Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

How to start the AI-accelerated defense

Early on in the AI adoption boom, I gained a reputation for just throwing everything at it to see what would stick. That wasn’t the most effective strategy, and my token usage was crazy high. There are a ton of talks and posts on all the cool ways you can use AI for detection engineering, but I didn’t see any that showed you where to begin.

When AI adoption outpaces IT visibility

At 1Password, we started expanding our use of AI with a familiar IT playbook. We identified the problems we wanted to solve and the tools that could help us achieve those goals. The plan was straightforward: enable teams, move quickly, learn what worked, and build the visibility needed to manage the cost.

What we learned about AI agent security by monitoring our agents

AI agents comprise models, instructions, data, and tools, so thoroughly investigating potential security risks requires evidence from several components. As Datadog teams build AI agents for internal workflows, we use Datadog AI Guard to monitor how they handle each component during a session. We’ve found that application logs may capture an agent’s final API call without showing which prompt, retrieved content, or tool result led to the action.

The Three Questions Every AI Telemetry Claim Should Survive

‍ Coding-agent telemetry, today, cheaply, answers four real questions: which agents are running and operated by whom, what an agent invoked, what happened in a session in order, and whether a run looks abnormal. Part 1 of this series covers that case in full. ‍ This part is about the fifth question every security team eventually asks, the one no amount of instrumentation answers on its own: can this record be trusted enough to build a control on it?

Warning: Malicious AI Tools Are Spreading in the Criminal Underground

Criminals are now selling malicious AI tools for use in cyberattacks, according to researchers at Trellix. These tools dramatically lower the barrier for unskilled crooks to launch sophisticated attacks. “In the first half of 2026, the Trellix research team identified multiple distinct AI-related offerings across major underground forums,” the researchers write.
Featured Post

Why AI is becoming harder to budget for

For most business technology, the cost is relatively easy to understand. You buy a licence, agree a contract or pay for a certain level of usage, and you have a reasonable idea of what you will spend over the year. AI is making that much harder. As businesses move beyond individual AI subscriptions and start using AI across more of their operations, costs can vary considerably depending on which models are being used, how often they're being used and what they're being asked to do.

Top 7 Technology Strategies Growing Businesses Need to Stay Competitive

Growing businesses face mounting pressure to modernize their operations while competitors race ahead with emerging technologies. The gap between those who adapt and those who fall behind widens each quarter, making strategic technology adoption no longer optional but essential for survival. Seven core strategies have emerged as critical differentiators in today's market, each addressing specific operational challenges that determine whether a company scales successfully or stagnates. Understanding these approaches reveals why some organizations thrive while others struggle to keep pace.
Featured Post

Identity Everywhere: Bringing Infrastructure Identity to Agentic IT

Every era of computing eventually exposes the assumptions that made the last era work. For decades, networking succeeded because it was mostly identity agnostic. Packets moved because they had addresses. Routers and switches forwarded traffic because the network knew where something was going, not necessarily who or what was behind it. That model helped build the internet and modern enterprises. But it is not enough for the era we are entering now.

What is DLL hijacking, and why your new AI plugin might be the easiest way in

DLL hijacking is a decades-old Windows vulnerability class (Mitre Att@ck T1574) getting new life from AI plugins bolted onto legacy desktop apps. Attackers plant a malicious DLL where a vulnerable app will load it instead of the real one, inheriting that app's privileges. To detect it, watch for DLLs loaded by name from writable folders. To prevent it, you have to fix the app's load-order logic or blocking untrusted DLLs at the endpoint.