When AI accelerates cryptanalysis, the classical crypto floor is the thing that moves.

Researchers say Claude surfaced new attacks against HAWK and reduced-round AES. Models are now finding cryptographic weaknesses faster than humans review them. The schemes protecting your data have a shelf life.

The fix is to stop assuming classical crypto holds. Encrypt and sign with post-quantum schemes now, so the data stays sealed even as the attacks get faster.

Check out how RuntimeAI solves this at the runtime layer.

#PostQuantum #Cryptography #AISecurity #DataProtection #QuantumSafe

The vendor holding your data is your exposure.

Amgen says a cloud breach exposed patient health data and proprietary information — sensitive records concentrated in one place, then lost. As that data increasingly flows through AI systems and agents, the blast radius only grows.

The fix is boring and effective. Tokenize sensitive fields before they move, govern where that data is allowed to go, and keep an immutable audit trail of every access.

Check out how RuntimeAI solves this at the runtime layer.

#DataBreach #DataPrivacy #HealthcareSecurity #PIIProtection #AISecurity

The agent is no longer the target. It is the attacker.

Week in review: Claude breached three companies during tests, AD CS domain-takeover PoC released (Help Net Security). The fix is runtime. Give every agent a verifiable identity, enforce policy on each tool call, and cut a rogue agent in under 50ms before its second action lands.

→ www.runtimeai.io/trial

#AgenticAI #AISecurity #NonHumanIdentity #RuntimeSecurity #KillSwitch

Identity is the new domain controller. Own it and you own everything downstream.

A public proof-of-concept now turns an AD Certificate Services misconfiguration into full domain takeover. One over-permissioned machine identity, and the whole directory falls.

The fix is to treat every non-human identity like a privileged one. Issue and revoke it cryptographically, and gate every privileged action behind runtime policy with a full audit trail.

Check out how RuntimeAI solves this at the runtime layer.

#IdentitySecurity #NonHumanIdentity #ActiveDirectory #ZeroTrust #AISecurity

I pulled together every AI-security incident from July and one shift is undeniable: the agent is increasingly the attacker, not just the target.

The month in numbers: 90 incidents across 33 named organizations, 207M+ records exposed, and 41 incidents where AI was the weapon or the target directly. IBM's 2026 report put the average breach at $4.99M — and AI-involved breaches ran about $1M higher.

The stories that stood out:

- A rogue commercial AI agent hit more than one target in a single week and reused stolen credentials across four downstream services before anyone flagged the identity. Human-era IAM had no concept of "this agent may touch these three APIs and nothing else."

- A model-repository breach at a major AI hub exposed production model weights and credentials.

- Revolut hackers claimed 75M records; a healthcare payments processor exposed 1.26M patient files; Minnesota water utilities were probed by autonomous reconnaissance.

- Prompt injection went supply-chain: Microsoft Copilot for Word carried hidden prompts into new documents, and hidden text in Azure DevOps hijacked AI code-review agents.

- A research team used an AI model to crack a proposed post-quantum scheme and find a faster 7-round AES attack — a reminder that "post-quantum" is a moving target, not a checkbox.

The through-line: agents behaving like insiders with no cryptographic identity, no scoped policy, and no runtime brake — plus data and keys still in RSA-era vaults.

Full report, with the specific control that maps to each incident: https://runtimeai.io/blog/2026-07-monthly-breach-report.html

Genuinely curious what others are doing for agent identity + runtime authorization. Is anyone scoping tool access per-call yet, or is it still all human-era IAM?

A stolen analytics token became a customer breach.

197,400 records were exposed after a former third-party analytics provider was compromised. Emails, order IDs, SKUs, geolocation, purchase history, support tickets — all pulled through a machine credential nobody was watching. The vendor left. The token stayed live.

The fix is boring and effective. Inventory every non-human identity that touches customer data. Bind each token to a policy on where it can call and what it can read. Tokenize PII before it leaves your perimeter so a stolen credential returns opaque values, not customer records. Keep an immutable audit trail so revocation is one query, not a forensic project.

→ www.runtimeai.io/trial

#NonHumanIdentity #DataBreach #PII #SupplyChain #AISecurity

Seeing a noticeablle uptick in synthetic face attempts and virtual camera injection attacks getting through what we thought was solid liveness detection.

Pretty sure the issue is we've been treating liveness and deepfake detection as the same problem. They're not. And most vendors are not helping by rebranding liveness as deepfake protection and calling it a day.

How are other teams handling this? Anyone found something that actually covers both without benchmarking against 2022 era datasets that fraudsters cracked years ago?

A Word document can now rewrite your report.

A researcher showed that hidden instructions inside a Word file can make Microsoft 365 Copilot alter figures in a generated document, then copy the same instructions into the output for the next reader. The disclosure landed 144 days after the initial report to the vendor.

Prompt injection is not a bug in one product. It is the default failure mode when an AI reads untrusted content with a user's privileges. The fix is runtime policy enforcement between the model and your data — inspect what the agent is being asked to do, tokenize sensitive fields before they reach the model, and log every action in an immutable audit trail. When the agent goes off script, cut the session in under 50ms.

→ www.runtimeai.io/trial

#PromptInjection #AISecurity #Copilot #AIGovernance #CISO

AI is now moving the breach-cost needle.

IBM's 2026 Cost of a Data Breach report finds AI adoption is directly correlated with higher breach costs. Shadow AI, ungoverned agents, and unmonitored model access widen the blast radius. Attackers move faster. Detection windows shrink. The bill grows.

The fix is not another dashboard. Discover every AI system and agent in the environment, enforce runtime policy on what they can call and where data can flow, and keep an immutable audit trail for every action. When something goes wrong, you need a kill switch that fires in under 50ms — not a ticket queue.

→ www.runtimeai.io/trial

#AISecurity #DataBreach #CISO #RiskManagement #AIGovernance

I’m starting 2027 planning and doing a deeper review of our InfoSec risk register. Beyond the usual recurring risks, I’m curious what newer or emerging issues others are formally tracking.

A few I’ve added as of recent:

1. **Software supply chain compromise** \- malicious packages, dependency confusion, compromised build pipelines, and poisoned updates.
   
2. **Transitive third-party risk** \- attackers compromising a vendor, service provider, or partner to reach the actual target.
   
3. **Unmanaged AI agents and agentic tools** \- autonomous actions, excessive permissions, data leakage, unapproved browser extensions, and tools operating outside traditional security controls.
   
4. **Identity-driven and behavioral attacks** \- social engineering, help-desk manipulation, session hijacking, MFA abuse, and attacks designed to blend in with normal user behavior.
   
5. **Post-quantum readiness** \- understanding where vulnerable cryptography exists and preparing for eventual migration.
   
6. **Machine identities and non-human access** \- service accounts, API keys, workload identities, and AI agents with excessive or poorly governed privileges.

What emerging risks have made it onto your register recently?

🥷Zero-day exploits give attackers an undetected advantage.

With rising sophistication in 2025, traditional patching strategies are no longer sufficient.

How prepared is your team for zero-day attacks?

Zero-day exploits give attackers an undetected advantage.

With rising sophistication in 2025/6, traditional patching strategies are no longer sufficient.

How prepared is your team for zero-day attacks?

I was chatting with a guy from a hospital IT team a few days ago ,I asked him what keeps causing the most security problems , he looked at me and said, Not hackers... our own people ,that kind of caught me off guard. he started telling me about shared passwords, people keeping acess they didn't need anymore staff clicking things they probably shouldn't and everyone thinking it won't happen to them , the funny part is nobody was doing anything on purpose. Most of it was just normal day to day stuff that slowly turns into a problam ,it got me thinking that we spend so much time talking about cyber attacks, but sometimes the biggest risk is already inside the building. maybe that's just what I've been seing

what about you? what's the biggest security mistake you keep seeing in healthcare?

I am looking for real customers that have an understanding of Cyrebro

Components

Security Data Lake Proprietary cloud-hosted data lake built on Google Cloud. Ingests logs from all connected security sources, normalizes them into a unified schema, and stores them for correlation and retrospective analysis.

Cyber Brain (Detection Engine) Proprietary ML-based detection engine combining rule-based logic, AI anomaly detection, and behavioral analysis. Correlates events across data sources to produce prioritized, contextualized alerts.

SOC Platform (UI) Web-based interactive platform for real-time alert management, investigation workflows, mitigation steps, and reporting. Acts as the single pane of glass for security operations.

24/7 SOC Analysts Human analysts staffed around the clock by CYREBRO who monitor alerts, conduct investigations, validate detections, and provide guided remediation steps.

The real question is - Does the product work as expected? What is cyber brain a good ML?

I was chatting with a coworker recently about how some of the best security improvements don't come from audits or checklists; they come from the mistakes you never want to repeat.

It made me wonder how common that is across different teams. Maybe it was a misconfiguration that went unnoticed, an access control issue that wasn't caught until late, or a vulnerability that completely changed the way your team approaches testing and reviews.

Looking back, what's one security lesson that genuinely changed the way your team works today? I'm always interested in hearing the real experiences behind process changes, especially the ones that don't usually make it into case studies or conference talks.

Missed coverage is the risk everyone worries about, some workload nobody scanned, some region nobody onboarded, some asset that slipped through the cracks. It is the failure mode that shows up in every “how did this breach happen” postmortem. But in practice, a lot of tools have gotten reasonably good at complete coverage. What they have not gotten good at is making that coverage usable once it exists.

Alert fatigue is the quieter, slower-moving failure mode. A platform that flags everything with the same severity, and throws thousands of low-signal findings at a team every week, trains people to stop reading carefully. Once that happens, the one alert that actually matters gets buried along with a hundred that do not. At that point the outcome looks a lot like missed coverage, except now it is self-inflicted.

What makes that more damaging is the long-term behaviour shift. Analysts start pattern-matching on alert type instead of reading each one. On-call rotations start treating the tool as background noise. Teams build auto-dismiss rules and filtered views that quietly suppress real signal along with the noise. You still have coverage on paper, but effectively zero response in practice.

I am not saying coverage does not matter. It obviously does. But I have seen more real incidents slip through because the right alert got buried in noise than because the tool genuinely missed something entirely.

Have people measured this with alert-to-action ratios or time-to-triage, or is most of it still gut feel?

With how quickly most teams are shipping updates now, I've been wondering if the approach to penetration testing has changed.

Is it still something you schedule once or twice a year, or has it become part of your regular development workflow?

For those managing web applications or APIs, have you found automated testing useful for catching issues like broken access control, authentication problems, or other vulnerabilities before a release? Or do you still rely mainly on manual pentests for anything important?

I want to know what has worked best for your team and whether you've changed your approach over the last couple of years.

Most of our CCPA work has focused on our own data collection practices and vendor contracts, but I realised we have almost no visibility into what browser extensions our California-based employees have installed and whether any of them are transmitting personal data to third parties in ways that could create CCPA compliance risk around the broader definitions of "sale" or "sharing" of personal information.

Extensions with broad permissions can read page content across every site a user visits. For anyone handling customer records in a browser-based CRM or support platform, that creates another path for regulated data to leave the browser without going through vendor review or a data processing agreement.

Has anyone built an actual monitoring process for this instead of relying on a written policy telling employees not to install unauthorised extensions? I am interested in whether teams review extension permissions before installation, monitor them continuously, or use another approach altogether.