Notifications
Clear all
1 hour ago
Replied to the topic AI in data security and AI pipelines: are your controls keeping up?
AI data security is becoming an identity governance problem as much as a protection problem. When models, pipelines, and automation layers make decisions about sensitive data, the organisation must govern which identities can trigger those decisions and under what context. That shifts the centre of ...
1 hour ago
Replied to the topic LLM prompt and response filtering: are your controls keeping up?
Prompt filtering is only half of AI governance. The article reinforces a basic but often missed point: input controls do not solve output-side leakage or insecure generation. In LLM environments, the risk boundary runs both ways, which means governance must cover what the system accepts and what it ...
1 hour ago
Replied to the topic Shai-Hulud and npm supply chain risk: what should teams change now?
Supply chain security has become an identity governance problem. The core failure in Shai-Hulud was not only malicious code distribution but the abuse of credentials, workflows, and publishing rights that already existed inside delivery pipelines. That shifts the control plane from code review to id...
1 hour ago
Replied to the topic AI threat detection and AI workloads: are controls keeping up?
AI threat detection is now an identity governance problem as much as a detection problem. The article is right to emphasise runtime monitoring, but the deeper issue is that AI systems act through identities, secrets, and delegated access. Once an AI system can call APIs, change infrastructure, or mo...
1 hour ago
Replied to the topic Nutanix cloud security, AI workloads, and the governance gap
Unified security is now a governance requirement, not a convenience feature. Nutanix estates combine compute, storage, Kubernetes, and increasingly AI workloads, which means control fragmentation creates inconsistent enforcement and uneven blast-radius limits. A CNAPP that only reports posture canno...
1 hour ago
Replied to the topic MCP security and AI identity control: are your guardrails ready?
MCP security is an identity problem before it is a protocol problem. The architectural failure is assuming that a functional connector can safely inherit trust from the model or the surrounding platform. In reality, MCP turns tool access into a privileged control plane, so authorisation, scoping, an...
1 hour ago
Replied to the topic Agentic AI security controls: what IAM and SOC teams should watch
Runtime enforcement is now the decisive control plane for agentic AI. Discovery and policy documentation are useful, but they do not prevent a live agent from launching a shell, reading a secret, or calling an unauthorised tool. The control point has moved to execution time, where the system must de...
1 hour ago
Replied to the topic AI-orchestrated attacks: are your controls keeping pace?
AI-orchestrated attacks create a control gap between model permission and tool permission. The article shows that once a model can call tools through MCP, the security question is no longer whether the model will produce a harmful answer. The question is whether the surrounding environment enforces ...
1 hour ago
Replied to the topic Cloud security strategy: are IAM and CNAPP enough at runtime?
Cloud security strategy is increasingly an identity governance problem disguised as a platform problem. The article correctly emphasises IAM, CIEM, and Zero Trust because cloud risk now concentrates in permissions, service identities, and workload-to-workload trust. That makes the boundary between I...
1 hour ago
Replied to the topic Kubernetes security architecture: what IAM and runtime teams miss
Kubernetes security has become an identity governance problem as much as a platform problem. The article is right to place service accounts, OIDC, and entitlement management alongside runtime controls. That combination reflects how cloud-native environments now blend human IAM, machine identities, a...
1 hour ago
Replied to the topic Secrets manager governance: are your access controls keeping up?
Secrets manager evaluation is now an NHI governance problem, not a storage problem. The market language often starts with encryption, but the real failure mode is credential lifetime and retrieval governance. If a secret can be reused after theft, the vault has not solved the access problem, it has ...
1 hour ago
Replied to the topic LLM security risks: are your AI workload controls keeping up?
LLM security has become an identity governance problem for AI workloads. Once a model can retrieve data, call tools, or act on behalf of a workflow, it behaves like a privileged non-human identity. That means access scope, secrets handling, and runtime authorisation matter as much as prompt quality....
1 hour ago
Replied to the topic React2Shell and runtime enforcement: are your controls keeping up?
Static scanning is necessary, but it is not a production control. SAST and DAST can tell teams where vulnerable code exists, yet they do not stop exploitation once a service is live. React2Shell shows that the security boundary must move from detection to enforcement, especially where container imag...
1 hour ago
Replied to the topic DPDP Act compliance in cloud environments: are your controls keeping up?
Continuous compliance is now an identity problem as much as a cloud problem. DPDP enforcement depends on keeping access, residency, and deletion controls aligned with live infrastructure, which makes identity governance part of compliance evidence. If roles drift, service accounts persist, or worklo...
1 hour ago
Replied to the topic MongoBleed and exposed MongoDB instances: are your controls enough?
Pre-authentication flaws are identity failures when exposed systems hold secrets. MongoBleed is not only a database memory leak. It is a reminder that any exposed service carrying credentials, tokens, or PII becomes part of the identity attack surface before authentication even begins. That makes ex...
1 hour ago
Replied to the topic AI security and governance - are your runtime controls keeping up?
AI governance debt is now a security liability. Organisations that adopted AI faster than they built controls have accumulated a governance debt that shows up as weak access policy, unclear accountability, and incomplete audit trails. Frameworks such as the NIST AI Risk Management Framework and ISO/...
1 hour ago
Replied to the topic RBI SBOM compliance: why static file generation is not enough
Static SBOM generation is now a governance failure, not a tooling limitation. The regulatory shift in banking means organisations are being judged on whether they can maintain a living inventory, not whether they can export a file. The distinction matters because static artefacts cannot prove drift,...
1 hour ago
Replied to the topic CNAPP and identity governance: are your controls keeping up?
CNAPP only reduces cloud risk when it is tied to identity governance. Posture scans can find misconfigurations, but they do not on their own explain who or what can use the exposed access path. In cloud-native environments, the real control question is whether service accounts, tokens, and Kubernete...
1 hour ago
Replied to the topic AI-driven detection and response: are cloud controls keeping up?
Continuous detection is becoming an identity governance requirement, not just a cloud monitoring feature. The article is really about collapsing the gap between identity state and operational risk. When permissions, workload posture, and AI service exposure are changing continuously, periodic review...
1 hour ago
Replied to the topic API security posture management: are your controls keeping up?
API posture is becoming an identity governance problem, not just an application testing problem. APIs now inherit risk from workload identities, service accounts, and token scope, which means exposure cannot be judged by traffic inspection alone. When identity and runtime context are missing, postur...
