control failure
8 posts
Your AI features are now your attack surface
Meta has confirmed over 1,000 Instagram accounts were compromised through abuse of its AI chatbot - a board-level view of the control failure.
The agent is the breach
A board-level assessment of the Microsoft Copilot Cowork file exfiltration: control failure, exposure model, and the conditions that must hold for in-tenant agents.
Your AI sessions are outside your control perimeter.
A board-level risk statement on the Claude AI file exfiltration demonstration: control failure, exposure, and what must be true going forward.
CISA is holding the leak with its hands
CISA is in containment mode after a data leak. What containment actually means, what failed, and why the assurance claim is now suspended.
CISA pushed passwords to a public repo
A top cyberdefense agency published credentials in a public GitHub repository. A control analysis of what failed and what must now be true.
NVD stopped, your scanner didn't notice
NVD enrichment is no longer keeping pace with CVE volume. What that breaks inside vulnerability management programs, and what operators must now own.
A license audit caught the breach
A six-week account takeover surfaced during a license audit. The detection vector defines the control failure.
License audit caught a six-week account takeover
A six-week account takeover surfaced in a license audit that never checked access legitimacy. Why that gap is a control failure, not a breach.