Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

To detect and govern shadow AI, organizations need to discover which AI tools employees are using, understand who is using them and why, then turn that visibility into an enforceable AI app policy. The goal is not only to find unsanctioned AI use, but to control which GenAI and AI-enabled apps are allowed, blocked or monitored across the organization.

Your data leaks in ways you don't expect. A developer pastes source code into ChatGPT. A finance employee emails a payroll spreadsheet to a personal inbox. A salesperson uploads a client list to a personal Google Drive before their last day. All of these are breaches, rather, potential breaches. That's exactly why data loss prevention (DLP) tools exist. But picking the right one? That's where it gets complicated.

Building a DLP strategy has two failure modes. The first is skipping the planning and going straight to deploying a tool. The second is over-planning and never actually deploying anything. These 10 Data Loss Prevention Best Practices cover the full arc. From picking the right DLP tool, setting up your program properly, and keeping it from drifting once it's live. Teams that get DLP right tend to follow roughly the same best practices.

Many observability platforms authenticate to Microsoft Azure by using client secrets. Teams must create, store, and periodically rotate these secrets to keep receiving the telemetry data that they need. This recurring maintenance adds operational overhead and increases the risk of ingestion outages that occur when secrets expire.

Two weeks ago, we published the Agent Baseline alongside Docker and Keycard. In it, we describe six security outcomes, 35 controls, and an open reference architecture for running AI agents at the enterprise level. Last week, we stress-tested it: we took it to a panel at Black Hat and spent about one hour being asked hard questions about it. Play Video: Snyk x Docker x Keycard | Agent Baseline Panel @ Black Hat 2026 The most useful question came from someone who had actually already read it.