Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Claude Code, Cursor, GitHub Copilot, and Gemini CLI are running on developer machines across your enterprise right now. They're browsing the web, writing to your filesystem, committing code to your repositories, and calling external APIs under the identity of your engineers. Most security teams have no visibility into any of it. This isn't a future problem.

We’ve been listening to dozens of CISOs. In roundtables, peer forums, customer and prospect calls, on the record, off the record, at event floors and dinners. And the same thing keeps coming up: the security program on paper and the one running in production are rarely the same. There’s a gap between security policy and reality.

Senior security leadership continues to confront a dual acceleration: self-propagating software supply-chain worms that weaponize developer credentials at unprecedented velocity, and the persistent security debt introduced by AI-generated code. This briefing synthesizes material developments across the most recent seven days and the preceding thirty days, framed strictly around residual risk, control effectiveness, and business enablement.

On World Wide Web Day (August 1), it’s worth celebrating what the web has made possible. It enabled remote work to function at scale, SaaS platforms to deliver capabilities in days instead of months and instantaneous collaboration through shared docs, chats, whiteboards and task tools that update in real time.

This briefing synthesizes verified threat activity, vulnerability disclosures, supply-chain incidents, and regulatory signals into a board-ready assessment of residual risk and control effectiveness for the period of 29 June to 28 July 2026. The analysis prioritizes AppSec, software supply chain, identity, cloud/IaC, API/web, ransomware resilience, and AI-related exposure.

Every CISO knows they need to do more with less. Fewer analysts, tighter budgets, more obligations. Matthew Martin has led security through all of it in two very different worlds: 20 years in financial services, and now in higher education at Western Carolina University. After two decades with enterprise budgets and every tool available, Matt made a deliberate choice to take on higher ed with different constraints and a decentralized structure.

This briefing analyzes verified developments over two horizons: the Past Week (July 15–21, 2026) and the Past Month (June 22–July 21, 2026). It draws exclusively from contemporaneous incident disclosures, threat research, and authoritative reporting. Analysis emphasizes material business risk, control effectiveness gaps, residual exposure in software supply chains, cloud/IaC environments, identity-adjacent vectors, and AI-adjacent workloads.

Coding agents have become one of the fastest-adopted AI technologies in the enterprise. They help developers write code, debug applications, automate repetitive tasks, and ship software faster than ever before. They also introduce a security challenge unlike anything most organizations have faced. Unlike traditional AI assistants that generate content, coding agents take action.