Identity & Access
AWS AgentCore Identity Explained: Does It Solve It?
AgentCore Identity reached GA in October 2025, built on Cognito for agent workloads. What it covers on AWS, and where cross-cloud identity still needs help.
Blog
Insights & updates — page 5
AI agent security, identity, governance, cost, and the engineering behind the control plane.
Platform & Operations
MCP 2026-07-28: What Changed in the Ratified Spec
The ratified MCP 2026-07-28 spec drops session state for a stateless core, adds MRTR and CIMD, and formalizes Tasks, MCP Apps, and EMA as extensions.
AI Agent Security
MITRE ATLAS vs OWASP Agentic AI Top 10: Different Jobs
MITRE ATLAS and the OWASP Agentic AI Top 10 answer different questions. Here is which framework to reach for, and when a team needs both.
AI Strategy
What Is AI TRiSM? Gartner's Framework Explained
AI TRiSM stands for trust, risk, and security management — Gartner's framework for governing AI systems, and where runtime controls fit.
AI Agent Security
The Mexico Government AI Breach: A Defender's Postmortem
A single operator used Claude Code and GPT-4.1 to breach nine Mexican government agencies. What the incident shows defenders about agent-assisted offense.
AI Governance & Compliance
AI Governance Platform vs GRC Extension vs Control Plane
Disambiguating three product categories that all call themselves 'AI governance': GRC extensions, risk systems of record, and runtime control planes.
Identity & Access
How Many Non-Human Identities Per Human? The 2026 Data
Non-human identities per human: CyberArk's survey reports 82:1 and Entro Labs counts 144:1. Why the two differ and which one to cite.
AI Governance & Compliance
The CSA AI Controls Matrix Explained
The Cloud Security Alliance's AI Controls Matrix maps AI risk to concrete controls across 18 domains, and lines up with ISO 42001 and NIST AI 600-1.
AI Strategy
The 2026 AI Agent Security M&A Wave and Your Shortlist
Cato–Aim, Palo Alto–Protect AI, Cisco–Robust Intelligence: what 2026's AI security acquisitions mean when you're shortlisting vendors.
AI FinOps
ACP vs AP2: Two Agentic Commerce Protocols Compared
ACP and AP2 both let AI agents complete purchases, but through different mechanisms and governance models. What each one actually does, as of mid-2026.
AI Governance & Compliance
ISO/IEC 42005 Explained: AI Impact Assessment vs DPIA
ISO/IEC 42005:2025 defines how to run an AI system impact assessment. Here is what it requires and how it differs from a DPIA or the EU AI Act's FRIA.
AI Strategy
Platform-Bundled vs Pure-Play AI Agent Security in 2026
A decision framework for choosing platform-bundled or pure-play AI agent security vendors after 2026's acquisition wave.
Platform & Operations
OpenTelemetry GenAI Semantic Conventions: What's Stable
As of mid-2026, no gen_ai.* OpenTelemetry attribute is stable — what moved, what that means for teams instrumenting agents now.
Identity & Access
Okta for AI Agents Explained: What It Covers
Okta for AI Agents reached GA in April 2026. What the identity layer covers, and what independent governance still needs to add for a mixed estate.
AI Agent Security
ServiceNow Now Assist Agent Discovery Incident
How second-order prompt injection abused ServiceNow Now Assist's agent-to-agent discovery feature, and what it shows about multi-agent privilege design.
AI Governance & Compliance
DORA and AI Vendors: When ICT Third-Party Risk Applies
DORA has applied to EU financial entities since January 2025. Here is when an AI or LLM vendor counts as a regulated ICT third party under it.
AI Governance & Compliance
BYO KMS and Per-Tenant Signing Keys
Per-tenant signing keys in a customer-controlled KMS change what a platform compromise can do and what a tenant can prove. The options, trade-offs, and cost.
Identity & Access
Entro Security Alternatives: Secrets-Centric NHI Governance
Evaluating alternatives to Entro Security for secrets-centric non-human identity governance and how it compares to broader NHI platforms.
AI Agent Security
The Lethal Trifecta: A Framework for Agent Data Exfiltration
The lethal trifecta names the three properties that make prompt injection dangerous: private data, untrusted content, and external communication.
Identity & Access
Token Exchange for Agent-to-Tool Authorization
OAuth 2.0 Token Exchange (RFC 8693) is the standard for on-behalf-of agent authorization: the flow, the claims that matter, and the limits that stop escalation.
AI Agent Security
ForcedLeak and PipeLeak: Agentforce Breaches Explained
Two 2025-2026 prompt-injection disclosures in Salesforce Agentforce, ForcedLeak and PipeLeak, show how form data becomes a data-exfiltration path.
AI Governance & Compliance
Public Agent Reputation and k-Anonymity
A public agent reputation lookup leaks information unless designed carefully. The anti-enumeration contract, k-anonymity thresholds, and reputation vs. trust.
AI Governance & Compliance
How to Audit AI Agent Activity: A Step-by-Step Process
A step-by-step process for auditing AI agent activity: what to log at each layer, how to reconstruct one agent action, and how to export evidence.
Platform & Operations
LLM Observability Tools for Security and Compliance Teams
Langfuse, LangSmith, Arize Phoenix, and Braintrust evaluated for audit-trail and compliance readiness — not eval quality.