Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

When planning a pentest, the list usually starts with the crown jewels: the applications and data stores you’ve classified as most critical. But a large external attack surface can contain thousands of assets. Some can expose sensitive data or provide access to critical systems, even if they’ve never made it onto your pentest shortlist. AI makes it possible to investigate more of that surface, but each investigation consumes compute and tokens.

Security teams built their controls around people, applications, devices, and networks. AI agents operate across all four at once. An agent can pull records from Salesforce, combine them with financial data, summarize the result with a language model, and post it to Slack, with no person touching any step. Each action may look permitted on its own, which means the risk sits in the sequence, and most tools can’t see the sequence.

I want to start with a confession that most security leaders will recognize but few will say out loud: almost everyone reuses passwords. Not the reckless or the untrained. Everyone including, if we are honest, a fair number of people in our own profession. For years, our industry's response to this has been some version of finger-wagging. Use unique passwords, make them longer, add a symbol and change them every 90 days. Do not write them down.

A security operations centre (SOC) is the team that watches your systems around the clock and steps in when an attacker gets past your defences. Its job is to find intruders quickly and contain them before reaching anything critical. Few businesses have their own in-house SOC. Most get the same 24/7 cover from a managed SOC, run by a specialist provider. Either way, what happens in the first few hours of an attack determines how much damage is done.

Run both approaches against one company and the figures differ, which is expected. The useful part is that they differ in a predictable direction, which makes the distance between them informative rather than embarrassing. ‍ Bottom-up tends to come in lower and top-down higher, for reasons that follow from how each is built. Knowing which way each one leans is more useful than choosing between them. ‍

Seven fields carry an agent registry, and they split into two kinds. Some a person has to state, because the answer exists only in somebody's intention. The rest can be read from systems that already hold them. ‍ Which kind each field belongs to decides whether the registry drifts. Typing an observable value creates a record that was accurate on the day somebody typed it, and recording a declared value is the only way to capture it at all. ‍

Remote code execution (RCE) lets an attacker run commands on a system they don't own, usually through a flaw in a web application, CMS, VPN portal, or API. A successful exploit inherits the permissions of the vulnerable service, and many services run with far more access than they need. AI shortens the time from a disclosed flaw to a working exploit and lets attackers test thousands of exposed systems at once. A remote code execution flaw turns a vulnerable server into someone else's computer.

A data risk assessment evaluates where sensitive data lives, who can reach it, and what happens if that access is misused. It creates value only when teams assign and track remediation; without current access data and live verification, organizations can't show that exposure has fallen. 75% of sensitive data exposures begin with compromised identities or misconfigured permissions, according to the Netwrix 2026 Data and Identity Security Report.