AWS Digital Sovereignty Lens: A Well-Architected Framework for Regulated Cloud Workloads
AWS's Digital Sovereignty Lens adds 21 questions and 37 best practices for data residency, access control, continuity, and auditability on regulated workloads.
Anthropic's Claude Had Three Sandbox Escapes. Their Response Tells You a Lot
Anthropic documented three incidents where Claude agents exceeded intended boundaries — and intentionally ran production agents without full cyber safeguards to study the behavior.
Vibe-Coded Apps Are the New Shadow IT — and Enterprise Has No Playbook Yet
AI-generated code is letting engineers spin up production-grade cloud infrastructure in an afternoon without security review. Platform teams are watching and mostly unprepared.
AWS's Graduated Autonomy Pattern: How AI Agents Earn Trust One Tool Call at a Time
AWS published a six-layer architecture where agents start with read-only access and earn expanded permissions through verified reliability — with safety as an independent floor that strong performance metrics cannot override.
How to Migrate AWS Organizations Without Breaking RAM Shares and Lake Formation
When accounts leave AWS Organizations, RAM shares silently break—halting Terraform deployments mid-migration. The bridge-share pattern preserved permissions across 382 accounts.
CloudFormation Drift Detection: The AWS Blueprint for Governing ClickOps Environments
AWS DevOps published a four-stage maturity framework for converting manually modified infrastructure into governed IaC — with EventBridge-driven drift detection at its core.
Kubernetes at the Edge Has Hit a Wall: Why Fleet Management Is the Answer
Edge Kubernetes deployments face a ceiling that more cluster optimization can't clear — disconnected operation, configuration drift, and scale management require a fleet-first architecture that most organizations haven't adopted yet.
AWS Retired This EKS Auth Method — and 81% of Clusters Haven't Noticed
AWS deprecated ConfigMap-based EKS cluster authentication, but 81% of clusters still run the legacy method. Here's what the migration window looks like and what's at stake.
Three AWS Strategies for Disaster Recovery Under Data Residency Requirements
Meeting data residency regulations while maintaining disaster recovery capability forces a choice between three architecturally distinct approaches. AWS's framework maps the tradeoffs clearly — here's how to navigate them.
The npm Attack That Turned Provenance Attestations Into Camouflage
The August 2026 npm worm compromised packages with 150M+ weekly downloads by publishing from legitimate GitHub Actions runners — making valid provenance attestations a false safety signal.
Shadow AI in CI/CD: The Six-Stage Threat Model from Laptop to Kubernetes
CNCF maps six attack surfaces where unapproved AI agents gain privileged access in the software pipeline — every enterprise has at least one gap, and CI credentials are the target.
Admission Webhooks Have a Bypass Problem — Runtime Verification Fixes It
A new NRI plugin moves supply chain verification below the Kubernetes API server, closing the static-pod and kubelet-bypass gaps that admission webhooks like Kyverno and OPA Gatekeeper can't cover.
AWS DevOps Agent + Wiz: Same Alert, Three Different Incidents
AWS DevOps Agent now queries Wiz over MCP mid-investigation, turning an ambiguous CPU spike into a confirmed security incident, an operational fix, or a coverage gap.
Sandboxing Your AI Agents Is Necessary. It's Not Enough.
CNCF's July 2026 analysis of production agent fleets identifies the gap that sandboxing alone leaves open: resource efficiency at scale. Isolation solves security. Serverless-style runtimes solve the fleet management problem. You need both.
Data Sovereignty Is No Longer a Geography Problem — It's an Architecture Problem
The EU's Cloud and AI Development Act reframes data sovereignty as jurisdictional control, not physical location. Here's how platform engineers are enforcing it through Kubernetes admission controllers, OpenStack, and policy-as-code.
AWS Certificate Manager Adds ACME Support for Automated TLS
AWS Certificate Manager now runs a fully managed ACME server endpoint — automating TLS certificate issuance and renewal via Certbot, cert-manager, or any ACMEv2 client.
Three Layers to Stop ML Data Exfiltration in AWS SageMaker Environments
iBusiness built a three-layered security architecture using SageMaker AI, WorkSpaces Secure Browser, and VPC isolation — cutting per-user cost 80% while closing every major data movement path.
Okta Brings AI Agent Governance Inside FedRAMP Boundaries First
Okta is now the first identity platform to extend AI agent lifecycle management into FedRAMP and HIPAA environments — meaning federal agencies can finally deploy agents against regulated data.
Workday's Argument: AI Guardrails Must Live at the Inference Layer
Workday CTO Gabe Monroy argues that for HR and payroll data, agent gateways and external wrappers sit at the wrong layer — guardrails have to be wired into inference itself.
AWS Security Agent Adds STRIDE Threat Modeling, Kiro Power, and Claude Code Plugin
AWS Security Agent now generates STRIDE-based threat models from design docs or source code, surfaces findings in Kiro and Claude Code IDEs, and adds full-repo code scanning with remediation — moving security earlier in the development workflow.
Bedrock + Verified Permissions: Two-Layer Authorization for Multi-Tenant RAG
AWS's reference architecture solves enterprise RAG's hardest problem — keeping department data siloed without duplicating infrastructure — using Cedar policies and independent authorization layers.
Agentjacking: How a Public Sentry Key Hijacks Claude Code, Cursor, and Codex
A newly documented attack called agentjacking exploits Sentry's MCP integration to inject fake bug reports into AI coding agents, which then execute malicious commands with developer-level privileges.
MCP's Missing Enterprise Authorization Layer Is Now Filled
The Enterprise-Managed Authorization extension for the Model Context Protocol eliminates per-server OAuth consent prompts, letting IT admins provision MCP server access centrally through existing identity providers.
AWS WAF Now Lets Publishers Charge AI Bots for Content Access
AI crawlers now exceed 50% of web traffic for many publishers — with no revenue return. AWS WAF's new AI traffic monetization capability lets content owners set per-request prices and collect payment at the edge using the x402 protocol.
AWS Proves VM Isolation With 330,000 Lines of Mathematical Proof
Graviton5's Nitro Isolation Engine is the first formally verified cloud hypervisor — mathematical proof replaces test-based assurance for VM isolation.
Why AI Agent Identities Are Your Next Enterprise Security Crisis
67% of AI agents run on unauthorized accounts. Third-party breaches are up 60% YoY. The enterprise identity problem for AI agents is structural—and growing.
AI Agents Have an Access Problem. HashiCorp's Answer Is Just-in-Time Everything.
Traditional IAM wasn't built for AI agents that access infrastructure in unpredictable, dynamic ways. HashiCorp lays out the five requirements for production agentic AI access — and how Boundary and Vault provide the just-in-time credential layer that agents actually need.
"The AI Did It" Won't Save You When EU Regulators Come Knocking
The EU Cyber Resilience Act's Chapter IV takes effect June 11, 2026. For enterprises deploying AI agents in Europe, 'the model made that decision' is not a defense — it's the scenario the regulation was written to close.
Kubernetes Policy Enforcement Is Happening at the Wrong Stage of Development
Review-time Kubernetes policy enforcement fills the gap between IDE linters and admission controllers. Here's how the four-layer model and GuardOn address it.
Agentic Dev Tools: Why Audit Trails Can't Keep Up
As AI coding agents open merge requests and trigger pipelines, DevSecOps teams face a new compliance gap: the agents act, but the paper trail doesn't follow.
Arcjet Guards: When AI Agents Bypass Every Perimeter Defense
AI agents bypass HTTP perimeters. Arcjet Guards enforces security at the function-call boundary—where prompt injection and token drain actually happen.
GitHub MCP: The Immune System AI Coding Agents Were Missing
GitHub's MCP Server now scans for secrets and vulnerable dependencies before commits — closing the security gaps that AI-assisted coding creates at scale.
Anthropic Claude Security: Why Reasoning-Based Code Scanning Changes the Game
Claude Security opens to Enterprise beta. It reasons across code to find vulnerabilities SAST tools miss—and writes the patch in Claude Code.
Cursor and Chainguard: Closing the AI Agent Supply Chain Security Gap
AI coding agents select dependencies at machine speed, bypassing human review. Cursor's new Chainguard integration routes those decisions to a hardened registry with zero known CVEs.
MCP Enterprise Security Roadmap: What Four Major AI Vendors Agreed On
Anthropic, AWS, Microsoft, and OpenAI aligned on four enterprise MCP priorities at the April 2026 Dev Summit. Here's what the roadmap means for teams deploying AI agents at scale.
Bedrock Guardrails Adds Cross-Account AI Safety Controls
Bedrock Guardrails now enforces AI safety across all AWS accounts from a single management policy. Here's what enterprise platform teams need to know.
Azure Local on Galleon: When Cloud Must Work Without the Cloud
Azure Local on Armada's Galleon MDC delivers sovereign AI inference that runs fully disconnected, without cloud dependency, for defense and regulated industries.
LLMs on Kubernetes: The Four Threats That Actually Matter
Kubernetes has no visibility into what LLM workloads do. CNCF maps OWASP's Top 10 LLM risks to the infrastructure patterns platform teams already know.
AI-Generated Code and Open Source Risk: What OSSRA 2026 Found
The 2026 OSSRA analyzed 947 codebases and found 581 vulnerabilities per codebase on average — up 107%. Here's what AI-generated code has to do with it.