security controls

Third-Party Risk Management: You Can Outsource the Task — Not the Risk

/ , ,

Third-Party Risk Management (TPRM) has evolved into a critical strategic capability as companies increasingly rely on third parties, exposing themselves to significant cybersecurity, compliance, supply chain, and sustainability risks. Regulatory bodies in the U.S., EU, Germany, and Brazil mandate that while companies may outsource tasks, they retain accountability for third-party failures, reinforcing the need for comprehensive, lifecycle-based risk programs integrated with broader enterprise risk management. Effective TPRM programs enable organizations to anticipate and mitigate risks through continuous monitoring, due diligence, contractual controls, and adaptability to emerging challenges such as AI, ultimately protecting operational resilience, regulatory compliance, and corporate value.

https://www.alvarezandmarsal.com/thought-leadership/third-party-risk-management-you-can-outsource-the-task-not-the-risk

The Due Diligence Blind Spot Every Fintech Acquirer Should Worry About in 2026

/ , , , ,

Sergiy Fitsak highlights a critical blind spot in fintech acquisitions centered on insufficient due diligence regarding technology infrastructure and security vulnerabilities. He emphasizes that overlooking these technical risks can lead to operational disruptions, compliance failures, and financial losses post-acquisition. The article urges acquirers to integrate comprehensive technical assessments into their due diligence processes to safeguard long-term value and stability.

https://www.finextra.com/blogposting/32365/the-due-diligence-blind-spot-every-fintech-acquirer-should-worry-about-in-2026

Shadow AI Is Really a Workflow Problem

/ , , ,

As law firms integrate AI into legal work, the primary challenge is not just unauthorized technology use (“Shadow AI”) but inconsistent, unofficial workflows (“Shadow Workflows”) created by individual lawyers lacking firm-wide guidance. This leads to varied AI practices within the same firm, undermining governance, quality consistency, and institutional knowledge while exposing lawyers and clients to operational risks. Effective AI governance requires designing shared, scalable workflows and organizational capabilities that enable responsible, consistent AI use beyond mere technology approval.

https://aceds.org/shadow-ai-is-really-a-workflow-problem-ai-blog/

Forget Data Leakage: Shadow AI’s Real Threat Is Access Control

/ , ,

Shadow AI in enterprises has evolved from a data leakage issue to a complex access control challenge, as AI agents increasingly act autonomously with broad permissions on critical systems. These agents, created rapidly across departments via various tools, can read, write, and modify data using inherited credentials, often without clear ownership or oversight, posing significant security risks beyond traditional controls. Effective governance requires continuous discovery, ownership assignment, scoped access, and automated lifecycle management of AI agents to prevent unauthorized actions and exposure within organizational environments.

https://thehackernews.com/2026/06/forget-data-leakage-shadow-ais-real.html

Why Culture Matters More Than You Think When Complex Tech Goes Wrong

/ , ,

Megan Owen argues that organizational culture plays a critical role in the success or failure of complex technology projects, emphasizing that hierarchies suppressing open communication often lead to unreported problems and compounded failures. Drawing parallels with aviation and healthcare, she advocates for environments that encourage candid dialogue, psychological safety, and reflective learning through checklists and mentorship to identify latent errors and address them proactively. Technology leaders must foster trust, listen carefully to early warnings, and balance assertive decision-making with collaborative problem-solving to prevent and mitigate costly project failures.

https://www.computerweekly.com/opinion/Why-culture-matters-more-than-you-think-when-complex-tech-goes-wrong

AI Innovation Surges as Security Fundamentals Lag, Kroll Research Finds

/ , ,

Kroll’s global research highlights a significant gap between rapid AI adoption and the maturity of security fundamentals, revealing that 76% of organizations experienced AI-related security incidents in the past two years. Despite AI’s integration into enterprise operations, many firms lack foundational security practices and governance frameworks, leading to substantial financial losses and insufficient investment in AI security measures. The study underscores that higher cyber maturity correlates with fewer AI security incidents, emphasizing the need for robust security foundations to enable sustainable AI innovation.

https://channeleye.media/ai-innovation-surges-as-security-fundamentals-lag-kroll-research-finds/

Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards

/ , , ,

Anthropic has released Claude Fable 5, its most advanced AI model to date, featuring integrated cybersecurity safeguards that route risky requests to a less capable model to prevent misuse. Alongside Fable 5, Anthropic offers Claude Mythos 5— the same powerful model without these restrictions—exclusively for vetted cybersecurity professionals to safely leverage its exploit-finding capabilities. This dual-product approach addresses the risk of malicious use while supporting defenders in vulnerability discovery and patching, highlighting the evolving challenges and strategies in securing AI-driven software vulnerability management.

https://thehackernews.com/2026/06/anthropic-releases-claude-fable-5-its.html

Our Data Security Policy Is Transparent in That It Doesn’t Exist

/

The article discusses the shortcomings of current data security tools, highlighting that while they effectively detect sensitive data like credit card numbers, they often miss critical context such as data access lineage and proper authorization, resulting in fragmented views across policy, security, and business functions. Experts on the CISO Series Podcast emphasize the need for integrated, system-level visibility—akin to an MRI rather than an X-ray—to effectively govern data security, especially as AI-driven data usage increases, underscoring challenges and the importance of continuous evaluation and simplification of security controls.

https://cisoseries.com/our-data-security-policy-is-transparent-in-that-it-doesnt-exist/

The AI Governance Imperative You Can’t Afford to Ignore

/ , ,

CIOs deploying AI agents without proper observability and governance risk significant negative consequences, as many organizations lack centralized control and tracing of AI actions. Experts emphasize the necessity of scalable governance frameworks that include continuous monitoring, human oversight, and detailed audit trails to ensure transparency, security, and compliance in autonomous AI workflows.

https://www.cio.com/article/4176067/the-ai-governance-imperative-you-cant-afford-to-ignore.html

NSA Launches Zero Trust Implementation Guidelines Resource Webpage

/ , , ,

The National Security Agency (NSA) has launched a new resource webpage providing guidelines for implementing Zero Trust architecture. This initiative aims to assist organizations in enhancing their cybersecurity posture by adopting Zero Trust principles more effectively.

https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4496862/nsa-launches-zero-trust-implementation-guidelines-resource-webpage/

Scroll to Top