Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A handful of services quietly redeploy. No one directly manages the traditional network perimeter. But somewhere along the way, an API key ends up in the wrong place. The reality of modern cloud security is that new identities are created fast, and permissions are granted broadly to keep things moving. Over time, these permissions collect unused rights and drift away from least privilege.

Researchers at Google’s Threat Intelligence Group (GTIG) warn that nation-state threat actors have adopted Gemini and other AI tools as essential components of their operations. The threat actors are using tools to conduct research and reconnaissance, target victims, and rapidly create phishing lures.

AI is not just another workload category. It is the first category of workloads that decides what to do at runtime. And that changes everything about how security must work in the cloud. For years, cloud security evolved around deterministic systems. You deploy code. That code follows defined logic paths. If something unexpected happens, such as a new process, an unusual outbound connection, or privilege escalation, you investigate and respond.

Here at ARMO, our customers run production Kubernetes clusters that face the open internet every day. That’s the reality of modern cloud-native infrastructure — your ingress controllers, API gateways, and load balancers are the front door, and threat actors are constantly rattling the handle.

In this article, we will explore the hot topic of securing AI-generated code and demonstrate a technical approach to shifting security left for cloud AI agents by using Model Context Protocol (MCP) tools.

Governments and regulated enterprises are pulling their most sensitive workloads out of infrastructure they can’t fully control. That’s the core driver behind sovereign cloud: cloud infrastructure where data residency, jurisdictional control, and supply-chain transparency are architectural requirements, not optional features. With GAIA-X moving into implementation and vendors like Red Hat launching sovereign support models for EU member states, adoption is accelerating fast.

Proprietary data is the definitive differentiator in the age of AI. Models can be replicated, infrastructure can be rented, and tools can be replaced. What cannot be easily reproduced is institutional knowledge, customer insight, and strategic intent found in enterprise data. This data must be continuously identified, deeply understood, and actively protected as it changes state, location, and context.

Cyber threat intelligence is often presented as a catalog of named threat actors, past incidents, and attribution labels that promise clarity. For defenders trying to understand risk, this structure feels reassuring. It suggests that threats can be identified, tracked, and anticipated based on observed behaviors. In practice, that confidence is often overstated.

In this second installment of a series on the transformation of SafeBreach’s development organization, VP of Development Yossi Attas details a structured operational workflow that integrates Jira, BitBucket, and Claude Code to turn AI usage from ad-hoc prompting into a rigorous engineering methodology.

In my previous piece, "The Agentic AI Governance Blind Spot," I laid out what I believe is one of the most critical gaps in the AI governance landscape today: the three most cited frameworks in AI governance, NIST AI RMF, ISO 42001, and the EU AI Act, don’t contain a single mention of agentic AI. Not one reference to autonomous agents, multi-agent systems, or AI that takes actions with real-world consequences. The response to that piece confirmed what I suspected.