This episode of Security Intelligence explores the "Promptware" kill chain for AI attacks, moving beyond simple prompt injections. The discussion also covers evolving cloud attack trends targeting ecosystems over infrastructure, ransomware gangs "living off the land" with native tools, and the critical yet overlooked "rusting edge" of OT security.
This episode explores the security risks of AI, including 'agentic blabbering' in AI browsers that aids phishing attacks, the ability of models like Claude Opus to resurrect vulnerabilities in legacy code, the debate on 'shift left' security practices, and new threats like AI-generated 'ephemeral malware' and the challenges of the post-authentication perimeter.
Agentic AI introduces a massive number of non-human identities that traditional, human-centric Identity and Access Management (IAM) systems are not equipped to handle. This creates significant security gaps, including lack of accountability, overprivilege, risky delegation, and the dangerous 'last mile' problem. The solution lies in adopting a Zero Trust approach with five key imperatives: registering all agents, stripping static privileges for just-in-time access, tying actions to intent, enforcing security at the point of use, and proving control through comprehensive audits. Implementing this requires a combination of orchestration, governance, and unified observability across security, IT, and development teams.
A deep dive into the [un]prompted AI security conference, the new Zero Day Clock initiative for vulnerability management, the emergent risks of autonomous AI agents, and the pervasive issue of burnout in the cybersecurity field.
A detailed breakdown of the updated OWASP Top 10 vulnerabilities for Large Language Models (LLMs), explaining threats like prompt injection, data poisoning, and supply chain risks, along with practical defense strategies.
Experts from IBM discuss the nuanced role of AI in mainframe modernization, the immense infrastructural and product challenges behind global AI adoption, and the critical need for a multi-layered, security-by-design framework for the safe deployment of AI agents.