Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

AI agents are creating a new penetration testing risk when they act beyond the tester’s intent and leave messy accountability behind. Once an agent touches email, tickets or workflows in a user’s name, legal, forensic and control problems start stacking up fast.

The FBI just issued a FLASH alert on TeamPCP — the group behind a wave of software supply chain attacks that compromised widely-used developer and security tools, harvesting cloud credentials, SSH keys, and Kubernetes secrets at scale. Tova Dvorin and Adrian Culley break down how TeamPCP operates with an APT's patience, and the open question the FBI alert doesn't answer: is a nation-state pulling the strings? Full breakdown on The Cyber Resilience Brief.

A criminal crew with APT-grade patience is trojanizing the very tools defenders trust. Host Tova Dvorin sits down with Adrian Culley to break down FBI FLASH-20260702-01 (coordinated with CISA) on TeamPCP — the group compromising Trivy, KICS, LiteLLM, and the Telnyx SDK to sit inside CI/CD pipelines. Inside: the CanisterWorm and SANDCLOCK credential stealers, the self-replicating "Mini Shai-Hulud" worm across npm and PyPI, npm account takeovers via expired recovery domains, and five concrete defenses — starting with searching your GitHub org for "tpcp-docs" right now.

Human in the loop AI security is failing because analysts are asked to review machine-speed output at human speed. AI now produces too many alerts, findings and decisions for manual review to remain the main safety control in modern cyber defence.

Shadow AI is already inside many companies through unapproved AI tools, local LLMs and public AI apps used without oversight. That creates data security, governance and compliance risk because the business often has no clear view of what is being used or where sensitive information is going.

Sophisticated fraudsters scale systems to increase their ROI. But it’s also a weakness that you can exploit to shut down fraud rings and keep attacks from scaling. In this discussion, fraud experts Nisreen Hussain, Irfan Faizullabhoy, and Ashley Fang show off how pattern and link analysis stop AI-powered fraud, account takeovers, and large fraud rings.

Sophisticated fraudsters are now targeting the recruiting process. Whether it's a "fake" candidate built on synthetic data, an interviewee hiding behind a deepfake, or a candidate getting a friend to take their technical test, hiring teams are facing a fraud crisis.

Nobody catches malware happening in real time, and that's by design. In this video, we outline the actual sequence, from the moment it lands to the moment your data is gone. Watch part 1 of 5 where we break down how attacks actually happen.

Privacy is getting harder to maintain. Governments are expanding surveillance. But there are practical steps you can take right now to secure your digital life and protect your family. James Rees walks through exactly how to do it. From choosing an operating system to securing your email and banking to protecting your devices. It's not expensive and it doesn't require being a tech expert. Operating system choice matters. VPNs are non negotiable. Backup everything with MFA enabled. Diversify your bank accounts. Use credit cards instead of debit cards. And yes, keep some cash on hand.