Cloud Security Alliance

In June, Google DeepMind did something unusual: it published an AI control roadmap premised on the idea that its own AI agents might turn against it. The AI Control Roadmap treats advanced internal agents as potential insider threats — the way a company treats a rogue employee who already has badge access. It builds on MITRE ATT&CK with a new taxonomy, TRAIT&R (Taxonomy...

Research conducted in collaboration with Jazz finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization  SEATTLE – Oct. 13, 2026 — Data loss prevention (DLP) tools are often functioning as after-the-fact forensic systems rather than prevention controls, according to DLP in the AI Era, a new...

In April 2026 the Cloud Security Alliance, working with our partners SANS and RSAC, first published The “AI Vulnerability Storm”: Building a “Mythos-ready” Security Program that opened the floodgates on our research for understanding and preparing for the emergence of advanced, adversarial AI. The goal is to determine how we, as defenders, can best prepare our organizations for ...

A sparkle icon shows up in the CRM. Nobody in IT deployed it. Account executives start using it to summarize renewal risk across their book, and the help desk is fielding tickets about whether it's allowed. Security can't answer with evidence. This is now the normal state of enterprise SaaS. Zoom gave admins four days in July 2024 to opt out before AI Companion auto-enabled. Mi...

AI agents select tools, invoke APIs, retrieve data, act under delegated user context, and create outbound connections at runtime. That autonomy can make them useful. It also means you need to know which agents can reach which tools, models, APIs, and data sources, and in what context. Zero Trust microsegmentation can help. By enforcing explicit, fine-grained communication contr...