Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Your AI agent is sandboxed. Its data still needs guardrails.

AI coding agents need access to real development context to be useful. They read repositories, modify files, execute commands, call tools, and communicate with external models. Docker Sandboxes gives those agents an isolated environment where they can work without unrestricted access to the developer’s host. But consider a simple scenario. An agent running entirely inside its sandbox reads a credential from a project configuration file and includes it in an otherwise legitimate request to its LLM.

Deployment alerts: know when a renewed certificate doesn't land

Renewing a certificate is the easy part. Getting it onto the server is where automation breaks. Somebody rotates the API token on the firewall. A service account password expires. A VM gets rebuilt and the agent never comes back. The certificate renews right on schedule, the deployment fails, and the server keeps serving the old certificate until it expires. Renewed and deployed are not the same thing.

AI Agents vs. Audit Logs: What We Learned at Security Game Day

Teams of three to four, detective aliases, a magician, and a flag hidden on a Manhattan billboard. This is our second Identity Security Game Day, a tabletop CTF where Teleport engineers and customers team up to simulate the incidents that don’t happen often, but matter when they do. Game days put customers and Teleporters at the same table. You find out how people actually deploy Teleport versus how you expected, spot better ways of doing things together, and build the personal connections remote work rarely gives you.

CloudCasa and Dell Technologies: Disaster Recovery for Kubernetes, Built on PowerStore

Together, CloudCasa by Catalogic and Dell PowerStore provide a complete disaster recovery solution for Kubernetes environments — combining PowerStore’s native array-to-array replication with CloudCasa’s Kubernetes-aware orchestration. PowerStore handles the data path, synchronously or asynchronously, while CloudCasa discovers workloads, validates the DR plan, and rebuilds Deployments, StatefulSets, and KubeVirt VMs on the target cluster, reconnecting them to the recovered volumes.

CIS Benchmarks: The Configuration Baseline Regulators Expect

Every major security regulation now asks the same question: can you prove your systems are securely configured? Few of them define what “secure” means. CIS Benchmarks fill that gap. Misconfiguration remains one of the easiest ways into an organisation. Default accounts, legacy protocols and inconsistent settings across thousands of servers hand attackers a foothold. Regulators have noticed.

Offense vs. Defense in the Age of AI | Red Team vs. Blue Team Panel

Who has the edge in AI security when attackers and defenders have the same models? In this red team vs. blue team panel, Teleport's Ben Arent (Director of Product) talks with Rob (Director of Security, Teleport) and Marcus (founder, maker of Nemesis) about how AI is reshaping infrastructure security: frontier models like Mythos, the Hugging Face incident, prompt injection and the "lethal trifecta," alert fatigue in the SOC, and Teleport's "Pressure Washing" project, where 13 engineers spent a quarter hunting vulnerabilities with LLMs and found more high-severity bugs than in 2024 and 2025 combined.

The NSA said wildcard certificates are bad. Everyone uses them anyway.

In October 2021 the NSA published an advisory titled “Avoid Dangers of Wildcard TLS Certificates.” It reiterated what security consultants had been saying for years: don’t use wildcard certificates. Single-name certificates per host are safer. Five years later, we counted the certificates that are actually used. One in three domains has a wildcard on it. For.bank domains, where you need a security review just to register, it’s four in five. Operators aren’t careless.

How to Tie Kubernetes Audit Logs to Individual Engineers

Kubernetes audit logs may show multiple engineers as one user and do not capture what is typed after a kubectl exec session starts. Assign each engineer a unique identity, make sure it stays consistent through proxies and cloud IAM, and use a session recorder if you need to review terminal activity.

How Modern Threat Actors Are Changing the Defense-in-Depth Playbook - Webinar October 8, 2026

Ransomware is still growing, but payouts are shrinking. Enterprises got better at backups, so attackers moved to where defenses are thinner: SaaS, identity, and stolen credentials. Infostealers do the collecting at scale, and AI is widening the gap. Credentials for AI services were the fastest growing category of leaked secrets in 2025, up 81% year over year with 1.27 million exposed (State of Secrets Sprawl 2026). Most defense-in-depth programs were not built with this attack chain in mind.