Cybersecurity Insights & Expert Analysis
‍

Most work sold as AI security testing is application testing with a model somewhere behind it. The model layer has its own failure modes, and testing them needs different access, different tooling and a different report.

Containment, evidence and root cause all assume a machine you can isolate. An agent acting through a dozen tool calls under a shared identity breaks each one.

ATLAS gets cited in decks and skipped in test plans. Thirteen techniques from release 2026.09, the test each one becomes, and what a result proves.

Vendors document their guardrails' limits in their own manuals. OWASP, NIST and MITRE all say detection-based guardrails decay. Here is how to measure yours.

We self-hosted an open model for an autonomous pentest agent and it passed 63% of a 295-test compatibility suite. Moved to a managed serving path, the same model family hit 99%. The model was never the problem — the serving stack was.

CISA lists this one under Google Brotli, and the entry never mentions Node.js. Patching your runtime fixes it on some hosts, does nothing on others, and was never needed on a third set. Here is how to tell which you have.

Two critical PHP remote code execution flaws, patched 21 October 2026. The version number in your ticket cannot tell you whether you were exposed. Your SAPI, worker count and effective ini values can.

WordPress patched a race in its update staging path on 28 October; CISA listed it as actively exploited five days later. The extraction still runs from the version you are updating from.

A crosswalk is not evidence. What artifact actually satisfies each NIST AI RMF function, which subcategories a penetration test answers, and why aligned, certified and tested are three different states.

Policy says inventory your AI, but few define the artifact. What the G7 minimum elements actually require, which fields you can re-derive and which are only prose, and five ways to validate an AI-BOM instead of filing it.

AI changed the speed of testing, not which half was hard. What autonomous tools genuinely catch, what they still miss, and what makes a pentest a pentest.

There is no AI-specific SOC 2 and no AI trust services category. What there is, is an existing criterion your AI system quietly stopped satisfying. Where AI systems land in the common criteria, why the carve-out matters, and what evidence over a period means when prompts change weekly.