Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

AI Security Posture Management (AI-SPM) platforms are specialized tools that discover, monitor, and secure AI models, pipelines, and data, mitigating risks like data leakage and model poisoning. They offer continuous visibility, manage misconfigurations, and enforce security policies across cloud services like Azure OpenAI and Bedrock.

For years, the application security testing tool category was defined by a simple question: can it find vulnerabilities? The better the scanner, the better the tool. That model made sense (for the most part) when humans wrote every line of code and security teams could reasonably review what developers shipped. That model is now obsolete.

Identity has become the new security perimeter. With over 80% of breaches involving compromised credentials, how organizations manage and govern identities is now the defining factor in both security posture and regulatory compliance. The stakes have risen sharply. Cloud adoption, remote workforces, AI-driven automation, and expanding third-party ecosystems have multiplied the volume of identities organizations must manage, and the consequences of mismanaged access have never been more severe.

In February 2026, Socket.dev published research on a multi-stage npm supply chain worm operating under the internal flag SANDWORM_MODE. The campaign spanned 19 malicious packages in total across two unique publisher aliases and demonstrated a new class of supply chain attacks that targeted AI-augmented development workflows.

Part 3 of our agent-identity series: a reference architecture showing how a locally running AI agent, like the coding assistant in your editor or the copilot in your browser, can borrow a human's authority in a scoped, short-lived, auditable way, anchored in an app the user already trusts.

AI hacking tools are compressing the time between finding a target and logging in as them. Password spraying, already responsible for the vast majority of identity attacks, is the technique benefiting most. Attackers use AI hacking methods to optimize timing, rotate infrastructure, and personalize lures at a scale no human operator could match manually.

Here is a document going into an AI assistant: A simple masking system produces: The information is protected, but the document has become almost impossible for the AI to reason about. It no longer knows who introduced whom, who approved the proposal, or whether the same person appears multiple times. By removing identity, we destroyed the relationships that give the document meaning.

In leading security for major Australian fintechs, Arun Singh has learned that "You could be the Einstein of cybersecurity, but if you cannot influence the business, you're no good." Implementing a new security control developers hate influences the business, but not in a good way.

ServiceNow is core to many modern businesses. The platform is cloud-based, AI-first and centralized. As the operational center of the enterprise, ServiceNow offers IT leaders automation opportunities that help optimize workflows, track requests and enforce processes. Naturally, managing so many actions within one ecosystem calls for advanced identity governance and administration (IGA).