Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CrowdStrike Counter Adversary Operations identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript (JS)-based information stealer PhantomRaven via npm, a platform on which developers can access open-source packages to build applications and software.

Getting an AI policy approved is not the same as being ready for ISO/IEC 42001 certification. Your organization may already have risk registers, information security controls, model documentation, supplier assessments and responsible AI principles. The more important question is whether these elements operate together as an Artificial Intelligence Management System (AIMS) — and whether you can demonstrate that with evidence. Before asking: “How quickly can we get ISO 42001 certified?”

Since joining BlueVoyant in May, I’ve spent my first 100 days listening. I've had conversations with nearly 50 customers and partners across industries and geographies, as well as the broader security industry, engaging with leaders at Black Hat last month. What I heard reinforced something I believe strongly: the security challenges organizations face today are changing faster than the traditional enterprise security model was designed to handle.

A browser sensor reports that somebody pasted 18,000 characters into an AI tool. A network sensor reports a 24 kilobyte upload to the same destination. Joining those two records on size looks reasonable and is the wrong instinct. ‍ The two numbers describe different objects with several transformations between them, and the transformations do not all run in the same direction. The error cannot even be signed, which rules out a tolerance as well as an equality. ‍

Recovery time objectives in manufacturing are usually set by information technology. Restore the servers, rebuild the domain, bring the applications back, declare recovery. Those milestones are measurable and a plan built around them looks complete. ‍ None of them produces a part.

On June 22, 2026, President Trump signed Executive Order 14412, accelerating the federal government’s transition to post-quantum cryptography. The order brings key migration deadlines forward from 2035 to 2030-2031 for high-value and high-impact systems. The Department of War followed with its own Post-Quantum Cryptography (PQC) Strategy, which sets additional deadlines and warns that a cryptographically relevant quantum computer is an existential threat to military missions.

AI agents are only as autonomous as the credentials behind them. This article talks about the Cloud Security Alliance's autonomy framework, why an agent's intended boundaries rarely match its actual access, and how GitGuardian helps close that gap through detection, remediation, and prevention.

Ask an AI system a question about your business and, before it can answer, it has another problem to solve: What information actually matters? It has to find the right files. Determine which version is current. Understand how those files relate to a project, client, deal, or other piece of work. Figure out which information applies to the person asking. Then assemble enough of that information to make a useful decision. For someone who works in the business every day, much of that is obvious.