|
By Dina Durutlic
Coding agent security has a framing problem. Most security conversations around these tools center on the wrong question. 'Did the agent have permission to do that?' is a reasonable place to start, but in the context of autonomous AI systems, it's not where the risk actually lives. In Zenity Labs' research into the coding agent threat model, the pattern that keeps surfacing isn't that agents are doing things they aren't allowed to do.
|
By Cinthia Portugal
The discussion during our recent webinar made one thing clear. Security teams aren't asking whether coding agents will become part of the enterprise. They're asking how to adopt them safely. The audience questions focused on practical concerns that many organizations are facing today, from autonomous execution to supply chain risk and governance. Here are the five questions that generated the most discussion.
|
By Cinthia Portugal
Coding agents have become one of the fastest-adopted AI technologies in the enterprise. They help developers write code, debug applications, automate repetitive tasks, and ship software faster than ever before. They also introduce a security challenge unlike anything most organizations have faced. Unlike traditional AI assistants that generate content, coding agents take action.
|
By Keren Katz
A few years ago, I was sitting across from a security leader at a large enterprise. They had just deployed their first wave of AI agents. When I asked how they were thinking about the security of it, they paused for a moment and then said something I haven’t forgotten. I felt that. Not just as a researcher, but as someone who had been in enough of those rooms to know it was not one person’s gap. It was the whole industry’s gap.
|
By Greg Zemlin
Customer telemetry shows how AI agents behave in a limited set of production environments and what risks they carry. Vulnerability research surfaces how those environments can be attacked. Both sources are valuable, but neither shows actual attacker behavior or how quickly they operationalize a new vulnerability once it's public.
|
By Cinthia Portugal
Anthropic’s Claude Tag represents a meaningful shift in how AI agents operate inside the enterprise. Unlike traditional AI assistants that act on behalf of an individual user, Claude Tag introduces a shared AI agent with its own identity, credentials, service accounts, and permissions. That shared agent lives inside a Slack channel, builds context over time, connects to enterprise systems, and performs work for everyone in the conversation.
|
By Cinthia Portugal
For the past two decades, enterprise security has evolved around a relatively stable assumption: software executes instructions, people take actions, and security teams are responsible for understanding and governing the interaction between the two. The technologies have changed. Infrastructure moved to the cloud. Applications became distributed. Identities expanded beyond employees to include partners, contractors, and machines. Yet the underlying model remained remarkably consistent.
|
By Cinthia Portugal
The next government security challenge isn’t AI models, it’s AI agents. Zenity and Carahsoft are helping agencies prepare. Across government agencies, AI agents are already interacting with sensitive data, mission-critical workflows, and public services. Yet most organizations still lack visibility into where these agents are deployed, what they can access, and how they behave once operational. The result is a growing governance gap between AI adoption and AI security.
|
By Ben Hanson
The regulatory landscape for agentic AI is moving faster than most compliance programs are tracking. CISOs who wait for final guidance before building their compliance posture will find themselves in catch-up mode at exactly the wrong moment and, in some cases, already behind.
|
By Cinthia Portugal
Many organizations still use the terms AI governance and AI security interchangeably. While they are closely related, they address fundamentally different challenges. Governance establishes accountability, defines acceptable use, manages risk, and helps organizations align AI adoption with business, legal, and regulatory requirements. Security focuses on understanding and controlling behavior.
|
By Zenity
Zenity's low-code security research team is exposed to real world low-code applications on a daily basis, and we're glad to share our knowledge in this domain in order to help you to design and develop secure low-code applications.
- July 2026 (4)
- June 2026 (14)
- May 2026 (6)
- April 2026 (11)
- March 2026 (9)
- February 2026 (3)
- January 2026 (6)
- December 2025 (7)
- November 2025 (6)
- October 2025 (8)
- September 2025 (7)
- August 2025 (1)
- July 2025 (2)
- June 2025 (7)
- May 2025 (5)
- April 2025 (6)
- March 2025 (1)
- February 2025 (3)
- January 2025 (4)
- December 2024 (5)
- November 2024 (2)
- October 2024 (2)
- September 2024 (4)
- July 2024 (3)
- June 2024 (2)
- May 2024 (6)
- April 2024 (2)
- March 2024 (2)
- February 2024 (2)
- January 2024 (3)
- December 2023 (2)
- November 2023 (4)
- October 2023 (1)
- September 2023 (5)
- July 2023 (2)
- June 2023 (3)
- May 2023 (7)
- April 2023 (4)
- March 2023 (3)
- February 2023 (3)
- January 2023 (1)
- December 2022 (1)
- November 2022 (2)
- September 2022 (2)
- August 2022 (1)
- July 2022 (2)
- June 2022 (1)
- May 2022 (3)
- April 2022 (2)
- February 2022 (1)
- January 2022 (3)
- December 2021 (2)
- November 2021 (3)
- October 2021 (3)
Continuously protecting all low-code/no-code applications and components! Design and implement governance policies, identify security risks, detect emerging threats and drive automatic mitigation and response.
Low-code/no-code development and automation platforms are the wave of the future. The largest companies in the world are already adopting low-code/no-code development for their core business units. But with all their benefits, low-code/no-code development brings with it a host of governance challenges and risks that are unaddressed by existing InfoSec and AppSec solutions.
Zenity, the first and only governance and security platform for low-code/no-code applications, creates a win-win environment where IT and information security can give business and pro developers the freedom and independence they want in order to continue pushing their business forward while retaining full visibility and control.
Our Platform:
- Discover: Identify shadow-IT business applications across your low-code/no-code fleet and track sensitive and business data movement.
- Mitigate: Identify insecure, vulnerable and risky configurations. Drive mitigation and remediation immediately.
- Govern: Design policies and implement automatic enforcement. Eliminate risks without disrupting business.
- Protect: Detect suspicious and malicious activity, such as supply-chain attacks, malware obfuscation and data leakage.
Governance and Security for Low-Code/No-Code Applications.