Copyright TechTarget - All rights reserved https://cyber.law.harvard.edu/rss/rss.html Techtarget Feed Generator en Fri, 21 Aug 2026 22:55:51 GMT https://www.techtarget.com/cybersecurity editor@techtarget.com <p>A Chinese threat actor has developed an offensive AI harness that deliberately throttles its own agents to avoid detection, while running noisy decoy attacks in parallel to distract the security operations center. That's according to Michael Freeman, senior director of threat research at ServiceNow, whose team observed the harness in the wild.</p> <p>"They will compromise a building management system, and the agent will just do a couple of probes every few days -- not enough to trigger any defensive algorithms or tool sets," he told TechTarget Cybersecurity. "It's actually quite impressive."</p> <p>The AI attack's low-and-slow approach makes it an alarming outlier. In <a href="https://www.techtarget.com/cybersecurity/news/366648755/Black-Hat-NOC-sees-AI-related-security-failures-firsthand">Black Hat's pop-up network operations center (NOC)</a>, for example -- one of the most challenging defense environments imaginable -- managers say agentic AI attacks are still noisy, conspicuous and easy to stop. But, based on the shift in nation-state threat activity, experts say that could soon change.</p> <p>"Historically, offensive techniques tend to follow a familiar path," said Jeff Pollard, analyst at Forrester Research, adding that nation-state hackers and <a href="https://www.techtarget.com/cybersecurity/news/366643829/Researchers-build-autonomous-AI-worm-that-can-reason-and-adapt">elite researchers</a> are generally the first to innovate, followed by advanced cybercrime groups and then criminals using commodity tooling.</p> <p>"The difference this time is speed," he said. "Between the volume of research coming out of Black Hat and DEF CON, the rapid pace of frontier model development and the growing open source ecosystem, I expect AI-enabled tradecraft to commoditize much faster than previous generations of offensive techniques."</p> <section class="section main-article-chapter" data-menu-title="Typical offensive AI agent still 'a bull in a china shop'"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Typical offensive AI agent still 'a bull in a china shop'</h2> <p>For now, however, the typical offensive AI agent remains "a bull in a china shop," Freeman said -- echoing what the Black Hat NOC team reports seeing on the ground at conferences worldwide. According to James Pope, SOC lead for the Black Hat NOC, adversarial AI agents currently have the subtlety of cannon fire.</p> <p>"They're not stealthy. They're trying all the things," said Pope, who is also senior director of security product research and technical marketing engineer at Corelight. "'Oh, that didn't work -- let me try this. Let me grab your credentials. Let me go put this here.' They are not low and slow right now. They're scanning and they're hitting everything."</p> <p>That includes canaries, honeypots and other <a href="https://www.techtarget.com/cybersecurity/tip/How-cyber-deception-technology-strengthens-enterprise-security">deception technologies</a>, making it easy for defenders to detect and stop them.</p> <blockquote class="main-article-pullquote"> <div class="main-article-pullquote-inner"> <figure> They come in fast and loud as hell, and they just kick everything over. Right now, our greatest line of defense is the fact that they trip every wire. </figure> <figcaption> <strong>Neil 'Grifter' Wyler</strong>Senior network operations lead, Black Hat </figcaption> <i class="icon" data-icon="z"></i> </div> </blockquote> <p>"They come in fast and loud as hell, and they just kick everything over. Right now, our greatest line of defense is the fact that they trip every wire," agreed Neil "Grifter" Wyler, senior network operations lead at <a href="https://www.techtarget.com/cybersecurity/conference/Black-Hat-2026-Key-news-takeaways-and-security-trends">Black Hat</a> and vice president of defensive services at Coalfire. By moving at machine speed, he added, malicious AI agents quickly give themselves away. "We're like, 'That's not a person; that's AI. Kill it.'"</p> <p>If he were advising a red team using AI, Wyler added, he would tell them to deliberately slow down their agents -- exactly what the ServiceNow threat researchers observed a Chinese threat-actor doing in the wild.</p> </section> <section class="section main-article-chapter" data-menu-title="AI harnesses could enable fast offensive gains"> <h2 class="section-title"><i class="icon" data-icon="1"></i>AI harnesses could enable fast offensive gains</h2> <p>Freeman acknowledged that cybersecurity vendors have a vested interest in overstating the current offensive AI threat and promising that their products and services can mitigate it. Until recently, he said he was skeptical of adversarial AI's real-world capabilities.</p> <p>"A few weeks [before Black Hat USA], I was going, 'This is a lot of marketing hype,'" he said. In a matter of days, however, he said he saw the rate of improvement in offensive AI shift dramatically. "The evolution is getting much, much faster as people understand that it's not the model, it's the harness that's really key."</p> <p>Once threat actors understand how to develop and tune <a href="https://www.techtarget.com/ai/tip/AI-agent-harnesses-The-infrastructure-behind-autonomy">AI harnesses</a>, they can quickly adapt and optimize their attacks. "It's just a template at that point," Freeman added. "I'm like, 'OK, I launched this attack, but I kept getting blocked at this phase. Why? What am I missing?'"</p> <p>Say the harness didn't have enough information about endpoint detection and response for the AI agent to bypass it, for example. The attacker can query AI for information on EDR tools and use that info to create a new harness component. According to Freeman, such tweaks eventually result in more effective -- and therefore, lower and slower -- attacks.</p> </section> <section class="section main-article-chapter" data-menu-title="'Do you feel lucky?' What CISOs should do now"> <h2 class="section-title"><i class="icon" data-icon="1"></i>'Do you feel lucky?' What CISOs should do now</h2> <p>For now, the typical criminal attacker is likely not well-versed in AI harness development -- just as the typical SOC likely isn't fending off sophisticated agentic AI attacks. How long that stays the case remains to be seen.</p> <p>"Could vendors be hyping a problem that isn't really here yet? Sure. The problem is knowing when it will be," said Rik Turner, an analyst at Omdia, a division of Informa TechTarget. "I'd expect methodologies those folks are using in their nation-state jobs to bleed across into the commercial sphere in a very short time frame."</p> <blockquote class="main-article-pullquote"> <div class="main-article-pullquote-inner"> <figure> Could vendors be hyping a problem that isn't really here yet? Sure. The problem is knowing when it will be. </figure> <figcaption> <strong>Rik Turner</strong>Analyst, Omdia </figcaption> <i class="icon" data-icon="z"></i> </div> </blockquote> <p>And there's always the possibility, Turner added, that low-and-slow AI-driven attacks are already<i> </i>happening in mainstream SOCs -- but with such sophistication, the targets haven't noticed.</p> <p>"Attackers have always optimized against whatever defenders measure," Forrester's Pollard added. "As detection improves, expect adversaries to shift their efforts toward patience, deception and behavioral camouflage. We've seen the same pattern play out across spam, malware, ransomware and cloud intrusions. Defenders adapt. Attackers adapt. The cycle repeats."</p> <p>The Black Hat NOC hasn't yet seen an AI-driven attack that meaningfully tests its defensive capabilities, but Wyler agreed that it's only a matter of time. "They will get stealthy, and that's when we're going to be like, 'well, shit,'" he said.</p> <p>With unfettered access to the cybersecurity industry's top technology and talent, the Black Hat NOC is unusually well-positioned to meet that moment. The <a href="https://www.techtarget.com/cybersecurity/news/366649216/Behind-the-scenes-at-Black-Hats-network-operations-center">team has already deployed defensive agentic AI</a> across multiple use cases -- and reported that its mean time to detect and mean time to contain have improved significantly in the past 24 months.</p> <p>According to analysts, mainstream CISOs should follow suit.</p> <p>"Learning how to operate with AI defensively now is a huge advantage. Waiting to invest just means waiting longer to learn that lesson," Pollard said. "And defensive AI can help with today's attacks -- and tomorrow's."</p> <p>And, added Turner, no one wants to be the CISO whose organization is among the first to suffer a sophisticated, low-and-slow AI attack but isn't prepared.</p> <p>"Not deploying defensive AI for the time being is a bit like playing Russian roulette," he said. "Or as Clint Eastwood once put it, 'You've got to ask yourself one question: "Do I feel lucky?" Well, do ya, punk?'"</p> <p><em>Alissa Irei is senior site editor of TechTarget Cybersecurity.</em></p> </section> Today's AI attacks are still hard to miss and easy to stop, but nation-state threat actors are quietly pioneering low-and-slow adversarial AI. Learn what the shift means for defenders. https://cdn.ttgtmedia.com/visuals/ComputerWeekly/Hero%20Images/Hacker-stereotype-hoodie-code-adobe-hero.jpg https://www.techtarget.com/cybersecurity/news/366649579/AI-attacks-lack-stealth-nation-state-actors-are-changing-that Fri, 21 Aug 2026 20:08:00 GMT <p>Infrastructure costs and cybersecurity threats are rising simultaneously and dramatically, yet executives must still demonstrate both fiscal discipline and cyber resilience. Instead of approaching these challenges as separate objectives measured by different metrics, organizations should optimize for risk reduction per dollar spent, not independent cost reduction or security expansion.</p> <p>This is where a unified model of FinOps and SecOps comes in.</p> <section class="section main-article-chapter" data-menu-title="The problem with siloed FinOps and SecOps teams"> <h2 class="section-title"><i class="icon" data-icon="1"></i>The problem with siloed FinOps and SecOps teams</h2> <p>In a nutshell, <a href="https://www.techtarget.com/whatis/definition/FinOps">FinOps</a> prioritizes efficiency, utilization and forecasting, and <a href="https://www.techtarget.com/cybersecurity/definition/SecOps">SecOps</a> prioritizes protection, detection and resilience. Isolating them reduces the effectiveness of each while ignoring essential financial and technical outcomes.</p> <p>For example, if an organization uses separate operating models, it might find itself reducing logging work to save on storage costs, or maintaining redundant security tools without a clear plan for ROI. Keeping the two separate can also delay modernization and training due to budget pressures, or generate technical debt that increases long-term operational costs.</p> <p>Managing financial and security objectives under a shared governance and decision-making model blends priorities and strengthens outcomes.</p> </section> <section class="section main-article-chapter" data-menu-title="How to design a unified operating model"> <h2 class="section-title"><i class="icon" data-icon="1"></i>How to design a unified operating model</h2> <p>Integrated <a href="https://www.techtarget.com/searchITOperations/tip/Top-IT-governance-best-practices">governance</a> requires shared accountability across a broader set of leaders and teams than managing FinOps and SecOps separately. Organizations need communication, collaboration and accountability across the CIO, CISO, CFO, and engineering and operations leadership teams.</p> <p>Organizations also need to establish recurring review cycles that evaluate cloud, infrastructure and operations spending; cyber exposure; <a href="https://www.techtarget.com/it-strategy/definition/What-is-business-resilience">operational resilience</a>; and business impact.</p> <p>Integrating these teams and reviews is a change in operating models, not just a tooling integration effort. The goal is convergence, not just better communication.</p> </section> <section class="section main-article-chapter" data-menu-title="How to apply FinOps principles to security investments"> <h2 class="section-title"><i class="icon" data-icon="1"></i>How to apply FinOps principles to security investments</h2> <p>Convergence enables greater control and understanding of cybersecurity and financial concerns. The key element is treating security controls as measurable business investments based on known risks and requirements.</p> <p>Apply unit economics to evaluate risk reduced per dollar spent, cost per protected workload, operational efficiency gains and reduction in manual effort using automation.</p> <p>Prioritize investments based on measurable business impact rather than fear, compliance or perceived value. This builds an effective, measured understanding of essential assets and risks, including crown-jewel asset protection, business-criticality scoring, marginal risk reduction and likelihood-versus-impact analysis.</p> <p>For example, evaluate the cost and effectiveness of automation versus additional staffing. In addition, pinpoint and eliminate overlapping tools that incur expense and effort. Prioritize identity and exposure management controls in alignment with <a href="https://www.techtarget.com/cybersecurity/definition/zero-trust-model-zero-trust-network">zero-trust</a> efforts.</p> </section> <section class="section main-article-chapter" data-menu-title="How to embed security into operations optimization workflows"> <h2 class="section-title"><i class="icon" data-icon="1"></i>How to embed security into operations optimization workflows</h2> <p>Cloud, infrastructure and other operations functions need directly embedded security and <a href="https://www.techtarget.com/cybersecurity/feature/How-to-operationalize-a-strong-cyber-resilience-plan">resilience capabilities</a>. Standardize on integrated decision points such as automated policy enforcement, asset visibility, compliance monitoring and right-sizing decisions.</p> <p>Eliminate <a href="https://www.techtarget.com/cybersecurity/tip/How-to-implement-security-control-rationalization">redundant resources</a> and orphaned infrastructure that create wasteful spending, technical debt and an expanded attack surface.</p> <p>AI and automation are key components of optimization, acting as force multipliers for monitoring, remediation and operational scalability.</p> </section> <section class="section main-article-chapter" data-menu-title="Use risk-adjusted ROI to justify tooling, automation and staffing"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Use risk-adjusted ROI to justify tooling, automation and staffing</h2> <p>Security leaders must increasingly justify investments using business-oriented language rather than technical reasons. Risk-adjusted ROI helps quantify this information, including avoided downtime, reduced breach exposure, operational continuity and staffing efficiency.</p> <p>Evaluate AI-enabled automation -- or automation in general -- based on measurable <a href="https://www.techtarget.com/cybersecurity/feature/How-AI-driven-SOC-tech-eased-alert-fatigue-Case-study">reductions in alert fatigue</a>, response times and manual overhead.</p> <p>ROI metrics go beyond an individual or tool's role in cybersecurity to measure its impact on business objectives and requirements.</p> </section> <section class="section main-article-chapter" data-menu-title="Communicating tradeoffs to the board"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Communicating tradeoffs to the board</h2> <p>Board-level visibility helps decision-makers understand tradeoffs in cost, resilience and operational risk. <a target="_blank" href="https://www.darkreading.com/cybersecurity-operations/7-tips-for-communicating-with-the-board" rel="noopener">Effectively communicating</a> these tradeoffs requires translating technical and financial decisions into business terms, such as financial exposure, downtime risk, regulatory pressure and continuity.</p> <p>Integrated governance improves transparency and accountability without automatically increasing budgets or hindering procurement.</p> </section> <section class="section main-article-chapter" data-menu-title="First steps toward integrated governance"> <h2 class="section-title"><i class="icon" data-icon="1"></i>First steps toward integrated governance</h2> <p>Integrating FinOps and SecOps governance requires coordination, cross-functional leadership and visibility into existing practices.</p> <p>To begin a shift into FinSecOps, take these steps:</p> <ul class="default-list"> <li>Establish shared FinOps and SecOps governance reviews.</li> <li>Align KPIs across finance, security and engineering.</li> <li>Prioritize high-value assets and controls.</li> <li>Consolidate overlapping tooling.</li> <li>Automate repetitive operational tasks.</li> <li>Provide joint reports on cost efficiency and resilience outcomes.</li> </ul> <p>Use the following <a href="https://www.techtarget.com/cybersecurity/tip/10-key-cybersecurity-metrics-and-KPIs-your-board-wants-tracked">standard KPIs</a> to inform reporting and relate spending decisions to cybersecurity effectiveness:</p> <ul class="default-list"> <li><b>Mean time to detect and mean time to recovery.</b> These track operational effectiveness in identifying and containing threats before impact on the business escalates.</li> <li><b>Percentage of automated security remediation</b><b>.</b> This measures how effectively automation reduces manual effort, response time and staffing pressure.</li> <li><b>Cost of security incidents</b><b>.</b> This quantifies the financial impact of downtime, recovery, legal exposure and operational disruption.</li> <li><b>Security coverage of critical assets.</b> This helps determine the percentage of high-value systems, identities and workloads that are protected by approved controls.</li> <li><b>Tool utilization and consolidation</b><b>.</b> This tracks overlapping or underutilized security and management tools to reduce redundant licensing, training and support spending.</li> <li><b>Policy compliance drift rate</b><b>.</b> This measures how quickly systems deviate from approved security and cost governance standards over time.</li> <li><b>Resilience efficiency index</b><b>.</b> This composite metric compares operational-resilience improvements against incremental-spending increases, helping leadership assess whether investments are producing meaningful business outcomes.</li> </ul> </section> <section class="section main-article-chapter" data-menu-title="Optimizing resilience per dollar"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Optimizing resilience per dollar</h2> <p>For CIOs, CISOs and CFOs, the future of governance is measurable, collaborative and outcome-driven. Success depends on an organization's ability to quantify resilience, prioritize investments based on business impact and communicate tradeoffs clearly to leadership. Unifying FinOps and SecOps into FinSecOps provides a framework for doing exactly that -- helping enterprises improve security posture and operational efficiency without treating either as a zero-sum exercise.</p> <p>The question is no longer whether the FinOps and SecOps disciplines should converge, but how quickly an organization can make the shift.</p> <p><i>Damon Garn owns Cogspinner Coaction and provides freelance IT writing and editing services. He has written multiple CompTIA study guides, including the Linux+, Cloud Essentials+ and Server+ guides, and contributes extensively to Informa TechTarget, The New Stack and CompTIA Blogs.</i></p> </section> The financial and operational aspects of security don't need to be separate disciplines. Is it time to consider a FinSecOps approach to defending your organization? https://cdn.ttgtmedia.com/rms/onlineimages/security_a135187239.jpg https://www.techtarget.com/cybersecurity/tip/Unifying-FinOps-and-SecOps-The-case-for-FinSecOps Thu, 20 Aug 2026 17:20:00 GMT <p>Claude Mythos entered the chat in April, and just a few short months later, it's hard to remember a time when Anthropic's frontier AI model didn't dominate cybersecurity discussions. Yet, plenty of unanswered questions about Mythos remain.</p> <p>In just a single month, <a href="https://www.techtarget.com/cybersecurity/news/366643606/First-month-of-Mythos-Preview-testing-exposes-10K-flaws">Mythos reportedly exposed more than 10,000 significant security flaws</a> at major tech vendors. Anthropic granted preview access to around 50 organizations under Project Glasswing, saying the model's ability to find previously unknown vulnerabilities made it too dangerous for broad release.</p> <p>As a result of frontier AI models' ability to find security weaknesses at machine speed, many experts warn that an unprecedented <a href="https://www.techtarget.com/cybersecurity/feature/The-AI-vulnerability-storm-is-here-Is-your-security-program-ready">tsunami of vulnerabilities is rolling toward enterprises</a>. Many argue <a href="https://www.techtarget.com/cybersecurity/feature/Vulnerability-management-needs-an-update-for-the-AI-era">CISOs will need to change their vulnerability management strategies</a> to keep afloat.</p> <p>In this episode of the Reporters' Notebook video series, journalists from TechTarget Cybersecurity, Dark Reading and Cybersecurity Dive discuss what else we know -- and what we still don't -- about Claude Mythos.</p> <p>Watch the full discussion now, and check out the following related articles:</p> <ul class="default-list"> <li><a href="https://www.techtarget.com/searchsecurity/news/366646755/What-CISOs-can-learn-from-the-Hugging-Face-OpenAI-incident">What CISOs should take from the Hugging Face-OpenAI incident</a></li> <li><a href="https://www.techtarget.com/cybersecurity/tip/Behavioral-biometrics-How-to-detect-nonhuman-threat-actors">Behavioral biometrics: How to detect nonhuman threat actors</a></li> <li><a href="https://www.techtarget.com/cybersecurity/news/366645907/Industry-reacts-to-Gold-Eagle-vulnerability-management-plan">Industry reacts to Gold Eagle vulnerability management plan</a></li> <li><a href="https://www.techtarget.com/cybersecurity/tip/What-AI-zero-days-mean-for-enterprise-cybersecurity">What AI zero days mean for enterprise cybersecurity</a></li> </ul> <p><em>Alissa Irei is senior site editor of TechTarget Cybersecurity.</em></p> <transcript> <p><b>Editor's note:&nbsp;</b><i>The following transcript has been transcribed and edited for length, clarity and readability by Informa TechTarget's internal AI assistant.</i></p> <p><b>Dark Reading's Alex Culafi:</b>&nbsp;Hello, everybody. Thank you for joining us for the latest installment of Reporters' Notebook, featuring editors and reporters from Cybersecurity Dive, TechTarget Cybersecurity and Dark Reading. I'm Alex Culafi, senior news writer at Dark Reading. I am joined here by:</p> <p><b>Cybersecurity Dive's David Jones:</b> David Jones at Cybersecurity Dive.</p> <p><b>TechTarget Cybersecurity's Alissa Irei:</b> Alissa Irei, TechTarget Cybersecurity.</p> <p><b>Culafi:</b>&nbsp;Today we are here to discuss&nbsp;Anthropic's Claude Mythos&nbsp;AI model and the intense saga that has surrounded it up until this point. Mythos was introduced in preview in April, with Anthropic claiming the&nbsp;large language model&nbsp;is so capable of finding and exploiting vulnerabilities that it could find critical exploits in popular decades-old software on its own.</p> <p>Because of this supposed danger, the company launched a secondary campaign called&nbsp;<a target="_blank" href="https://www.darkreading.com/cyberattacks-data-breaches/glasswing-secured-code-stack-on-you" rel="noopener">Project Glasswing</a>&nbsp;in order to give cybersecurity partners a head start and limit the potential for Mythos to be misused by threat actors. Even under Glasswing, access was restricted and monitored among organizations.</p> <p>In June, Mythos Preview became Mythos 5 and was released to a larger pool of early-access partners. It was still restricted, but it was introduced alongside Claude Fable 5, a safer, publicly accessible version of Mythos that doesn't do sensitive tasks involving things like cybersecurity, biology, etc.</p> <p>Soon after -- I think within a day or two of Fable and Mythos going public -- the White House restricted access to Mythos and Fable to non-U.S. nationals, including Anthropic employees, after reports that a jailbreak was able to bypass Fable's guardrails. This temporarily led Anthropic to disable Mythos and Fable access to all users, though a couple weeks later the U.S. government lifted its restriction, and things seem to be mostly back on track.</p> <p>Many security experts say Mythos is capable of completely altering the security vulnerability landscape and will require organizations to rebuild their&nbsp;security programs&nbsp;from the ground up.</p> <p>That brings us to our discussion today -- a check-in on how we feel about the Mythos saga to date.</p> <p>My first question: I want to hear what we all think, but we'll start with you, Dave. What has your overall impression been of the Mythos saga, and what is this story to you?</p> <p><b>Jones:</b>&nbsp;Well, I think, generally, my concerns about AI from the start have been there's this tension between the interest in using AI by major companies, governments and&nbsp;critical infrastructure&nbsp;providers to accelerate their capacity to conduct their business, be productive and speed up timelines.</p> <p>But the problem is that that pressure everybody seems to be under because they don't want to be left behind is getting ahead of the necessary guardrails to make sure they're doing this in a safe and thoughtful manner.</p> <p>And what tends to happen is when the&nbsp;security guardrails&nbsp;are not there, the people who are tapping others on the shoulder or looking over their shoulder and saying, 'This needs to be dialed back. We need to slow this down,' may not find out until after the cat's out of the bag in terms of what the potential risks are.</p> <p>Let's say you go out and you find vulnerabilities at an accelerated pace. Somebody's got to prioritize what you focus on first of all. And what do you do when you find something and you have to go out and actually remediate what you found in the first place?</p> <p>Somebody's got to do the work, and somebody's got to let folks know, 'OK, we've got several thousand vulnerabilities that we found in a given time frame. Where do you start? What's the most important thing? How are you going to make sure you know what should be prioritized?'</p> <p>If you don't have that thought out properly, you're just going to have a lot of people doing a lot of busy work and not really understanding what they're doing. The fire is going to start spreading, and where do you start to put it out?</p> <p><b>Irei:</b>&nbsp;I would agree with that. I think so far, the technology and the risk of AI seem to be amplifying existing problems, like, to Dave's point,&nbsp;vulnerability management, patch management, existing risk exposure, identity and access management, and trust.</p> <p>How do we not only make sure that human users are accessing only the assets they need to do their jobs, but also now the&nbsp;agentic AI&nbsp;users?</p> <p>As for the big-picture, what's-to-come angle, I think it's anybody's guess. The optimistic part of me thinks maybe this will help defenders because while there is this incoming tsunami of vulnerabilities that's already starting to arrive, it also seems possible that the same technology, deployed in a defensive capacity, could help with vulnerability management and prioritizing remediations and patches in a more strategic way than human operators have been able to do so far.</p> <p>We know that security teams are so&nbsp;<a target="_blank" href="https://www.darkreading.com/cybersecurity-operations/triple-threat-burnout-overworked-unsatisfied-trapped" rel="noopener">overworked, understaffed and stretched thin</a>, and that was true before AI. So I'm hopeful. I don't know that I think this is going to happen, but best-case scenario, those teams can use AI in a way that makes enterprises safer.</p> <p>Of course, the threat actors also have access to a lot of this technology, even if not the actual Mythos model yet.</p> <p>Alex, what are your thoughts?</p> <p><b>Culafi:</b>&nbsp;A fundamental distrust of the B2B space makes me very skeptical any time anyone says anything about Mythos.</p> <p>Because we're in the B2B space, everyone is trying to make money and push a certain agenda, which is fine. We know the space we're in. Everyone's trying to make money, but also possibly have the best security solutions.</p> <p>It doesn't surprise me that AI is doing some of the things that Mythos describes because I went to DEF CON last year, and DARPA, for the last two or three years, has been building out -- or fostering younger talent and newer talent -- to basically develop AI vulnerability discovery capability. So this type of stuff has been in the works for a while.</p> <p>If there's, let's say, a precipice we're going to go over, that doesn't surprise me so much, whether it's Anthropic or someone else.</p> <p>The parts that I distrust or am skeptical about are that I'm still not fully clear on exactly how powerful this is, other than Anthropic's own blog posts. That's kind of interesting, right?</p> <p>The other thing is, OK, let's say AI can do this stuff where it can find critical vulnerabilities through natural language prompting. Is Mythos really the only one that can do that? Are some of these Chinese models capable of doing that?</p> <p>What I'm hearing is that some of these Chinese models -- some of the competitors -- are behind Mythos, but maybe six months behind Mythos. This sort of technology isn't really going to stay with Anthropic if it's only Anthropic right now.</p> <p>So, I look at the White House ban and all this other stuff happening, and part of me wants to have the knee-jerk reaction that they're overselling it. They're doing their B2B thing and engaging in a little business-motivated fearmongering.</p> <p>On the other hand, I'm like, if it's not there yet, I think it's going to be there soon. I don't know. Do you guys agree with me or no?</p> <p><b>Irei:</b>&nbsp;I think you make really good points because, on the one hand, we've been expecting this news from, to your point, any AI provider, not necessarily Anthropic.</p> <p>On the other hand, it is sort of an interesting dynamic where they have broadcast loudly and heavily the superpowered capabilities of Mythos, but no one largely can access it. So, no one can verify it that isn't Anthropic or an Anthropic partner -- a very short list.</p> <p>Cisco&nbsp;has come out and said they've seen really staggering results from using Mythos. But again, they're, by definition at this point, a partner, if only in the context of this project.</p> <p>Anthropic is a business, and they do have PR and marketing objectives along with technological objectives. So I am with you. I go back and forth on whether this is all very convenient -- the terms of the project, the closed-door nature of it, and the short list of participants.</p> <p>Another thing I've been thinking about is that they could have been quiet about this. There was a lot of announcing something that ultimately, arguably, didn't need to be publicized at the points that it was.</p> <p>But I'm hearing the same things about China being hot on their heels, and&nbsp;OpenAI&nbsp;is working on similar projects.</p> <p>So, I don't really know where I land, but I share your skepticism in general.</p> <p><b>Jones:</b>&nbsp;Well, I mean, if you think about it, imagine if you created a new superweapon and you keep telling people that you have this superweapon that can wipe out aircraft flying at 60,000 feet within a couple of minutes, and there's no military bomber or fighter jet that can outflank this weapon.</p> <p>At a certain point, you've got to be able to roll it out and test it in the real world. You'll get that one shot to either hit the mark or miss, and there's going to be blowback.</p> <p>When you have something like Anthropic, where you're testing these models in a simulated environment, at some point you've got to be able to demonstrate them in a real-world scenario where there are multiple sides, where somebody has an attempt to create a product and somebody has the ability to respond to it.</p> <p>Whether or not you're going to be able to match the hype that you're bringing forth, I think at a certain point they're going to be tested. They're going to have to demonstrate that, yes, they can find these vulnerabilities and figure out a way to mitigate them.</p> <p>Then the threat actors are already fairly skilled at creating vulnerabilities faster than humans can patch them right now. These models are going to have to step up to the plate at some point and demonstrate that they can actually outflank actors who are pretty skilled and pretty fast in terms of what they're capable of doing.</p> <p>We're already starting to see that threat actors are taking AI outside of Mythos and creating situations where they're outpacing what we're currently capable of doing. So maybe a few months down the road -- and there have already been warnings about this -- they're going to be tested in the real world.</p> <p><b>Irei:</b>&nbsp;I think that's a great point. Just as a quick sidebar, there's already AI technology that is not Mythos and is not a frontier-model application that's weaponizing AI.</p> <p>We saw the AI worm that was confined to a research lab, I believe, at the University of Toronto. But there are attacks possible already using AI that we all have access to -- open source models, and not necessarily Mythos. So, yeah, just building on Dave's point there.</p> <p><b>Culafi:</b>&nbsp;I would even go so far as to say there are a few examples of attackers doing complete front-to-back operations in preexisting, publicly available AI, from developing malware to orchestrating full attacks.</p> <p>There was one example last week. I think it was maybe Cygnia that presented an example of a lone attacker who compromised an entire&nbsp;AWS customer, not AWS themselves but an AWS customer.</p> <p>They managed to take down this whole global environment by orchestrating AI to take one set of plaintext credentials they could find, get everything they could out of it, and then gain footholds to get deeper and deeper into the organization until they were able to successfully financially extort this unnamed victim.</p> <p>Even outside that, you have phishing attacks where now you can write a clean email even if, let's say, English isn't your first language, and you want to send an English-language email to someone.</p> <p>If you have access to a Web browser, it's no longer difficult to get something that's perfect and plausible for the right victim, which is weird, right?</p> <p>I wanted to go back to something you were saying, Dave, this idea of the superweapon. Alissa, I think you and I already talked about this a bit, but I'm curious where you stand, Dave. Do you think Mythos is the real deal based on what you're seeing out there so far? Or do you still feel a little of the skepticism that we do?</p> <p><b>Jones:</b>&nbsp;I'm a little skeptical from the standpoint that the company has a product it's trying to sell. So, they have an interest in promoting its capabilities, obviously. At the same time, they've demonstrated to a certain extent that what they've created may be a little beyond what they're capable of reining in and controlling.</p> <p>What they're trying to do is set up almost sandbox environments where they can put this to the test in the most realistic scenario. They would create a model for a sophisticated, sensitive organization like a&nbsp;financial institution, a cybersecurity company, or other companies that are getting involved in these testing and sandbox environments. They're actually going to be able to demonstrate, "OK, we can find these vulnerabilities at this speed. We can determine how quickly we can weaponize this."</p> <p>Somebody's going to have to come back and say, "OK, now that we've figured out where the vulnerability is, how much access to an environment does this product have?"</p> <p>Part of the problem is there are certain products that have wide exposure to&nbsp;IT environments&nbsp;where they can access almost everything you have, and with the blink of an eye they can gain control of your systems. I think they're going to be pushed to determine, very soon -- within maybe a few months -- whether they can control how this rolls out.</p> <p>For all we know, there may be companies working on an alternative version of this beyond the U.S. and beyond China, where in a few months they're going to be able to counter what Mythos does or counter what China's doing.</p> <p>I'm sure the threat actors are gathering all the information they can and saying, 'Well, we have our response to the product you're putting out.'</p> <p>Everybody has their own self-interest in terms of what they're putting forth. But we already know that for every technology that emerges, there's probably another unknown party that's developing a counter to whatever you're working on. And so, I think we'll learn pretty soon.</p> <p><b>Culafi:</b>&nbsp;Yeah, and the thing that I keep going back to is you've got <a target="_blank" href="https://www.darkreading.com/threat-intelligence/cybercrime-cobalt-strike-use-plummets-worldwide" rel="noopener">threat actors that already use legitimate red-teaming tools like&nbsp;Cobalt Strike&nbsp;</a>and whatnot to compromise environments. I think the threat of Mythos is that this is both better and easier to use than Cobalt Strike. If someone who isn't, let's say, technologically capable got hold of it, then they could have that superweapon capability. And I think that's the fear.</p> <p>I guess the one question that sort of remains -- and we'll start with you, Alissa -- is how should organizations prepare themselves? Because maybe we don't know the exact extent that Mythos is a threat right now, or how much it'll be a threat in a few months, or when, let's say, opportunistic attackers are going to get their hands on it. But it sounds like something like this is real, or becoming real. What do you think folks should do?</p> <p><b>Irei:</b>&nbsp;So, I think the good news and the bad news is the answer is fairly boring. We've covered this quite a bit on TechTarget Cybersecurity. It's old problems that now have a new urgency:&nbsp;patch management, vulnerability management and making sure users are following good&nbsp;password practices.</p> <p>I think things like&nbsp;zero trust, which we've been talking about for many years, are also important. A lot of organizations still have not really deployed zero trust across their environments. Identity and access management becomes hugely important if you have agentic AI in your environment, which you probably do whether you know it or not.</p> <p>So, I think really doubling down on these cybersecurity fundamentals is the best place to start, and in some ways the only place to start. Because if you haven't addressed those, the outlook isn't great, whether or not Mythos turns out to be the one, or it turns out to be something a little further down the road.</p> <p>It's the rare organization that really has all of those fundamentals buttoned down. I think that's what we're hearing from&nbsp;experts CISOs&nbsp;should start with, and there's plenty to work on there.</p> <p>Beyond that, if you're an organization that has the resources, it's definitely a good time to be gathering information and talking to vendors about defensive AI capabilities -- not necessarily making purchasing decisions yet but monitoring what's possible and keeping abreast of how your organization can use AI defensively. That is necessary, and I think it will be necessary in the future.</p> <p><b>Jones:</b>&nbsp;I think one thing that kind of gets overlooked is the governance and the guardrails. If you're a company embracing the use of AI and you feel like you're in a race to outpace your competitors because you don't want to be left behind, do you actually know why you think you need AI? Do you know what the purpose of AI is? What is AI supposed to do to help your company?</p> <p>If you're an organization and you start experimenting with&nbsp;<a target="_blank" href="https://www.darkreading.com/cybersecurity-operations/trump-ai-order-seeks-voluntary-frontier-model-testing" rel="noopener">frontier AI models</a>, do you have the infrastructure set up to deal with potential outcomes that may not necessarily go your way? Do you have the personnel and the resources necessary to maintain a semblance of control over how the technology is utilized, who has access to the technology, how it's going to be implemented, and what the rules are? If, for example, a&nbsp;malicious actor&nbsp;comes back at you in response to your AI rollout, do you know who's going to be responsible for responding to that?</p> <p>I'm just not sure that a lot of these secondary questions have been thoroughly thought through and game-planned for.</p> <p>Everybody says, 'We have the most confidence in our security capabilities.' But if you took the CEO, the CISO and some of the lower-level employees into separate rooms, you might get a different set of answers depending on who you spoke to.</p> <p>It's not necessarily clear to me that the people who need to be having these conversations are having them - or that those conversations are being listened to.</p> <p><b>Culafi:</b>&nbsp;Agreed with everything you're both saying and co-signed. The only thing I would add is there's this report that came out the weekend after Mythos and Project Glasswing were introduced from the Cloud Security Alliance.</p> <p>Basically, over that weekend, a who's who of cybersecurity luminaries got together and worked on a report called&nbsp;"Building the AI Vulnerability Storm: Building a Mythos-Ready Security Program," which is not that long but is very helpful. April sounds like it was forever ago, but I think a lot of the advice in there is still practical and relevant because so much of Mythos, from an attacker's standpoint, is still very much theoretical.</p> <p>So many of the security issues involving AI don't really evolve beyond strong security fundamentals. It's a data security program. It's keeping your authentication in check. It's a lot of the same boring stuff that you brought up, Alissa.</p> <p>The idea of preparing for Mythos really hasn't changed. So, believe it or not, a report that's three months old is still perfectly viable.</p> <p>On that note, thank you very much. Alissa and Dave, I really appreciate your time. For our viewers, I'm Dark Reading's Alex Culafi. I've been joined by TechTarget Cybersecurity's Alissa Irei and Cybersecurity Dive's David Jones. Thank you for watching, and we'll see you next time.</p> </transcript> <p><em></em></p> In this Reporters' Notebook video, Informa TechTarget journalists discuss what we know -- and don't know -- about Claude Mythos, and what CISOs should do next. https://www.techtarget.com/cybersecurity/video/Cutting-through-the-Claude-Mythos-hype-What-it-means-for-CISOs Wed, 19 Aug 2026 19:18:00 GMT <p>Organizations are deploying AI agents at unprecedented scale. Gartner found that while the average Fortune 500 enterprise used fewer than 15 agents in 2025, that number will balloon to more than 150,000 by 2028.</p> <p>Given recent incidents of <a href="https://www.techtarget.com/cybersecurity/news/366646105/OpenAI-models-escape-containment-hack-Hugging-Face">AI agents escaping their testing environments</a>, executives and board members are rightfully demanding accountability and security for the AI agents deployed in their organizations. <a href="https://www.techtarget.com/ai/feature/Humans-and-AI-The-role-of-people-in-the-new-AI-world">Human-in-the-loop</a> is a common default response, but bottlenecks, latency, scalability challenges, poor feedback loops, and human decision-making issues and fatigue are common arguments against it.</p> <p>"If a person's reviewing hundreds of decisions after the fact, or if they're approving actions they can't independently validate, or they don't have the expertise to know what they're looking at, is that oversight or is that just some sort of accountability theater?" asked Jess Burn, an analyst at Forrester Research, during a panel session at <a href="https://www.techtarget.com/cybersecurity/conference/Black-Hat-2026-Key-news-takeaways-and-security-trends">Black Hat USA 2026</a>.</p> <blockquote class="main-article-pullquote"> <div class="main-article-pullquote-inner"> <figure> If you don't give agents agency, then what are you doing? </figure> <figcaption> <strong>Will Pearce, co-founder, Dreadnode</strong> </figcaption> <i class="icon" data-icon="z"></i> </div> </blockquote> <p>"Human-in-the-loop is one of those things that people like to say," said Nathan Hamiel, senior director of research at Kudelski Security. "You want someone to blame when something goes wrong."</p> <section class="section main-article-chapter" data-menu-title="The case for letting agents fail"> <h2 class="section-title"><i class="icon" data-icon="1"></i>The case for letting agents fail</h2> <p>Will Pearce, co-founder of Dreadnode, an AI-native security company, advocates for letting agents do their thing -- within reason.</p> <p>Regulated industries must follow specific guidelines, he noted. But if the average SOC has a handle on agent permissions and guardrails, it can and should "explore the edges of what's possible," permitting AI agents to run and, yes, fail. He cited the use of red teaming, <a href="https://www.techtarget.com/cybersecurity/tip/Pen-testing-guide-Types-steps-methodologies-and-frameworks">pen testing</a> and vulnerability scanning -- all conducted to find and fix weaknesses. AI agents should be treated no differently.</p> <p>"If you don't give agents agency, then what are you doing?" Pearce said. "The whole point is to scale beyond what you could before. If you constrain it to this human-in-the-loop -- it's really expensive <i>not </i>to let it go. In those failures you're finding moments where something wasn't the way you thought it was."</p> <p>Pearce added that when deploying AI agents, "there's a step that defenders need to take where it's not caring less, it's just becoming less policy-driven and more action-driven."</p> <p>Of course, this won't work with every single scenario, Hamiel said. "The problem -- as with anything that you apply AI to -- is that everything is a risk-based decision."</p> <p>He explained that the success of human-in-the-loop initiatives largely depends on the organization's understanding of its agent use cases, and its <a href="https://www.techtarget.com/cybersecurity/definition/What-is-a-risk-profile-Definition-examples-and-types">risk profile</a> and appetite for potential failure. As risk scales, so will the need for human-in-the-loop.</p> <p>Victoria Westeroff, principal of AI red team ops at Microsoft, agreed. "Knowing where really big decisions are in the process and the tech stack should be the guiding principle of where you're mandating human review," she said.</p> </section> <section class="section main-article-chapter" data-menu-title="Building secure agentic systems"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Building secure agentic systems</h2> <p>Several factors go into <a target="_blank" href="https://www.darkreading.com/cyber-risk/securing-ai-agents-rogue" rel="noopener">securing AI agents</a>. "You can't treat [an agent] like a traditional software component," Hamiel said, adding that in terms of access, an agent acts almost like a human hacker. "Not to anthropomorphize it, but you're giving it access to tools, you're giving it access to files, you're giving it access to things it needs to be able to perform an action."</p> <p>In terms of access control, the experts recommended providing agents only with the access and permissions they need, following the <a href="https://www.techtarget.com/cybersecurity/definition/What-is-the-principle-of-least-privilege-POLP">principles of least privilege</a>, least access and least agency.</p> <p>To do this properly, teams must understand the agentic workload and its mission. This includes knowing agents' intentionality, Westeroff said.</p> <p>"If you start building agentic ecosystems without really clear expectations about what they're solving, it's really difficult to know if they're going out of lane," Westeroff said. "To actually monitor and call those agents out when we see behavior that's not intentional requires you to have definitions of how you want those agents behaving and pretty strict personas or lanes. You really need to know what you want those agents to be doing."</p> <p>This involves intentionally integrating agents into workflows, knowing stop gaps and understanding where decisions can be autonomously pulled back -- if possible.</p> </section> <section class="section main-article-chapter" data-menu-title="Guardrails and data complexity"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Guardrails and data complexity</h2> <p>Once teams understand intentionality and definitions, they can better classify what constitutes a "good" agent across various scenarios. And when failures occur, they can learn from them and <a href="https://www.techtarget.com/cybersecurity/tip/How-to-build-AI-security-guardrails-without-blocking-innovation">put security guardrails in place</a>.</p> <p>"There are all kinds of different experiments you can run," Pearce said. "As long as you have the ability to collect that data, replay that data and observe what's happening, you have the ability to write a guardrail for next time."</p> <p>Admittedly, Pearce said, keeping up with those guardrails is hard. "It's not this one-off thing. You need systems that can hold data, you need to query it, you need to sandbox -- there are a lot of different technologies," he said. "Finding these issues isn't hard; it's just the continuity of the improvement that is difficult to manage."</p> <p>Beyond a scaling continuous improvement process, human-in-the-loop requires diagnosing issues. People must understand the data an agent provides and its context -- an area where current capabilities often fall short.</p> <p>"If you're in a multi-agentic system, you need to understand actions across multiple agentic actions and actors. The data munching gets really, really complex," Westeroff said. "If you don't have the tools or folks who know how to do it, then the human-in-the-loop is inherently not going to be the expert needed."</p> <p>As the number of agents is expected to scale in the months and years ahead, this will become exponentially more difficult.</p> <p>"You need to invest in a way to map the data that you get out of agentic ecosystems to something that the expert decision-maker can actually compute quickly and decisively -- and I think we have some work to do," Westeroff said.</p> <p><em>Sharon Shea is executive editor of TechTarget Cybersecurity.</em></p> </section> Human-in-the-loop can't scale with AI agents. Security leaders at Black Hat explained action-driven approaches for managing agentic ecosystems. https://cdn.ttgtmedia.com/rms/onlineimages/ai_a264431831.jpg https://www.techtarget.com/cybersecurity/news/366649417/AI-agent-security-must-move-beyond-human-in-the-loop-experts-say Tue, 18 Aug 2026 16:34:00 GMT <p>Modern organizations can manage their digital credentials by either using a centralized identity provider or by relying on directly controlled, decentralized identity management.</p> <p>Decentralized identity lets individuals securely share data without having to use a centralized authority. It relies on verifiable, cryptographically secure credentials, offering IT leaders a new approach that improves privacy, trust and agility. Benefits aside, decentralized identity also introduces governance, auditability and control concerns.</p> <p>As regulatory pressure and digital partnerships grow, organizations must decide where decentralized identity delivers measurable business value. This article examines the strategic value and related challenges of decentralized identity, and offers a methodology to determine whether the framework is a suitable option.</p> <section class="section main-article-chapter" data-menu-title="What is decentralized identity?"> <h2 class="section-title"><i class="icon" data-icon="1"></i>What is decentralized identity?</h2> <p>With <a href="https://www.techtarget.com/whatis/definition/decentralized-identity">decentralized identity</a>, accounts are not held in a single system. Instead, identity is built on portable, cryptographically verifiable credentials that can be presented as needed.</p> <p>Key components include:</p> <ul class="default-list"> <li><b>Decentralized identifiers.</b> Unique identifiers created and controlled by the identity owner, not a central provider.</li> <li><b>Verifiable credentials.</b> Digitally signed claims -- e.g., role, certification or status -- that can be independently verified.</li> <li><b>Digital wallets/agent.</b> Tools that store credentials and manage how they are shared.</li> <li><b>Trust frameworks.</b> Established governance models consisting of rules for recognized issuers and credential validators.</li> </ul> <p>Traditional identity and access management (IAM) platforms use <a href="https://www.techtarget.com/searchsecurity/tip/Centralized-vs-decentralized-identity-management-explained">centralized directory services</a> and identity providers to authenticate users and enforce access. Enterprise systems typically store identity data and mediate trust using <a href="https://www.techtarget.com/searchsecurity/tip/CISOs-guide-to-centralized-vs-federated-security-models">federation</a> or single sign-on. While this approach offers strong control, visibility and auditability, it also concentrates risk, increases storage requirements and creates friction in cross-organization scenarios.</p> <p>Decentralized identity shifts oversight from a centralized model to a distributed one, reducing reliance on stored personal data. It enables flexible, ecosystem-driven interactions. It also requires new approaches to <a href="https://www.techtarget.com/data-technologies/tip/10-data-governance-challenges-that-can-sink-data-operations">governance</a>, integration and compliance oversight for success.</p> </section> <section class="section main-article-chapter" data-menu-title="The strategic value of decentralized identity"> <h2 class="section-title"><i class="icon" data-icon="1"></i>The strategic value of decentralized identity</h2> <p>In the <a target="_blank" href="https://www.darkreading.com/identity-access-management-security/is-decentralized-identity-about-to-reach-an-inflection-point-" rel="noopener">correct environments</a>, decentralized identity is a business enabler with tangible benefits, not just a security tool. It offers strategic value across multiple facets of business, including:</p> <ul class="default-list"> <li>Customer trust and privacy via reduced exposure and selective disclosure.</li> <li>Diverse ecosystem integration with streamlined partner onboarding.</li> <li>Operational efficiency based on fewer redundancy checks.</li> <li>Regulatory alignment supporting data minimization principles.</li> </ul> <p>Decentralized identity complements rather than replaces IAM. It works alongside existing identity providers and access management systems. Like traditional IAM, it requires policy alignment and benefits from <a href="https://www.techtarget.com/searchitoperations/tip/IT-automation-vs-orchestration-Key-differences">orchestration</a>.</p> </section> <section class="section main-article-chapter" data-menu-title="Where decentralized identity reduces risk and creates value"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Where decentralized identity reduces risk and creates value</h2> <p>Decentralized identity offers the greatest benefits in distributed, high-trust environments; not every organization will match this criteria. Organizations should consider using it for business partners, customer identity and workforce management.</p> <p>In partner ecosystems and supply chains, verifiable credentials streamline onboarding and reduce reliance on shared logins, <a href="https://www.techtarget.com/cybersecurity/tip/How-to-prevent-a-data-breach-11-best-practices-and-tactics">lowering breach risk</a> and administrative overhead.</p> <p>For customers, decentralized identity minimizes the need for centralized storage of sensitive data, reducing liability and exposure while enabling privacy-preserving verification. It also improves user experience by eliminating repetitive identity checks.</p> <p>In scenarios involving contractors or <a href="https://www.techtarget.com/searchsecurity/tip/How-to-build-an-effective-third-party-risk-assessment-framework">third parties</a>, digital identity lets companies use portable, time-bound credentials that simplify access provisioning.</p> <p>With decentralized identity, organizations achieve faster onboarding, lower identity verification costs and reduced fraud risk.</p> </section> <section class="section main-article-chapter" data-menu-title="Where decentralized identity introduces complexity"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Where decentralized identity introduces complexity</h2> <p>As with any technology, decentralized identity introduces overhead and operational complexity. Specific challenges include:</p> <ul class="default-list"> <li><b>Compliance and auditability.</b> Logs and traces are decentralized, increasing the complexity of troubleshooting and evidence collection.</li> <li><b>Access governance gaps.</b> Potential gaps reside around revocation, lifecycle management and policy enforcement.</li> <li><b>Immature standards and vendor fragmentation.</b> Various implementations exist or are under development, creating potential interoperability challenges.</li> <li><b>User responsibility risks.</b> Users might lose wallets or neglect key management, leading to increased support overhead.</li> <li><b>Integration.</b> Integrating decentralized identity with traditional IAM approaches can be challenging.</li> </ul> <p>Decentralized identity redistributes risk and management responsibilities rather than completely eliminating them.</p> <h3>Risk scenarios leaders must anticipate</h3> <p>Potential scenarios that demonstrate decentralized identity risks include:</p> <ul class="default-list"> <li><b>Audit failures.</b> Inability to produce centralized logs for regulators.</li> <li><b>Trust breakdowns.</b> Accepting credentials from untrusted or misaligned issuers.</li> <li><b>User issues.</b> Lost credentials could disrupt access or increase support burdens.</li> <li><b>Fragmentation.</b> Multiple incompatible decentralized identity ecosystems could increase complexity.</li> <li><b>Vendor lock-in.</b> Lack of standards means potential <a href="https://www.techtarget.com/searchdatacenter/definition/vendor-lock-in">vendor lock-in</a> despite decentralized claims.</li> </ul> </section> <section class="section main-article-chapter" data-menu-title="Metrics and benchmarks"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Metrics and benchmarks</h2> <p>IT leaders must be able to justify and measure business outcomes. Use the <a href="https://www.techtarget.com/cybersecurity/tip/10-key-cybersecurity-metrics-and-KPIs-your-board-wants-tracked">following metrics</a> to evaluate decentralized identity implementations:</p> <ul class="default-list"> <li><b>Risk reduction. </b>Decrease in stored personally identifiable information; reduced identity-related breach exposure.</li> </ul> <ul class="default-list"> <li><b>Operational efficiency. </b>Reduced time to onboard partners and users; reduced manual verification steps.</li> <li><b>User experience. </b>Reduced login and verification friction.</li> </ul> <ul class="default-list"> <li><b>Compliance posture. </b>Audit readiness time; evidence collection completeness.</li> </ul> <p>To gather the most accurate measurement of progress and value, establish baselines using these metrics before launching pilot programs.</p> </section> <section class="section main-article-chapter" data-menu-title="Decision framework for leaders"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Decision framework for leaders</h2> <p>Use the decision framework below to determine whether decentralized identity will be an effective approach to identity management.</p> <ul class="default-list"> <li><b>Business fit.</b> Does the organization rely heavily on partner or customer identity flows?</li> <li><b>Risk and regulatory impact.</b> Would decentralized identity reduce liability or complicate audits?</li> <li><b>Architecture readiness.</b> How well will decentralized identity integrate with existing IAM and access controls?</li> <li><b>Vendor and ecosystem risk.</b> Does the decentralized identity software align with open standards and use a mature trust framework?</li> </ul> <p>If these questions indicate decentralized identity is a good fit, begin with contained, high-value use cases to demonstrate value and enable IAM interoperability. Define success metrics -- cost, speed and compliance -- and choose targeted applications that offer measurable outcomes -- such as customer verification or partner onboarding. Align security, legal and business teams early.</p> <p>Decentralized identity is moving from concept to competitive differentiator. Assess the organization's readiness now or risk falling behind as partners, regulators and customers begin to expect more secure, privacy-first identity models.</p> <p><i>Damon Garn owns Cogspinner Coaction and provides freelance IT writing and editing services. He has written multiple CompTIA study guides, including the Linux+, Cloud Essentials+ and Server+ guides, and contributes extensively to Informa TechTarget, The New Stack and CompTIA Blogs.</i></p> </section> Decentralized identity isn't for every organization, but where it's deployed correctly, the methodology yields improved trust, privacy and agility. https://cdn.ttgtmedia.com/rms/onlineimages/check_g1211896141.jpg https://www.techtarget.com/cybersecurity/tip/CISOs-guide-to-decentralized-identity Tue, 18 Aug 2026 12:39:00 GMT <p>Black Hat USA 2026 returns for its 29th year, covering the latest in infosec for CISOs, technical experts, thought leaders, innovative vendors and cybersecurity pros.&nbsp;</p> <p>The two-day main event, taking place August 5-6 at Mandalay Bay in Las Vegas, features more than 200 sessions on topics from cyber-resilience and malware to detection engineering, security culture, privacy, supply chain security and cryptography. And, of course, AI security, LLMs, prompt engineering, promptware, autonomous exploits and AI agents.</p> <p>Four days of specialized trainings, August 1-4, will cover incident response, third-party risk management, AI security for executives, red teaming, adversary tactics and more. This year also marks the return of the CISO Summit, Financial Threat Summit, Innovators &amp; Investors Summit, Omdia Analyst Summit and AI Summit, as well as the inaugural Healthcare Summit, in partnership with HIMSS.</p> <p>Informa TechTarget's editorial team will be on-site, reporting from the conference floor. This guide gathers articles from our reports on TechTarget Cybersecurity, Dark Reading and Cybersecurity Dive.</p> This is your guide to the breaking news, trending topics and more at Black Hat USA 2026, from Dark Reading, Cybersecurity Dive and TechTarget Cybersecurity. https://www.techtarget.com/cybersecurity/conference/Black-Hat-2026-Key-news-takeaways-and-security-trends Tue, 18 Aug 2026 09:00:00 GMT <p>IT leaders often view automated vulnerability scanning as a routine technical safeguard. In reality, it's a controlled operational activity that presents not only a measurable business reward, but also risk.</p> <p>Poorly governed scans degrade system performance, interrupt critical services or expose the organization to legal and regulatory scrutiny. These outcomes directly affect revenue, reputation and resilience.</p> <p>Enterprises that place formal governance guardrails -- defined authorization, precise scope control, operational safeguards and auditable oversight -- around their automated scanning transform the process into a strategic security capability rather than a technical gamble. Established best practices emphasize that security controls must be both effective and accountable.</p> <p>For executive leadership, the question is not <a href="https://www.techtarget.com/cybersecurity/tip/5-ways-to-automate-security-testing-in-DevSecOps">whether to automate</a> vulnerability scanning, but how to operationalize it safely, transparently and in alignment with enterprise risk tolerance.</p> <p>Let's examine how to reframe automated scanning, select targets, create safe scan configurations and manage auditability. The goal is to establish an effective vulnerability scanning framework without disrupting daily operations.</p> <section class="section main-article-chapter" data-menu-title="Reframing automated scanning as a change-inducing activity"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Reframing automated scanning as a change-inducing activity</h2> <p>Operationally, automated network and system vulnerability scanning behaves like a controlled change event. It can drag down network performance for both users and systems by consuming bandwidth, triggering defensive controls and placing a significant load on production systems.</p> <p>In complex automated environments, these effects can cascade -- initiating alerts, automated responses and degrading service levels at a rate that mirrors the impact of configuration changes or <a href="https://www.techtarget.com/cybersecurity/tip/10-enterprise-patch-management-best-practices">patch deployments</a>.</p> <p>Because of this potential effect, automated scanning should follow a governance lifecycle similar to other change-inducing activities. This lifecycle typically includes:</p> <ul class="default-list"> <li>Formal authorization and accountability.</li> <li>Clearly bounded scope.</li> <li>Risk-informed scheduling.</li> <li>Controlled execution.</li> <li>Documented review.</li> </ul> <blockquote class="main-article-pullquote"> <div class="main-article-pullquote-inner"> <figure> For IT leaders, reframing vulnerability scanning shifts it from a background technical function to a managed risk control that aligns with change management discipline, business continuity priorities and enterprise risk tolerance. </figure> <i class="icon" data-icon="z"></i> </div> </blockquote> <p>For IT leaders, reframing vulnerability scanning shifts it from a background technical function to a managed risk control that aligns with change management discipline, business continuity priorities and enterprise risk tolerance.</p> </section> <section class="section main-article-chapter" data-menu-title="Legal and authorization requirements"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Legal and authorization requirements</h2> <p>Formal authorization from system owners is critical to automated scanning. This documentation establishes consent, clarifies accountability and demonstrates due diligence if operational or legal questions surface. Unauthorized scanning can violate contractual terms, spark regulatory scrutiny or be interpreted as malicious access activity that triggers resource-consuming automated defenses.</p> <p>Governance should align scanning practices with established risk and security management principles, among them:</p> <ul class="default-list"> <li>Permitted targets.</li> <li>Timing windows.</li> <li>Approved scanning methods.</li> <li>Operational constraints.</li> <li>Escalation procedures for unexpected impacts.</li> <li>Data handling expectations.</li> </ul> <p>For executive leadership, structured authorization transforms automated scanning from an ad hoc technical practice to a defensible, policy-driven control that supports compliance, protects organizational interests and ensures security activities remain both intentional and accountable.</p> </section> <section class="section main-article-chapter" data-menu-title="Scoping and risk-based target selection"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Scoping and risk-based target selection</h2> <p>The primary mechanism to control risk in automated scanning is effective scoping. Instead of scanning broadly, organizations should define targets based on a verified <a href="https://www.techtarget.com/it-infrastructure/tip/How-to-use-Nmap-to-scan-a-network-for-documentation">asset inventory</a> and business criticality. Specific practices include:</p> <ul class="default-list"> <li>Segmenting and testing production, staging and development environments.</li> <li>Testing customer-facing and mission-critical systems with stricter controls.</li> <li>Using time-bound execution windows to reduce impact by aligning scans with maintenance periods and lower-traffic intervals.</li> <li>Maintaining exclusion lists for fragile or highly sensitive systems that require alternative vulnerability assessment methods.</li> </ul> <p>Risk-based targeting also informs scanning frequency. Internet-facing and high-value systems warrant more frequent assessments, while lower-risk assets can handle longer intervals.</p> <p>Scoping decisions represent explicit risk trade-offs for IT leaders, balancing visibility and assurance against availability and operational stability. Defining the governing scope is a strategic choice rather than a technical task.</p> </section> <section class="section main-article-chapter" data-menu-title="Engineering safe and non-disruptive scan configurations"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Engineering safe and non-disruptive scan configurations</h2> <p>The key to translating governance to operational effectiveness -- and safety -- is disciplined scan configuration. Automated vulnerability scans should minimize system impact through rate limiting, connection throttling and the use of nonintrusive probing techniques where feasible. Load-aware scheduling helps prevent resource contention, and timeout thresholds and automatic pause options can avoid cascading disruption if systems respond unpredictably.</p> <p>Pilot testing in controlled environments provides safe scan parameters, enabling the development of standardized, version-controlled configuration baselines tied to organizational security guidance. Continuous monitoring during execution enables rapid adjustment if unexpected performance patterns emerge.</p> <p>Disciplined configuration management ensures automated scanning functions as a controlled security mechanism rather than an unmanaged technical activity with uncertain operational consequences. This configuration management enables IT leaders to trust a predictable, repeatable scanning process that aligns with <a href="https://www.techtarget.com/data-technologies/definition/business-continuity">business continuity</a> objectives.</p> </section> <section class="section main-article-chapter" data-menu-title="Logging, auditability, and evidence management"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Logging, auditability, and evidence management</h2> <p>Comprehensive logging transforms automated security scanning from a technical activity into an auditable security control. Scans should produce a verifiable record that captures critical data, such as authorization references, scope definition, configuration parameters, execution timestamps and observed operational anomalies.</p> <p>Document result handling processes, including classification, storage locations and access controls for sensitive findings. Centralized log retention supports traceability and enables independent review.</p> <p>For IT leaders, strong auditability demonstrates due diligence, strengthens regulatory defensibility and provides measurable assurance that automated scanning operates within defined policy boundaries and accountability structures.</p> </section> <section class="section main-article-chapter" data-menu-title="Data protection and compliance considerations"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Data protection and compliance considerations</h2> <p>Automated scan outputs often reveal detailed information about network segments, system configurations, exposed services and potential weaknesses -- data that can substantially increase the organization's risk of mishandling. As such, scan results should be classified and governed as sensitive security information.</p> <p>Protection measures include role-based access controls, <a href="https://www.techtarget.com/cybersecurity/feature/How-to-secure-data-at-rest-in-use-and-in-motion">data-in-transit and data-at-rest encryption</a>, defined retention and <a href="https://www.techtarget.com/cybersecurity/tutorial/Using-shred-and-dd-commands-in-Linux-to-securely-wipe-data">disposal</a> schedules, legal and regulatory obligation alignment, and adherence to enterprise compliance frameworks.</p> <p>Disciplined protection of vulnerability data assures IT leaders that security efforts do not inadvertently create new exposure or compliance liabilities.</p> </section> <section class="section main-article-chapter" data-menu-title="Stakeholder coordination and operational integration"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Stakeholder coordination and operational integration</h2> <p>Effective automated scanning depends on coordinated ownership across security, IT ops, legal and compliance, and business system stakeholders. Clear communication protocols should define pre-scan notifications, escalation paths for unexpected impact and structured post-scan reporting.</p> <p>Integrating scanning into <a href="https://www.techtarget.com/it-strategy/definition/change-management">formal change management</a> ensures scheduling, approvals and risk assessments are consistently applied. They also connect scan results to remediation workflows, enterprise risk registers and executive security measures.</p> <p>Cross-functional coordination converts scanning from a siloed technical task into an enterprise control that syncs with business processes, is transparent in execution and accountable for measurable risk reduction.</p> <p>When governed effectively, automated vulnerability scanning delivers outcomes that extend beyond technical assurance. Organizations prevent unmanaged disruptions by gaining predictable risk visibility, stronger regulatory defensibility and improved operational stability.</p> <p>Leadership gains measurable security performance indicators aligned to enterprise risk management objectives. Over time, disciplined scanning practices mature vulnerability management into a repeatable, policy-driven capability that supports resilience, strengthens stakeholder confidence and positions security as a fundamental component of reliable, well-governed operations.</p> <p><i>Damon Garn owns Cogspinner Coaction and provides freelance IT writing and editing services. He has written multiple CompTIA study guides, including the Linux+, Cloud Essentials+ and Server+ guides, and contributes extensively to Informa TechTarget, The New Stack and CompTIA Blogs.</i></p> </section> Scanning the network for vulnerabilities is not just a routine operation. It should be part of a comprehensive security initiative that aligns with risk tolerance. https://cdn.ttgtmedia.com/rms/onlineimages/ransom_g943616820_01.jpg https://www.techtarget.com/cybersecurity/tip/Governance-and-best-practices-for-automating-vulnerability-scans Fri, 14 Aug 2026 16:11:00 GMT <p>A senior cybersecurity staffer from a Fortune 500 organization learned something alarming and unexpected during a recent training session at <a href="https://www.techtarget.com/cybersecurity/conference/Black-Hat-2026-Key-news-takeaways-and-security-trends">Black Hat USA</a>: Because his company's MCP server wasn't secured properly, anyone on the conference's public network could have gained write-access to its EDR system.</p> <p>"'Somebody on hotel Wi-Fi could have host-isolated all of your endpoints across the entire company,'" James Pope, SOC lead for the Black Hat Network Operations Center, said he told the attendee. "'It also looks like your identity was in there. So, we could have locked out every user in the entire org.'"</p> <p>The company had apparently set up the MCP gateway and Claude CLI to manage its security stack, which Black Hat NOC analysts could see included CrowdStrike Falcon, Google SecOps, Optiv and Obsidian tools.</p> <blockquote class="main-article-pullquote"> <div class="main-article-pullquote-inner"> <figure> We could have locked out every user in the entire org. </figure> <figcaption> <strong>James Pope </strong>SOC lead, Black Hat Network Operations Center </figcaption> <i class="icon" data-icon="z"></i> </div> </blockquote> <p>"They were passing their token in the clear," said Bart Stump, managing principal at Coalfire, during a conference session on the NOC's findings. "And it was a write token, so we could have wiped all of [the security stack]. Or, we could have helped them manage it."</p> <p>"'Hi, we're the guys from the NOC,'" joked Neil "Grifter" Wyler, senior network operations lead at Black Hat and vice president of defensive services at Coalfire, who presented with Stump. "'Don't worry, we got this. When we're done, we'll close the door on our way out.'"</p> <p>When Black Hat NOC analysts find a vulnerability or threat on someone's device, they use the IP address to triangulate the device's location to a given conference room, where they then make an impromptu announcement -- never naming names, even when they know them. The team also invites affected users to follow up at the NOC for additional information or support.</p> <p>After Pope made the notification about the MCP server, the user in question approached him to discuss the exposure. He said the MCP server was recently provisioned by his company -- a Fortune 500 organization that Pope declined to identify but described as a household name. Like many major enterprises, he added, the company seems to have moved quickly to <a target="_blank" href="https://www.darkreading.com/cybersecurity-operations/closing-ai-execution-gap-cybersecurity-ciso-framework" rel="noopener">adopt AI for security</a> and inadvertently exposed itself to massive risk in the process.</p> <section class="section main-article-chapter" data-menu-title="As vibe coding takes off, encryption rates fall"> <h2 class="section-title"><i class="icon" data-icon="1"></i>As vibe coding takes off, encryption rates fall</h2> <p>The MCP server incident reflects a broader trend, according to Pope, who is also senior director of security product research and technical marketing engineer at Corelight. While the Black Hat NOC used to see the percentage of conference traffic that was encrypted climb year over year, that number is now declining. Pope pointed to the rise of AI and <a href="https://www.techtarget.com/cybersecurity/tip/Vibe-coding-security-risks-and-how-to-mitigate-them">vibe coding</a>, with many users shipping applications without proper security.</p> <p>"AI and vibe coding are great for people building a lot of interesting, good stuff that's impacting the industry," Pope said. "But it's also a lot of people who don't understand how to secure things -- even at a security conference."</p> <p>As the barrier to entry for vibe coding keeps getting lower, he added, expect to see even less encryption and more risk exposure. While a frontier model could theoretically bake in security by auto-installing TLS in a new application, that would require a certificate authority and a digital certificate -- a level of complexity that vibe coders are often inclined and even incentivized to sidestep. If the proof of concept works on the developer's laptop, the app ships and eventually appears on the Black Hat network in the clear.</p> <p>"They're just like, 'Make the thing -- I don't care,'" Pope said. "It's all vibes and no encryption."</p> <blockquote class="main-article-pullquote"> <div class="main-article-pullquote-inner"> <figure> It's all vibes and no encryption. </figure> <figcaption> <strong>James Pope</strong>SOC lead, Black Hat Network Operations Center </figcaption> <i class="icon" data-icon="z"></i> </div> </blockquote> <p>In another incident at Black Hat, an attendee sitting in a training classroom checked an interior camera feed back at home. The NOC team saw the person's partner and kids in their living room in real time, streaming in the clear. Because the home automation app didn't match any known commercial product, Pope concluded it was likely a DIY vibe-coded project. The NOC team alerted the user, and the traffic fell off.</p> <p>"That's the best thing in my job," Pope said. "They understood, and they reduced their risk."</p> </section> <section class="section main-article-chapter" data-menu-title="Lessons for CISOs from the Black Hat NOC"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Lessons for CISOs from the Black Hat NOC</h2> <p>Pope advised the cybersecurity pro with the <a href="https://www.techtarget.com/searchsecurity/tip/Secure-MCP-servers-to-safeguard-AI-and-corporate-data">vulnerable MCP server</a> to consider gating it behind a VPN and implementing <a href="https://www.techtarget.com/it-infrastructure/definition/OAuth-Open-Authorization">OAuth</a>-based authentication. "And make sure it has some gate for TLS or some encryption where you're not flying that over the wire," he said, adding that the organization's cloud-based EDR tool should also sit behind a VPN.</p> <p>Cybersecurity still hinges on the "unsexy" fundamentals, Pope added. While he used to see large enterprises incorrectly installing VPNs or SASE, inadvertently putting themselves at risk, he said the same pattern is now playing out with <a target="_blank" href="https://www.darkreading.com/vulnerabilities-threats/2000-mcp-servers-security" rel="noopener">MCP servers</a>. His advice to CISOs is simple: Go look.</p> <p>"Validate it," Pope said, adding that network visibility is key, regardless of budget. "[We at] Corelight will tell you, 'Buy our stuff, and we'll help your enterprise scale this up.' But Zeek is open source; it's free. Suricata is free. They could stand it up on a single box, and AI is great at this: 'Docker up Zeke.' Connect this one, connect that one, put your SPAN port, your TAP into it. There's no reason to send 50,000 employees out into the world without checking that. So, go check."</p> <div class="extra-info"> <div class="extra-info-inner"> <h3 class="splash-heading">Other findings from the Black Hat NOC</h3> <p><b>Unsecure security products. </b>The Black Hat NOC found a security log collector transmitting endpoint telemetry in the clear, including patch levels, usernames, roles, devices and sites accessed. In 2025, the NOC noticed another established vendor's endpoint log collector sending data over HTTP instead of HTTPS. In a third incident, a VPN encrypted traffic destinations but leaked GPS data, exposing user locations.</p> <p>"We're saying, 'Fix this for your customers and security people in general. You've got to make this better,'" Pope said, adding that vendors often act on notifications from the Black Hat NOC, but not always. "After multiple years of [a vulnerability] sitting there, sometimes we'll just start dropping companies' names on stage."</p> <p><b>Infected rental laptops.</b> The NOC team alerted a vendor on the expo floor that its rental laptops had malware. Further investigation revealed that the rental company's golden image, which it uses to reset devices before loaning them to new customers, was infected. "They got a supply chain attack somewhere, and they're now shipping this to every person who rents a laptop," Pope said. Fortunately, the vendor in question used only demo credentials in a demo environment on the rented devices, so the malware hadn't spread to production.</p> <p><b>A personal loan application made public. </b>An attendee contacted their bank about a loan application using a SIP-based calling app, with the audio reconstructible off the wire. Multiple other conference participants also used SIP in the clear. "That's just weird," Pope said. "Come on."</p> </div> </div> <p><em>Alissa Irei is senior site editor of TechTarget Cybersecurity.</em></p> </section> A disturbing trend is unfolding on the ground at Black Hat's elite network operations center: As AI takes off, cyber-risk is rising too. Here's what the NOC wants CISOs to know. https://cdn.ttgtmedia.com/visuals/LeMagIT/hero_article/Cybersecurity_search_AdobeStock_1884692525-hero.jpg https://www.techtarget.com/cybersecurity/news/366648755/Black-Hat-NOC-sees-AI-related-security-failures-firsthand Thu, 13 Aug 2026 21:30:00 GMT <p>Behind a guarded door on the second floor of Mandalay Bay in Las Vegas is the Black Hat network operations center. A wall of windows offers passers-by a glimpse into the lives of the security pros who protect the network of one of the world's <a href="https://www.techtarget.com/cybersecurity/conference/Black-Hat-2026-Key-news-takeaways-and-security-trends">biggest cybersecurity conferences</a>.</p> <p>Peek into the dark room and you'll see laptops in orderly rows along tables that line the room's perimeter, and large screens hanging on the walls that flash alerts, charts and other key data. <i>The Creator </i>-- a movie set during a future war between humanity and AI -- plays in the background. The expert crew -- ranging from analysts and threat hunters to engineers and researchers -- diligently monitors alerts to protect a unique network -- one that more than 23,000 attendees connect to, and on which ethical hackers test their newly learned skills.</p> <section class="section main-article-chapter" data-menu-title="The team and its technology"> <h2 class="section-title"><i class="icon" data-icon="1"></i>The team and its technology</h2> <p>When the NOC crew arrives at Mandalay Bay, it takes over the network, replacing every router, switch, firewall and access point with its own technology.</p> <p>"We do that for a couple of reasons," said Neil "Grifter" Wyler, senior network operations lead at Black Hat and vice president of defensive services at Coalfire. "One is that we're control freaks. But it's also that with what happens on the network, if we need to do any type of mitigation, we can't open a support ticket with the team at Mandalay Bay and wait 90 minutes. When something hits the fan -- and it will -- we have to be able to respond immediately."</p> <p>It's no easy task.</p> <p>When Black Hat began more than two decades ago, the NOC consisted of Wyler and two teammates using open source scripts and hardware to secure a show with 1,500 attendees and 15 training classes that maxed out at 20 students each. This year, a team of more than 100 members uses handpicked vendor products -- and many tools of their own creation -- to secure more than 15 times the attendees and more than 100 training classes that now max out at 100 students each.</p> <p>"The show has grown, and we've had to adapt and grow with it," Wyler said. "And obviously, the technologies and the demands have changed as well."</p> <p>It's called the Black Hat NOC because the team's primary goal is to stand up infrastructure, said James Pope, SOC lead for the Black Hat NOC and senior director of security product research and technical marketing engineer at Corelight.</p> <p>"We set up this enterprise network in a very short period of time, and then we switch roles into security. We call it a NOC because if it's not available, then there's really nothing to secure. But once it's available, then we have a lot of eyes on glass and a lot of security functions," he said.</p> <p>Vendors jump at the opportunity to donate their products and NOC staff in exchange for their logo in the program or on the NOC kickboard, Wyler said, enabling the Black Hat NOC to run on pretty much an unlimited budget.</p> <p>According to both Wyler and Pope, the team selects its tools with only one goal in mind: Ensure the conference has the most secure operations possible. "These are not sponsors, they are partners we choose," Wyler said. "You cannot pay your way into the SOC."</p> <p>This year, Palo Alto Networks provided the firewall and an AI-enabled security operations platform that aggregates <a href="https://www.techtarget.com/cybersecurity/definition/What-is-SIEM-security-information-and-event-management">SIEM</a>, <a href="https://www.techtarget.com/cybersecurity/definition/SOAR-security-orchestration-automation-and-response">SOAR</a> and <a href="https://www.techtarget.com/cybersecurity/definition/What-is-extended-detection-and-response-XDR">XDR</a> alerts. Lumen supplied the internet, Arista the switches and access points, and Jamf the <a href="https://www.techtarget.com/searchmobilecomputing/definition/mobile-device-management">MDM</a> software for the tablets and other devices used across the show floor. Cisco provided DNS and file analysis of the data gathered from Corelight's network visibility tools, including its <a href="https://www.techtarget.com/cybersecurity/definition/What-is-network-detection-and-response-NDR">NDR</a> and threat-hunting platform.<i></i></p> </section> <section class="section main-article-chapter" data-menu-title="The challenge of securing the Black Hat NOC"> <h2 class="section-title"><i class="icon" data-icon="1"></i>The challenge of securing the Black Hat NOC</h2> <p>The Black Hat NOC is, in a word, unique. For one, the team receives pretty much unlimited resources, donated by the vendor community, so it doesn't have to worry about budget restraints. But it is also a prime target for some of the world's most elite -- and up-and-coming -- hackers. This year, someone attacked the internal servers within 15 minutes of the network being set up.</p> <p>"The way we explain it to people is that most organizations looking for malicious actors in their environment are looking for a needle in a haystack," Wyler said. "Here at Black Hat, we're looking for a needle in a needle stack."</p> <p>Most of the traffic traversing the network would be considered hostile in any other environment, he explained -- but not at Black Hat. After the show, Wyler told TechTarget Cybersecurity that the team received 285 million informational alerts, which it whittled down to 17.1 million threats. It then blocked 383 of those threats -- the needles in the needle stack.</p> <p>The other threats are what the crew calls "Black Hat positives" -- expected behavior from the training classes held during the show and the presentations held by researchers.</p> <p>Then come the outliers.</p> <p>"That's the key to threat hunting. It's a game of outliers," Wyler said. For example, the NOC might detect a single threat actor trying to exploit the network. The team then zooms in on their activity and pulls available data, such as an IP or MAC address, to build a profile on that individual.</p> <p>"If it is something illegal -- and it does happen, probably at this show a dozen or so times -- we go to the classroom and go, 'Doing illegal things at Black Hat is still illegal' and [the activity] usually stops," he said. If it doesn't stop, the team digs even deeper.</p> <p>"We have a 100% success rate at identifying people on the network based on their traffic and where they work. We take that, tie it into the registration database and often find the individual, so we can just go, 'We can identify you, we can find you if we need to. Again, <i>stop</i>.' And then it stops," he said. "We don't often turn things over to law enforcement because we're like, 'You crazy kids,' and slap them on the ass and send them on their way."</p> </section> <section class="section main-article-chapter" data-menu-title="AI in the NOC"> <h2 class="section-title"><i class="icon" data-icon="1"></i>AI in the NOC</h2> <p>AI was everywhere at Black Hat, and the NOC was no exception.</p> <p>"Everybody's running around going, 'AI, AI, AI," Wyler said. "And we're like, 'That's adorable. We've been using AI for years.'"</p> <p>The team began using machine learning and AI where most security teams do -- <a href="https://www.techtarget.com/cybersecurity/feature/How-AI-threat-detection-is-transforming-enterprise-cybersecurity">alerting</a> -- but soon found it needed more. After evaluating several tools, however, the crew realized most couldn't handle the required loads or respond quickly enough to meet the dynamic needs of Black Hat's network. So the pros developed their own tools.</p> <p>In 2024, for example, they used AI to help create FragglePacket, a Rust-based network diagnostic tool. The team had been running into network issues and no commercially available tool fit the bill.</p> <p>"They just weren't doing everything -- they didn't have the features that we needed. So we're like, screw it, we'll write our own," Wyler said. During this year's show, the team enlisted AI's help to add 71 features to the tool. Now it offers attack path probing, packet <a href="https://www.techtarget.com/cybersecurity/tutorial/Fuzzy-about-fuzz-testing-This-fuzzing-tutorial-will-help">fuzzing</a>, PCAP replay, staged HTTPS analysis and a rule-based diagnosis engine. "At this point, this thing is a full-on network troubleshooting monster. It will go out and just carve through a network and find every place where things are going wrong."</p> <p>The team also uses agents. Trevor, an AI chatbot interfaces with Palo Alto's security operations platform to assist with <a href="https://www.techtarget.com/cybersecurity/tip/What-is-threat-hunting-Key-strategies-explained">threat hunting</a> and <a href="https://www.techtarget.com/cybersecurity/definition/What-is-incident-response-A-complete-guide">incident response</a>. For example, an analyst can query Trevor about an address and it will dig through the logs for information -- saving the team a lot of time.</p> <p>This year, the team introduced NOCgentic, a multiagent LLM platform that routes analyst questions to specialists, queries logs and telemetry, and responds with clear answers and next-step advice. Wyler called it a "user-friendly, hand-holdy" agent that offers level 1 threat hunters a level 3 or level 4 analyst to sit next to and work with.</p> <p>The team also introduced SOCgentic, a version of NOCgentic where "the training wheels are off," according to Wyler. The team nicknamed its SOCgentic front end Postcog, short for Postcognition. It accompanies the Precogs -- sensors that alert the team to problematic behaviors on the network before they happen, a la <i>Minority Report</i>.</p> <p>Wyler added that he and his teammates gave Postcog a comically jaded attitude. "We're working, there's a goal here, but it's also incredibly stressful," he said. "If we can make anybody half-smile, we take it as a win. Analyst burnout and the tedium [of the NOC] is real."</p> <p>"[SOCgentic has] been built and hardened by this environment," Wyler said. "We built our own harnesses. We built our own skills. We trained our own models which, at the end of the show, will go up on Hugging Face." The team has since <a target="_blank" href="https://github.com/bhnoc/NOCgentic" rel="noopener">released</a> NOCgentic on Github.</p> <p>"One of the great things about [Postcog] is that you've designed a tool that works in an environment that should be well beyond anyone's worst day," said Charles Henderson, executive vice president and head of DivisionHex at Coalfire. "It's almost like having a watch for normal wear that's water-resistant to 500 meters. If I ever enter a situation where I need that and I'm not diving 500 meters underwater, I've got much greater concern than my stability."</p> <p>Despite all the agents, the team said <a href="https://www.techtarget.com/ai/feature/Will-AI-replace-cybersecurity-jobs">AI won't replace humans</a> in the NOC.</p> <p>"There's always a human in the loop," Wyler noted, adding that in an environment like Black Hat they need to be able to say no -- especially at an event where Black Hat positives, such as a presenter demoing an exploit, are regular occurrences.</p> <p>Bart Stump, managing principal at Coalfire, said he sees AI as a force multiplier -- "a really good one," he added. "I don't want to replace the people we have. We have really smart people and just [want to] make them more efficient in what they're doing."</p> </section> <section class="section main-article-chapter" data-menu-title="The future Black Hat NOC"> <h2 class="section-title"><i class="icon" data-icon="1"></i>The future Black Hat NOC</h2> <p>While AI-powered threats were the talk of Mandalay, Wyler admitted they are pretty easy to spot -- for now. They are fast, he said, but also loud, not stealthy and usually end up "just kicking everything over."</p> <p>"Our greatest line of defense is the fact that they trip every wire," Wyler said, explaining that AI attacks often get trapped by canaries, honeypots and other <a href="https://www.techtarget.com/cybersecurity/tip/How-cyber-deception-technology-strengthens-enterprise-security">deception technologies</a>, simply because they "don't care."</p> <p>It's only a matter of time until they improve, however, which will likely be a problem for the Black Hat NOC to tackle in 2027. But with nearly unlimited resources and the latest AI tools working alongside some of the brightest minds in the biz, few teams will be better prepared.</p> <p><em>Sharon Shea is executive editor of TechTarget Cybersecurity.</em></p> </section> Step inside Black Hat's guarded NOC, where nearly unlimited threats meet unlimited resources, and security experts battle hackers, deploy custom AI agents and mitigate attacks. https://cdn.ttgtmedia.com/rms/onlineimages/security_a308939347.jpg https://www.techtarget.com/cybersecurity/news/366649216/Behind-the-scenes-at-Black-Hats-network-operations-center Wed, 12 Aug 2026 18:17:00 GMT <p>As security tools like SIEM, SOAR, vulnerability scanning tools and agentic response systems become embedded with AI and LLMs, CISOs face a new and somewhat unfamiliar challenge: budgeting for highly variable, token-based costs.</p> <p>Traditionally, security spending has been largely predictable -- buy a software tool or appliance, purchase a license or subscription, and hire qualified teams to run them. Token consumption, on the other hand, scales with the security tools' needs. Above-average data volume, alert spikes and incident complexity can significantly affect the number of tokens used on any given day.</p> <p>This unpredictability puts CISOs in a difficult position. They want to harness the power of AI to improve triage, conduct <a href="https://www.techtarget.com/cybersecurity/feature/How-AI-threat-detection-is-transforming-enterprise-cybersecurity">deeper investigations</a> and <a href="https://www.techtarget.com/cybersecurity/news/366644163/AI-in-cyberdefense-Learning-from-threat-actors-playbooks">strengthen defenses</a>, but they must also keep a close eye on governance. For many, AI budgeting remains a guessing game. There are, however, some core concepts, estimation techniques, optimization strategies and governance practices CISOs can use to manage AI token costs more effectively.</p> <section class="section main-article-chapter" data-menu-title="Tokens and AI cost models"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Tokens and AI cost models</h2> <p>Many security tools using AI rely on the concept of tokens. A token's data value roughly equates to four characters in the English language. Models consume and track both input and output tokens. Prompts and automations use input tokens, while the generated output or actions generate output tokens. It's important to note that output tokens generated by AI often cost three to five times more than input tokens.</p> <p>Most security AI features sold today rely on pay-per-token methods through cloud APIs, but some cost models are subscription-based with overage charges or committed spend agreements. Regardless of the token method used, security use cases -- including alert triage, incident investigation, vulnerability analysis and <a href="https://www.techtarget.com/cybersecurity/tip/What-agentic-AI-means-for-cybersecurity">security-focused agentic workflows</a> -- can create token usage spikes, making it essential to truly understand token demand for budgeting purposes.</p> </section> <section class="section main-article-chapter" data-menu-title="Managing AI token use"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Managing AI token use</h2> <p>Estimating token use, modeling costs and putting the right guardrails in place are practical steps to eliminate budget risk for any security team.</p> <h3>Estimating token usage</h3> <p>Many AI security companies offer built-in tools to measure typical prompts, alerts and logs, helping customers forecast how many input and output tokens specific workflows will consume. Security vendors also commonly offer prospective customers pilot programs that enable them to run security-focused AI in a portion of their environments and to predict token consumption.</p> <h3>Modeling costs</h3> <p>With an estimate of token usage in hand, the next step is to convert token counts into dollars. Taking estimated averages, including baseline and peak usage, CISOs can get a realistic estimate under normal conditions. Including a buffer in modeling costs can prevent inadvertent depletion of token budgets at the end of the fiscal year. Moving forward, teams should conduct modeling cost estimates at least once or twice a year, using actual consumption data to further refine estimates.</p> <h3>Optimizations and guardrails</h3> <p>Implementing AI in security tools for the first time rarely includes optimization plans or guardrails to protect against unforeseen spikes in token use. Once a tool is in place, however, CISOs should establish processes to reduce token overconsumption. For example:</p> <ul class="default-list"> <li>Ensure <a href="https://www.techtarget.com/ai/tip/Prompt-engineering-tips-for-ChatGPT-and-other-LLMs">prompts are short and well-structured</a>.</li> <li>Categorize tasks and route them to lower-cost models.</li> <li>Enable AI route caching for repeated processes.</li> <li>Create guardrails around maximum output lengths.</li> <li>Standardize high-volume use cases to eliminate repetitive use of AI.</li> <li>Set per-user, per-team and per-workflow usage quotas.</li> <li>Monitor and track cost-per-alert and cost-per-incident data.</li> </ul> <p>By combining realistic estimates, cost modeling and ongoing optimizations with guardrails, CISOs can appropriately budget for AI use and limit the risk of unexpected overruns.</p> </section> <section class="section main-article-chapter" data-menu-title="Best practices for building an AI budget"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Best practices for building an AI budget</h2> <p>Once estimates and controls are in place, the focus shifts to <a href="https://www.techtarget.com/cybersecurity/tip/Cybersecurity-budget-justification-A-guide-for-CISOs">building a realistic budget</a>. Follow these four practices:</p> <ol class="default-list"> <li>Involve the finance team early in the budgeting process so it understands the variability and usage-based behavior of AI token costs.</li> <li>Build a budget by calculating both baseline and peak scenarios.</li> <li>Review and refine budget numbers regularly.</li> <li>Tie the budget to measurable security outcomes and KPIs to <a href="https://www.techtarget.com/cybersecurity/tip/Calculating-the-ROI-of-AI-in-cybersecurity">prove value and ROI</a>.</li> </ol> <p>Following these steps helps convert usage data into a meaningful and defensible budgeting plan.</p> </section> <section class="section main-article-chapter" data-menu-title="Practical tools for token visibility"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Practical tools for token visibility</h2> <p>In addition to the token estimation tools provided by AI and LLM providers, larger enterprises can deploy <a href="https://www.techtarget.com/cybersecurity/tip/Use-an-AI-gateway-to-secure-AI-models-and-applications">one or more AI gateways</a>. These are software-based tools that sit between the security platform and LLM. All AI traffic is routed through the gateways, helping security teams to enforce model routing, enable caching and quotas, and maintain a centralized set of logs. For easy auditing and chargebacks, CISOs can also deploy observability platforms to attribute token spend to specific security tools, workloads or teams.</p> <p>For many in the security world, AI is quickly becoming table stakes within the enterprise security stack. The organizations that get the most value from it will be those that treat token management as an ongoing operational discipline rather than an afterthought. The goal is to use AI to its fullest potential while proving clear value for every dollar spent.</p> <p><i>Andrew Froehlich is founder of InfraMomentum, an enterprise IT research and analyst firm, and president of West Gate Networks, an IT consulting company. He has been involved in enterprise IT for more than 20 years.</i></p> </section> AI tools are transforming cybersecurity, but token-based pricing can be a budgeting nightmare. Learn how CISOs can estimate costs, optimize usage and build realistic AI budgets. https://cdn.ttgtmedia.com/rms/onlineimages/money_g1021600178.jpg https://www.techtarget.com/cybersecurity/tip/AI-budgeting-Estimating-tokens-for-enterprise-cybersecurity Wed, 12 Aug 2026 15:03:00 GMT <p>Cybersecurity decisions now factor into an organization's broader risk and resilience strategy. Implementing microsegmentation is a crucial example of this type of decision-making.</p> <p><a href="https://www.techtarget.com/searchnetworking/definition/microsegmentation">Microsegmentation</a> is an advanced security strategy that employs granular, identity- and context-aware policies to restrict lateral movement, enforce consistent controls across complex hybrid environments and reduce the impact of cyberthreats. It results in a reduced blast radius, faster containment and improved compliance posture. It is also a core enabler of a <a href="https://www.techtarget.com/searchsecurity/definition/zero-trust-model-zero-trust-network">zero-trust strategy</a>.</p> <p>Read on to learn about microsegmentation's lifecycle, including visibility, policy design, enforcement, validation and continuous improvement.</p> <section class="section main-article-chapter" data-menu-title="Why microsegmentation matters now"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Why microsegmentation matters now</h2> <p>The proliferation of incidents involving lateral movement across hybrid attack surfaces makes microsegmentation crucial. The erosion of legacy perimeter-based security models and increasing regulatory pressures add to its importance.</p> <p>Microsegmentation is a <a href="https://www.techtarget.com/searchsecurity/tip/Why-zero-trust-requires-microsegmentation">building block for zero-trust architectures</a> and security stacks, including those that <a href="https://www.techtarget.com/searchSecurity/tip/A-leaders-guide-to-integrating-EDR-SIEM-and-SOAR/">integrate strategies</a> such as identity and access management (<a href="https://www.techtarget.com/searchsecurity/definition/identity-access-management-IAM-system">IAM</a>), endpoint detection and response (<a href="https://www.techtarget.com/searchsecurity/definition/endpoint-detection-and-response-EDR">EDR</a>) and <a href="https://www.techtarget.com/searchsecurity/definition/security-information-and-event-management-SIEM">SIEM</a>. It is no longer optional; it is a critical component of modern security practices.</p> </section> <section class="section main-article-chapter" data-menu-title="Building visibility: Dependencies, data flows and trust boundaries"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Building visibility: Dependencies, data flows and trust boundaries</h2> <p>When implementing microsegmentation, begin by building a foundational approach that addresses visibility. This is more than an infrastructure map; it identifies and places resources in their business context. Use the following practices to understand the existing environment:</p> <ul class="default-list"> <li>Map application dependencies and east-west traffic flows.</li> <li>Identify sensitive data paths and crown-jewel assets.</li> <li><a href="https://www.techtarget.com/searchdatamanagement/definition/data-classification">Classify data</a> based on sensitivity.</li> <li>Define trust boundaries across on-premises, cloud and third-party environments.</li> </ul> <p>Use telemetry, flow mapping and discovery tools to establish a clear, prioritized understanding of what must be protected.</p> </section> <section class="section main-article-chapter" data-menu-title="Designing policies: From insight to enforceable controls"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Designing policies: From insight to enforceable controls</h2> <p>Translate visibility findings into granular, business-aligned policies from which to construct controls. Base these controls on application tiers and workflows; identity -- i.e., users, services and workloads; and data sensitivity and classification.</p> <p>Establish effective controls without over-segmentation or policy sprawl. Policies must reflect business intent and risk tolerance, supporting uptime requirements and operational continuity.</p> </section> <section class="section main-article-chapter" data-menu-title="Identity- and context-aware enforcement"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Identity- and context-aware enforcement</h2> <p>Microsegmentation continues the shift away from network-centric security toward identity- and context-driven controls, enabling it to fit more effectively with zero trust. It incorporates specific signals, including user identity, device posture, location and behavior.</p> <p>These identity and context cues enable consistent policy enforcement across disparate environments, including on-premises systems, hybrid on-premises and cloud architectures, multi-cloud platforms, and containerized and dynamic workloads.</p> <p>Context-driven controls enable centralized policy automation. Microsegmentation also integrates with IAM, EDR and SIEM tools for unified enforcement and reporting.</p> </section> <section class="section main-article-chapter" data-menu-title="Scaling and technology considerations"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Scaling and technology considerations</h2> <p>While microsegmentation's strategies are important, don't overlook the technical considerations. Begin by evaluating the best approach. There are three primary controls:</p> <ul class="default-list"> <li><b>Agent-based.</b> This provides deep workload visibility and enforcement, but generates deployment overhead.</li> <li><b>Network-based.</b> While easier to implement, this is less precise.</li> <li><b>Cloud-native.</b> This integrates with platform services for scalability, but it is limited to cloud environments.</li> </ul> <p>Deployments must address interoperability across legacy and modern environments, as well as hybrid and multi-cloud disparities. The aim is to ensure scalability and flexibility without adding operational complexity that impedes workflows.</p> </section> <section class="section main-article-chapter" data-menu-title="Challenges, performance and change management"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Challenges, performance and change management</h2> <p>Several barriers hinder microsegmentation success. These also affect zero-trust and DevOps, so address them to streamline operations.</p> <p>Common barriers include the following:</p> <ul class="default-list"> <li>Organizational silos, particularly between security and operations.</li> <li><a href="https://www.techtarget.com/searchITOperations/feature/IT-skills-development-strategies-to-close-gaps-in-IT-ops">Skills gaps</a> and resource constraints.</li> <li>Legacy system limitations.</li> <li>Failure to establish stakeholder understanding and buy-in.</li> </ul> <p>Operations practices must manage performance and latency impacts on workflows to minimize disruption. Use a phased rollout approach to accomplish this.</p> <p>Treat microsegmentation as both a technical and organizational transformation.</p> </section> <section class="section main-article-chapter" data-menu-title="Continuous validation, metrics and incident response value"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Continuous validation, metrics and incident response value</h2> <p>Continuously test policies using simulation and modeling to ensure coverage. Red teaming and what-if scenarios measure effectiveness. Validation techniques must detect policy drift, automate compliance checks and analyze attack paths.</p> <p>Collect and analyze the following <a href="https://www.techtarget.com/cybersecurity/tip/7-key-cybersecurity-metrics-for-the-board-and-how-to-present-them">key metrics</a>:</p> <ul class="default-list"> <li>Reduction in attack surface.</li> <li>Mean time to contain.</li> <li>Time to detect anomalous traffic.</li> <li>Percentage of blocked unauthorized <a href="https://www.techtarget.com/cybersecurity/tip/Common-lateral-movement-techniques-and-how-to-prevent-them">lateral-movement attempts</a>.</li> <li>Policy coverage across critical assets.</li> </ul> <p>Microsegmentation's value lies in real-time breach containment and incident response, so focus monitoring and testing on those areas. Its role includes isolating compromised workloads in real time, restricting attack movement to a single segment and enabling faster forensic analysis through segmented logs.</p> <p>Update microsegmentation policies as threats and business needs evolve.</p> </section> <section class="section main-article-chapter" data-menu-title="Governance, compliance and adoption roadmap"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Governance, compliance and adoption roadmap</h2> <p>Any strategic organizational change requires careful management and planning. Use the following roadmap to structure the approach:</p> <ul class="default-list"> <li>Establish clear ownership across the CISO, CIO and platform teams.</li> <li>Assess and prioritize crown-jewel applications, dependencies and risk-based segmentation.</li> <li>Define policy lifecycle management and audit processes.</li> <li>Align with <a href="https://www.techtarget.com/cybersecurity/tip/Top-15-IT-security-frameworks-and-standards-explained">security frameworks</a>, such as NIST, ISO, PCI DSS and HIPAA, that are most relevant based on industry.</li> <li>Adopt a phased approach that begins with high-value assets before expanding across environments.</li> <li>Validate the deployment with simulations, adjusting for accuracy and minimizing disruptions.</li> <li>Scale incrementally using automation and standardized policies.</li> <li>Provide continuous monitoring and improvement validations.</li> <li>Ensure ongoing executive oversight and cross-functional governance.</li> </ul> </section> <section class="section main-article-chapter" data-menu-title="Key takeaways for leaders"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Key takeaways for leaders</h2> <p>Microsegmentation is a continuous program, not a one-time effort. It begins with visibility and continues with automated scaling and validation. Align it with business priorities, risk tolerance and industry requirements, adjusting for diverse deployment environments and workflows. Focus on measurable outcomes: containment speed, reduced exposure and operational resilience.</p> <p>Make microsegmentation a cornerstone of the organization's zero-trust strategy -- align teams, automate enforcement and continuously validate to stay ahead of evolving threats.</p> <p><i>Damon Garn owns Cogspinner Coaction and provides freelance IT writing and editing services. He has written multiple CompTIA study guides, including the Linux+, Cloud Essentials+ and Server+ guides, and contributes extensively to TechTarget Editorial, The New Stack and CompTIA Blogs.</i></p> </section> Perimeter-based security can't meet modern threats. With microsegmentation, defenders improve their awareness, data protection, containment and compliance. https://cdn.ttgtmedia.com/rms/onlineimages/security_a296619547.jpg https://www.techtarget.com/cybersecurity/tip/How-to-adopt-microsegmentation-From-visibility-to-control Tue, 11 Aug 2026 14:50:00 GMT <p>The next big wave of AI adoption is underway as executives across industries plot how to bring agentic AI into their organizations. Many believe agentic AI will remake the workforce, creating an environment where humans and agents work alongside each other to reduce costs, boost productivity and scale services.</p> <p>Agentic AI enables organizations to automate entire workflows, with agents capable of making decisions autonomously to execute complex, multistep processes across multiple digital systems. Some 17% of organizations have already <a href="https://www.gartner.com/en/articles/hype-cycle-for-agentic-ai" target="_blank" rel="noopener">deployed agents</a>, according to the "2026 CIO and Technology Executive Survey" from Gartner, and more than 60% expect to do so within the next two years.</p> <p><a href="https://www.techtarget.com/searchenterpriseai/definition/agentic-AI"></a>But the reality of agentic AI is more complex than a list of anticipated benefits for the organization. It also carries risks, and the technology's autonomy can have consequences that extend far beyond those associated with traditional automation. As agentic AI transforms enterprise operations, analysts at Forrester argue that traditional "block or allow" security models designed for predictable, human-initiated actions are inadequate for autonomous agents that operate at machine speed, make independent decisions and adapt their behavior dynamically. Instead, CISOs must pivot to a "probability of success" approach that continuously assesses risk in real time based on agent behavior, context and potential impact.</p> <p>One emerging option for managing <a></a><a href="https://www.techtarget.com/searchenterpriseai/feature/Security-risks-in-agentic-AI-systems-and-how-to-evaluate-threats">agentic AI risk</a>&nbsp;is the Agentic AI Enterprise Guardrails for Information Security, or <a href="https://www.forrester.com/technology/aegis-framework/" target="_blank" rel="noopener">AEGIS, framework</a> from Forrester Research. AEGIS aims to help organizations deploy agentic AI with reasonable guardrails in place, enabling innovation without recklessly exposing the enterprise to risk. By implementing continuous monitoring, <a href="https://www.techtarget.com/searchsecurity/feature/How-AI-threat-detection-is-transforming-enterprise-cybersecurity">threat detection</a>&nbsp;and adaptive controls, AEGIS can help organizations build resilient AI operations that detect and respond to anomalies before they escalate into crises.</p> <section class="section main-article-chapter" data-menu-title="Agentic AI risks"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Agentic AI risks</h2> <p>Agentic AI significantly expands an organization's <a href="https://www.techtarget.com/searchsecurity/tip/How-to-implement-an-attack-surface-management-program">attack surface</a>, creating more pathways for adversaries to breach enterprise systems and exploit agent behavior. Additionally, agentic AI can lead to cascading failures. As agents execute tasks through multistep workflows across interconnected platforms, they're subject to goal drift or hijacking through manipulated prompts, data inputs or tool permissions. An unintentional error or a maliciously prompted action taken by an agent anywhere along the way can ripple through the connected systems. Depending on the work an agent performs, the consequences can be severe.</p> <p>Few organizations today are prepared to guard against such situations, according to research. Deloitte's 2026 "State of AI in the Enterprise" <a></a><a target="_blank" href="https://www.deloitte.com/content/dam/assets-zone3/us/en/docs/services/consulting/2026/state-of-ai-2026.pdf" rel="noopener">report</a>&nbsp;found that only 21% of organizations had a mature model for governance of autonomous agents. That means they lack clear boundaries for what decisions agents can make, have few or no real-time monitoring systems to track agent behavior and flag anomalies, and have no audit trails to capture the full chain of agent actions.</p> <p>Security leaders acknowledge that traditional cybersecurity architectures, designed for digital systems where humans ultimately execute actions, cannot handle enterprise environments in which AI agents act autonomously.</p> <blockquote class="main-article-pullquote"> <div class="main-article-pullquote-inner"> <figure> AEGIS offers CISOs, CIOs and CTOs a framework for building architectural and operational foundations that enable safe and responsible agentic AI deployments. </figure> <i class="icon" data-icon="z"></i> </div> </blockquote> </section> <section class="section main-article-chapter" data-menu-title="A framework for responsible agentic AI deployment"> <h2 class="section-title"><i class="icon" data-icon="1"></i>A framework for responsible agentic AI deployment</h2> <p>According to Forrester, AEGIS offers CISOs, CIOs and CTOs a framework for building architectural and operational foundations that enable safe and responsible agentic AI deployments. AEGIS hinges on the following principles:</p> <ul class="default-list"> <li><b>Least agency.</b> An agentic AI-specific version of the <a href="https://www.techtarget.com/cybersecurity/definition/What-is-the-principle-of-least-privilege-POLP?amp=1">principle of least privilege</a>, least agency gives AI agents as few capabilities, tools and permissions as possible. While least privilege limits users' ability to access resources, least agency limits agents' ability to make decisions and take action.</li> <li><b>Continuous risk management to maintain trust.</b> Environments where agentic AI has the ongoing ability to make decisions and take action require continuous monitoring of agents, models and data. The goal, according to Forrester, is to provide moment-by-moment assurance that agentic AI deployments are secure.</li> <li><b>Explainable outcomes.</b> Agentic AI makes decisions based on learning, context and intent, rather than static rules. Both people and systems must therefore be able to understand and explain security guardrail outcomes.</li> </ul> <h3>6 domains of the AEGIS framework</h3> <p>The AEGIS framework features the following six domains, which Forrester says organizations should adopt in phases:</p> <ol class="default-list"> <li><b>Governance, risk and compliance.</b> Includes real-time risk and compliance monitoring, automated detection of behavior drift, cross-functional risk mapping and policy-as-code guardrails to enforce machine-executable policies.</li> <li><b>Identity and access management. </b>Calls for <a href="https://www.techtarget.com/cybersecurity/tip/How-to-fix-cybersecuritys-agentic-AI-identity-crisis?amp=1">managing agents as first-class entities</a> with ownership, credentials, lifecycle management and auditability, and to have just-in-time, least-privilege authorization.</li> <li><b>Data security and privacy.</b> Implements <a href="https://www.techtarget.com/searchsecurity/tip/How-to-write-a-data-classification-policy-with-template">unified definitions of sensitive data</a>, purpose-bounded data access, expanded data security posture management, data loss prevention, digital asset management for agent actions and privacy-preserving techniques such as masking, encryption and synthetic data.</li> <li><b>Application security.</b> Includes the use of <a href="https://www.techtarget.com/searchsecurity/tip/Use-AI-threat-modeling-to-mitigate-emerging-attacks">AI-specific threat modeling</a>, rigorous validation of agent-generated code, software bills of materials, AI bills of materials for provenance, secure prompt engineering and continuous observability across the agent lifecycle.</li> <li><b>Threat management.</b> Calls for detailed logging of prompts, actions and reasoning steps, errors; detection for prompt injection, hallucinations and drift; purple teaming for agent behaviors; and automated response playbooks tied to agent actions.</li> <li><b>Zero-trust architecture.</b> Includes microsegmentation, API gateways, privilege and objective constraints, access brokers and network-level containment.</li> </ol> <p>CISOs should note that implementing AEGIS requires specialized expertise in both AI systems and enterprise security architecture. Many enterprises operate hybrid environments with legacy systems that lack modern security capabilities. Integrating AEGIS controls with older infrastructure can be technically complex and could require significant modernization efforts, particularly in areas such as <a href="https://www.techtarget.com/searchsecurity/tip/CISOs-guide-to-privileged-identity-management">identity management</a> and <a href="https://www.techtarget.com/cybersecurity/tip/How-to-implement-zero-trust-for-AI?amp=1">zero-trust</a> architecture. Organizations might need to invest in training or external expertise to execute the framework effectively.</p> <p>The phased long-term implementation timeline also requires sustained organizational commitment and resources. Despite these challenges, AEGIS offers a path forward for organizations serious about deploying agentic AI responsibly. Critically, the framework acknowledges that agentic AI is not simply another application to secure, but a fundamentally new category of enterprise actor requiring purpose-built governance and protection.<br><br><i>Mary K. Pratt is an award-winning freelance journalist with a focus on covering enterprise IT and cybersecurity management.</i></p> </section> Learn how Forrester's AEGIS framework can help organizations securely deploy agentic AI, shifting from static controls to dynamic risk assessment that balances innovation with safety. https://cdn.ttgtmedia.com/rms/onlineimages/ai_a352095729.jpg https://www.techtarget.com/cybersecurity/tip/How-the-AEGIS-framework-mitigates-agentic-AI-risks Wed, 05 Aug 2026 14:50:00 GMT <p>Organizations that take cybersecurity seriously <a href="https://www.techtarget.com/searchsecurity/tip/How-to-perform-a-cybersecurity-risk-assessment-step-by-step">conduct risk assessments</a> to determine policies, practices and controls. Often, however, security teams keep the actual assessments to themselves, with their findings failing to reach a broader audience.</p> <p>"A lot of times things communicated downstream are mistranslated; they get proxied through multiple layers of the organization," said TJ Patterson, vice president and information security officer at STAR Financial Bank. "It's like the telephone game."</p> <p>When stakeholders on the business side never learn <a href="https://www.techtarget.com/searchsecurity/feature/Why-effective-cybersecurity-is-important-for-businesses">why security policies and controls exist</a>, they see them as barriers to getting work done and take them less seriously. The result is often compliance failures and distrust of the security function.</p> <p>That adds up to a significant missed opportunity, according to Patterson, who uses risk assessments to inform, drive and maintain the cybersecurity culture in his CISO role. Success, he said, lies in effectively framing and communicating risk assessments, translating them into business language and metrics, and reinforcing security-aligned behavior over time.</p> <p>"The controls within a risk assessment are what people feel," Patterson said. And their feelings, whether positive, negative or ambivalent, ultimately drive security outcomes.</p> <section class="section main-article-chapter" data-menu-title="How to use a risk assessment to drive cultural change"> <h2 class="section-title"><i class="icon" data-icon="1"></i>How to use a risk assessment to drive cultural change</h2> <p>"Cybersecurity has historically been seen as a compliance, check-the-box exercise," said Lauren Craig, associate partner at McKinsey's Cyber and Technology practice. "That's created a culture where everyone thinks that security does its own thing in a silo, [when it's] very much a shared responsibility."</p> <p>As a security executive, Patterson uses risk assessments to <a href="https://www.techtarget.com/searchsecurity/tip/Enterprise-risk-management-should-inform-cyber-risk-strategies">reframe cyber-risk as business risk</a> and <a href="https://www.techtarget.com/searchsecurity/tip/5-tips-for-building-a-cybersecurity-culture-at-your-company">improve internal cybersecurity culture</a>. To do this, he recommended CISOs consider the following best practices.</p> <h3>Take the security culture's temperature</h3> <p>To understand their organizations' baseline security cultures, CISOs and their teams must do some legwork. Get out and speak with people in different areas of the organization, Patterson said, whether in structured interviews or ad hoc chats.</p> <p>Ideally, added Lance Spitzner, director of Workforce Cybersecurity Training at SANS Institute, security teams also periodically conduct formal, large-scale surveys to understand how the workforce thinks and feels about security at a macro level.</p> <h3>Sell business stakeholders on the risk assessment</h3> <p>Communicate to stakeholders how cyber-risks and mitigations directly affect their areas of responsibility and their ability to achieve their goals. Patterson suggested using real-world anecdotes to show why non-security professionals should care about security controls. "I will find examples where someone managed risk in a healthy way, and I will find examples where they didn't," he added.</p> <p>CISOs should also keep key business leaders, such as the CIO and chief risk officer, in the loop during and after an assessment, according to Craig. "Transparency throughout is key [to maintaining leadership buy-in], so it's not, 'Hey, we did a lot of preparation and never heard the response,'" she said.</p> <h3>Tie cyber-risk messaging to business consequences</h3> <p>Cybersecurity jargon can alienate users and make the security team seem out of touch, Craig cautioned. <a href="https://www.techtarget.com/searchsecurity/opinion/Cyber-risk-management-remains-challenging">Frame cyber-risk in terms of business consequences</a> to show that "it's not just an assessment for the assessment's sake."</p> <p>Similarly, she added, <a target="_blank" href="https://www.darkreading.com/cyber-risk/are-we-prioritizing-wrong-security-metrics" rel="noopener">raw security metrics typically mean little</a> to those on the business side who lack the context to interpret them. Say, for example, a risk assessment shows that an organization has 10,000 unpatched vulnerabilities. A sales executive likely doesn't know -- or care -- if that number is relatively low or high, inconsequential or catastrophic. What matters to business leaders is how those vulnerabilities could affect the bottom line.</p> <p>"People do not understand the 'why.' If you can explain the why in their terms and how it benefits them, they are far more likely to buy in," Spitzner agreed. "Where possible, we want to make security as simple as possible. The more motivated people are, and the easier the security expectations are, the more likely change happens."</p> <h3>Repeat security messaging</h3> <p>Security leaders often establish guardrails based on risk assessments and then leave department managers to communicate them down the ranks. This is not enough to make behavioral changes stick. People need to hear messaging repeatedly and in a productive, positive way.</p> <p>Patterson, for example, hosts periodic lunch-and-learn sessions and other internal presentations that build on what managers have told their teams. "Then the dots start to connect," he said. "Now they're hearing a message reinforced by me that they may have heard from a proxy before. It's a lot of rinse and repeat from the leadership perspective, trying to push the [cybersecurity] culture."</p> <h3>Be accessible, approachable and adaptable</h3> <p>Patterson said he makes a point of regularly getting out and talking to people beyond his immediate department. "They see the human behind all this security. They start to recognize it's more than just technology," he said. "There are humans actually trying to solve and manage this risk."</p> <p>Patterson said informal banter and relationship-building with employees has led them to alert him to suspicious cyberactivity. "That wouldn't have been possible had I not gone out into the organization and talked with folks," he added.</p> <h3>Treat guardrail failures as a business problem, not a people problem</h3> <p>Don't automatically punish employees for improper responses to controls. Instead, use those incidents as learning opportunities for both end users and the security team, referring back to the risk assessment.</p> <p>If possible, uncover failures preemptively and drive home business impacts through regular simulations. "Related to risk assessments are things like tabletop simulation exercises that help to make the risk real," Craig said. Include key business stakeholders who heavily influence organizational culture.</p> <h3>Reward positive security behavior</h3> <p>Phishing controls are the most visible to rank-and-file users and therefore the most likely to create widespread positive or negative feelings toward cybersecurity, according to Patterson. With that in mind, he pays particular attention to them in risk assessments.</p> <p>"I may find ways to enhance them so employees have a better experience [when they see the controls]," he said. For example, he might ensure users who report a potential phishing email receive a thank-you message from the security team. Conversely, failing to respond to users who properly report suspicious activities can discourage them from doing so again.</p> <p>In addition to acknowledging individual contributions, celebrate security wins with the entire organization. Show how risk decreases as security culture improves by linking <a href="https://www.techtarget.com/searchsecurity/tip/Meaningful-metrics-demonstrate-the-value-of-cyber-resiliency">key metrics</a> -- e.g., higher reporting rates and lower incident rates, attacker dwell times and policy violations -- directly to business outcomes.</p> <div class="extra-info"> <div class="extra-info-inner"> <h3 class="splash-heading">Challenges to establishing a cybersecurity culture</h3> <p>Effective risk assessments and follow-on efforts to gain organizational buy-in always start at the executive level. If management and the board don't fully support the effort, it will be harder to get other stakeholders to take security seriously.</p> <p>A CISO might get pushback because the organization has cyber insurance or has never had a breach -- creating the perception of minimal cyber-risk. In that case, the CISO must explain that past performance is not an indicator of future resilience. "I've never been in a car accident, but I still wear a seatbelt," Craig said.</p> <p>At the employee and management level, CISOs will always have to grapple with people who, for whatever reason, don't want to adhere to security controls or policies. Patterson said he addresses these issues at the individual level but sometimes enlists help.</p> <p>"I'll hear people complain about [a control], and that's where I'll find folks in their teams," he added. "If I can build a rapport with one person, that's usually enough to get the buy-in I need."</p> <p>A security team's internal attitudes and culture can also pose a challenge if practitioners lose sight of the forest for the trees. "Sometimes cybersecurity professionals get caught up in 'don't click on this' or 'you need this piece of software to protect your environment,'" Patterson said. "It's very important for cybersecurity leaders to remember that we are in the risk management business and the people business, not just these individual technologies."</p> <p>Perhaps the biggest challenge to establishing a cybersecurity culture is time, Spitzner said. "To influence and build a strong security culture takes years as you are changing the shared attitudes, perceptions and beliefs of your organization globally," he said. "The biggest influencers of your culture include leadership, your security team, your security policies and your security training. All of these have to work together to help influence that change."</p> </div> </div> </section> A strong security culture requires that executives and rank-and-file users understand why controls exist. A risk assessment can be a powerful tool for winning hearts and minds. https://cdn.ttgtmedia.com/rms/onlineimages/security_a375027496.jpg https://www.techtarget.com/cybersecurity/feature/How-CISOs-can-use-risk-assessments-to-drive-security-culture Tue, 04 Aug 2026 16:25:00 GMT <p>Microsoft made a couple of significant announcements that are worth watching: Project Perception, which provides a multi-agent approach to cybersecurity, and a custom model for security tasks that changes the cost curve for AI-driven security.</p> <p>Project Perception is an agentic security system that brings together DevOps and SecOps to continuously identify, evaluate, mitigate and respond to security vulnerabilities. Merging these with <a href="https://www.techtarget.com/searchitoperations/feature/5-DevSecOps-best-practices-to-prioritize">DevSecOps practices</a> should optimize remediation efficiency, taking big chunks of risk off the table. The DevSecOps approach enables the SecOps team to identify vulnerabilities and take mitigation actions -- deploying detection for vulnerability exploitation, virtual patching to mitigate, etc. -- while DevOps achieves visibility to understand the vulnerability and implement a permanent fix. Perception provides a unified approach with different surfaces for different teams. At an analyst roundtable event in San Francisco, Hayete Gallot, executive vice president at Microsoft Security, indicated that the multi-agent approach could be applied to other cybersecurity problems.</p> <p>A subtext of the Microsoft announcement was affordability with a multimodel approach to AI. Some tasks need a frontier model while other tasks can use something cheaper. And Microsoft provided some benchmarking substantiation.</p> <p>Microsoft <a target="_blank" href="https://microsoft.ai/news/introducing-mai-cyber-1-flash-inside-mdash/" rel="noopener">unveiled</a> MAI-Cyber-1-Flash, a cybersecurity-specialized AI model designed for software vulnerability analysis inside MDASH, Microsoft's multi-agent vulnerability identification and remediation harness. MAI-Cyber-1-Flash<b> </b>shone in the CyberGym benchmark compared to Gemini, GPT and Mythos, but the big news was its cost-effectiveness. Microsoft pointed to MAI-Cyber-1-Flash within MDASH costing 50% of leading models.</p> <p>The Microsoft announcements dovetail with <a target="_blank" href="https://research.esg-global.com/aim/en/reports/515202226" rel="noopener">research</a> from Omdia, a division of Informa TechTarget. In "The Dream is Real: An Autonomous Security Operations Center is Within Reach," published in July, we found that the biggest expected benefits from AI investments in SecOps were improved overall security posture (18%) and <a href="https://www.techtarget.com/searchsecurity/feature/How-AI-driven-SOC-tech-eased-alert-fatigue-Case-study">freeing up staff</a> for more proactive security functions (18%).</p> <p>Pricing for Perception, which enters public preview this week, has not been announced. Microsoft indicated the pricing would be based on consumption, which scales with the value provided. The company has its persistent eye on the AI affordability challenge -- the <a href="https://www.techtarget.com/searchcio/feature/finops-for-ai-how-cios-are-navigating-tokenomics"><i>tokenomics</i></a> -- with the multimodel approach, and I expect there will be an ongoing focus on delivering optimal price and performance.</p> <p><em>Todd Thiemann is a senior analyst covering identity access management and data security for Omdia. He has more than 20 years of experience in cybersecurity marketing and strategy.</em></p> <p><em>Omdia is a division of Informa TechTarget. Its analysts have business relationships with technology vendors.</em></p> With Project Perception, Microsoft offers a multi-agent path for finding and fixing vulnerabilities. And the company has ideas on containing AI security costs. https://cdn.ttgtmedia.com/rms/onlineimages/security_g1192070289.jpg https://www.techtarget.com/cybersecurity/opinion/Microsoft-Perception-Adding-agents-and-retooling-AIs-costs Tue, 04 Aug 2026 14:31:00 GMT <p>Organizations must rethink long-held assumptions about patch management and change how they prioritize, remediate and manage cyber-risk, especially in the age of AI.</p> <p>Since 2019, the average time between vulnerability disclosure and confirmed exploitation has <a target="_blank" href="https://www.sans.org/press/announcements/emergency-strategy-briefing-ai-driven-vulnerability-discovery-compresses-exploit-timelines" rel="noopener">collapsed</a> from months and weeks to mere hours. CISOs and their teams have far less time to assess risk, prioritize remediation and protect critical assets. CVSS scores, never a great measure of real-world risk on their own, are even less meaningful without additional metrics such as exploitability and asset criticality.</p> <section class="section main-article-chapter" data-menu-title="More than just patch deployment"> <h2 class="section-title"><i class="icon" data-icon="1"></i>More than just patch deployment</h2> <p>Today, vulnerability management is less about <a href="https://www.techtarget.com/searchenterprisedesktop/definition/patch-management">simply deploying patches</a> and more about continuously identifying and reducing the exposures attackers are most likely to exploit.</p> <p>"Organizations should stop treating vulnerability management as a closed loop ending in a patch," said Nicole Carignan, senior vice president of security and AI strategy and field CISO at Darktrace.</p> <p>Instead, security leaders must prioritize their responses based on exploitability, exposure, asset criticality and the organization's ability to detect and&nbsp;contain&nbsp;exploitation if patching is delayed. "They need to know where they are exposed, what normal behavior looks like, whether they can&nbsp;identify&nbsp;out-of-place activity and autonomously respond or&nbsp;contain it&nbsp;before it becomes a larger incident," she said.</p> </section> <section class="section main-article-chapter" data-menu-title="Follow the feds"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Follow the feds</h2> <p>The shift is already underway within U.S. federal civilian executive branch agencies. CISA recently issued <a href="https://www.techtarget.com/searchsecurity/news/366644336/What-CISAs-new-remediation-directive-means-for-CISOs">binding operational directive 26-04</a> as a response to new challenges stemming from AI-driven vulnerability discovery and exploit development. The ruling effectively replaces traditional severity-driven patch management with a risk-based model that requires agencies to consider factors such as active exploitation, internet exposure, exploit automation potential and attack impact.</p> <p>The directive also requires agencies to remediate the highest-risk vulnerabilities within three days; lower-priority threats can be deferred. Significantly, as part of the mandate, federal agencies must conduct a full forensic triage after remediating high-priority vulnerabilities to determine whether their systems are already compromised.</p> <p>The directive reflects a broader recognition that technical severity alone is no longer an adequate guide for remediation decisions. Instead, organizations increasingly need to weigh a vulnerability's likelihood of exploitation alongside the potential operational and <a href="https://www.techtarget.com/searchsecurity/feature/Why-effective-cybersecurity-is-important-for-businesses">business impact</a> of a successful attack.</p> </section> <section class="section main-article-chapter" data-menu-title="Put CVSS in context"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Put CVSS in context</h2> <p>Even as vulnerability management tactics evolve, CVSS can still help companies prioritize risk initially, said Jeffrey Wheatman, senior vice president and cyber-risk strategist at Black Kite. But additional context will be vital, especially metrics such as the likelihood that a vulnerability will be exploited in the next 30 days -- as measured by the <a href="https://www.techtarget.com/searchsecurity/opinion/Key-capabilities-for-effective-cyber-risk-management">Exploit Prediction Scoring System</a>. When making patching decisions, organizations need to gather context about the potential operational and financial impact of a specific vulnerability in their environment.</p> <blockquote class="main-article-pullquote"> <div class="main-article-pullquote-inner"> <figure> Architect your program as patch intelligence, not patch management. </figure> <figcaption> <strong>Jeffrey Wheatman, senior vice president and cyber-risk strategist, Black Kite</strong> </figcaption> <i class="icon" data-icon="z"></i> </div> </blockquote> <p>Given the sheer velocity of AI-driven vulnerability discovery, organizations should shift from a "patch it all" mentality to a "patch what can cause damage right now" approach, Wheatman said. "Create remediation tiers with appropriate targets, not one giant patching list."</p> <p>Business risk is paramount. Companies should focus on that before considering severity or technical risk, he said, adding that organizations should supplement patching with other mitigation measures such as disabling vulnerable features, blocking exploit pathways, rotating credentials and monitoring data access. "Architect your program as patch intelligence, not patch management," he said.</p> <p>Jeff Williams, founder and CTO of Contrast Security, advises security leaders to invest in their abilities to quickly answer questions around how vulnerable components are deployed, configured, invoked and exposed in their production environment. That data, he said, is often far more valuable than a generic CVSS score designed to apply equally to all organizations.</p> <p>"Organizations were never supposed to stop at the base score of a CVE," said Williams, who is also a co-founder of OWASP. "The real value comes from combining technical severity with threat intelligence, environmental context and business impact. In an AI-driven threat environment, that full picture matters more than ever."</p> <p>Once those details are realized, Williams said, the second step is to reduce the inflow by eliminating vulnerability backlog and improving secure development practices. And the third step is to assume vulnerabilities will exist and deploy runtime protections that prevent exploitation while remediation is underway.</p> </section> <section class="section main-article-chapter" data-menu-title="Focus on behavioral analytics"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Focus on behavioral analytics</h2> <p>Detection and mitigation models that rely on known attack signatures or previously observed exploit techniques have long been insufficient and will become even less effective in the AI era. AI enables attackers to rapidly <a href="https://www.techtarget.com/searchsecurity/tip/How-AI-malware-works-and-how-to-defend-against-it">generate novel payloads</a> and variations far faster than detections and signatures can be developed to keep pace.</p> <p>In response, organizations must rely far more heavily on behavioral detection approaches that identify deviations from expected system and user activity. This includes monitoring for unusual authentication patterns, abnormal process behavior and anomalous data access flows that might indicate compromise even when no known signature or exploit pattern exists. Compensating controls, including network segmentation and tighter enforcement of <a href="https://www.techtarget.com/searchsecurity/answer/Compare-zero-trust-vs-the-principle-of-least-privilege">least-privilege access</a>, should become a primary layer of defense rather than a temporary fallback when vulnerabilities cannot be patched quickly enough. These techniques, which also include token and credential scoping and application-level allowlisting, aren't new, but they are quickly becoming indispensable.</p> <p>"Organizations need to invest in scaled visibility, behavioral analytics, anomaly detection, autonomous investigation and autonomous containment across endpoints,&nbsp;network,&nbsp;cloud, identities, SaaS and critical infrastructure," Darktrace's Carignan said.</p> <p>To that end, defenders must shift away from traditional approaches and move toward those that identify&nbsp;anomalous behavior. Organizations these days are defending against a lot more than just software flaws. Identity and credential theft, human error, <a href="https://www.techtarget.com/searchsecurity/feature/Agentic-AIs-role-in-amplifying-and-creating-insider-risks">insider threats</a>, misconfigurations, misuse of AI tools and AI systems that introduce new&nbsp;risk&nbsp;all&nbsp;must&nbsp;be part of the security model.</p> <p>"If a system cannot be patched quickly, the organization still needs to detect attempted exploitation and contain it at machine speed," Carignan said.</p> </section> <section class="section main-article-chapter" data-menu-title="Continuous vulnerability management"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Continuous vulnerability management</h2> <p>Douglas José Pereira dos Santos, senior director of advanced threat intelligence at FortiGuard Labs, said organizations must stop thinking about patch management as a discrete operational cycle and instead focus on continually managing vulnerability exposure.</p> <p>Getting there requires several structural shifts, he said. Remediation SLAs, for example, should be built on layered risk signals that include exploitation likelihood, asset exposure and business impact. Threat intelligence needs to be part of the triage decision the moment a vulnerability enters the queue and not a separate enrichment step that occurs later in a different part of the organization. Similarly, compensating controls need to be treated as formal, documented risk mitigation mechanisms rather than informal workarounds.</p> <p>"The operational shift required is from prevention as the primary control to resilience as the underlying design principle," dos Santos said. At the same time, organizations must assume some exploitation will occur and engineer their environments to detect and contain attacks rapidly.</p> <p><i>Jaikumar Vijayan is a freelance technology journalist with more than 20 years of award-winning experience in IT trade journalism, specializing in information security, data privacy and cybersecurity topics.</i></p> </section> AI accelerates exploit timelines from months to hours. Organizations must shift from patch-all to risk-based prioritization using exploitability metrics. https://cdn.ttgtmedia.com/rms/onlineimages/clock-time19.jpg https://www.techtarget.com/cybersecurity/feature/Vulnerability-management-needs-an-update-for-the-AI-era Wed, 29 Jul 2026 18:26:00 GMT <p>Cybersecurity executives are already familiar with the idea of phishing prevention. For years, CISOs have trained staff to be suspicious of and resistant to old-school social engineering attacks, in which attackers use fake emails or texts that seem to come from executives, managers, vendors, partners or customers. Some organizations use security awareness training tools or services that run simulated phishing attacks to identify weaknesses in training materials and users who need further training.</p> <p>With the steady spread of AI tools through every part of the cybercrime marketplace, some social engineering campaigns now include voice and video, which humans are predisposed to trust. Generative AI helps malicious actors craft deepfake phishing attacks, <a href="https://www.techtarget.com/searchsecurity/tip/Real-world-AI-voice-cloning-attack-A-red-teaming-case-study">using the cloned voices</a> and synthetic images of company executives or even employees' direct managers or peers.</p> <p>Phishing simulation tools are leveling up accordingly, incorporating AI deepfakes to probe organizational resistance to state-of-the-art social engineering across multiple channels. With these tools, security teams can <a href="https://www.techtarget.com/searchcio/tip/How-executives-can-counter-AI-impersonation">impersonate executives in deepfake voice</a> or video messages or even converse with staff in real time on audio or video calls, perhaps demanding they change a password or permission setting or authorize a financial transaction.</p> <section class="section main-article-chapter" data-menu-title="Is deepfake phishing simulation software worth it?"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Is deepfake phishing simulation software worth it?</h2> <p>As in all cybersecurity decisions, <a href="https://www.techtarget.com/searchsecurity/tip/5-ways-to-achieve-a-risk-based-security-strategy">CISOs need to weigh risk and cost</a> in deciding whether to deploy deepfake-capable phishing simulations.</p> <p>These kinds of tools typically come at significant cost. A CISO must weigh that cost against the organization's potential losses if a staff member falls victim to social engineering, and the likelihood of that happening. Imagine just one person responds to, say, an urgent phone call purportedly from the CIO with instructions to isolate an entire data center from the rest of the enterprise. If that would drive losses of hundreds of thousands or millions of dollars, or create existential operational risk, then better hardening against social engineering is probably justifiable. Other risks, such as leakage of personally identifiable information or confidential intellectual property, might also justify the expense.</p> <p>A CISO should factor another sort of vulnerability into the calculation, too: the availability of raw materials needed to generate deepfakes. If executives, leaders or subject matter experts in the company have appeared in public at live events or on podcasts or webinars, and video or audio of those appearances is readily available on YouTube or the like, then overall risk increases. That CEO's TED Talk, that CTO's MWC (formerly Mobile World Congress) keynote, that CISO's RSAC conference session -- any could be turned into deepfake fodder.</p> <p>One way to gauge the true level of vulnerability in the organization is, of course, to test using a reputable <a href="https://www.techtarget.com/searchsecurity/tip/Prepare-for-deepfake-phishing-attacks-in-the-enterprise">deepfake phishing</a> simulation tool on a short-term contract. Some vendors even offer trial versions, fully expecting their offerings to successfully fool prospective customers' staff and thereby prove their value.</p> <div class="extra-info"> <div class="extra-info-inner"> <h3 class="splash-heading">Deepfake phishing simulations: Metrics beyond clicks</h3> <p>Just by identifying which kinds of attacks get an employee to do the wrong thing -- click a link, change a setting, whatever -- phishing simulation tools identify where training needs improvement, processes need tightening and staff -- both individually and by department or role -- need more training.</p> <p>These tools might also offer additional insights, such as how many users who avoided the phishing attempt also reported it and how long it took them to do so. The more data cybersecurity teams have, the more targeted and meaningful their proactive efforts in training and in process and behavioral hardening can be.</p> <p>With deepfakes, new levels of testing and reporting are possible. Are staff more susceptible to pleas or threats? To emergencies or tedium? How much does tone of voice change response rates? What about the gender and appearance of the faked person? CISOs, equipped with all kinds of additional data about what their users are susceptible to, can tailor training and hardening initiatives accordingly.</p> </div> </div> </section> <section class="section main-article-chapter" data-menu-title="What to look for in deepfake phishing simulation software"> <h2 class="section-title"><i class="icon" data-icon="1"></i>What to look for in deepfake phishing simulation software</h2> <p>When evaluating deepfake phishing simulation software, CISOs should consider whether offerings have the following capabilities:</p> <ul class="default-list"> <li>Ability to create realistic deepfakes in the platform.</li> <li>Ability to <a href="https://www.techtarget.com/searchsecurity/post/How-attackers-use-open-source-intelligence-against-enterprises">seek material for deepfakes on public sources</a>, also known as open source intelligence (OSINT).</li> <li>Ability to use real-time voice conversations with a cloned voice as part of an attack simulation.</li> <li>Ability to use real-time, two-way video with a deepfake image <i>and </i>cloned voice in a simulation.</li> <li>Ability to drive multichannel attacks -- e.g. using voice calling and SMS, or email and video conferencing.</li> </ul> <p>It is also important to assess the tool's integration capabilities with other phishing simulation tools and phishing training packages, as well as the ease of running both broad attack simulations and spear phishing campaigns aimed at specific individuals.</p> <p>Additionally, consider if there is a learning curve for advanced functionality. Also evaluate if the tool supports all the languages the company uses for business and supports all the compliance regimes the company operates under.</p> </section> <section class="section main-article-chapter" data-menu-title="Deepfake phishing simulation providers"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Deepfake phishing simulation providers</h2> <p>As is typical in the cybersecurity market, deepfake phishing simulation providers currently include a fresh crop of startups focused sharply on the leading edge of the threat space -- in this case, the addition of AI-powered deepfakes -- and a smaller set of incumbents. Additional <a href="https://www.techtarget.com/searchsecurity/tip/Cybersecurity-employee-training-How-to-build-a-solid-plan">security awareness training</a> incumbents are likely figuring out which startups to merge with or acquire.</p> <p>The following offerings, listed alphabetically, provide CISOs with insight into the current deepfake phishing simulation software market.</p> <p><b>Editor's note:</b><i>&nbsp;The author selected these tools based on market research, prioritizing offerings that have sizable customer bases, relevant features and distinguishing characteristics.</i></p> <ul class="default-list"> <li><b>Adaptive Security. </b>Creates deepfake video and audio simulations, built from public OSINT. Enables multichannel simulated attacks across email, voice, SMS and chat. Serves many verticals, including hospitality, healthcare and education.</li> <li><b>Breacher.ai.</b> Launches orchestrated, multistage attack chains with coordinated OSINT-based campaigns across channels, including deepfake videos and voice cloning. Adapts in real time based on the target's response, mirroring adversaries' behavior and stress-testing enterprise defenses.</li> <li><b>Brightside.</b> Provides phone-based social engineering attacks with live, conversational AI calls that use custom voice cloning. Runs hybrid vishing and email phishing campaigns, powered by OSINT.</li> <li><b>Hoxhunt.</b> Supports creation of deepfake audio and video for use in multichannel simulated attacks. Pre-scripted exchanges are designed to appear real time -- using the pretext of poor connectivity to explain lagging and glitching effects -- but don't support open-ended chatting. Uses fake, look-alike versions of Zoom, Microsoft Teams and Google Meet apps to contain the experience. A user who falls for the deepfake receives instant micro-training.</li> <li><b>KnowBe4. </b>Longtime security awareness training provider introduced its Deepfake Training Content Agent in 2026. Supports audio and video uploads from consenting insiders, such as executives, to generate deepfakes. As of this writing, however, KnowBe4's published documentation does not describe support for real-time, two-way voice conversations, which is where the most novel threats currently lie.</li> </ul> <p>As always, CISOs should assess vendors' strengths across verticals and geographies. Consider also their overall financial stability, especially if they are still venture-funded.</p> <p><em>John Burke is CTO and a research analyst at Nemertes Research. Burke joined Nemertes in 2005 with nearly two decades of technology experience. He has worked at all levels of IT, including as an end-user support specialist, programmer, system administrator, database specialist, network administrator, network architect and systems architect.</em></p> </section> Deepfake phishing simulation software uses AI to probe organizational resistance to state-of-the-art social engineering attacks. Learn why they should be on CISOs' radar. https://cdn.ttgtmedia.com/visuals/German/Hero-Email-Sicherheit-Phishing-Adobe-V-madedee-03.jpg https://www.techtarget.com/cybersecurity/tip/What-to-know-about-deepfake-phishing-simulation-software Wed, 29 Jul 2026 17:42:00 GMT <p>Organizations today generate, process and share more sensitive information than at any other point in history. Customer records, financial transactions, healthcare information, intellectual property, employee data, operational telemetry and AI training data sets routinely move across cloud platforms, SaaS applications, development environments, analytics pipelines and third-party ecosystems. While encryption has long been a foundational security control for protecting information at rest and in transit, it offers limited protection for data that is actively being processed. There's an increasing need for data security controls that help data to retain business value while reducing the likelihood that sensitive information will be exposed to unauthorized users.</p> <p>Data obfuscation tools and controls transform sensitive information into a form that is unreadable, deidentified, substituted and significantly less valuable to an attacker while preserving its usefulness for authorized business activities. Unlike encryption, which focuses on confidentiality until data is decrypted, obfuscation enables organizations to develop, test, analyze, share and process information without unnecessarily exposing production data.</p> <p>CISOs should no longer view data obfuscation as a niche compliance capability. It is a practical risk reduction strategy that supports <a href="https://www.techtarget.com/searchsecurity/feature/How-to-implement-zero-trust-security-from-people-who-did-it">zero trust</a>, privacy by design, cloud transformation, AI adoption and third-party risk management.</p> <section class="section main-article-chapter" data-menu-title="Data obfuscation drivers and use cases"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Data obfuscation drivers and use cases</h2> <p>Organizations frequently need to share data with individuals or systems that don't require access to the original values. For example, software developers might need realistic test data, while data scientists need production-like data sets to develop machine learning and other models, and vendors require access to customer information for support. Other common enterprise use cases include:</p> <ul class="default-list"> <li>Software QA.</li> <li>Third-party software support.</li> <li><a href="https://www.techtarget.com/searchcloudcomputing/tip/9-cloud-migration-security-considerations-and-challenges">Cloud migration</a> projects.</li> <li>Business intelligence and analytics.</li> <li>Security research.</li> <li>Demonstration environments.</li> <li>Customer support operations.</li> </ul> <p>In each of these use cases, exposing real data increases organizational risk. Data obfuscation significantly reduces the potential impact of data breaches because attackers who obtain properly obfuscated data can't reconstruct the original information. Even if an attacker successfully compromises a development environment or third-party application, the stolen data holds little practical value.</p> <p>Many <a href="https://www.techtarget.com/searchsecurity/tip/State-of-data-privacy-laws">privacy regulations</a> require or strongly encourage organizations to minimize unnecessary exposure of personal information, making a good case for data obfuscation controls. For example, GDPR encourages pseudonymization and data minimization as mechanisms for reducing privacy risk. CCPA and CPRA emphasize protecting consumer information and limiting unnecessary disclosure. HIPAA encourages deidentification techniques to reduce the exposure of protected health information, and PCI DSS requires strong protection of payment card data with tokenization and masking where appropriate.</p> <p>While data obfuscation alone does not guarantee regulatory compliance, it provides an important primary or compensating control that significantly reduces compliance scope and breach impact.</p> </section> <section class="section main-article-chapter" data-menu-title="Primary data obfuscation methods"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Primary data obfuscation methods</h2> <p>One of the most common misconceptions surrounding data obfuscation is that there is a single "best" technique. In practice, each approach addresses a different business requirement, and mature security programs often employ several of them simultaneously. The three most common techniques and controls in many organizations today are encryption, tokenization and data masking.</p> <h3>Encryption</h3> <p>Encryption remains the most widely deployed data protection technology. Encryption transforms plaintext into ciphertext using cryptographic algorithms and encryption keys. Only authorized users possessing the appropriate decryption keys can recover the original data.</p> <p>Benefits of encryption include strong confidentiality, mature standards, excellent regulatory acceptance and broad vendor support. Some potential drawbacks are that users must decrypt data before use, key management can introduce operational complexity and the risk of post-decryption exposure exists.</p> <p>The best use cases for encryption include databases, file storage, <a href="https://www.techtarget.com/searchstorage/tip/Top-5-cloud-storage-security-issues-and-how-to-contain-them">cloud storage</a>, backup systems and network communications. To implement encryption successfully, organizations should adopt centralized <a href="https://www.techtarget.com/searchsecurity/tip/How-to-choose-a-cloud-key-management-service">key management</a>, hardware security modules for high-value workloads, automated key rotation and strong separation of encryption keys from protected data.</p> <h3>Tokenization</h3> <p><a href="https://www.techtarget.com/searchsecurity/definition/tokenization">Tokenization</a> replaces sensitive values with randomly generated surrogate values called <i>tokens</i>. The original information remains securely stored in a token vault while applications use the token instead of the real value.</p> <p>Tokenization is beneficial because it doesn't expose the original data, it reduces compliance scope and it requires minimal application changes to support it. Common challenges include the need for a secure token vault infrastructure and potential performance considerations in high-volume environments.</p> <p>The best use cases for tokenization include <a href="https://www.techtarget.com/searchsecurity/tip/How-payment-tokenization-works-and-why-its-important">payment processing</a>, customer identifiers, healthcare identifiers and personally identifiable information. Tokenization is particularly effective when a limited number of applications require access to the original values.</p> <h3>Data masking</h3> <p><a href="https://www.techtarget.com/searchsecurity/definition/data-masking">Data masking</a> is perhaps the most familiar obfuscation technique because of its widespread use in software development and testing. Properly implemented masking preserves the realism, formatting and relationships that applications require while removing sensitive elements. Development teams receive production-like data sets that accurately support testing without creating unnecessary exposure if those environments are compromised.</p> <p>Organizations generally implement masking in one of two ways:</p> <ol class="default-list"> <li><b>Static data masking</b> permanently transforms a copy of production data before it is distributed to development, testing or training environments. Static masking is often preferred for use cases that require complete database copies.</li> <li><b>Dynamic data masking</b> leaves the production database unchanged while masking information in real time based on the user's identity, role or authorization level. Dynamic masking works well when production systems need to serve different classes of users with varying access privileges.</li> </ol> <p>Benefits of data masking include simple implementation, preservation of realistic data and <a href="https://www.techtarget.com/searchsecurity/definition/principle-of-least-privilege-POLP">least privilege</a> support. Poorly designed masking can remain reversible, however, and these controls don't always preserve analytical relationships.</p> <p>The most common masking use cases include software development, QA testing, customer support and reporting. Organizations should mask data consistently across related data sets to preserve referential integrity and prevent unauthorized reconstruction.</p> </section> <section class="section main-article-chapter" data-menu-title="Additional data obfuscation techniques"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Additional data obfuscation techniques</h2> <p>In recent years, the following data obfuscation technologies and controls have emerged.</p> <h3>Pseudonymization and anonymization</h3> <p>Pseudonymization and <a href="https://www.techtarget.com/searchdatabackup/definition/data-anonymization">anonymization</a> are often discussed together, but they serve different purposes.</p> <p>Pseudonymization replaces identifying information with alternate identifiers while maintaining the ability to reconnect records through separately protected lookup tables. This approach is common in healthcare research, privacy programs and environments that require legitimate reidentification.</p> <p>Anonymization goes further by permanently removing the ability to identify an individual. While this sounds straightforward, achieving true anonymization is considerably more difficult than many organizations expect. It is often possible to reidentify information that appears anonymous in isolation by combining it with publicly available data sets or other internal information. Security and privacy teams should therefore be cautious about assuming that simply removing names or account numbers renders data anonymous.</p> <h3>Format-preserving encryption</h3> <p>Many older systems validate the format, length or structure of fields before processing them. Replacing a 16-digit account number with conventional ciphertext could break application logic or require extensive software changes. Format-preserving encryption (FPE) addresses this problem by encrypting the value while preserving its original format. A protected credit card number still appears valid, enabling existing applications to continue functioning with little or no modification. FPE is particularly useful for financial systems and older enterprise applications with strict formatting requirements.</p> <h3>Synthetic data generation</h3> <p>Synthetic data generation creates artificial data sets that <a href="https://www.techtarget.com/searchenterpriseai/feature/GenAI-and-synthetic-data-What-can-go-wrong-in-business">preserve statistical characteristics without copying actual customer records</a>. As generative AI matures, synthetic data has become increasingly valuable for software testing, analytics and machine learning while minimizing privacy concerns. Benefits include strong privacy protection, reduced regulatory exposure, excellent AI training data sets and safer software testing.</p> <h3>Differential privacy</h3> <p>Differential privacy introduces carefully controlled statistical noise into data sets or query results, enabling organizations to analyze large populations while reducing the ability to identify individual records. Major cloud providers, research organizations and technology companies increasingly employ differential privacy for analytics, AI and data sharing initiatives. Although still relatively specialized, it is becoming more relevant as organizations expand their AI capabilities.</p> </section> <section class="section main-article-chapter" data-menu-title="Best practices for enterprise data obfuscation"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Best practices for enterprise data obfuscation</h2> <p>Successful data obfuscation programs begin with comprehensive data discovery and classification since it's difficult to protect information you haven't identified. Automated discovery tools and data security posture management (DSPM) platforms can locate sensitive information across cloud storage, SaaS platforms, databases, endpoints and collaboration systems.</p> <p>Embed data obfuscation into <a href="https://www.techtarget.com/searchitoperations/tip/9-ways-to-infuse-security-in-your-CI-CD-pipeline">continuous integration/continuous delivery pipelines</a>, data integration workflows and cloud migration processes rather than treat it as a manual task. Automated policy enforcement improves consistency and reduces operational overhead.</p> <p>Remember, don't rely on any one single technique in isolation. Encryption, masking, tokenization, strong identity controls, least privilege, data loss prevention, DSPM and continuous monitoring provide complementary layers of protection. Also, periodically assess whether it is possible to reidentify masked or anonymized data sets using public information or related internal data sets.</p> <p>Establish governance that clearly defines when teams can copy production data, who can request access, which obfuscation techniques different data classes require and how the organization approves and monitors exceptions.</p> <p><i>Dave Shackleford is founder and principal consultant at Voodoo Security, as well as a SANS analyst, instructor and course author, and GIAC technical director.</i></p> </section> With so many services requiring access to sensitive data, encryption alone is not enough. Data obfuscation has evolved into a core element of modern cybersecurity architecture. https://cdn.ttgtmedia.com/rms/onlineimages/container_g498396156.jpg https://www.techtarget.com/cybersecurity/tip/CISOs-guide-to-data-obfuscation Tue, 28 Jul 2026 14:48:00 GMT <p>The combination of sophisticated attacks and increasingly complex deployments makes achieving cybersecurity and establishing centralized visibility greater challenges than ever.</p> <p>Organizations generate unprecedented volumes of security telemetry across disparate environments. Security teams often struggle with the quantity of information, and fragmented visibility across tools, cloud environments and endpoints <a href="https://www.techtarget.com/searchitoperations/tip/Observability-vs-monitoring-Whats-the-difference">leaves dangerous gaps</a>. The result is often too much information without comprehensive coverage.</p> <p>To that end, more enterprises are deploying security data lakes to consolidate and analyze security information at scale. Security data lakes improve threat detection and operational efficiency, but they also introduce governance and security considerations.</p> <p>Let's compare security data lakes and SIEM workflows, then identify use cases, challenges and best practices.</p> <section class="section main-article-chapter" data-menu-title="What is a security data lake?"> <h2 class="section-title"><i class="icon" data-icon="1"></i>What is a security data lake?</h2> <p>Security data lakes are centralized repositories designed specifically to collect security-related data. They aggregate security information from many sources, enabling long-term storage and advanced analytics at a cost-effective price.</p> <p>Common data inputs include:</p> <ul class="default-list"> <li>Logs and alerts.</li> <li>Endpoint telemetry.</li> <li><a href="https://www.techtarget.com/searchsecurity/tip/Enhance-security-audits-with-Nmap-and-NSE-scripts">Network activity</a>.</li> <li>Firewall logs.</li> <li>Identity management systems.</li> <li><a href="https://www.techtarget.com/searchNetworking/tip/The-steps-and-benefits-of-DNS-service-audits">DNS activity</a>.</li> <li>Email.</li> <li>Threat intelligence.</li> <li>Security incident records.</li> </ul> <p>Security data lakes offer companies a unified foundation for security operations, <a href="https://www.techtarget.com/searchsecurity/tip/What-is-threat-hunting-Key-strategies-explained">threat hunting</a>, forensics and compliance. Because they specifically house cybersecurity-related data, security lakes stand apart from enterprise data lakes that store other information.</p> </section> <section class="section main-article-chapter" data-menu-title="Why security data lakes matter to leaders"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Why security data lakes matter to leaders</h2> <p>Security data lakes offer a strategic business value. They can improve visibility across hybrid and <a href="https://www.techtarget.com/searchcloudcomputing/tip/Conquer-8-cloud-observability-challenges-to-maximize-ROI">multi-cloud environments</a> while eliminating data silos. A centralized database lets companies detect threats more quickly, gain operational efficiency and respond more effectively to incidents. Comprehensive analytics also supports risk management and data-driven decision-making.</p> <p>Expect security lakes to offer specific, measurable business impacts, including:</p> <ul class="default-list"> <li>Reduced <a href="https://www.techtarget.com/searchsecurity/tip/7-key-cybersecurity-metrics-for-the-board-and-how-to-present-them">mean time to detect</a>.</li> <li>Reduced mean time to respond.</li> <li>Better utilization of existing security investments.</li> <li>Lower security operations costs.</li> <li>Enhanced support for compliance reporting and audit readiness.</li> <li>Better executive and board-level reporting.</li> <li>Improved security team productivity.</li> <li>Improved scalability for future growth.</li> </ul> </section> <section class="section main-article-chapter" data-menu-title="Security data lakes and the evolution of SIEM"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Security data lakes and the evolution of SIEM</h2> <blockquote class="main-article-pullquote"> <div class="main-article-pullquote-inner"> <figure> SIEM systems are optimized for real-time alerting, correlation and incident workflows. Security lakes offer scalable, long-term storage and deep analysis. Many enterprises rely on both approaches. </figure> <i class="icon" data-icon="z"></i> </div> </blockquote> <p>Security lakes differ from standard SIEM tools. SIEM systems are optimized for real-time alerting, correlation and incident workflows. Security lakes offer scalable, long-term storage and deep analysis. Many enterprises rely on both approaches.</p> <p>For example, if an attacker moved slowly across cloud, identity and endpoint systems over several months, a security data lake could retain enough data to reconstruct the timeline and spot patterns. A SIEM tool might miss these signals due to its shorter data retention structure.</p> <p>IT leaders recognize that security lakes enhance rather than replace existing SIEM platforms. Security data lakes offer unique and complementary information; SIEM systems remain valuable for real-time monitoring and alerting. Organizations use data lakes to provide scalable, cost-effective storage to support advanced analytics in ways that are impractical with traditional SIEMs.</p> <p>The combination of these tools offers greater flexibility, visibility and cost management.</p> </section> <section class="section main-article-chapter" data-menu-title="Key security data lake use cases"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Key security data lake use cases</h2> <p>Security data lakes enable detection, analysis and reporting for many cybersecurity use cases, among them:</p> <ul class="default-list"> <li><b>Threat detection and threat hunting. </b>Security data lakes correlate data from multiple sources, identify sophisticated attacks and anomalous behavior, and enable proactive threat hunting.</li> <li><b>Incident investigation and compliance. </b>Security data lakes<b> </b>accelerate forensic investigations, support regulatory reporting and audits, and maintain historical security records.</li> <li><b>AI and advanced analytics. </b>Security data lakes provide the large, diverse data sets necessary for machine learning, improve behavioral analytics and predictive threat detection, and support emerging <a href="https://www.techtarget.com/searchsecurity/tip/How-AI-could-change-threat-detection">AI-driven security operations</a> and automation initiatives.</li> </ul> </section> <section class="section main-article-chapter" data-menu-title="Governance, security and implementation challenges"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Governance, security and implementation challenges</h2> <p>Security lakes pose adoption challenges. Understanding these challenges helps IT leaders determine whether data lakes are justified in their environment, as well as identify the hurdles they must overcome to deploy them effectively.</p> <p>Specific issues include data management, governance, privacy and operational complexity:</p> <ul class="default-list"> <li><b>Data integrity and quality.</b> Security analytics are only as effective as the data they rely on. Evaluate data normalization, validation and quality controls to ensure the lake contains useful, usable content.</li> <li><b>Access controls and governance.</b> Establish data ownership and accountability early. Once defined, implement role-based access controls and least-privilege policies. Monitor and audit access to sensitive information.</li> <li><b>Security and privacy risks.</b> Security lakes are high-value targets for attackers. Require <a href="https://www.techtarget.com/searchsecurity/feature/Best-practices-to-secure-data-at-rest-in-use-and-in-motion">effective encryption for data at rest and in transit</a> to protect regulated and sensitive business information. Meet industry-specific compliance requirements.</li> <li><b>Operational complexity.</b> Expect additional complexity and resource allocations for data ingestion, retention and governance across diverse data sources. Align security, IT, compliance and business stakeholders. Build a continuous improvement lifecycle.</li> </ul> </section> <section class="section main-article-chapter" data-menu-title="Best practices for success"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Best practices for success</h2> <p>Use the following best practices to enable a successful security data lake deployment. They address accountability, risk management, governance and business value considerations.</p> <ul class="default-list"> <li>Establish governance teams and policies early.</li> <li>Implement strong encryption and <a href="https://www.techtarget.com/searchnetworking/tip/The-basics-of-zero-trust-network-access-explained">zero-trust access controls</a>.</li> <li>Identify and prioritize high-value data sources.</li> <li>Define retention and <a href="https://www.techtarget.com/searchsecurity/tip/How-to-write-a-data-classification-policy-with-template">data classification standards</a>.</li> <li>Continuously monitor data lake activity, including both ingestion and consumption.</li> <li>Implement continuous data quality monitoring.</li> <li>Align initiatives with broader cybersecurity and business objectives.</li> <li>Measure success with business-focused metrics.</li> <li>Build for AI and advanced analytics readiness.</li> </ul> <p>As cyberthreats continue to grow in scale and complexity, centralized security data is a strategic advantage. Security data lakes are reshaping how organizations detect and respond to threats. Evaluate whether the organization's current architecture can support real-time insight, scalable analytics and AI-driven security operations.</p> <p><i>Damon Garn owns Cogspinner Coaction and provides freelance IT writing and editing services. He has written multiple CompTIA study guides, including the Linux+, Cloud Essentials+ and Server+ guides, and contributes extensively to InformaTechTarget, The New Stack and CompTIA Blogs.</i></p> </section> A security data lake gives organizations a centralized repository of security information, but it can pose governance and operational risks. https://cdn.ttgtmedia.com/rms/onlineimages/strategy_g1192721749.jpg https://www.techtarget.com/cybersecurity/tip/A-CISOs-guide-to-security-data-lakes Mon, 27 Jul 2026 15:22:00 GMT <p>Organizations are leaning into zero trust, a framework that assumes no entity can access a specific asset until they have been verified, validated and authorized. This approach makes privileged identity management, or <i><a href="https://www.techtarget.com/searchsecurity/definition/privileged-identity-management-PIM">PIM</a></i>, an increasingly important resource.</p> <p>PIM supplants permanent access rights with provisional, sanctioned and audited access. This granular control gives the user or device access to precisely what they need to complete a task -- no more, no less.</p> <p>This is important because credential theft or misuse was the root cause in 32% of breaches, according to IBM's "X-Force Threat Intelligence Index 2026." Threat actors rely on penetrating a system and then traversing multiple attack vectors to exploit vulnerabilities on other systems. This lateral movement was found in 87% of all breaches, Palo Alto Networks reported in its "Global Incidents Response Report 2026." Lateral movement attacks use stolen credentials and administrative tools, such as remote desktop protocol and PowerShell, to find network passwords and execute commands.</p> <p>Security teams can counter this threat with PIM, putting precise, temporary privileged access controls in place. PIM, which comprises policy, workflow, enforcement and logging, uses processes and tools to administer, protect and examine accounts and permissions, including domain admins, cloud subscription owners and root access. It ensures users and devices attempting to access a system gain entry only to exactly what they need and are denied permanent privileges.</p> <section class="section main-article-chapter" data-menu-title="How privileged identity management works"> <h2 class="section-title"><i class="icon" data-icon="1"></i>How privileged identity management works</h2> <p>PIM tools start by discovering privileged users, roles, groups, API keys, service accounts and SSH keys. Tools also locate where those things are stored, such as in Active Directory, databases and cloud environments. The tools then identify effective privilege, the sum of which assets an entity needs access to function in its role. This extends to nested groups.</p> <p>To establish governance, PIM manages administrative roles. End users are not given specific rights. Instead, they are deemed eligible for future access when necessary. Privileged access is time-bound and temporary. When users need to perform a privileged task, they log into the PIM console and ask to initiate their role.</p> <p>Access permissions are granted according to policy tied to requirements. These could include device compliance, manager approval, network location, risk signals and MFA. Access expires automatically.</p> <p>For audit purposes, PIM tools log all events from the time of the initial request through the time of expiration. PIM applies controlled techniques to maintain secure access paths, including privileged access workstations, secure portals and bastions. To protect privileged information, PIM moves passwords and keys and stores confidential data, access policies and audit trails in a hardened vault.</p> </section> <section class="section main-article-chapter" data-menu-title="PIM benefits and challenges"> <h2 class="section-title"><i class="icon" data-icon="1"></i>PIM benefits and challenges</h2> <p>PIM boosts an organization's security in several ways. By limiting access, PIM reduces the likelihood that credentials can be stolen. It also <a href="https://www.techtarget.com/searchsecurity/tip/How-to-prevent-and-detect-lateral-movement-attacks">prevents lateral movement</a> and escalation by securing pathways and reducing the time a malicious hacker has inside a breached system. PIM also establishes strong security controls for the actions the organization deems most critical.</p> <p>PIM limits privilege sprawl by preventing users from gaining and keeping excessive rights. Logging capabilities support auditing and compliance efforts. Through vaulting and rotation, PIM protects shared and legacy admin accounts.</p> <p>Like most security controls, however, PIM creates friction for administrators responsible for approvals, timeouts and other steps that can impede operations. Adopting PIM can be complex and expensive, particularly in hybrid environments. There is also a risk of under-securing certain pathways, leading to overconfidence.</p> <p>While PIM is useful, it is only one facet of a strong defense. A multilayered security infrastructure also incorporates endpoint security, segmentation and <a href="https://www.techtarget.com/searchsecurity/definition/threat-detection-and-response-TDR">threat detection and response</a>.</p> </section> <section class="section main-article-chapter" data-menu-title="Best practices for effective PIM"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Best practices for effective PIM</h2> <p>For a PIM program to succeed, follow these best practices:</p> <ul class="default-list"> <li><b>Adopt core access controls.</b> Consider just-in-time role activation, scoped permissions, approvals and workflows, as well as strong MFA requirements and conditional access permissions.</li> <li><b>Document privileged roles and permissions.</b> To support strong governance, PIM needs a privileged-role catalog and administrative ownership.</li> <li><b>Continuously update documentation.</b> Because it is a dynamic asset, PIM requires consistent reviews and recertification for privileged roles and general eligibility.</li> <li><b>Protect secrets.</b> Set up specifications for human and nonhuman entities. Key vaulting for shared accounts and service accounts is essential.</li> <li><b>Rotate controls.</b> Automate checkout and check-in rotations. For service accounts, PIM should have controls around ownership, purpose, credential scope and rotation.</li> <li><b>Address key management.</b> This includes key rotation when practical. An effective PIM strategy needs to take session security into account. Session brokering, for example, uses an intermediate system to secure the connection between the accessing entity and the target resource. For logging purposes, PIM should record sessions.</li> <li><b>Perform consistent logging.</b> On a broader level, PIM tools should log elevation events and downstream processes.</li> <li><b>Monitor PIM tools and events.</b> Monitoring is important so tools can track and flag events such as anomalous elevation patterns and risky commands. To streamline incident response, PIM should integrate with <a href="https://www.techtarget.com/searchsecurity/answer/SOAR-vs-SIEM-Whats-the-difference">SIEM and SOAR tools</a>.</li> </ul> </section> <section class="section main-article-chapter" data-menu-title="Where PIM fits in identity management"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Where PIM fits in identity management</h2> <p>As mentioned, PIM plays a critical role in an organization's overarching identity and access management strategy, but it is a complementary role and only one piece in the puzzle. It regulates how much access is granted, essentially acting as the enforcement controller.</p> <p>PIM works alongside access management and single sign-on, which address user authentication, session management, federation and conditional access. It solidifies privileged pathways by executing authentication controls, implementing policies for privileged sessions and segmenting admin roles and accounts. PIM helps admins apply <a href="https://www.techtarget.com/searchsecurity/tip/The-5-principles-of-zero-trust-security">zero-trust principles</a>, including <a href="https://www.techtarget.com/searchsecurity/definition/principle-of-least-privilege-POLP">least privilege</a>, just-in-time and just-enough access, and continuous validation.</p> <p>Many are confused about how PIM aligns with and differs from privileged access management (<a href="https://www.techtarget.com/searchsecurity/definition/privileged-access-management-PAM">PAM</a>). PIM oversees eligibility and elevation. For example, an organization could use PIM to grant a specific individual database admin privileges for 45 minutes on a particular day. PAM, meanwhile, governs how privileged sessions and credentials are used and tracked, such as with session recording, rotation, and check-ins and checkouts.</p> <p>When executed well, PIM is a vital part of an organization's overall IAM strategy. Still, it is just one element of a larger identity strategy.</p> <p><i>Amy Larsen DeCarlo has covered the IT industry for more than 30 years, as a journalist, editor and analyst. As a principal analyst at GlobalData, she covers managed security and cloud services.</i></p> </section> IAM is more crucial than ever in the AI era. To better control who -- and what -- is accessing systems and data, security teams need to move beyond standing access privileges. https://cdn.ttgtmedia.com/rms/onlineimages/security_a296619547.jpg https://www.techtarget.com/cybersecurity/tip/CISOs-guide-to-privileged-identity-management Fri, 24 Jul 2026 16:03:00 GMT <p>OpenAI reported this week that its autonomous AI models escaped an isolated testing environment during a training exercise and breached Hugging Face, an AI collaboration platform.</p> <p>Last week, Hugging Face <a target="_blank" href="https://huggingface.co/blog/security-incident-july-2026" rel="noopener">disclosed</a> that it "detected and responded to an intrusion into part of our production infrastructure. This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system -- and we detected and dissected it largely with AI of our own."</p> <p>Security experts are calling the event a first-of-its-kind cyberattack. Not only was the incident carried out by an <a href="https://www.techtarget.com/searchenterpriseai/definition/autonomous-AI-agents">AI agent</a> with no human operator, but it was wholly unintended. The model was given a specific task under controlled conditions, yet it managed to circumvent guardrails and infiltrate Hugging Face's systems.</p> <p>"We strongly believe there was no malicious intent on [OpenAI's] part," said Hugging Face co-founder and CEO Clément Delange in a statement. "It's quite mind-blowing that all this happened autonomously."</p> <section class="section main-article-chapter" data-menu-title="What happened?"> <h2 class="section-title"><i class="icon" data-icon="1"></i>What happened?</h2> <p>OpenAI <a href="https://openai.com/index/hugging-face-model-evaluation-security-incident/">disclosed</a> that the security incident was actuated by a combination of its models, including an instance of its new GPT-5.6 Sol and a more capable prerelease model. During an internal evaluation on ExploitGym, a public benchmark that measures whether AI can convert existing software flaws into exploits, the models used a <a href="https://www.techtarget.com/searchsecurity/tip/What-AI-zero-days-mean-for-enterprise-cybersecurity">zero-day vulnerability</a> in a package-registry proxy, escalated privileges and pursued a path out of the testing environment to the internet.</p> <p>Testers tasked the AI agent with solving the exploitation benchmark. However, it followed that goal so doggedly that it investigated its own containment, discovered and exploited vulnerabilities, escalated privileges and moved laterally until it found a machine with internet access. The AI deduced that Hugging Face hosted the benchmark solutions and, using multiple attack vectors, accessed the company's production infrastructure.</p> </section> <section class="section main-article-chapter" data-menu-title="The implications of rogue AI agents"> <h2 class="section-title"><i class="icon" data-icon="1"></i>The implications of rogue AI agents</h2> <p>While Hugging Face was able to detect and contain OpenAI's rogue agent, the event underscores the perils of frontier AI models and, specifically, their ability to circumvent guardrails in pursuit of their objectives. As AI agents grow in sophistication, they might become more adept at setting reasonable boundaries when attempting to complete a task, or they could continue to display unexpected and undesirable behaviors, resulting in greater harm.</p> <p>Now that AI systems have demonstrated they can execute sophisticated cyberattacks without human intent or oversight, <a href="https://www.techtarget.com/searchsecurity/tip/Behavioral-biometrics-How-to-detect-non-human-threat-actors">threat actors</a> will not waste any time using similar models to launch large-scale, multistage campaigns at machine speed.</p> <p>The threats posed by frontier AI models have been significant enough to compel the Trump administration to <a href="https://www.techtarget.com/searchenterpriseai/news/366644013/Trump-AI-order-targets-frontier-model-prerelease-review">issue an executive order</a> establishing a framework for federal oversight of the most powerful AI systems, including requirements to vet models for potential national security risks prior to general availability. In the wake of this incident, congressional lawmakers have already introduced a <a href="https://www.cfodive.com/news/lawmakers-push-ai-kill-switch-bill-openai-breach-sparks-alarms/826080/" target="_blank" rel="noopener">"kill-switch" bill</a> that, if made law, would require AI developers to maintain the technical capacity to throttle, suspend or shut down autonomous systems at will.</p> <p>Other experts urge caution as technology pioneers continue to push enterprise AI adoption. They warn that AI must be engineered with the same expectations for safety and reliability as any other critical system. Long before release, AI models must be thoroughly tested, continuously monitored and designed with the kill-switch fail-safe in the event things go drastically wrong.</p> <p>OpenAI is navigating the implications of its rogue AI in real time. The company has outlined its immediate next steps:</p> <ul class="default-list"> <li>Implementing strict controls in infrastructure configuration at the cost of research velocity while patching vulnerabilities.</li> <li>Working with Hugging Face to forensically investigate the incident.</li> <li>Disclosing the identified zero-day vulnerability in the internally hosted third-party software and working with the vendor to patch it.</li> <li>Using its OpenAI models to help Hugging Face improve its defenses.</li> <li>Improving and adding stronger protections around future training and evaluations.</li> </ul> </section> <section class="section main-article-chapter" data-menu-title="What can CISOs do now?"> <h2 class="section-title"><i class="icon" data-icon="1"></i>What can CISOs do now?</h2> <p>Last year, Forrester introduced <a href="https://www.techtarget.com/cybersecurity/tip/How-the-AEGIS-framework-mitigates-agentic-AI-risks">AEGIS</a> (Agentic AI Enterprise Guardrails for Information Security), a <a target="_blank" href="https://www.forrester.com/blogs/introducing-aegis-the-guardrails-cisos-need-for-the-agentic-enterprise/" rel="noopener">six-domain framework</a>, to help CISOs secure, govern and manage autonomous AI agents and agentic enterprise infrastructure.</p> <p>Forrester researchers <a target="_blank" href="https://www.forrester.com/blogs/an-ai-security-facepalm-openais-evaluation-became-hugging-faces-incident/" rel="noopener">published a blog</a> outlining the following seven priorities CISOs should take now, based on AEGIS, in light of the Hugging Face attack:</p> <ul class="default-list"> <li><b>Govern high-risk model evaluations.</b> Implement strong authorization, perform containment tests, establish abort criteria, know incident owners and confirm communication processes.</li> <li><b>Apply least privilege.</b> Limit models' tools, credentials, compute, network paths and authority, following least-privilege guidance.</li> <li><b>Design a containment plan for model-enabled attacks.</b> Remove unnecessary egress controls, isolate package infrastructure, rotate credentials and adopt zero-trust architecture.</li> <li><b>Document the exercise.</b> Preserve prompts, reasoning artifacts, tool calls, identities, network activity and policy decisions.</li> <li><b>Establish an incident response model.</b> Implement and test a fallback model.</li> <li><b>Evaluate AI vendors.</b> Assess how third parties manage safeguards, isolate models, govern benchmarks, disclose incidents and support responders.</li> <li><b>Treat AI as critical infrastructure.</b> Map AI model use, including hosts, package proxies, repositories, benchmarks and tools, and implement controls in the event of component failures.</li> </ul> <p>In its statement, Open AI said, "AI is accelerating the discovery and exploitation of vulnerabilities. The primary lesson from this incident is that model security and safety must keep pace with rapidly advancing capabilities."</p> <p>While the damage from OpenAI's unexpected breach of Hugging Face's systems was limited, future AI models could be even more tenacious in their efforts to achieve perceived goals -- regardless of consequences. CISOs should take this novel event as a learning opportunity and shore up their agentic AI security measures now.</p> <p><i>Richard Livingston is an editor with Informa TechTarget's SearchSecurity site, covering cybersecurity news, trends and analysis.</i></p> </section> In an unprecedented -- and unintended -- cyberattack, frontier AI models autonomously escaped their contained testing environment and breached another company's systems. https://cdn.ttgtmedia.com/rms/onlineimages/code_g1304896250.jpg https://www.techtarget.com/cybersecurity/news/366646105/OpenAI-models-escape-containment-hack-Hugging-Face Thu, 23 Jul 2026 17:35:00 GMT 60 webmaster@techtarget.com