security controls – Page 4

Rising Identity Complexity: How CISOs Can Prevent It From Becoming an Attacker’s Roadmap

February 23, 2026 / security controls, authentication, IAM, cybersecurity

The identity surface has expanded dramatically, encompassing employees, contractors, machines, and cloud workloads, making identity management a critical security concern. IAM has evolved from an administrative utility to a proactive defense layer, integrating with security operations to detect and respond to identity-based threats. A threat-aware IAM strategy focuses on continuous posture assessment, attack path analysis, and automated mitigation to protect against credential misuse and privilege escalation.

https://thenewstack.io/ciso-identity-complexity-strategy/

AI Is Spreading Faster Than Companies Can Secure It, CISO Survey Finds

February 22, 2026 / security controls, report, trends, AI

AI adoption is outpacing security measures, per a Pentera survey of 300 U.S. CISOs. Key findings: 67% lack visibility into AI usage, 44% report lagging AI security, and major challenges include expertise shortages and reliance on outdated security controls. Despite funding for AI security, it lacks dedicated budgets, highlighting significant gaps in securing evolving AI systems amidst complex IT environments.

https://www.prnewswire.com/il/news-releases/ai-is-spreading-faster-than-companies-can-secure-it-ciso-survey-finds-302691361.html

Data Minimization Is Still an Underrated Security Control

February 21, 2026 / risk management, cybersecurity, security controls

Data minimization is an underrated security control that reduces the volume of sensitive data, thereby decreasing the impact of breaches and improving security operations. Despite organizations claiming to practice data minimization, the sheer volume of data often outpaces governance capabilities, thereby increasing risk. To effectively implement data minimization, organizations must challenge the “speculative” analytics mindset, audit data propagation, and automate retention processes.

https://www.databreachtoday.com/blogs/data-minimization-still-underrated-security-control-p-4049

Is Microsoft 365 a Compliant EDRMS?

February 16, 2026 / Microsoft, cybersecurity, cloud, security controls

Microsoft 365 can be used as an EDRMS if it complies with the Managing Digital Records in Systems Standard and the Minimum Recordkeeping Metadata Requirements Standard. Agencies must ensure information assets are protected, metadata is created, and information is accessible for the required duration. If M365 cannot be configured to meet these standards, integration with an EDRMS or saving information assets in an EDRMS is recommended.

https://archives.sa.gov.au/managing-information/Information-management/storing-information-assets/-is-microsoft-365-a-compliant-edrmsbusiness-system

The Hidden Cybersecurity Cost Of ‘Just-In-Case’ Decisions

February 5, 2026 / risk management, cybersecurity, budget, security controls

Organizations often accept risks unknowingly through “just-in-case” decisions, granting data access and keeping permissions active to avoid disruption. These decisions, while seemingly responsible, accumulate over time and create a larger attack surface, increasing the risk of security incidents. To mitigate this, organizations should implement practices like removing dormant accounts, setting expiration dates for temporary access, and treating access reviews as risk assessments.

https://www.forbes.com/councils/forbestechcouncil/2026/02/04/the-hidden-cybersecurity-cost-of-just-in-case-decisions/

75% of Organisations Have Gaps in Core Security Controls, Research Finds

February 2, 2026 / compliance, security controls

75% of organizations lack core security controls, with insufficient MFA, endpoint detection, and policy management. This results in overlapping exposures and significant risk, as seen in recent research by Nagomi Security. Misconfigurations are rapidly increasing exposure, and vulnerabilities are not the only concern. While vulnerability management is strong, identity and endpoint controls lag, leaving many assets unprotected. Progress should focus on eliminating high-impact exposure conditions rather than siloed metrics.

https://www.itsecurityguru.org/2026/01/29/75-of-organisations-have-gaps-in-core-security-controls-research-finds/

Аgentic AI Security Measures Based on the OWASP ASI Top 10

January 27, 2026 / security controls, AI, AI agent, threats

The OWASP Foundation released a playbook outlining the top 10 risks of deploying autonomous AI agents, including goal hijacking, tool misuse, and privilege abuse. These risks arise from the agents’ ability to make decisions and process data without human oversight. Mitigation strategies include enforcing least autonomy and privilege, using short-lived credentials, and requiring human confirmation for critical actions.

https://www.kaspersky.com/blog/top-agentic-ai-risks-2026/55184/

Who Approved This Agent? Rethinking Access, Accountability, and Risk in the Age of AI Agents

January 26, 2026 / risk management, AI, AI agent, security controls

AI agents boost productivity by automating tasks, but their rapid deployment complicates accountability, creating security risks. They bypass traditional access models, accumulating broad permissions without clear ownership. Three types of agents exist: personal (user-owned, low risk), third-party (vendor-owned, moderate risk), and organizational (shared, high risk). Organizations must rethink risk management, establish clear ownership, and map user-agent interactions to avoid authorization bypass problems. Unmanaged AI agents represent significant risks due to their autonomous nature and unclear responsibilities.

https://thehackernews.com/2026/01/who-approved-this-agent-rethinking.html

New Security Baseline Available for Microsoft 365 Apps for Enterprise

January 22, 2026 / cybersecurity, Microsoft, security controls

Microsoft enhances M365 Apps for Enterprise with new security baselines, improving defenses against cyber threats. Key updates include protections for Excel, PowerPoint, and system settings, blocking risky links, insecure protocols, and legacy automation features. Deployment can be done via Office cloud policies or Group Policy.

https://petri.com/microsoft-365-apps-enterprise-security-baseline/

Businesses in 2026: AI Security Oh Yeah Better Look at That

January 13, 2026 / risk management, AI, cybersecurity, security controls

Businesses are increasingly prioritizing AI security, with the number of organizations assessing AI tools for security risks almost doubling to 64% in a year. Many leaders view AI as a key driver of cybersecurity change, fearing data leaks and adversarial attacks. Geopolitical factors influence security strategies, especially in larger organizations. While most companies meet basic cyber resilience standards, significant concerns remain about ransomware and supply chain attacks.

https://www.theregister.com/2026/01/12/ai_security_wef_survey/