Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Somewhere in your fleet sits a laptop with a pristine, 100% compliance score. Not because it’s running the latest patches, but because it hasn’t talked to the server in three weeks, and a device that never checks in can’t exactly fail an audit, right? IT teams now manage more endpoints outside the office than inside it.

Shopify App Store requirements have a lot to say about app security, and almost none of it says “get a pentest.” Dig through the App Store review rules, the protected customer data requirements, the Built for Shopify criteria, and the Certified Technology Partner list, and you’ll find only one program that mentions penetration testing. Others are just expected to be secure, which is fair, except there is no clear definition of the word or process for proving the same.

Zenity pioneered AI Agent Security because we recognized early that agents would require a different approach to protection. Software that can access sensitive data, use tools, and creator credentials to take action on their behalf requires security that understands what the agents can do and how they actually behave. Today, Zenity is joining as a founding member of the ServiceNow Control Tower Alliance.

Voice-based fraud now accounts for billions in annual losses, and the FBI has flagged AI-assisted voice fraud as one of the fastest-growing financial crime vectors in the country. Your email security didn’t catch it. Your DMARC configuration didn’t fire. Neither did your anti-phishing stack. That’s not a gap in your tools. It’s a gap in your threat model. How does vishing work?

PHP2Shell is a pair of critical PHP flaws that leaked before disclosure and drew instant interest from attackers. This post covers what CYJAX analysts have seen on cybercriminal forums and code repositories, and what organisations running PHP should do now.

Every major identity vendor shipped an agent offering during 2026, and the datasheets converge on the same three claims. Agents get first-class identities, permissions are scoped, and access is governed. ‍ The question that separates them is narrower. When the engineer who built an agent leaves the company, what happens to the agent? The answers differ enormously, and they differ for reasons that trace back to what each vendor was originally built to do. ‍

Rotating 1,000+ service credentials across 150+ applications with zero outages took one lesson: rotation is the last step. Here’s the six-stage SCALER method, from inventory to rotation, and why a revert path made it safer.