Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

As organizations rush to deploy AI agents across enterprises to handle HR cases, write and execute code, and manage customer interactions, they very often need to grant them access to sensitive systems and data.

Organizations are struggling to detect, investigate, and contain cloud threats before adversaries achieve their goals. The new CrowdStrike State of Cloud Detection and Response (CDR) Survey highlights the primary challenges they face: Together, these challenges are creating opportunities for threat actors to successfully breach cloud environments.

Sharing applications with the world is no easy task. Developers struggle to ensure compatibility across different platforms, vendors continually search for new channels to showcase and distribute their software, and users often encounter hurdles when installing and updating the applications. To help solve this challenge, Microsoft offers multiple solutions including its Microsoft Store, the native Windows Installer component (.msi packages), and a lesser-known but powerful option: ClickOnce technology.

Following our deep dive into the internals of ClickOnce application deployment in Part 1 of this two-part blog series, let’s focus on the security implications of this technology. In this blog, we examine how threat actors can weaponize ClickOnce features, and we reveal what we believe to be a new abuse that security teams need to be aware of.

Adversaries are using AI to attack with unprecedented speed and precision. This trend, coupled with the rapidly growing use of agentic AI, means it is now necessary to use AI to protect and defend the modern tech stack. It is timely that on June 2, 2026, President Trump signed Executive Order 14409 on Promoting Advanced Artificial Intelligence Innovation and Security. At a high level, this EO validates that security is fundamental to reaping the benefits of AI.

Frontier AI is poised to change cybersecurity faster than most organizations can adapt. It’s accelerating vulnerability discovery, which puts new pressure on security teams to handle more vulnerabilities, in less time, with workflows built for much slower technology. The primary challenge of the frontier AI era is not the increase in vulnerabilities. It’s understanding which exposures are most critical and how to address them before adversaries target them.