Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Snyk

The Agent Baseline: 35 controls, but where should you start?

Aug 12, 2026 By Krysztof Huszcza In Snyk
Two weeks ago, we published the Agent Baseline alongside Docker and Keycard. In it, we describe six security outcomes, 35 controls, and an open reference architecture for running AI agents at the enterprise level. Last week, we stress-tested it: we took it to a panel at Black Hat and spent about one hour being asked hard questions about it. Play Video: Snyk x Docker x Keycard | Agent Baseline Panel @ Black Hat 2026 The most useful question came from someone who had actually already read it.
Read Post
Zenity

Black Hat Proved AI Agents Are Already the Attack Surface

Aug 12, 2026 By Anna Schibli In Zenity
Enterprise AI agents stopped being a pilot project a while ago. They read email, touch source code, operate browsers, and increasingly make decisions inside production systems, which means the security model built for chatbots and prompts no longer covers what is actually happening inside the enterprise. Black Hat USA 2026 turned out to be the week that gap became impossible to ignore.
Read Post
Zenity

Coding Agent Risk for CISOs: Blast Radius, Governance, and Where to Start

Aug 12, 2026 By Dina Durutlic In Zenity
Claude Code, Cursor, GitHub Copilot, and Gemini CLI are running on developer machines across your enterprise right now. They're browsing the web, writing to your filesystem, committing code to your repositories, and calling external APIs under the identity of your engineers. Most security teams have no visibility into any of it. This isn't a future problem.
Read Post

Is your AI system secure enough? MITRE ATLAS Is Now Law.

Aug 12, 2026 By SafeBreach In SafeBreach
For the first time anywhere, the MITRE ATLAS framework and the OWASP Top 10 for LLM applications are written into binding law. Article 15 names data poisoning, model poisoning, adversarial examples, model evasion and confidentiality attacks as threat classes you must have technical measures against—and must be able to evidence to a regulator. The question is no longer whether you have thought about AI security. It is whether you can prove your AI system holds.
View Video

Ep. 73 - EU AI Act-What Actually Lands on August 2nd, and What Slipped to 2027

Aug 12, 2026 By SafeBreach In SafeBreach
The EU AI Act's August 2nd, 2026 deadline just changed shape. Host Tova Dvorin and offensive security engineer Adrian Cully separate what actually lands—Article 50 transparency duties and GPAI enforcement powers—from the high-risk obligations that slipped to December 2027. Inside: Article 15 writes MITRE ATLAS and the OWASP LLM Top 10 into binding law, the DORA / NIS2 / AI Act overlap that makes one incident reportable three times, penalties up to 7% of global turnover, and the five things a CISO should do this week. Part 1 of 2.
View Video
kovrr

AI Security Posture Management: What It Covers and What It Misses

Aug 12, 2026 By Kovrr In Kovrr
AI Security Posture Management arrived as a term before it arrived as a definition. Vendors announced products under the label through 2025 and in volume at RSA Conference 2026, each describing a somewhat different scope, and buyers now evaluate a category whose boundaries depend on who is selling. The lineage is evident, since AI-SPM follows cloud and data security posture management, and the inherited assumptions are where the difficulty starts.
Read Post
appsentinels

What the OpenClaw Gym Booking Incident Reveals About Agentic and API Security

Aug 12, 2026 By AppSentinels In AppSentinels
An Australian man named Andrew asked his personal AI agent, built on the open-source OpenClaw framework and powered by Anthropic’s Claude model, to book him into a popular morning gym class. According to ABC News, the class was full, so the agent started looking for a way around that. It found that the gym’s booking API let bookings be pushed far further into the future than the website’s own interface allowed, a limit that turned out to exist only on the front end.
Read Post
seemplicity

AI Can't Do CTEM Alone (And Neither Can You)

Aug 12, 2026 By Megan Horner In Seemplicity
AI can meaningfully power Continuous Threat Exposure Management (CTEM), but only for specific stages of the cycle: prioritization, validation, and remediation routing. AI can’t replace the underlying data integration work, and it can’t turn CTEM into a single product, because Gartner defines CTEM as a continuous five-stage program (scoping, discovery, prioritization, validation, mobilization), not a tool you install.
Read Post
upguard

The Cloud Controls Matrix (CCM): Manual vs. AI-Assisted Vendor Assessment

Aug 12, 2026 By Cassy van Eeden In UpGuard
Most teams that assess cloud vendors already have a general idea of the Consensus Assessment Initiative Questionnaire (CAIQ) and Cloud Controls Matrix (CCM). However, you may not have a good answer for what it takes to run that assessment. Turning a vendor's trust center page, SOC 2 report, and security policy into a structured, defensible view of CCM control coverage is a different problem entirely.
Read Post
knowbe4

Why Securing AI Agents Is More Critical Than Ever

Aug 12, 2026 By Erich Kron In KnowBe4
AI agents offer unprecedented capabilities, speed, automation, deep context, and hyper-personalization, that will transform how we work. However, these same capabilities make AI agents significantly more dangerous than traditional software when hijacked by cybercriminals. You simply cannot rely on yesterday's risk management playbooks to handle today's AI-driven threats.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.