Category: Practical Security
-
Your AI Tool Sprawl Is Your New Shadow IT
The board wants a number for the AI rollout. The honest answer is around 30 to 50 tools in active use, depending on how you count. That number is conservative. Most CISOs I have talked to in the last quarter think the real number is north of 100 if you include browser extensions and shadow…
-
The accidental insider: when your own AI agent causes a breach
The dominant breach pattern of 2026 is not the external attacker. It is the autonomous agent, internal, with credentials, acting on its own. The pattern has a name now, and the playbook for defending against it is taking shape.
-
The post-quantum migration: who has actually moved in 2026, and what broke
Two years after NIST finalised the first post-quantum standards, the migration that everyone agreed was urgent has, in most places, not happened. Here is what shipped, what is stuck, and what a defensible end of year position looks like.
-
Prompt injection in agent memory: the OWASP top 10 got the threat order wrong
The OWASP GenAI LLM Top 10 for 2026 still leads with prompt injection. The 2026 attack class is not the one the list leads with, and the gap is shaping what teams defend against first.
-
Human in the Loop Has Become a Marketing Checkbox
The phrase ‘human in the loop’ used to mean a human reviewed and approved the AI’s significant actions. In 2026 it usually means a human is somewhere in the system, possibly asleep.
-
Your AI Agent Has a Memory. Now You Have a Data Retention Problem.
Persistent memory makes AI agents more useful because they can remember projects, preferences, decisions, credentials and previous conversations. It also creates a growing archive of sensitive information that may be inaccurate, outdated, exposed to other agents or retained far longer than intended.
-
Your AI Agent Is Not an Employee. Stop Giving It Employee Access.
Businesses are handing email accounts, terminals, GitHub access and payment permissions to AI agents that hallucinate, get prompt injected and follow anyone who knows the right words. An agent is not an employee. It is an untrusted service account, and it should be treated like one.
-
The Quiet Death of ‘Just Send Me the File’
Every business, every day, has the conversation that ends with ‘just send me the file.’ The way the file moves has not changed in 30 years. That is starting to change, slowly.
-
Small Business Actually Secure in 2026
Small business security in 2026 amounts to the security work the typical 10-50 person company has to do without the budget of the Fortune 500. The work is not impossible, the work runs as the work the security vendors do not sell to the small business, the work amounts to the work the small business…
-
The 3 2 1 1 0 Backup Strategy Explained
The 3-2-1 backup strategy has been the industry standard for so long that the new variant (the 3-2-1-1-0) sounds like a typo. It is not. The extra numbers serve as the answer to the ransomware variant that the 3-2-1 was not designed to handle.