A question worth separating out:

Q: How do teams know if AI threat hunting is actually improving detection?

A: Measure how quickly intelligence becomes an active hunt, how many hunts run continuously, and how often findings map to real adversary techniques rather than noise. If those metrics improve, the programme is becoming more operational. If they do not, the AI layer is only adding complexity.

👉 Read our full editorial: AI-powered cyberattacks are accelerating faster than SOCs can absorb

A question worth separating out:

Q: What is the difference between scripted penetration testing and intent-driven validation?

A: Scripted testing follows predefined steps, while intent-driven validation lets the operator state the goal and lets the platform choose the path. That improves flexibility, but it also creates stronger requirements for authorization, scope enforcement, and traceability because the exact sequence may change during execution.

👉 Read our full editorial: AI is reshaping adversarial testing for hybrid security validation

A few things that frame the scale:

• Tailscale runs a global mesh network with millions of nodes, connecting laptops, servers, phones, routers, VMs, containers, drones, cameras, sensors, satellites, and everything in between, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.

A question worth separating out:

Q: Who is accountable for connection metadata in an identity-centric network?

A: Accountability sits with the organisation that chooses the service and the operator that defines retention, access, and logging policy. If the architecture permits identity and topology visibility, those records need the same governance as other identity data, including purpose limitation, review, and legal hold handling where applicable.

👉 Read our full editorial: Tailscale’s identity-centric network is not an anonymity service

A question worth separating out:

Q: Who is accountable when a compromised AI agent misuses delegated access?

A: Accountability usually spans the business owner of the workflow, the team that issued or approved the credential, and the vendor if a third-party integration was involved. The critical governance question is not who logged in, but who allowed the delegation chain to exist and remain valid. That chain must be documented before incidents occur.

👉 Read our full editorial: Targeted promptware turns Google Calendar into an AI control channel

A question worth separating out:

Q: How can organisations decide whether DAST coverage is good enough?

A: Measure coverage by the workflows that carry the highest security impact, not by scan volume alone. A useful programme tests authentication, session handling, input validation, and access-sensitive APIs on every build, then tracks whether recurring findings are being eliminated rather than merely detected.

👉 Read our full editorial: HTTP request smuggling detection still misses root-cause desync flaws

A question worth separating out:

Q: When should organisations retire HTTP/1.1 rather than keep compensating for it?

A: Retire HTTP/1.1 when it sits inside trusted service paths, when repeated parser mismatches appear across layers, or when mitigation layers have made the attack surface harder to validate. At that point, compensating controls are usually preserving complexity rather than reducing risk. The safer option is to modernise the protocol path end-to-end.

👉 Read our full editorial: HTTP/1.1 request smuggling remains an architectural liability

A question worth separating out:

Q: What should organisations do when a service still depends on upstream HTTP/1.1?

A: Organisations should treat upstream HTTP/1.1 as a risk decision, not a default. If it remains necessary, isolate it from the most sensitive authenticated flows, test for parser discrepancies regularly, and document compensating controls. If it is not necessary, prioritise migration to a framing model that reduces ambiguity.

👉 Read our full editorial: HTTP/1.1 desync remains a live attack surface in modern web stacks

A question worth separating out:

Q: What should teams do when HTTP/1.1 still exists in critical paths?

A: Teams should treat HTTP/1.1 as a residual-risk condition and prioritise it in the most sensitive paths first. Focus on login, session handling, privileged operations, and any workflow that crosses multiple proxies. If retirement is not immediate, reduce intermediaries, verify parser consistency, and assign clear ownership for remediation.

👉 Read our full editorial: HTTP/1.1 request smuggling is still breaking modern web stacks

A question worth separating out:

Q: What should teams do when vendors claim HTTP/2 support but still use HTTP/1.1 internally?

A: Teams should ask for the full request path, not just the edge protocol banner. If internal HTTP/1.1 still exists, request smuggling remains possible even when the front end advertises modern transport. The right response is to require architectural clarification, document the downgrade point, and prioritise removal of the legacy hop where feasible.

👉 Read our full editorial: HTTP/1.1 desync risk persists as protocol ambiguity stays exploitable

A question worth separating out:

Q: What should teams do when endpoint activity suggests credential dumping?

A: Escalate the case into both SOC and identity workflows, then verify the affected account, review recent authentication activity, and revoke any exposed secrets or tokens. The goal is to stop the credential path, not just quarantine the endpoint after the fact.

👉 Read our full editorial: Autonomous Cortex XDR investigations change how SOCs handle endpoint alerts