Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Snyk

Why AI Coding Agents Keep Writing Broken Access Control

Oct 1, 2026 By Brendan Hann In Snyk
AI coding agents produce authorization logic that compiles, passes review, and enforces the wrong policy. Broken access control ranks first in the OWASP Top 10:2025, where 100% of applications tested showed some form of it, across 1,839,701 recorded occurrences, the highest count of any category on the list. One part of that category is also the part that pattern-based scanning was never built to reach.
Read Post

AI Security: Are We in the Lull Before the Storm?

Oct 1, 2026 By Razorwire Cybersecurity In Razorthorn
AI adoption is accelerating, cyber attacks are increasing and organisations are transforming faster than their security can keep up. In this Razorwire Raw, James Rees looks at why cybersecurity could be in the lull before the storm. AI agents, vibe coding and automation are changing business at extraordinary speed, while attackers are using the same technology to find vulnerabilities and accelerate attacks.
View Video
apono

Apono Partners with Databricks to Govern Privileged Access Across the Lakehouse

Sep 30, 2026 By Elad Plachzinsky In Apono
Databricks has become the data and AI platform of record for a large and growing share of the enterprise market. Unity Catalog gives teams unified governance over data assets, AI models, and agentic workflows, controlling what exists, who can use it, and what policies apply.
Read Post
armo

NIST AI Agent Authorization: Five Asks Mapped to Kubernetes

Sep 30, 2026 By Ben Hirschberg In ARMO
NIST has published no AI agent authorization standard, and nothing in its February 2026 draft gives an auditor a control to test. What the NCCoE did publish is more useful to a CISO with an audit on the calendar: five areas of interest that read like an assessor’s question list. Together they ask which agent acted, on whose behalf, under what authority, and with what record. A Kubernetes cluster has a primitive it can point to for each area.
Read Post
armo

Agentic AI Security Risks, Ranked by Recovery Cost

Sep 30, 2026 By Yossi Ben Naim In ARMO
The board wants to know which AI agent risk to fund first, and a likelihood score cannot answer it. No incident survey gives base rates for agents on your architecture, and an agent can take a different path on the same input. What a CISO can estimate is what each risk would cost to recover from: the work to detect it, scope it, revoke the authority it used, and prove what happened. Ranked on that cost, unexpected code execution drops toward the bottom.
Read Post
armo

Zero Trust for AI Agents: What to Verify When There Is No Session

Sep 30, 2026 By Shauli Rozen In ARMO
The agent that worries you is authorized. It holds a service account you provisioned, calls tools you approved, and reaches destinations someone signed off on. Zero trust asks two questions at every decision point, who is this and what are they allowed to do, and an agent redirected by trusted input answers both correctly every time. For a person those questions fire at a session boundary, where context gets re-checked. An agent on Kubernetes has no such boundary.
Read Post
armo

Agentic AI Security Platforms: What Agent Logs Miss

Sep 30, 2026 By Ben Hirschberg In ARMO
An agent’s logs are written by the agent. Every framework log, trace span and tool-call record that an agentic AI security platform ingests comes from the process being watched, or from a gateway that sees only what that process routes through it. When a trusted prompt coerces an agent into misusing a permission it already holds, the record shows a normal tool call, because from inside the process it was one. Running more analysis on that record returns the same answer faster.
Read Post

Ep. 83 - Anthropic's CISO Guide to Agentic AI: Your Next Insider Threat Is an AI Agent

Sep 30, 2026 By SafeBreach In SafeBreach
An AI agent that drifts from your intent looks exactly like an insider attack: legitimate credentials, sanctioned tools, plausible actions, at machine speed. In this episode, we break down Anthropic's "Zero Risk Isn't the Job" CISO guide: a four-question review framework, seven vendor-neutral controls, and why egress allowlisting is the strongest defense against prompt injection. Plus: the Claude Opus 4.5 upgrade that had an incident-response agent recruit another agent, and why agentic AI needs continuous adversarial exposure validation.
View Video

Claude Cowork Activity Isn't Captured in Compliance Logs

Sep 30, 2026 By SafeBreach In SafeBreach
Is your AI compliance up to par? Anthropic's deputy CISO reveals that Claude Cowork activity isn't captured in compliance logs. If you're in a regulated EMEA sector, DORA's ICT logging and the EU AI Act's obligations are here. Relying on a self-configured OTel stream isn't enough for formal audits. Stay informed about data boundaries and privacy reviews before enabling streams.
View Video

Webinar Recording: One Breach Away: Why Managed Devices Are the New Perimeter for AI, Finance...

Sep 30, 2026 By miniOrange In miniOrange
Welcome to the recording of our recent webinar “One Breach Away: Why Managed Devices Are the New Perimeter for AI, Finance and Healthcare Data.” In this session, our experts discuss how organizations can secure access to business applications, sensitive data, and AI tools by making device security a core part of their identity and access strategy. As employees connect from personal devices, remote environments, and multiple endpoints, ensuring device compliance and security posture has become critical for protecting enterprise data.
View Video

Copyright © 2026 OpsMatters™. All rights reserved.