Security
A report released by the SANS Institute on Monday indicates that enterprise security teams are integrating AI into security programs at an unprecedented speed, but there is a significant gap in governance policies supporting this expansion. The survey shows that 40% of security practitioners report their organizations have no formal AI adoption policy, and over 60% cannot track where AI models are used or what types of information are exposed. About 75% of practitioners bear governance responsibilities related to enterprise AI, but more than half of respondents say they lack an established AI audit framework. Report author Matt Bromiley points out a 14-percentage-point perception gap between security leaders and frontline practitioners, reflecting the practical challenges of governance implementation.
The Trump administration announced on Tuesday the launch of the Gold Eagle project, aimed at coordinating the use of cutting-edge AI models in vulnerability discovery and remediation to address the surge in vulnerabilities caused by AI and pressure on the security community. The project, in collaboration with Carnegie Mellon University and based on the VINCE platform, focuses on open-source software but faces challenges such as overlap with existing private sector initiatives and the expiration of CISA's authorization.
Recently, a threat actor claiming to be "888" stated that they breached Accenture's systems in early July, stealing approximately 35GB of data, involving source code, Azure personal access tokens, RSA encryption keys, and SSH keys. An Accenture spokesperson stated that the issue has been fixed, but analysis by security firm SOCRadar indicates that the leaked source code and keys may expose Accenture and its clients to further attacks. This incident is not isolated, as Accenture previously suffered a LockBit ransomware attack and data exposure due to AWS misconfiguration.
According to a report released Tuesday by Information Services Group, U.S. companies are incorporating cyber risk issues into overall enterprise risk strategies, with AI adoption and business resilience driving significant shifts in business priorities. Cybersecurity is increasingly seen as a critical business issue, with companies accelerating the adoption of agentic AI and transitioning to hybrid or multi-cloud environments. Corporate leadership is closely integrating cyber spending decisions with overall IT strategy, with C-suite executives and board members taking on greater responsibility for business continuity, financial risk, and compliance.
Anthropic reopened access to its advanced AI models Fable and Mythos on Wednesday after the Trump administration lifted export control restrictions. Fable 5 is generally available again, while Mythos 5 remains limited to trusted partners. The company stated it has improved safety classifiers and called for a unified standard for assessing jailbreak severity.
ServiceNow and Accenture have partnered to launch integrated security services, combining the ServiceNow AI platform with Accenture's AI migration tools to help enterprises address security risks brought by agentic AI and accelerate the transition from legacy systems to modern platforms.
Several technology companies, including Anthropic, AWS, IBM, and Microsoft, have announced the formation of the Akrites Alliance to discover, disclose, and fix security vulnerabilities in open source software. Led by the Linux Foundation, the alliance will establish shared security incident response teams and coordinated vulnerability disclosure mechanisms to address the dramatically increased speed of vulnerability discovery and the risk of malicious exploitation brought by cutting-edge AI models.
Facing pressure on AI investment returns, enterprise CIOs can draw on the public sector's lean innovation experience. New York State CIO Dru Rai emphasizes achieving sustainable AI applications through controlled experimentation, pragmatic technology choices, and prioritizing security and privacy within limited budgets.
A survey jointly released by the Information Systems Security Association (ISSA) and Omdia shows that despite the increasingly widespread application of AI in the cybersecurity field, nearly 70% of practitioners report that their work has become more difficult over the past two years, and the issues of talent attrition and skill gaps remain severe.
AWS announced AWS Continuum and AWS Context, two agent tools, at the AWS Summit in New York City on Wednesday. The former is used to identify and fix security risks, while the latter serves as a search layer based on enterprise data to enhance agent decision-making. Additionally, AWS expanded the capabilities of AI tools such as Kiro, AWS DevOps Agent, AWS Transform, and Amazon Bedrock AgentCore, and updated Amazon Quick (released last year as Quick Suite).