Maya Anaya

September 27, 2026

The AI Data Leak You Miss Is the Agent Acting on Someone's Behalf

AI agents can move sensitive data with legitimate user access. Learn how to test on-behalf-of traffic, block risky transfers and prove control outcomes.

September 10, 2026

Stop Asking Whether Your AI Agent Is Autonomous. Ask Who Owns Its Actions.

AI agents can act autonomously, but accountability stays human. Learn four practical controls for ownership, permissions, approvals and auditability.

September 7, 2026

The New AI Governance Test: Can You Stop an Agent Mid-Task?

AI agent governance now depends on runtime visibility, scoped permissions, approval gates and a tested kill switch—not just pre-deployment review.

August 23, 2026

AI Agents Are Forcing Zero Trust to Leave the Network

AI agents demand action-level zero trust. Learn how to replace standing access with bounded authority, verified tool calls and an action ledger.

July 29, 2026

AI Sovereignty Is Not a Cloud Location. It Is a Control Plane.

IBM's new APAC AI-first blueprint puts sovereignty at the centre of enterprise AI. Here is why data residency alone will not control shadow AI or agent risk.

July 26, 2026

Your AI Agent Rollout Has an Approval Debt Problem

New joint cyber guidance says never give AI agents broad access. Learn how approval debt builds, why discovery is not governance, and what to control.

July 22, 2026

54% of Enterprises Have Had an AI Agent Incident. The Root Cause Is Identity.

New research shows most enterprises let AI agents share credentials. Here is what that means for your blast radius - and how AI governance closes the gap.

July 9, 2026

AI Agents Do Not Just Act. They Remember.

AI agent memory changes enterprise risk. Learn how CISOs should govern stored context, access revocation, memory poisoning, retention, and audit logs.

July 4, 2026

Your Enterprise Has AI Agents. Your Controls Haven't Caught Up.

IBM and NIST just made the enterprise AI problem harder to ignore: agents are scaling faster than governance, and static guardrails are not enough. Here's what mature control actually looks like.

May 17, 2026

The AI Agent Risk Nobody Can Patch With a DLP Rule

AI security has moved beyond prompt leakage. Learn why agent permissions, mobile AI usage, and action-level auditability are the next enterprise governance gap.

May 10, 2026

Forrester Says an AI Agent Will Cause a Major Enterprise Breach in 2026. Most Security Teams Aren't Ready.

Forrester predicts an agentic AI deployment will cause a major public breach in 2026 — and it won't come from external attackers. Here's what the data shows and what enterprise security teams need to do now.

May 6, 2026

Your SBOM Is Missing Half the Picture. Welcome to the Age of AI-BOMs.

Shadow IT became shadow AI. Now enterprises need AI Bills of Materials to track every model, agent, MCP server, and agentic workflow in their environment. Here's why your SBOM can't cover it.

May 3, 2026

Your AI Vendor Decides What You Can Do With Their Tools. The Pentagon Didn't Like That Answer.

OpenAI is gatekeeping GPT-5.5 Cyber. Anthropic fought the Pentagon over guardrails. Both stories reveal the same uncomfortable truth: your AI vendor controls your AI governance — unless you build your own layer.

May 1, 2026

The Same AI Tools Your Developers Love Are Being Used to Hack Them

North Korean hackers used ChatGPT and Cursor to steal $12M. PyTorch Lightning was compromised in a supply chain attack. AI tools are now both the productivity layer and the attack surface — here's what enterprise security teams need to know.

April 27, 2026

Shadow AI, Agentic Identity, and Why Blocking AI Fails - with Abbas Kudrati

Aona AI interviews Abbas Kudrati on shadow AI, agentic identity, AI governance, and why blocking AI tools often creates more risk than it removes.

April 26, 2026

Your Employees Trust Microsoft Teams. Attackers Are Counting On It.

A new malware campaign called Snow exploited Microsoft Teams to bypass enterprise defenses. Here's what it reveals about the blind spots in most AI governance strategies — and what to actually do about them.

April 19, 2026

When Your AI Coding Agent Becomes the Attacker: The Prompt Injection Threat Enterprises Are Ignoring

Security researchers hijacked Claude, Gemini, and GitHub Copilot using a new prompt injection technique — stealing API keys with a single PR title. Here's what enterprise security teams need to act on now.

April 12, 2026

Shadow Agents in 2026: The CISO Guide to Employee-Built AI Agents

Employees are building AI agents that touch CRM, email, files and workflows outside IT visibility. Learn the governance controls CISOs need now.

April 5, 2026

An AI Agent Hacked a Hardened OS in Four Hours. Here's What That Means for Enterprise Security.

An autonomous AI agent compromised a hardened OS kernel in four hours. Combined with growing shadow AI exposure, here's what enterprise security teams need to do now.

April 1, 2026

Microsoft Just Added Shadow AI Controls to Edge. Here's Why That's Not Enough.

Microsoft announced Shadow AI protection in Edge for Business at RSAC 2026. It's a useful control — but browser-level DLP alone doesn't give enterprises the full AI governance picture. Here's what it misses.

March 26, 2026

What is an AI Agent? The Enterprise Guide for Business Leaders

March 26, 2026

AI Agent Security Risks: 8 Attack Vectors Every CTO Needs to Know

Discover the 8 critical AI agent security risks every CTO must understand — from prompt injection to privilege escalation. Learn how to test and defend your AI systems.

March 23, 2026

Shadow AI Agents: The Invisible Risk in Your Enterprise

Employees are deploying autonomous AI agents—Cursor, Windsurf, GPT Actions—without IT visibility. Here's what the risk looks like and how to find them.

March 23, 2026

MCP Servers and Enterprise Security: What Your Security Team Needs to Know

Model Context Protocol (MCP) is the new enterprise attack surface. How MCP servers expose internal tools to AI agents—and the specific risks your security team must address.

March 23, 2026

Agentic AI Compliance: GDPR, SOC 2, and ISO 27001 Implications

Agentic AI creates specific compliance gaps under GDPR, SOC 2, and ISO 27001. Here's what breaks and how to address data residency, audit trails, and consent.

March 19, 2026

Microsoft Copilot Compliance 2026: CISO Controls for M365 Enterprises

Microsoft Copilot can expose sensitive M365 data through permissions, retention and eDiscovery gaps. See the compliance controls CISOs need before rollout.

March 16, 2026

Shadow AI Compliance 2026: The CISO Playbook for Every Regulation

GDPR, EU AI Act, APRA, SOC 2, ISO 42001 — Shadow AI creates exposure under all of them. This CISO playbook maps every regulation, the enforcement risks, and the governance steps that actually reduce liability.

March 16, 2026

Shadow AI Agents: 7 Risks Your Security Stack Cannot See in 2026

Shadow AI agents bypass CASB, DLP, and SSO logs without a trace. Discover the 7 invisible risks - and the CISO controls that find them before damage is done.

March 11, 2026

Bring Your Own Model: The Shadow AI Threat Your Network Can't See

Employees are running powerful AI models locally on corporate laptops — no cloud, no network traffic, no audit trail. BYOM is the shadow AI blind spot your security tools will miss.

February 13, 2026

Shadow AI Agents: 7 Attack Vectors Every CISO Must Know in 2026

Unmanaged AI agents exfiltrate data, abuse credentials, and move laterally without triggering a single DLP alert. Here are the 7 attack vectors security teams must address now.

February 10, 2026

The Shadow AI Problem: Why Your Employees' Favourite AI Tools Are Your Biggest Blind Spot

Shadow AI is the fastest-growing security blind spot in enterprise. Learn why blocking AI tools fails, and how to govern AI adoption with visibility, guardrails, and real-time coaching.

October 29, 2025

7 AI Security Threats Facing Australian Enterprises in 2026 — With Defences

From prompt injection to AI supply chain attacks, Australia faces a distinct AI threat landscape in 2026. Security leaders share the seven risks you must address — and the controls that work.