Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Anthropic Claude has become a powerhouse for enterprise organizations, supercharging everything from software engineering to data analysis. But with great agentic AI power comes an equally massive security challenge. Every prompt, snippet of code, or piece of customer PII fed into the Claude platform represents a potential data leak or compliance breach. To safely leverage AI’s full potential, CISOs and engineering leaders can no longer rely on yesterday’s security stack.

You can build a masking demo in an afternoon. Run a regex for credit card patterns, swap the match for XXXX, and ship it. The demo works, the compliance slide says “no PII sent to the LLM,” and everyone moves on. That demo is fooling you by leaving things out. It works because the input is a) clean (card 4111 1111 1111 1111), b) because the only sensitive thing in it is a textbook PII pattern, and c) because nobody downstream ever needs to use the value again.

When we think about email security, our minds almost always jump to the inbound threats: the sophisticated phishing lures, the AI-generated business email compromise (BEC) attacks, and the malicious attachments knocking at the perimeter. But there is a silent, internal crisis happening on the way out of your organization. And chances are, you’re flying completely blind to it.

Top tips is a weekly column where we highlight what's trending in the tech world and list practical ways to explore these trends. This week, we are tackling something almost everyone does without thinking twice: connecting to public Wi-Fi (and what it could be costing you without you ever knowing). You are at an airport, a coffee shop, or a hotel lobby. You notice your data plan is running low and scroll through the available networks. And there it is: Free Wi-Fi—no password required.

A lot of security programs still treat data exfiltration as a downstream consequence of compromise. That framing is too narrow. The global average cost of a breach reached $4.44 million in 2025 according to Varonis's summary of 2025 data breach statistics, and that cost lands on operations, legal, compliance, and executive credibility, not just the SOC.

A customer support agent needs a payment reference, a token or transaction ID, to issue a refund. A summarization agent reading the same ticket needs none of it. A billing agent needs only the last four digits to match a transaction. A fraud agent needs the full credit card number, but only when a case is open and only for the account it is reviewing. Traditional DLP sees one thing across all four: sensitive data, a 16-digit string that matches a card pattern. It makes one choice: block, redact, or allow.