Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

An AI agent runs with your credentials and acts before you can stop it. Nine incidents show what that costs. Six controls limit the damage: sandbox the agent, scope its credentials, lock its configuration, log every call, scan the workspace first, and deny by default.

SOC metrics are quantifiable measures of how well a security operations center detects, investigates, and contains threats. The metrics that matter most are mean time to detect (MTTD), mean time to respond (MTTR), and incident closure rate, because together they show speed, effectiveness, and reliability, not just activity.

Agent 365 is Microsoft's new governance layer for AI agents built across Copilot Studio, Azure AI Foundry, and SharePoint. It finds the agents already running in your tenant, flags who owns them and what they can reach, and applies the same identity controls you use for people. Most organizations have more agents out there than they think.

On 8 October 2026 a threat actor published a compromised version of tensorlake to npm. The compromised version is 0.5.144 and contains a variant of the Shai-Hulud worm, which exfiltrates secrets from infected devices and attempts to self-replicate through connected supply chains. Tensorlake is a serverless sandbox for AI agents and its npm package has a reported lifetime install count of over 100,000.

Application onboarding is the process of integrating an application with your identity governance and administration platform so its accounts, roles, and entitlements can be governed. Once an application is onboarded, you can: Without onboarding, an application stays outside your controls, and any access inside it is invisible to your security and audit teams.

An employee changes roles. Their manager requests access for the new job, and IT grants it quickly. That part works well. The issue appears when access from the previous role stays in place. The same thing happens when a contractor finishes a project, an admin completes urgent work, or a team retires an application. Access often remains because nobody has checked whether it still serves a purpose. Active Directory governance allows IT and security teams to answer three questions.