Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

How Early Action Helps Organizations Stay Ahead

In a rapidly changing technology landscape, waiting for consensus can mean losing the advantage. Elisa Costante, VP of Software Engineering at Forescout, explains how acting early helps organizations build understanding, adapt to change, and stay ahead as AI transforms cybersecurity for defenders and attackers alike.

The New Agent Control Standard Names the Controls, Not Their Value

The OWASP GenAI Security Project unveiled an Agent Control Standard in early September, donated to the project and aimed at runtime enforcement for agentic systems. It sets out that agents should be inspectable, traceable and instrumentable, with declarative hooks and policy enforcement across frameworks. ‍ It answers which controls belong around an agent.

Why AI Review Cannot Keep Up With the Decision

That human review becomes a bottleneck as agents scale is now widely observed. Five or ten agents working in parallel produce more decisions than one reviewer can evaluate, and under queue pressure the review degrades into approval without examination. ‍ The usual response is to move up a level, reviewing intents and boundaries rather than individual outputs.

Can Autonomous Pentesting Rescue CVE Coverage From Vanity Metric Hell?

The security industry killed CVE coverage as a credible metric, and it deserved to die. Vendors inflated the numbers for years in the name of depth, and nobody in the room had an incentive to ask whether they reflected real validated risk or just a longer signature list. So “CVE coverage is a vanity metric” became earned consensus. The question I keep coming back to is whether the autonomous pentesting era makes that consensus outdated.

How APRA's AI guidance impacts banks and insurers in Australia

Accelerating security solutions for small businesses‍ Tagore offers strategic services to small businesses. A partnership that can scale‍ Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate. Standing out from competitors‍ Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market.

Why Retired IT Equipment Can Become a Cybersecurity Blind Spot

The security team at a mid-sized insurer spent eighteen months hardening everything that faced the internet. They rotated credentials, tightened their identity provider, and ran tabletop exercises until the incident playbook felt routine. Then a contractor bought a pallet of decommissioned laptops at a regional auction and found four of them still booting into a cached domain profile. Nothing had been breached. The data simply walked out through the loading dock, on equipment the company had already stopped thinking about.

Protecting Assets from Cyber-Physical Attacks

Our digital and physical worlds are now closely linked. This connection brings incredible efficiency, but it also creates new vulnerabilities. When digital systems control physical infrastructure, a security failure can have real, tangible consequences. Protecting your assets today means having a strategy that tackles threats in both these areas at the same time.

AI governance monitoring: how to prove your program is actually working

Ask a governance lead which of their AI controls actually ran last Tuesday at 2:14 p.m., when a specific agent touched a specific dataset, and the answer usually arrives as a policy document, an org chart, and a shrug. That gap between the controls a program claims to have and the controls that actually fired when an agent acted is where AI governance quietly fails. Policy documents describe intent. Model monitoring tracks accuracy and drift.

Two Reporting Clocks on One AI Product, Only One Running

An AI product sold in Europe is described as facing two incident reporting duties. One under product security rules and one under AI rules, with different triggers and different deadlines. ‍ Only one of them is running. Article 14 of the Cyber Resilience Act has applied since 11 September 2026. The AI duty moved, and coverage published in the last few weeks still describes it as live. ‍