Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

GPT-5.5-Cyber is here. What it means for defenders operating at the frontier. OpenAI’s May 7 release of GPT-5.5 and the limited preview of GPT-5.5-Cyber put frontier AI in verified defenders’ hands. As a member of the Trusted Access for Cyber program, Sophos is using these models to sharpen what we already operate: an agentic SOC that resolves more than half of cases without a human, and an endpoint architecture purpose-built to stop AI-generated zero-days.

Ransomware: AI changes the writer. It doesn't change the math. Why most endpoint protection still treats ransomware as just another piece of malware, and what changes when you watch the data instead of the attacker. In 2013, CryptoLocker introduced the modern ransomware playbook. It also introduced something most of the industry has still not come to terms with: remote encryption.

Security teams that have invested in AI governance programs over the past two years face a problem that those programs were not designed to solve. The controls built to manage generative AI, network proxies, browser monitoring, and SSO enforcement work when data moves through defined channels. Endpoint AI agents do not move through those channels. They run locally, operate at the OS level, and access data through pathways that exist entirely outside your current visibility.

A good way to measure the success and challenges of new technologies is to spend an evening networking with your peers. Sure, a lot of what you take in is anecdotal, but what you are looking for is consistency in the stories being shared and the industries where the stories are occurring. Recently, I had the opportunity to network with a number of my peers. I had one question that I asked consistently: “How are your AI deployments going?”

Defending your network against modern hackers is a lot like playing a game of chess against an opponent who can move all their pieces at once. Traditional cybersecurity relies on anticipating human behavior and recognizing known patterns, but artificial intelligence (AI) changes the rules entirely. Attackers now use machine learning algorithms to automate their strikes, adapt to your defenses in real time, and scale their operations to unprecedented levels.

AI agents are already running inside your organization. They are accessing files, calling APIs, and executing multi-step workflows with no human reviewing each action. Most governance programs were not designed for this. They were built around policies for human users, controls for known data channels, and audits that happen after the fact. None of those structures were designed to govern systems that act at machine speed across every environment where data lives.

Published by the Open Worldwide Application Security Project (OWASP) in 2025, the OWASP Top 10 for Agentic Applications 2026 identifies security risks that organizations need to consider when implementing agentic artificial intelligence (AI) systems. The guide focuses on how threat actors can exploit agentic systems in new ways and on the associated risk mitigation strategies.

For about thirty years, security has rested on the assumption that the measures guarding your systems do not have opinions. A firewall does not care how politely you ask it to open a port. An SQL filter does not weigh the context of a query before deciding whether to pass it through. An authentication check does not get distracted or talked round. You either present the right credential or you do not, and the answer is the same every time you ask.

Every few years, something enters the market that doesn’t just change the conversation — it restructures the underlying assumptions of an entire industry. The rapid advancement of AI systems purpose-built for software and security workflows is one of those moments. And I think most of the market is still misreading what it actually means. There will be no shortage of takes. Some will declare that AI has finally “solved” software security.

Something fundamentally shifted in cybersecurity. Claude Mythos, Anthropic’s frontier AI model, signaled the arrival of what the Cloud Security Alliance called an “AI vulnerability storm,” a world where vulnerabilities are discovered and exploited at machine speed. This is a compression event, collapsing timelines, expanding attack surfaces, and forcing a rewrite of how organizations think about security operations, software development, risk, and ultimately, business survival.