal budget to testing is self-defeating. Security tools do not work perfectly out of the box, and penetration testing must go beyond surface-level assessments. Finally, Wright stresses the importance of depth. Black-box testing alone is not enough. Organisations need to assume breach scenarios and test how attackers move inside their environments, particularly through identity-based attacks such as phishing.TakeawaysCybersecurity is frequently mistaken for deploying tools, rather than managing risk.Cyber risk must be treated as a board-level responsibility, not a technical afterthought.The real cybersecurity skills gap exists at senior and decision-making levels.Cyber legislation is largely reactive and struggles to keep pace with modern threats.Bug bounty programmes can help governments identify weaknesses before attackers do.Offensive security insight strengthens defensive strategy and decision-making.Legacy systems can be secured when risks are properly understood and addressed.AI is accelerating the scale and speed of cyber attacks, not replacing attackers.Security investments must be validated through continuous testing and assurance.Multi-factor authentication is a foundational requirement for modern cyber resilience.Chapters00:00 Introduction to Cybersecurity Landscape02:56 William Wright's Journey in Cybersecurity05:56 Current Cybersecurity Challenges in the UK08:53 Evaluating the UK Government's Cyber Action Plan12:03 The Impact of Legislation on Cybersecurity15:01 Lessons from Offensive Security for Government16:55 Notable Cybersecurity Breaches and Their Impacts19:59 Future Focus: Improving Cyber Resilience24:01 Emerging Cyber Threats: AI and Supply Chain Risks27:48 Practical Advice for Organisations31:05 Conclusion and Key Takeaways

In an era of accelerating digital change, understanding the tactics employed by modern attackers is crucial for organisations doing everything in their power to protect their sensitive information. In this episode of the&nbsp;Security Strategist podcast, host&nbsp;Richard Stiennon&nbsp;and&nbsp;Chester Wisniewski, Director, Global Field CISO of&nbsp;Sophos, examine the findings of the&nbsp;Active Adversary Report, compiled by Wisniewski and his team, shedding light on how cyber threats are changing and what security leaders can do to adapt their strategies.&nbsp;Understanding the Active Adversary Report&nbsp;The&nbsp;Active Adversary Report, compiled by Wisniewski’s team at Sophos, provides invaluable insights into the common pitfalls organisations face when responding to cyber incidents. With Chester's extensive experience in cybersecurity and incident response, the report aims to analyse real-world data from hundreds of incident responses across 50 countries. The report categorises incidents into two main groups: those who seek immediate help during a crisis and those who utilise managed detection and response services. By examining these cases, the report identifies key indicators that contribute to security breaches, offering organisations a roadmap to enhance their security posture.The Focus on Identity TheftOne of the most startling revelations from the report is that nearly 70 per cent of incidents last year were linked to identity-related issues such as stolen passwords, session tokens, or phishing attacks. Chester explains that attackers are increasingly leveraging identity theft because it is often easier to log in as an authorised user than to break into a system. This trend underscores the importance of security teams to prioritise identity management as part of their overall strategy.Wisniewski also emphasises that the ease of access through stolen credentials presents fewer telltale signs of unauthorised activity, making it harder for organisations to detect breaches. In the past, cybercriminals often exploited vulnerabilities in software like Flash and Java, but as security measures have improved, they have shifted their tactics toward the more vulnerable area of user identity. This shift indicates a pressing need for organisations to bolster their identity security protocols.Balancing Vulnerability Management with Identity Security&nbsp;As organisations work to strengthen their security measures, the challenge of balancing patch management with a focus on identity security. He points out that while patching vulnerabilities remains essential, many organisations face difficulties, particularly those with hybrid workforces. Unpatched VPN gateways and firewalls have become common entry points for attackers, making it critical for organisations to prioritise their patch management efforts based on exposure and the sensitivity of the data involved.Wisniewski&nbsp;advocates for a more strategic approach to identity management, highlighting that the adoption of multifactor authentication (MFA) is still lacking across many organisations. He notes that many systems still rely on basic MFA methods, such as six-digit codes or push notifications, which do not provide adequate protection against sophisticated attacks. To truly enhance security, organisations must consider more robust identity verification methods and address the complexities introduced by non-human identities as well.The Challenge of Non-Human IdentitiesIn the current technological climate, non-human identities such as API keys present significant challenges for security teams. There have been recent incidents where API keys were exploited to gain unauthorised access to sensitive systems, pointing out that organisations must be vigilant in managing these non-human identities. As organisations adopt technologies like passkeys for human users, understanding and securing non-human identities is becoming increasingly important.&nbsp;With cyber risks becoming more complex, organisations must adapt their security strategies to address these challenges effectively. Here are a few things businesses can do to protect themselves:Prioritise identity security by implementing robust protocols and strategies to combat identity theft.Balance patch management with a focus on securing critical assets and data.Enhance multifactor authentication practices to ensure stronger protection against unauthorised access.Develop a comprehensive understanding of non-human identities and implement measures to secure them.&nbsp;By staying informed about the latest trends and insights in cybersecurity, organisations can better equip themselves to fend off the growing tide of cyber threats. For more information, visit&nbsp;https://www.sophos.com/TakeawaysNearly 70 per cent of incidents last year involved identity-related issues.Attackers find it easier to log in as authorised users.Patching and vulnerability management are challenging for organisations.MFA adoption remains low despite its importance.Most attacks occur outside of normal business hours.Median incident response time is significantly reduced with MDR services.Employees can act as early warning systems for security threats.Focusing on basic cybersecurity practices is essential.AI can help streamline data analysis in incident response.AI is also being used to enhance phishing attacks.Chapters00:00 Introduction to Cybersecurity Challenges02:57 Understanding the Active Adversary Report05:55 The Shift Towards Identity-Based Attacks08:48 Balancing Patching and Identity Management12:04 Operational Challenges for CISOs15:09 Leveraging Employee Awareness for Security18:12 Practical Steps for CISOs to Strengthen Resilience20:56 The Role of AI in Cybersecurity

Podcast series: The Security StrategistGuest: Doug Merritt, Chairperson, CEO, and President of AviatrixHost: Shubhangi Dua, Podcast Host, Producer and B2B Tech Journalist at EM360TechCloud security now involves more than just protecting a single environment. As organisations grow across multiple clouds, integrate SaaS platforms, modernise applications, and deploy AI-driven workloads, the attack surface expands in complex ways that are hard to see and even harder to manage.In the recent episode of The Security Strategist podcast, Doug Merritt, Chairperson, CEO, and President of Aviatrix, a cloud network security company, sits down with Shubhangi Dua, Podcast Host, Producer and B2B Tech Journalist at EM360Tech. They discuss why gaps in cloud networking visibility are becoming one of the biggest security risks for businesses today.The conversation also covers how cloud complexity has changed over time, why old security models struggle to keep up, and what practical steps leaders can take to lower exposure before attackers exploit hidden pathways.Securing the World’s Digital FabricOn a mission to secure “the world’s digital fabric,” Merritt spotlights the reasons explaining that organisations often perceive cybersecurity through “constructs and silos.” However, attackers see the entire landscape, which leads to a gap in the perspective.Most enterprises started their cloud journey with lift-and-shift migrations, moving familiar applications from data centres to the cloud. Over time, these applications were modernised, broken into containerised services, and expanded with serverless functions, APIs, and third-party SaaS platforms.Merritt notes that applications today often involve "10 to 15 different major components from start to finish," many of which exist across different clouds or outside direct organisational control.This variety has brought speed and innovation, but it has also led to vastly different workload behaviours. Some workloads are long-lasting, others are temporary, and many can be accessed publicly.According to the Aviatrix CEO, this "really powerful landscape" has resulted in "an incredibly powerful attack surface." Without consistent visibility and remediation across all workloads, attackers can find "which workloads have value and which workloads are unprotected" and move laterally until they reach critical assets.AI adds additional challenges. While the technology seems new, he further emphasises that AI agents are still workloads with identities, operating at high speed and broad permission levels. They rely completely on network connectivity, making the network a crucial point for both visibility and control. In a hyper-connected environment, he argues, the network should be seen as a key security layer rather than just a transport system.How to Prepare for the Next Wave of Cloud ThreatsWhen asked what CIOs, CISOs, and cloud leaders should focus on next, Merritt alludes to a reality check. He urges leaders to choose a single complex application and ask their teams to identify every workload involved, every network path taken, and whether there is visibility into "every packet that goes into the workload and comes back out."In most cases, he says, organisations find that they cannot do this. This gap reveals the first and most urgent issue: a lack of understanding of the environment itself. Without a clear map of workloads and communication paths, security teams operate with blind spots.The Chairperson of Aviatrix insists that visibility must come before control. Once organisations understand their exposure, they can prioritise the "most dangerous communication pathways" and secure them. He warns that many large enterprises still have "thousands of workloads with direct internet connections and no filter in front," describing this exposure as "horrific," given how easily even less sophisticated attackers could exploit it.He also points out that visibility and enforcement must be close to the workload. Centralised controls increase costs and latency, while distributed enforcement allows for faster response and containment. Ultimately, just observing traffic isn't enough; organisations need to be able to act.Cloud security isn’t about adding more tools; it’s about changing perspective. By mapping workloads, understanding communication paths, and using the network as a consistent layer for visibility and enforcement, organisations can reduce lateral movement, limit blast radius, and prepare more effectively for the next generation of cloud threats.TakeawaysOrganisations need to focus on the uncovered attack surface.The digital fabric includes diverse workloads across multiple clouds.Visibility and remediation are critical in managing workloads.The complexity of multi-cloud environments is increasing.AI is accelerating the evolution of cloud security challenges.Networking plays a pivotal role in security strategies.Collaboration between security, networking, and cloud teams is essential.Mapping workloads and communication pathways is crucial for security.Organisations must prioritise securing high-risk workloads.Understanding the shared responsibility model is vital for cloud security.Chapters00:00 Introduction to Cloud Security Challenges03:03 Understanding the Digital Fabric05:56 Navigating the Modern Attack Surface08:46 Key Trends in Cloud Adoption12:11 The Complexity of Multi-Cloud Environments14:51 The Evolving Role of Networking in Security17:58 Bridging the Gap Between Teams21:02 Real-World Solutions and Case Studies23:53 Preparing for Future Threats29:09 Final Thoughts and Key Takeaways#CloudSecurity #MultiCloud #CloudNetworking #Aviatrix #CISO #AttackSurface #CloudThreats #EnterpriseSecurity #TechPodcast #SecurityStrategist #DigitalFabric #AIinSecurity #WorkloadSecurityFor more information, visit aviatrix.ai and em360tech.com. Follow: @EM360Tech on YouTube, LinkedIn and XAviatrix YT: @AviatrixSystemsAviatrix LinkedIn: https://www.linkedin.com/company/aviatrix-systems/

Cybersecurity often feels like a battle of technologies—firewalls, AI, monitoring tools, but at its core, it’s human. People are both the first line of defence and, more often than not, the most vulnerable point. On a recent episode of Security Strategist, Richard Stiennon spoke with Nicole Jiang-Gibson, Chief Executive Officer of Fable Security, about why traditional training doesn’t work and how understanding human behaviour can fundamentally change an organisation’s security posture.Humans are the Weakest LinkNicole’s journey in cybersecurity began long before Fable. She was an early member at Abnormal Security, where she helped build email security solutions. That experience exposed a recurring truth, and that was even the best technical safeguards can be undone by human error.“Human error is really the number one cause at the beginning of cybersecurity incidents,” Nicole explains. “Phishing attacks are the number-one starting point—one click, one misstep, and suddenly the consequences are massive.”She recalls the MGM Resorts breach as a turning point: an IT help desk employee took a phone call from someone impersonating an Okta admin, leading to a major security lapse. “Even with strong email defences, people were exposed in ways technology couldn’t prevent. That’s when I realised that this was a human problem we needed to solve.”Seeing Security Through the Attacker’s EyesFable Security’s approach is rooted in understanding both the employee and attacker behaviour. Nicole describes it almost like a conversation at both sides of the table.“Looking at security from the attacker’s perspective changes how organisations design interventions,” she says. Employees often don’t even realise which actions put them at risk. By understanding predictable behaviours, we can build targeted, timely interventions instead of generic training modules that people forget.”The company leverages data to identify risky behaviours and reinforce safe ones. Richard notes that this can turn the math of phishing attacks in an organisation’s favour, reducing the likelihood of a click from 40 per cent to 2 per cent, for example, meaning attackers have to try 50 times to succeed once.Reinforcement Not PunishmentOne of the major differences in Fable’s approach is how they treat learning. Traditional phishing simulations can leave employees feeling tricked or shamed. Fable focuses on reinforcement and repetition, creating a culture where security is part of everyday decision-making.“We empower organisations with data to understand how employees behave and then help them stay one step ahead of attacks,” Nicole explains. “It’s not just about preventing business loss, it’s about protecting culture, brand, and employee safety.”By shifting the focus from blame to understanding and from generic training to targeted behavioural interventions, organisations can finally address the human factor in cybersecurity with the seriousness and nuance it deserves.For more information, visit fablesecurity.comTakeawaysCybersecurity is not just about technology; it's about people.Traditional training often fails to change behaviour effectively.Human errors are the leading cause of cybersecurity incidents.Fable Security focuses on understanding and changing human behaviour.The threat landscape is constantly evolving, requiring adaptive solutions.Organisations must view security as a supportive, not punitive, measure.Phishing simulations can be harmful if not conducted ethically.Building trust with employees is essential for effective security training.Employees can serve as valuable sensors for identifying threats.Meaningful behaviour change requires a shift in mindset and approach.Chapters00:00 The Human Factor in Cybersecurity01:11 Fable Security's Origin Story04:23 Understanding Human Vulnerabilities06:01 The Attacker's Perspective08:29 Fable's Ad Tech Approach12:04 Revolutionising Security Training14:37 The Ethics of Phishing Simulations19:42 Building Trust in Security Training22:56 Empowering Employees as Sensors27:40 Steps Towards Meaningful Behaviour Change

When code is no longer written solely by humans, the way we think about application security has to change. In a recent episode of the&nbsp;Security Strategist&nbsp;podcast, host&nbsp;Richard Stiennon&nbsp;sits down with&nbsp;Gadi Bashvitz, CEO of&nbsp;Bright Security, to talk about the challenges and opportunities of securing applications in an AI-driven world. Their conversation reveals a reality many organisations are only beginning to face, and that is vulnerabilities are multiplying faster than ever, and traditional security tools aren’t keeping up.Rethinking Application Security for a New RealitySince 2018, Bright Security has been helping organisations secure their applications and APIs. Gadi Bashvitz shares that the company’s journey has always been about anticipating challenges before they become crises.&nbsp;“And that’s what we did from 2019 to 2024—signed up some of the world’s largest financial institutions and insurance companies, so very proud of that customer base,” he explains.But in 2024, everything changed. Customers started raising concerns about AI-assisted coding. Bashvitz recalls:“Some of those customers came to us and said, ‘Houston, we’ve got a problem. We’re starting to adopt AI-assisted coding.’ We’ve gone from a world where a developer generates 100 per cent of code and 100 per cent of vulnerabilities, to one where that developer is now generating 200 per cent of code and 600 per cent of vulnerabilities. That AI-generated code is three times more prone to vulnerabilities.”This shift exposes a fundamental truth, and that is that AI is reshaping software development, but not always in ways organisations are ready to manage. What was once a controlled DevOps process is now a rapid, high-volume environment where oversight can easily slip.The Hidden Risks of AI-Generated CodeThe impact is real and immediate. Marketing teams, product managers, and developers alike are generating code faster than ever, but without the traditional checks and balances. Bashvitz highlights that AI models are trained on open-source code, often without security in mind. This means vulnerabilities multiply at a rate that can overwhelm static tools or conventional security processes.Organisations are feeling the pressure daily, realising that if they don’t adapt, AI-generated vulnerabilities could outpace their ability to detect and mitigate risks.Embedding Security Into Every Step of DevelopmentSo how can enterprises regain control? Bashvitz is clear: it’s not too late, but action must be deliberate.“At some point, there will be a few very, very significant hacks that will take us back,” he warns. “The key is to embed dynamic security measures directly into the development lifecycle. That’s how you catch vulnerabilities, even when code is being generated at an unprecedented scale.”Dynamic Application Security Testing (DAST) is one approach Bright Security has championed. Unlike traditional static tools, dynamic testing integrates into code repositories and runs throughout the development pipeline, from unit tests to production deployment. This approach doesn’t just mitigate risk—it empowers teams to continue innovating without being paralysed by fear of vulnerabilities. The goal is to create a balance where AI-driven productivity and robust security coexist.For more information, visit&nbsp;https://brightsec.comTakeawaysBright Security was founded to address application and API security gaps.AI-driven code generation has significantly increased the number of vulnerabilities.Dynamic application security testing (DAST) is essential for modern development practices.Static analysis tools often produce high rates of false positives, wasting developer time.Organisations must adapt security practices to include both finding and fixing vulnerabilities.The integration of AI in security tools can streamline vulnerability management.Dynamic validation of static scan results can reduce noise in security findings.CISOs must collaborate with DevOps teams to ensure security is integrated into development.The rise of AI has introduced new types of vulnerabilities that need to be addressed.Security practices must evolve to keep pace with rapid technological changes.Chapters00:00 The Evolution of Application Security03:41 AI's Impact on Code Generation09:39 Challenges of Traditional Security Tools16:31 Integrating AI in Security Solutions21:20 Future of Security in AI-Driven Development

Cybersecurity, for many years, has functioned on an obvious assumption that attacks repeat themselves. For instance, if a phishing email works once, it will work again. Simply put, catch it, study it, write a signature, update the model — and block the next wave.What if there is no next wave? What happens when every malicious email is now uniquely written by AI, personalised at scale, and never seen before?In the recent episode of The Security Strategist podcast, host Richard Stiennon spoke with Alan LeFort, CEO of StrongestLayer, and Eric Sanchez, CISO at Global Law Firm, about how generative AI is reshaping email security — and why many traditional defences may already be obsolete.Why is Email the Open Door to Attacks? Stiennon questions what many security leaders tacitly ask – If most enterprises run on Microsoft’s ecosystem, why does a separate email security market even exist?LeFort responds, stating that attackers are economically rational. They go where entry is cheapest and easiest. For decades, email has been that open door.However, the industry has changed. First came secure email gateways built on rules and regex. Then, machine learning systems are trained to distinguish “normal” from “abnormal.” Both improved detection rates and both reduced risk.But both depend on historical data. They need to have seen an attack before to stop it again.Generative AI is believed to have changed that. It enables attackers to create perfectly written, highly personalised phishing emails at near-zero cost. According to a study from the Harvard Kennedy School, AI-generated phishing achieved a 54% click rate among trained employees — more than four times the baseline. Even more concerning, the cost of crafting those emails dropped from roughly $15–$20 in labour to just a few cents.That economic shift is seismic. When every email can be unique, the pattern is difficult to spot, signatures are not updated, and a “previous attack” to learn from is nonexistent.Is Alert Fatigue the Hidden Crisis?While breach headlines dominate the industry, Sanchez spotlights a quieter operational threat – alert fatigue.At Orrick, a global law firm handling hundreds of thousands of emails each month, traditional security tools generate a steady stream of alerts. Many turn out to be benign. Analysts triage, close, repeat, Sanchez shared that, over time, the burden compounds. Security teams spend less time stopping real attacks and more time managing noisy systems.LeFort argues that false positives are not merely tuning problems — they are architectural problems. Most detection systems rely on a single scoring threshold. If something crosses the line, it’s flagged. If it doesn’t, it passes.A key insight to note is that deception alone isn’t malicious intent. Marketing emails are persuasive and sometimes manipulative, yet harmless. A credential-harvesting email, on the other hand, carries real risk. Treating both on the same scoring axis inevitably creates noise.From Pattern Matching to ReasoningStrongestLayer’s approach, as described by LeFort, moves away from pure pattern recognition and toward reasoning. Instead of asking, “Does this match something bad we’ve seen before?” the system evaluates multiple dimensions: What harm would occur if this succeeds? Is it anomalous for this recipient? What is the sender’s likely intent? How much deception is present?Crucially, it weighs evidence of innocence alongside evidence of guilt — akin to how opposing arguments are weighed in a courtroom.Such a multi-dimensional analysis, LeFort believes, dramatically reduces false positives while still catching novel threats. For Sanchez, the operational benefit is tangible. He describes scenarios where traditional gateways failed to detect unusual phishing techniques, including Unicode-based obfuscation. A reasoning-driven system flagged the anomaly not because it recognised a known signature, but because the structure and context “didn’t make sense.”That distinction is critical. AI-generated attacks do not need to repeat. They only need to work once.What key Challenges will Security Teams Face within 2 Years?All speakers agree that over the next 12 to 24 months, security teams face a dual challenge of sophistication and scale. AI lowers the cost of creating attacks and automating personalisation. When volume increases, precision increases and speed increases.LeFort emphasises that organisations evaluating AI security tools should look beyond detection rates. Automation matters just as much. Does the system eliminate operational drag? Does it allow analysts to focus on strategic threats rather than inbox noise?The consensus is that email remains the most common entry point into organisations. What has changed is the attacker’s economics. When personalisation costs pennies and sophistication is automated, defenders must respond in kind.The question is no longer whether AI will influence email security. It’s already influencing email cybersecurity across enterprises. The real question is whether an enterprise's defences are still waiting to see the attack twice.Key TakeawaysAI-generated attacks break detection models that rely on past patterns.Email remains the easiest and most economical entry point for attackers.Traditional tools force security teams into a reactive cycle.Effective AI defence must evaluate context, not just rules.Automation is now as critical as detection accuracy.Stopping the first and only attack is the new security standard.Chapters00:00 Introduction to Cybersecurity and AI's Role03:00 The Email Security Landscape and AI's Impact05:49 Understanding Alert Fatigue and Its Consequences08:52 Innovative Approaches to Email Security11:48 The Necessity of AI in Modern Security14:55 Future Priorities for Security Leaders17:57 Conclusion and Key Takeaways#EmailSecurity #AICybersecurity #GenerativeAI #Phishing #B2BSecurity #EnterpriseSecurity #CyberAttack #SecurityStrategist #StrongestLayer #AlertFatigue #CISO #TechPodcast #InfoSec #CyberDefence