News and Tech Update

Austin, Texas / USA, September 9th, 2026, CyberNewswire Ninety-five percent of organizations believe they have visibility into their AI and machine identity exposures, yet only 36% are actually monitoring them. SpyCloud , the leader in identity threat protection, today released its annual SpyCloud Identity Threat Report , a survey-based study finding that non-human identities (NHIs) – the AI agents, service accounts, API keys, and authentication tokens that connect to internal systems – have become the most common route attackers take into the enterprise. SpyCloud 2026 Identity Threat Report, Source: SpyCloud The survey found that compromised NHIs (31%) are nearly 2x as likely to be the primary entry point compared to phishing and social engineering (17%), the second-ranked answer. NHI-related misuse was also the most commonly reported identity-based event type at 42%, yet the vast majority of organizations aren’t watching for them. While 95% of organizations believe they have ad...

Every security team that has run Dependabot against a private registry knows the drill. You need a personal access token, a safe place to store it, a reminder to rotate it, and a way to update it in dependabot.yml before it expires and quietly breaks your dependency updates. None of that is hard. It’s tedious, and people skip tedious security chores. GitHub has now closed that gap for its own registries. As of this week, Dependabot can authenticate directly to GitHub Packages, the GitHub Container Registry ( ghcr.io ), and other GitHub-hosted package registries without a PAT. It uses the same GITHUB_TOKEN mechanism that already powers GitHub Actions workflows, requesting packages: Read access and presenting that token automatically when it pulls a dependency. If a repository already has access to a package through the “Manage Actions access” setting, Dependabot inherits that access the same way an Actions workflow would. That last part is the real change. Dependab...

DevOps is often associated with speed: shorter release cycles, greater automation, faster feedback and increased developer autonomy. In financial services, however, speed is only one part of the equation. A platform supporting banking, payments or other regulated financial workloads also has to account for security, traceability, resilience, access control and operational risk. A deployment that reaches production quickly but cannot be adequately explained, audited or recovered is not necessarily a successful deployment. This changes the way DevOps needs to be implemented. The goal is not to choose between speed and control. The goal is to design delivery systems in which the controls themselves become part of the engineering workflow. Compliance Should Be Designed Into the Pipeline One of the easiest mistakes to make in regulated environments is treating compliance as something that happens after engineering work is complete. A team builds an application, creates its deploymen...

Apica today added an artificial intelligence (AI) agent and Model Context Protocol (MCP) server to version 3.0 of its Ascent platform for managing telemetry data pipelines. Andi Mann, chief product and technology officer for Apica, said the AI agent, dubbed Venn, makes it possible for IT teams to use natural language rather than having to create scripts to build and manage data pipelines at higher levels of scale. The MCP server, meanwhile, makes it possible for IT teams to use third-party AI tools to invoke the Ascent platform and its multiple embedded AI skills within the context of a DevOps workflow. Finally, a flow-only mode capability has been added to the platform to enable telemetry data to flow 10x faster. That additional capacity will prove critical as more AI agents are added to IT environments, said Mann. Just as importantly, however, any change that could delete or materially alter configuration requires the consent of an administrator before being applied to ensure no ...

Boston, MA, USA, September 8th, 2026, CyberNewswire Specialized team of AI agents that discover, attack, and validate web vulnerabilities, leveraging pre-existing site context to eliminate noise and speed remediation. Reflectiz, the continuous web exposure management company, today launched a multi-agent penetration testing platform for websites. Multiple specialized AI agents discover, attack, and validate vulnerabilities across complex web environments, and because they start from an existing model of each site, they cover up to ten times more than conventional pentesting tools. A pentest used to be an event. An engagement, a report, done. The report described a moment. The website kept going: login, checkout, payments, dozens of third-party scripts, all probed by attackers daily. “Websites change every week and get pentested once or twice a year. That gap is where exposure builds up,” said Idan Cohen, CEO and co-founder of Reflectiz. “Teams need testing that ke...

New York, NY, United States, September 8th, 2026, CyberNewswire Mars Security, the autonomous threat hunting and detection engineering platform founded by offensive security veterans, today announced Real-Time Intel-Based Detection, a capability that turns newly published threat intelligence into validated, ready-to-deploy detection rules within minutes of release. Built by former offensive operators, the new capability converts advisories from CISA, Mandiant, and other intelligence sources into MITRE ATT&CK-mapped detection rules across CrowdStrike, Wiz, Splunk, and cloud telemetry, each one tested against 30 days of the customer’s own data before it goes live. Mars believes it is the first platform to automate the complete path from threat advisory to production detection, including backtesting against the customer’s own environment, with no data ingestion and no changes to the existing security stack. Every security team already pays for threat intelligence. Very little of...

Ask any developer who works with multiple AI coding assistants how they choose a model for a given task, and you’ll get some version of the same answer: Trial and error. A quick model for simple edits. A stronger, pricier one for hard debugging. Sometimes a second model gets pulled in just to check the first one’s work. It’s a manual routing problem, and it falls on the developer every single time. GitHub thinks it has a fix. The company just introduced Project HydraFusion , a research preview built into GitHub Copilot that handles that routing automatically. Instead of a developer deciding which model gets which task, HydraFusion evaluates the request and builds the workflow itself. The system leans on three execution patterns. In “single” mode, one model handles the task outright. In “cascade” mode, an efficient model drafts a solution first, and only escalates to a stronger, more expensive model if the draft doesn’t clear a quality g...