Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

An emergency vulnerability response begins before the patch arrives. On 20 October 2026, the PHP project announced two critical vulnerabilities, each rated CVSS v4.0 9.2, but withheld the technical details security teams would normally use to assess exposure. Organizations had a release window to prepare for, but no confirmed affected versions or attack vector.

Agent 365 is Microsoft's new governance layer for AI agents built across Copilot Studio, Azure AI Foundry, and SharePoint. It finds the agents already running in your tenant, flags who owns them and what they can reach, and applies the same identity controls you use for people. Most organizations have more agents out there than they think.

Federal security restrictions and procurement bans have targeted Chinese telecommunications and technology suppliers for years. But removing a company's name from an authorization is not the same as removing the risk it carries into a supply chain. For C-SCRM programs, the harder question is identifying where that risk persists — through affiliates, resellers, data center tenancies, and proxy or sub-tier relationships that no order directly names.

When a vendor’s risk score changes, a TPRM team can see what issues were flagged, why they matter, and what remediation steps are recommended next. But improving a vendor’s risk posture is not always as simple as working through each risk finding one by one. Sometimes the bigger pattern sits at the asset level.

Foreign Ownership, Control, or Influence (FOCI) risk is often discussed as an ownership problem. Who owns the supplier? Who sits on the board? Is there a parent company tied to a foreign government? Does that relationship trigger CFIUS, export controls, sanctions, or a facility clearance review? These questions matter, but they do not capture the full risk picture. For C-SCRM program stakeholders, the most important word in FOCI is not ownership or control — it is influence.

Cost pressure can decide what your security team gets to see. A useful log source gets left out. Investigation history gets shortened. Analysts work with the evidence the organization could afford to keep. That is the part of Microsoft's Integrated Security Operations Center, or ISOC, announcement I keep coming back to. Bringing SIEM capabilities into the Defender experience, using native security data, and changing the economics gives customers a reason to revisit those decisions.

As you’re reading this, it’s possible an agent you’ve never heard of is reading your files. But where did it come from? What systems can it access? And who’s responsible for its oversight? Today, employees are using AI and agents to expand what they can accomplish and how work gets done. And the barriers to innovation have never been lower — with natural language and no-code tools, anyone in your organization can build a new agent in the span of an afternoon.