Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Security incidents are rising with each passing year. The global cost of cybersecurity incidents was $10.5 trillion at the end of 2025. It is projected that data breaches will increase by 40% in 2026, as reported in SentinelOne. Security incidents are no longer isolated events. Many organizations use security systems such as SIEMs, EDRs, and identity telemetry, which generate alerts based on detection logic. While some controls can block the activity, others may allow it to continue undetected.

For years, managed service providers (MSPs) have played a critical role in helping businesses maintain and support their IT environments. But today, the market is demanding something fundamentally different. Cybersecurity has become a continuous operational challenge, one that many SMB and midmarket organizations can no longer manage alone.

Most organizations have an acceptable use policy for AI tools. Very few have controls that actually enforce it. The gap between what the policy says and what security teams can detect is where insider risk lives when it comes to large language model (LLM) usage.

Sophos Firewall and Synchronized Security Synchronized Security is a unique capability you won’t get anywhere else. If you look at what’s required to properly secure a modern network, it breaks down into three pillars: hardening, protection, and detection and response. Or another way to look at it: being equal parts proactive and reactive - or what you need to do before, during, and after an attack.

A malicious VS Code extension led to cloned private repositories, reportedly offered for sale on a criminal forum On May 19-20, 2026, GitHub confirmed a security incident affecting its own internal systems. A threat actor self-identifying as TeamPCP, also tracked as UNC6780, compromised an employee’s developer device by way of a malicious Visual Studio Code extension and used that foothold to clone roughly 3,800 of GitHub’s internal repositories.

The security industry spent a good chunk of early 2026 debating whether Anthropic’s Mythos and OpenAI’s Daybreak are truly dangerous or just good marketing. It's a reasonable debate. But while we're having it, attackers are asking a different question: how do we use tools like this to move faster than defenders can respond?

Every conversation I have with CIOs and IT leaders right now starts the same way. They're not short on activity. They've got pilots running, tools deployed, teams experimenting. What they don't have is much to show for it. The data backs it up: 92% of companies are ramping AI investment right now. Only 1% consider themselves mature.

A couple of years ago, AI agent security was a niche conversation. The practitioners who took it seriously were a small group of researchers, a handful of forward-looking CISOs, and a few founders who had watched the attack surface forming in real time. The broader market hadn't caught up yet. It has now. Enterprises are deploying AI agents at scale across platforms. The productivity gains are real. The competitive pressure to adopt is real.

If there's one idea that shaped RSA 2026, it was identity. Vendor booths, keynotes, conversations. All roads led back to the same instinct: control identity, control access, control risk. That instinct is directionally correct. Identity governance is foundational. But identity answers only part of the question agentic AI is asking. Here's the part it doesn't answer: authorization tells you what an agent was permitted to do. It says nothing about whether what it actually did was appropriate.