Trust & Security
Anthropic’s CNA Designation Marks the Industrialization of Vulnerability Discovery
The 282nd U.S. CVE Numbering Authority is now assigning CVE IDs at scale. The disclosure pipeline isn't ready.
◆ Heath Callahan
Beat
Trust & Security
-
-
Trust & Security
Shadow AI Doubles to 43% of Breaches as AI-Driven Attacks Add $1 Million Per Incident
IBM's annual breach study finds ungoverned AI adoption outpacing security frameworks, with 92% of organizations hit by AI breaches lacking basic access controls.
◆ Heath Callahan
-
Trust & Security
EU’s AI Act ‘Teeth Pulled’ by Digital Omnibus Deferring High-Risk Obligations 16 Months
The EU just gave the AI industry a 16-month compliance reprieve — not because companies were ready, but because the enforcement infrastructure wasn't.
◆ Heath Callahan
-
Trust & Security
Cyera’s $1B Bet on Oasis Security Prices the Agent Identity Gap at Last
The first billion-dollar acquisition in non-human identity security validates a governance gap that 92% of CISOs say they cannot close with existing tools.
◆ Heath Callahan
-
Trust & Security
AI Is Finding Software Flaws Faster Than the Exploit Infrastructure Can Track or Fix Them
Discovery volume is doubling year over year. Actual exploitation is not keeping pace. The NVD is overwhelmed, exploitation windows have collapsed to hours, and the industry is scrambling to adapt.
◆ Heath Callahan
-
Trust & Security
Nvidia’s Open Secure AI Alliance Has 37 Members. The Four That Aren’t There Tell the Real Story.
OpenAI, Google, Anthropic, and Meta declined to join a defensive coalition formed in direct response to an OpenAI-caused breach. The industry's security divide just became structural.
◆ Heath Callahan
-
Trust & Security
Kimi K3 Assisted Offensive Cyber Ops ‘Without Pushback.’ Its Open Weights Drop Today.
A joint UK-US assessment found the model's safeguards failed during testing. With the open-weight release now live, no API guardrails remain for self-hosted deployments.
◆ Heath Callahan
-
Trust & Security
The EU AI Act Hits in Six Days. The Enforcement Infrastructure Doesn’t Exist.
The law becomes binding August 2 with penalties up to 7% of global turnover. But 78% of organizations haven't started compliance, 12+ Member States lack enforcement authorities, and the AI Omnibus extension has created fog over which obligations even apply.
◆ Heath Callahan
-
Trust & Security
NadMesh Botnet Marks the Shift From AI Compute Theft to Credential Harvesting
A purpose-built botnet is hunting exposed AI services not for their GPUs, but for the cloud keys and Kubernetes tokens that unlock the broader enterprise. MCP exploitation sits at the top of its priority list.
◆ Heath Callahan
-
Trust & Security
OpenAI’s Rogue Agent Breach Exposes a Regulatory Vacuum California Can’t Close
SB 53's disclosure mandate doesn't cover evaluation-related containment failures. The Hugging Face breach — and the guardrail paradox that followed — reveals how far the law trails the capability.
◆ Heath Callahan
