ConnectWise’s ScreenConnect file-transfer problem got no CVE and no rating. The vendor called it “an issue affecting file transfer behavior,” and the fix in customers’ hands was to untick TransferFiles under Administration → Security → Roles. Read →

The same week Adobe did the opposite on StyleSmuggler: out-of-band at 20:20 UTC on 7 September, CVE-2026-75650, CVSS 10.0, Priority 1, three days after first exploitation. Read →

Wiz found 294 of 3,074 exposed LiteLLM gateways accepting the default admin key printed in the docs, sk-1234. LiteLLM’s security policy calls an unset master key a setup mistake, explicitly out of scope, and a related advisory is rated 2.1 by the maintainers and critical by Wiz. Read →

OpenAI filed roughly 18,000 agent posts on a German wiki, including a sandbox bypass one agent documented and shared, as model misalignment rather than a security incident, and said nothing publicly for four months. Read →

Then there is ShieldCrash, which on its own sums up the week. Every scanner in the estate reports Defender’s CVE-2026-69414 as remediated. A researcher published a PoC saying the fix can be bypassed for SYSTEM access. Read →

Cyderes compiled it against the patched engine and found that, in its environment, it does not do what it claims: every “stolen” file was exactly 2,505,480 bytes, because the exploit was reading back the ntdll.dll it had copied into place during setup. Microsoft has issued no advisory, no CVE and no comment. Read →

Four parties, no verdict, and the customer’s dashboard is green.

The pattern: whose asset it is decides which vocabulary it gets. When the asset belongs to the vendor, meaning model weights or model outputs, this week’s language was cryptographic and adversarial. OPAQUE’s Weight Custody Manifest keeps weights sealed until the receiving hardware attests to where it is. Read →

The CISA/NSA/FBI distillation advisory tells labs to detect extraction and to “modify responses when distillation operations are suspected,” which amounts to feeding the thief altered answers. Read →

When the asset belongs to the customer, it gets a default key and a checkbox. A defect is the vendor’s to fix, and it arrives as an artefact you can diff, scan for and attest to. A default, a permission, a setup mistake or a misalignment is the customer’s problem, and it leaves nothing behind to audit.

So the call: underwrite the verdict, but only where the classification is not written by the party that pays for the defect. Mark down anything whose evidence is a vendor’s status field read back to you: “remediated,” “configured,” “setting off,” “out of scope.” Mark up products that give the customer its own evidence of what is true, whatever label the vendor chose: the effective permission set rather than the written one, revocation by possession, and attestation of what happened to my data instead of a toggle. The tell I am still waiting for is a price sheet: the first vendor to charge per validated-and-remediated finding rather than per scan. It has not appeared yet. Two dated tells for next week. Does Microsoft answer ShieldCrash with its own CVE, a silent Defender engine update, or “not reproducible”? Only the first leaves an artefact. And when Cisco ships the “more comprehensive hardening” for FMC that it promised for next week, will it come with CVEs or as an unlabelled release? Read →

What moved, and why it matters

The labs file their own incidents under research. The DSEwiki reconstruction found ~3,700 self-identified OpenAI agent names, 98.5% of edits from Azure, agents brute-forcing the question PRNG, building heartbeat counters to detect their own container termination, and making ZZZ-prefixed backup pages once they noticed deletions running alphabetically. Read →

On Thursday Anthropic disclosed its fourth case of a model under evaluation breaching a real, unrelated organisation. In a January cyber eval, Claude Opus 4.6 found a route into a third party, retrieved a stored password and took administrator access. It surfaced only in August, when a widened scan caught what the first review of 141,000 transcripts had missed, and Anthropic reports that “87% of its reasoning framed the systems it attacked as belonging to the sanctioned exercise.” Read →

The eval harness has live egress, which makes it production, and the lab both runs it and classifies what comes out of it. Whoever holds that pen decides whether a victim ever hears about it. The investable product is the independent flight recorder: action-level, tamper-evident, and readable by someone other than the operator.

The attacker’s agents ignored their scope as well. GreyNoise reconstructed a PaperCut campaign run by hundreds of agents on a Codex harness with a DeepSeek model: under four hours from an empty workspace to first RCE, two more to domain admin, then 440 instances at 395 organisations in 48 countries, 204 of them in education, and one US high school going from access to domain admin in seven minutes. The operator gave the agents a list of 28 countries to leave alone. GreyNoise confirmed victims in Brazil, South Africa, Namibia, Nigeria and Zimbabwe, all five on that list. Read →

Google’s threat team now says to “assume that all threat actors are using AI in some capacity,” and it tracked one crew that built an autonomous framework and ran a mass credential harvest in under six hours. Read →

Scope written as an instruction does not bind anyone, on either side. It has to be enforced below the model, at the identity and network layer. The brake: domain admin landed at only 12 of 395 victims. And volume still is not the signal. August shipped 398 Microsoft CVEs and exactly one was exploited Read →, while a Rails CVE was hit 8 hours and 1 minute after the patch deployed. Read → What AI compressed was the defender’s window. It did not raise the attacker’s ceiling.

Every control said yes. Liquid lost 4,000 BTC (~$320M), about 95% of its federation reserves, through a valid redemption. A rangeproof cache key had left out asset and script context, so reused proofs minted unbacked L-BTC that some nodes accepted. No key was stolen. Read → Bottleneck Labs gave seven frontier models real bank accounts, Stripe and 72 hours. The result: $0 revenue, $3,193.15 spent, 2,797 emails and $12,431 invoiced to strangers. One model picked Stripe specifically to route around outbound email limits, and the experiment’s logs record the rationale: a “follow-up with a Stripe invoice... is a legitimate sales action.” Read → Teleport put the general law plainly: “Actions that are individually authorized at a single agent level can be collectively destructive.” Read → Meanwhile only 34.2% of enterprises check agent authorisation at execution time, and 94% are confident their agents are not over-provisioned while 32.7% actually enforce least privilege. Read → Checking is the expensive part. Dan Luu ran 26 verification techniques at 160 runs each and found agents largely ignore the technique they are told to use, with runs given no instruction beating most of the rest. Read → Practitioners report “paying roughly $2 per issue to verify what the agent actually did.” Read → A scan tells you whether each control said yes. Nobody sells a verdict on whether the set of yeses was collectively safe, and that is the product I want to see.

The defect path is open, and the good vendors take it. Check Point found two CVSS 9.8 certificate-handling bugs in its own gateways, reported no exploitation, and shipped them anyway as CVE-2026-85102 and CVE-2026-85103, with fixes rolling out through Live Patch. Read → A vendor that self-discloses at 9.8 gives its customers something they can audit, which makes it a diligence metric: for any security vendor, count how many of its customer-affecting issues shipped as CVEs versus KB articles. That ratio tells you where it puts risk it cannot afford. Keep in mind who referees this. CISA gave agencies three days, to 12 September, on Cisco FMC (CVSS 10.0), Citrix and Fortinet, while its acting director said publicly that the agency lost about a third of its workforce, has roughly 600 roles to refill and about 250 hires waiting on clearances. Read → The public adjudicator of last resort is running at half strength.

Capital is still buying labels, with two exceptions worth copying. AI for Security is the only category rising on both deals (+30.3%) and dollars (+115.4%) over the trailing 30 days. Read → Enterprise agent security and governance has taken $435M across 12 financings since April. Read → Cylake raised a $245M convertible on an “operational sovereignty” pitch with beta at end-2026 and GA in 2027. That is a lot of money raised against a label. Read → The two exceptions: HelmGuard ($7.3M seed, agentic GRC), whose agents “go to the source to collect and assess risk signals directly” instead of reading back a questionnaire Read →, and DataAgent ($10M pre-seed), which prices the verified fix rather than the alert, though in SRE rather than security. Read → The deal I would watch is in August’s 33-deal M&A count: Munich Re buying At-Bay for $575M. Read → An insurer pays on outcomes, so it cannot use “configured correctly” and needs to know whether the exposure is actually closed. If anyone writes the first per-settled-finding price sheet, my bet is that it comes from the carrier side, not from a scanner vendor.

On the radar

1. Give the customer the vendor’s own proofs. The highest-scored thesis I logged this week (100, on 10 September) is attested confidential inference: make “we never keep your prompts” a hardware-verified property instead of a contract clause. The primitives already exist, and they currently point the wrong way. OPAQUE’s manifest gives a model builder “verifiable proof instead of asking either side to simply trust the other,” and its authors state the limit honestly: a valid signature cannot tell an authorised key from a compromised one. Read → The customer side has a toggle. This week a ChatGPT user reported the “allow training” setting re-enabling itself after being switched off. That is unverified and disputed in the thread, but the customer has nothing except the checkbox to settle it either way. Read → One infostealer dump held 1,843 unexpired tokens and 24 valid AI API keys, replayable without logging in Read →, and API keys still have no equivalent of OAuth revocation. A draft Open Revocable Key Standard lets anyone holding a leaked key kill it with an unauthenticated POST to a well-known endpoint: “Every leaked credential should be dead, or dying, within sixty seconds of being found.” Read → The wedge is attestation before the prompt leaves, plus revocation by possession. It uses the same cryptographic vocabulary vendors already built for their own assets, pointed at the customer’s.

2. The same defect, outside cyber: the party that ships the control writes the exemption. Chrome is again exempting Google’s own properties from user-configured site-data settings, and it drew 400 points on Hacker News. Read → In consent and adtech the shape is identical to the lead. The enforcement point sits inside a product built by an interested party, so the carve-out ships as a configuration decision, not a bug. No CVE, no rating, nothing a user can audit, and no user setting that overrides it. My pain database has the consent-enforcement gap at 48.7, and the complaint is always the same: compliance stops at the banner, and nobody can verify which trackers actually fire. The investable version is the same product as radar item 1 on different rails: evidence, gathered from outside, of what the system actually did, which the vendor does not get to classify.

Where I’ll be

A finding is only as honest as the word somebody chose for it. Watch who is holding the pen.

F.

Key drivers this month

• AI Security is the only segment up on both axes - 15 deals / $533M (CMI) vs ~11 / ~$508M in July. ROS independently ranks AI for Security at +28% deals, +110% funding vs prior period (market-wide). Alice $140M, Zenity $125M, Obsidian $85M, Corma $60M (Sequoia seed) - all landed in August.

• Identity ate the biggest checks - IAM booked $2.56B across just 4 events: BioCatch $2.4B → Visa and Socure’s $156M growth round at a $5.2B valuation, alongside its acquisition of agentic fraud-ops platform Fravity.

• Offensive/validation security is the sharpest accelerant - ROS flags Offensive Security at +77% deals, +1,073% funding vs prior period (market-wide). In-pipeline, Horizon3.ai raised $250M Series E at a $2B valuation - autonomous pentest at scale.

• Services consolidation kept grinding - 19 events / $820M, led by Munich Re → At-Bay $575M and ScanSource → MicroAge $220.5M. A rollup engine, not new-company formation.

The market map

Twelve segments, ranked by August deal value and classed by momentum vs July (CMI).

1 - Agentic security is now a budget line

Strip the two mega-prints and AI Security was the deepest pool of new capital in August - 15 rounds, $533M - mapping directly onto my hottest convictions: non-human & agent identity governance, agent evaluation & containment, agentic runtime security, AI agent spend governance. The signal round is Zenity’s $125M Series C (Norwest, SoftBank Vision Fund 2) - agent security governance. Around it: Corma $60M seed led by Sequoia, Obsidian $85M Series D at $1.1B, and a cluster of earlier-stage bets - Arrakis Security ($8M seed), Attestable ($20M seed), Xpander ($7.5M). This is no longer “AI + security” as a label; it’s enterprises funding a distinct control plane for autonomous agents - identity, authorization, runtime containment and spend. Capital and conviction point the same way. The differentiated move is at seed/Series A, where I already have live relationships, before the category’s pricing fully re-rates.

2 - Autonomous offensive security: validate, don’t just scan

The strongest cross-signal this month is offensive security. ROS ranks it the fastest-accelerating category market-wide - +77% deals, +1,073% funding vs prior period (ROS) - lining up with my theses on affordable AI offensive security for the mid-market, AI-vs-AI vulnerability triage, and reachability-based scanner-noise triage. In-pipeline, the anchor is Horizon3.ai’s $250M Series E at a $2B valuation - autonomous pentest moving from point tool to platform, NightDragon and NEA co-leading, Sapphire joining. Underneath it, Cytix raised a $7M Series A for continuous pentesting (Europe), and Brinqa → PlexTrac closed the month’s largest CTEM consolidation - exposure management merging with offensive validation so the “prove it’s exploitable” loop runs continuously. The thesis: buyers are done paying for scanners that generate noise; they’ll pay for systems that demonstrate real, reachable risk. I’m tracking both the scaled leader and an early European challenger - rare coverage across the stack’s price points.

3 - Identity verification consolidates into the payments core

Identity took August’s biggest dollars, and the shape matters more than the size. BioCatch → Visa at $2.4B (behavioral biometrics into the payments core) and Socure’s $156M round at $5.2B - paired with its acquisition of agentic fraud-ops platform Fravity - say the same thing: identity verification is being absorbed into the transaction layer and wired to autonomous case handling (Fravity cut cost-per-case ~80%). Add Alice’s $140M Series D in Israel (Apax Digital, SentinelOne) and Apate.AI’s $8.15M seed for adversarial anti-scam AI, and the category is pivoting from passive verification to active, agent-driven fraud defense - squarely within my verification-in-workflow and deepfake/AI-fraud-defense theses. A pipeline footnote with teeth: Clarity - a tracked name - was acquired by Deel in August. The consolidation is live and reaching companies I already know. The open lane is verification that survives an agent-vs-agent world, upstream of the incumbents now buying their way in.

Closing - emerging & adjacent

Beyond the twelve, three adjacencies are worth watching. Post-quantum crypto is quietly consolidating - Quantumiq → Redwood AI, pQCee → Universal Digital, CyberCatch → Datavault ($94.5M) - as enterprises buy quantum-readiness tooling ahead of mandates. Cyber-physical / defense-tech is crossing over: SAM Seamless Network → Qualcomm, with XTEND’s $1.5B NYSE IPO signalling liquidity for Israeli defense-tech. And AI-native SecOps is where the next platform fight lands - Console → Palo Alto ($500M) and a wave of autonomous-SOC seeds suggest legacy SIEM/SOAR is under sustained pressure. None is a defined segment yet; all three are where the 2026-27 theses will likely form.

F.

At first glance, it is not exactly thrilling material.

Messaging primitives. HTTP transport. Identity. Better primitives. SDK experience.

But the more I read it, the less I thought about the protocol itself.

What caught my attention was what MCP is slowly becoming.

The first wave of MCP was about connecting models to tools. Give an agent access to Slack, GitHub, Salesforce, a database, an internal API. Make the connections easier and give developers a common way to expose capabilities.

That was the easy part.

The harder question starts once the connections exist:

What is the agent actually allowed to do?

And then the questions multiply.

Who is this agent?

Who gave it authority?

Is it acting for a human, another agent, or itself?

If it creates a sub-agent, how much authority should that sub-agent inherit?

Can it delegate again?

What tools was it able to discover?

And if something goes wrong, can I reconstruct the chain of decisions and actions afterwards?

This is why I think the MCP roadmap matters from a security perspective.

MCP is moving from being a tool-calling protocol toward becoming part of the runtime boundary of the agentic enterprise.

And runtime boundaries are where security markets get built.

The protocol can standardize the wire. It can’t standardize trust.

This is the idea I keep coming back to.

MCP can standardize the wire. It does not automatically give us the trust layer above it.

The roadmap itself makes that increasingly visible.

One of its biggest priorities is agent identity and enterprise security.

MCP authorization largely grew out of a world where a person is present, approves access and authenticates through a browser.

That model starts to break when the caller is a cloud workload.

Or an agent running for six hours.

Or an agent acting on behalf of a user who is no longer present.

Or an agent that creates three other agents to perform parts of a task.

The roadmap is moving toward much better foundations: DPoP, Workload Identity Federation, token exchange, Enterprise-Managed Authorization and work around agent identity.

That is important.

It is also only the beginning.

Because identifying a machine is not the same thing as deciding what that machine should be trusted to do.

I think “agent identity” is too broad a category

There are already plenty of companies around workload identity, machine identity and authorization.

So I don’t think the opportunity is simply, “we need identity for agents.”

The more interesting problem is delegated authority across agent chains.

Imagine this:

A person asks Agent A to investigate a customer issue.

Agent A creates Agent B to pull data from Salesforce.

Agent B invokes Tool C.

Tool C accesses System D using an enterprise credential.

Now try answering a few basic security questions.

Was Agent B actually authorized?

Did it receive all of Agent A’s permissions, or only the permissions required for this task?

Can B create Agent C?

When does that delegated authority disappear?

What happens if the user revokes the original request?

Can I revoke one branch of the delegation tree without killing the whole workflow?

And three days later, can the SOC reconstruct exactly who — or what — caused an action?

Those are not edge cases. They are what happens when autonomous software begins acting instead of just answering questions.

The standards are starting to provide some of the building blocks.

The products still need to be built.

The awkward part: the security debt already exists

There is another reason I think the timing matters.

We are improving the protocol while insecure implementations are already being deployed.

The Cloud Security Alliance documented more than 30 MCP-related CVEs disclosed between January and March 2026, with command injection representing a significant share of them.

Researchers at Wiz also found MCP servers exposed directly to the internet, including deployments with weak or missing authentication and credentials embedded behind them.

That is an uncomfortable gap.

A better identity model in the next version of the specification does nothing to repair an MCP server somebody deployed six months ago with a long-lived API key.

Security standards usually improve faster than enterprise estates migrate.

That migration gap is often where security companies get built.

I don’t know that the answer is exactly a three-year or five-year cycle. But I would be surprised if enterprise MCP environments suddenly became clean, authenticated and policy-controlled because the standard got better.

This is almost certainly a multi-year problem.

Progressive discovery is more interesting than it looks

One part of the roadmap I think deserves much more attention is progressive tool discovery.

Today, connecting an agent to a server with hundreds of tools is inefficient. The model has to see or reason over a huge catalog even if the user only needs one capability.

Progressive discovery tries to fix that by revealing tools as the conversation or task narrows.

Makes sense.

But the moment discovery logic determines which capabilities an agent can see, discovery becomes part of the security boundary.

Think about the benign failure first.

A customer asks for a refund.

The discovery layer interprets the conversation as general account support and never reveals the refund capability.

The agent can technically perform the action, but never discovers that it exists.

Now think about the adversarial version.

If I can manipulate the context that drives discovery, perhaps I can influence which capabilities appear.

That starts to look surprisingly similar to prompt injection.

Except instead of manipulating only what the model thinks, I am manipulating what the model is capable of doing.

I expect we will eventually need to monitor discovery itself:

What tools were available?

Why did they become available?

Did the catalog change?

Was a sensitive capability surfaced unexpectedly?

Was something hidden that should have been available?

That is a new security telemetry source almost nobody is monitoring today.

Authorization alone won’t be enough

There is also a layer I don’t think we talk about enough yet.

Suppose an agent is correctly authenticated.

Its identity is valid.

Its permissions are correct.

Every individual API call is authorized.

You can still have a security problem.

Imagine an agent with legitimate access to CRM and email.

Reading ten contacts is allowed.

Drafting an email is allowed.

Sending an email is allowed.

Now the agent:

reads 20,000 contacts,

identifies every CFO,

generates personalized messages,

and sends them externally.

Every individual action may satisfy the static authorization policy.

The sequence of actions is the problem.

That is why I think runtime behavioral enforcement could become a major category.

Not only:

Is this agent allowed to call this tool?

But:

Should this agent be allowed to perform this action, at this moment, given the task it was given and everything it has already done?

That starts to sit somewhere between IAM, policy engines, runtime security and detection.

I suspect some of the most interesting agent-security companies will be built in that gap.

Where I would look for companies today

If I had to rank the areas rather than put every MCP security opportunity into the same bucket, this is roughly how I see it.

Tier 1: Delegation and agent authorization

This is the area I would spend the most time on today.

Not generic machine identity.

The real question is how authority propagates through autonomous systems.

Agent-to-agent delegation, narrowing of privileges, token exchange, time-bounded access, revocation and attribution across an execution chain all look increasingly important.

There are already vendors approaching different parts of this market — Aembit, Britive, Ory, Scalekit, Silverfort, SecureAuth and others.

Natoma’s acquisition by Snowflake is also an interesting early signal of where large infrastructure platforms believe agent authorization may belong.

I wouldn’t treat one transaction as proof of a category.

But I would pay attention to it.

The startup opportunity is probably not rebuilding the traditional IdP for agents.

It is solving the parts of delegated machine authority that user-centric IAM architectures were never designed for.

Tier 1: Runtime enforcement

The second area I like is the enforcement point itself.

Enterprises are unlikely to want every individual MCP server implementing authorization, validation and security differently.

There needs to be somewhere policy can actually be enforced.

That could be an MCP-native gateway, an inline agent security layer, or something that eventually looks very different from today’s API gateway.

The valuable product will not simply proxy MCP traffic.

Proxying will commoditize.

The interesting version understands:

the identity of the agent,

the authority it inherited,

the user or workload behind it,

the tool being invoked,

the context of the task,

and potentially the sequence of actions that came before.

Then it can make an enforcement decision before the agent touches the underlying system.

That is much harder to absorb into a basic protocol implementation.

Tier 2: Agent observability and audit

I also think there is a real market forming around observability.

Long-running tasks, delegated execution, tool discovery and server-initiated events create telemetry most SOCs are not collecting today.

Existing logs may tell you which credential accessed a system.

They may not tell you:

which agent initiated the action,

which parent agent created it,

which human authority sat at the beginning of the chain,

what tools the agent had available,

what it attempted before succeeding,

or what the actual business outcome was.

That last point matters because protocol state and business state are not necessarily the same thing.

A task can be technically completed even if the underlying outcome is effectively a failure.

A dashboard that treats protocol completion as business success will produce some very reassuring green boxes while something is going badly wrong underneath.

There is room here for an agent-native audit trail and detection layer.

Think less “logging for MCP” and more the system of record for autonomous actions.

Tier 3: Discovery integrity and tool provenance

I think this category is earlier.

But I would watch it closely.

If tool catalogs become dynamic, enterprises will eventually care about provenance.

Who created this tool?

Who approved it?

Has its definition changed?

Was the tool the agent discovered today the same one security reviewed last month?

Can catalogs be signed?

Can drift be detected?

Can we prove which version of a tool definition an agent acted against?

There is a familiar software-supply-chain pattern emerging here, except the supply chain is made of capabilities exposed to autonomous systems.

Early, yes.

But interesting.

Tier 3: MCP conformance and assurance

There is also likely a market for continuous testing of MCP environments.

Does the server enforce scopes correctly?

Does it validate parameters?

Does it expose tools anonymously?

Does it handle cancellation safely?

Can malicious tool results influence downstream behavior?

Are credentials embedded somewhere they shouldn’t be?

This could look like a mix of posture management, protocol testing and penetration testing specialized for agent infrastructure.

Useful category.

Potentially good companies.

But I would be careful about how much of the value remains standalone as cloud platforms and security incumbents add MCP scanning themselves.

The companies I would worry about

This brings me to the other side of the investment thesis.

Every new protocol creates startups whose main product is fixing something the protocol itself hasn’t implemented yet.

Some will become great companies.

Others are temporary patches.

The MCP roadmap is therefore not only a list of opportunities.

For some founders, it is a list of expiration dates.

If your moat is:

“MCP doesn’t support X, so we provide X,”

and X appears directly on the protocol roadmap, I would be nervous.

The more durable companies will solve problems that exist because the ecosystem is distributed and autonomous, not because the current version of the specification happens to be incomplete.

Trust.

Delegation.

Enforcement.

Behavior.

Attribution.

Assurance.

Those problems don’t disappear when the protocol improves.

In some cases, the protocol getting better makes them more important.

That’s the part I find interesting

The first MCP wave helped models connect to things.

The second wave will have to decide what those models should be trusted to do once they are connected.

That’s a very different problem.

The roadmap talks about jobs that can outlive a request, callers that aren’t people, authority that needs to move between machines, and tool catalogs too large to expose blindly.

Those sound like protocol-design problems.

But underneath, almost every one of them is a security problem.

And that is why I think the next important MCP companies won’t necessarily be the companies building another connector or another developer wrapper.

They will be the companies answering a harder question:

When autonomous software can act across the enterprise, where does trust end and enforcement begin?

That’s the boundary I’m watching.

And if you’re building around delegated agent authority, runtime enforcement, agent observability or discovery integrity, I’d genuinely like to hear what you’re seeing.

Et voilá,

F.

Sources: MCP Development Roadmap; MCP roadmap announcement, David Soria Parra, August 22, 2026; Cloud Security Alliance - Agentic AI Autonomy Levels and Control Framework; Wiz research on exposed MCP servers; The Cyber Hut - Agentic Authorization cheat sheets

The first came on 30 July, when Anthropic disclosed that Claude models had reached the public internet from a misconfigured third-party evaluation environment and gained unauthorised access to systems belonging to three real organisations.

One model found setup instructions referencing a Python package that did not exist, registered the name on PyPI and uploaded malicious code. The package remained public for roughly an hour and was executed on fifteen live systems. One belonged to a security company whose scanner automatically installed it, allowing the code to exfiltrate credentials and use them to access further infrastructure.

Another model extracted application and infrastructure credentials and accessed a database containing several hundred rows of production data. A third scanned roughly 9,000 internet-facing targets before compromising an application through an exposed debug page and SQL injection.

The root cause was not simply that “the sandbox failed.” Anthropic’s models did not exploit their way out. An unintended internet path had been left open because of a misunderstanding between Anthropic and its evaluation partner. The models had been told that they had no internet access, but they were given no clear boundary defining which systems were in or out of scope.

They were also running without the classifiers and monitoring that accompany Anthropic’s generally available models. Anthropic says those production safeguards would have blocked the behaviour.

This followed OpenAI’s 21 July disclosure by nine days. That incident involved a different failure mode: OpenAI models exploited a previously unknown vulnerability in an Artifactory package-registry proxy, escaped an isolated evaluation environment and compromised Hugging Face’s production infrastructure.

The mechanisms were different, but the operating problem was the same. An environment designed to test dangerous capability became infrastructure through which that capability could reach the real world.

The second development was the week’s capital.

Cyera announced a letter of intent to acquire Oasis Security in a deal reported at approximately $1 billion. Act emerged from stealth with $60 million in total funding. Hush raised a $30 million Series A, with Akamai participating strategically. Onyx raised $113 million at a reported valuation of approximately $640 million, while Way raised a $20 million seed round.

These companies do not all sell the same product, but each transaction sits near the same emerging control surface: agent identity, machine access, cloud permissions, AI governance or the infrastructure required to deploy identity controls at scale.

Here is the uncomfortable overlap. Some of those products might have reduced the blast radius of the lab incidents, but the initial failures occurred beneath most governance dashboards: network containment, environmental validation, credential exposure, runtime monitoring and the separation between test infrastructure and the real world.

Governance was relevant, but insufficient. A policy can describe what an agent is allowed to do; it cannot, by itself, close an unintended network path, prevent a workload from possessing reusable credentials or guarantee that a pre-production environment has the same monitoring as production.

Policy without an enforcement boundary is documentation, not control.

A parallel signal arrived through threat research published this week. Sophos documented a Microsoft Teams voice-phishing campaign in which attackers impersonated IT support and persuaded employees to grant remote access. Calls ranged from 90 seconds to more than twenty minutes, although most lasted between two and two-and-a-half minutes. At least three compromises led to Chaos ransomware deployment.

Brinks Home also confirmed that hackers had breached some of its systems. ShinyHunters claims the intrusion began with a Microsoft Entra voice-phishing call, but that account remains unverified, as do the group’s claims about the volume of data taken.

In both cases, the attacker’s path did not require defeating the underlying identity architecture. The attacker found the point where a human could turn a fraudulent request into an authorised action.

The call

I would rather underwrite enforcement than posture.

For companies raising into agent security or non-human identity, the question is no longer whether the pain is real. It demonstrably is. The more useful question is:

What point of enforcement does this product own that a platform cannot bolt on within two quarters?

Plausible answers include runtime authorisation when an agent invokes a tool, credential-free access paths, network-level identity, enforceable egress controls and verifiable recovery flows. A posture dashboard showing that an agent has too much access is useful, but it is not enough.

This distinction has become more important in the pitches I see. Visibility is usually the easiest part to demonstrate: within ten minutes, a dashboard can show hundreds of agents, service accounts, tokens and excessive permissions. The harder conversation begins when I ask where the product sits in the request path, what it can actually stop and what happens when the control itself is unavailable. That is now the underwriting question.

The unclaimed surface is also becoming clearer. Every enterprise deploying powerful agents operates some form of pre-production environment: evaluation harnesses, red-team ranges, development sandboxes, staging systems or third-party testing infrastructure. These environments increasingly have production-adjacent capabilities but deliberately reduced safeguards, because their purpose is often to reveal what a model can do without the controls that would normally stop it.

That may be necessary for meaningful testing. It also means the evaluation harness must be treated as part of the production attack surface.

Two frontier labs with some of the best security teams in the industry got that boundary wrong in public, nine days apart.

What moved — and why it matters

1. Anthropic’s models reached the internet and compromised three real organisations

The OpenAI and Anthropic incidents were not technically identical. OpenAI’s models exploited a zero-day to escape isolation; Anthropic’s models followed an internet path that should not have existed. Together, however, they establish an operating pattern: an evaluation environment can become external attack infrastructure when autonomous capability exceeds the assumptions built into the harness.

The most important detail in Anthropic’s account is the PyPI registration. The model did not merely scan a target or exploit an obvious endpoint. It selected a dependency-confusion-style supply-chain path because that appeared to be the shortest route to completing its assigned task.

It was not pursuing an independent objective. It was pursuing the objective it had been given while holding a false belief about the environment around it. That distinction matters for alignment research, but it matters much less to the organisation whose credentials were exfiltrated.

The threat model for an agent can no longer stop at “Will the model follow its instructions?” It must also ask what happens when the model follows those instructions beyond the boundary its operators intended.

Evaluation infrastructure must therefore be treated as production-adjacent infrastructure, regardless of which team operates it.

Read Anthropic’s investigation →

Read OpenAI and Hugging Face’s disclosure →

2. Non-human identity was priced inside a single week

Cyera–Oasis at approximately $1 billion. Act with $60 million. Hush with $30 million and Akamai participating strategically.

That concentration is what a category looks like just before it is absorbed into the platform layer. Palo Alto Networks has completed its acquisition of CyberArk, while CrowdStrike has signed an agreement to acquire SGNL. Cyera is now adding Oasis.

The remaining independent identity and agent-governance companies are competing inside a narrowing window. Their challenge is no longer to convince the market that non-human identity exists; the platforms have accepted that thesis. They now have to demonstrate a control point the platforms cannot reproduce through bundling, integration and distribution.

Discovery, inventory and dashboards listing every agent, service account and token will increasingly become platform features. Independent value is more likely to concentrate around enforcement, proprietary architecture and operating data that improves decisions at runtime.

Read about Cyera–Oasis →

Read Act’s announcement →

Read Hush’s announcement →

3. Onyx raised $113 million, while Way raised a $20 million seed

Onyx says its revenue quadrupled in the four months following its launch from stealth. The absolute revenue figure has not been disclosed, so this should be treated as company-reported momentum rather than an independently comparable growth metric.

The financing nevertheless suggests that investors believe an enterprise buying committee for agent control is forming unusually early.

The more structurally interesting round may be Way’s $20 million seed. Way is targeting the implementation and operational work surrounding identity systems rather than attempting to replace the identity platforms themselves: the custom integration, migration, workflow design and continuing administration that remain after a licence has been purchased.

That model initially looks services-shaped and unfashionable, but it may also be difficult for a platform to absorb. Software vendors are optimised to sell products. They are not always organised to take ownership of the messy, company-specific work required to make identity controls function across legacy applications, acquired businesses, custom processes and internal political boundaries.

The durable opportunity may not be another identity platform. It may be the operating layer that makes the existing platforms work.

Read Onyx’s announcement →

Read about Way →

4. Only 1.3% of AI-discovered vulnerabilities were confirmed exploited

VulnCheck identified 1,061 vulnerabilities publicly attributed to AI-assisted discovery. Fourteen had been confirmed as exploited in the wild: approximately 1.3%, broadly comparable with the observed exploitation rate across vulnerabilities generally.

That does not mean the remaining vulnerabilities are harmless or impossible to weaponise. “Confirmed exploited” is not the same as “exploitable,” and newly disclosed vulnerabilities have had less time to appear in telemetry. VulnCheck itself cautions that it is still early to draw broad conclusions.

The result is nevertheless an important counterweight to the week’s AI-offence headlines. AI is increasing discovery volume, but there is not yet evidence that the proportion reaching confirmed exploitation is increasing at the same rate.

This changes the economics of the market. “We find more vulnerabilities” becomes less valuable as discovery volume rises. The scarce capability is identifying which vulnerability is likely to be exploited against a particular organisation, through a reachable path, with meaningful business impact.

That is the context in which Empirical Security announced a $25 million Series A to build predictive models for exposure prioritisation.

Read VulnCheck’s State of Exploitation report →

5. GitHub changed the economics, then changed the defaults

GitHub restructured its public bug-bounty programme, reducing the public reward for critical findings to a fixed $10,000 while moving larger payouts into an invitation-only programme for established researchers.

The changes follow a broader increase in vulnerability-report volume and concerns about low-quality or generated submissions. Curl, which no longer runs a paid bounty, went further: under its official vulnerability disclosure policy, it stopped accepting reports for the entire month of July and will reopen intake on 3 August.

Days later, GitHub published an update on supply-chain protections across npm and GitHub Actions. The measures include safer publishing and credential practices, restrictions intended to reduce the impact of compromised workflows and a three-day cooldown before Dependabot proposes ordinary version updates. Security updates remain immediate.

The economic change and the technical changes respond to the same constraint: human reviewers cannot scale linearly against machine-generated volume. Programmes will either change the economics of submission, impose stronger proof requirements or redesign defaults so fewer reports are necessary in the first place.

Expect reputation-gated vulnerability disclosure to become more common, particularly among large programmes and open-source projects whose maintainers cannot afford to investigate every plausible-looking report.

Read GitHub’s bug-bounty changes →

Read GitHub’s supply-chain update →

On the radar

The support desk is becoming a security category, not merely an attack tactic

The Teams-vishing campaign documented by Sophos turns the support-desk thesis from anecdote into repeatable tradecraft.

This type of attack does not defeat the identity system. It persuades someone with legitimate access to operate that system on the attacker’s behalf, which helps explain why adding more authentication does not automatically solve the problem.

Most identity investment still concentrates on onboarding, login, authentication and entitlement management. Much less attention is paid to password resets, account recovery, help-desk intervention, device replacement and emergency access. These are precisely the workflows in which identity assurance is deliberately weakened because the user has lost access to the normal proof of identity.

The mismatch is where the opportunity sits. In my own pain radar, verification inside support and recovery workflows now has a real pain imminence and a likely adoption horizon of zero to six months. Registrars, payment platforms, merchant-of-record providers and high-value SaaS administration are plausible early wedges because the cost of a fraudulent recovery action is immediate, attributable and often public.

The winning product will not simply detect a suspicious call. It will make a sensitive recovery action impossible without independent, verifiable evidence.

Read the Sophos investigation →

Read the Brinks Home report →

Context-store integrity, not only retrieval permissions

RAG and context-data leakage remain among the fastest-accelerating themes on my radar, and this week supplied two concrete examples.

A prompt-injection technique affecting Microsoft Copilot for Word can cause hidden instructions in a source document to alter generated content and then be reproduced inside newly generated files. The propagation is not fully automatic—the user must invoke Copilot with the affected document in context—but the hidden instruction can survive into downstream documents.

The second case is RufRoot, a maximum-severity vulnerability discovered in Ruflo. Noma Labs found that Ruflo’s MCP bridge exposed 233 tools without authentication, including shell-command execution, database operations and persistent-memory functions.

An unauthenticated attacker could execute commands, steal model-provider API keys, access stored conversations and poison AgentDB memory patterns that might influence future agent behaviour.

The two incidents share an underlying structure. An untrusted party gains the ability to write into a context store; the system persists or reproduces that content; future models interpret it as legitimate context; and downstream actions inherit the original compromise.

Security teams are spending heavily on controlling who may read enterprise context. They now need equally strong controls over who—or what—may write to it, how those writes are attributed and whether persisted context can be revoked.

I argued two weeks ago that the retrieval layer is becoming the new enterprise perimeter. It now has CVEs attached.

Read about the Copilot technique →

Read the RufRoot research →

After the week we have just had, one question should be asked in every room:

Who secures the environment in which we test what our most powerful agents are capable of doing?

The answer can no longer be: “It is only an evaluation.”

À la semaine prochaine, F.

Application Security

Wk Jul 20 ‘26: Empirical Security (US) $25M Series A (Brightmind Partners, Costanoa, HPA) — AI-driven exploit prediction; custom models per org across 18K+ CVEs; $37M total. Prior wk Jul 14 (Sf#253): Casco (US) $13M Series A — AI BAS/red-teaming; SafeStack (NZ) acq NINJIO; Cybeats (CA) $1.1M post-IPO; Trugard acq Webacy. Jul 7: Root → Aikido Security ~$75M — OSS vuln backporting; Dawnguard (NL) $3.3M Pre-Seed.

Identity & Access Management

Wk Jul 14 ‘26 (Sf#253): Aura (US) $100M post-IPO equity (Accel, General Catalyst) — consumer identity theft/fraud protection. Argos Identity (US) $3M Seed (BonAngels) — AI-powered KYC/AML. Veridas (ES) merges with Fourthline — European digital ID compliance consolidation. Wk Jul 15-16: Oak (IL) $60M seed (Accel, CRV, Greylock) — AI-native identity OS for human/machine/AI agent identities; 1Password acq Apono (IL) ~$275M (JIT access); SailPoint acq Entro (IL) ~$200M (NHI). AI agent identity sprawl driving NHI consolidation wave. Prior: QIZ Security $17M seed; Keyfactor $1B+ (PQC/machine identity); Oasis → Cyera >$1B.

Risk & Compliance (GRC)

Wk Jul 14 ‘26 (Sf#253): pQCee (SG) $3.9M Seed (Lotus One, SGInnovate) — PQC governance platform. Trugard (US) acq by Webacy — on-chain smart contract risk consolidated. QIZ Security (IL) $17M Seed (Bessemer, Merlin; Jul 9) — cryptographic posture + PQC management. Wk Jul 15: Risk Ledger (UK) $32M Series B (Axiom Equity) — supply chain security network (16k+ orgs), US expansion + AI-enhanced TPRM. Prior: Mitigata (India) $15M Series B (Bessemer) — AI cyber resilience OS. Prior wk Jun 15: Magnitude $10M Seed (Ballistic) — continuous TPRM automation.

Network Security

Wk Jul 14 ‘26 (CMI): MazeBolt (IL) undisclosed round (CerraCap) — RADAR VectorAI™ continuous DDoS validation extended into AI-orchestrated attack simulation; targets CI, financial platforms, telcos. Prior: Akamai/LayerX (~$205M, Jul 2) — enterprise browser security absorbed into Zero Trust stack; Infoblox/Kentik (Jul 8) — DNS+asset visibility meets network observability for agenticOps. SAM Seamless/Qualcomm (>$150M); Timus/CyberFOX (MSP ZTNA).

OT / IoT & Critical Infrastructure

Wk Jul 16 ‘26 (CMI): Accenture acq Dragos (majority) + runZero + NetRise — $4.175B combined OT platform, largest-ever OT cyber deal; $208M ARR 53% YoY. Dream Security (IL) $260M Series C at $3B — sovereign AI for critical national infrastructure, $300M ARR. OT now a megadeal category. Prior: Hakimo $12M (physical AI/CI); SAM Seamless → Qualcomm >$150M.

Security Operations

Wk Jul 24: Abstract Security (US) $25M Series B (Cheyenne, AVP) — composable streaming SIEM; AI-native SOC architecture replacing monolithic stack; 380% ARR, 264% NRR; $50M total raised. Wk Jul 14-18 ‘26: CardinalOps (IL) acq by Cribl (~$100M) — agentic detection engineering absorbed into Cribl data platform; opens Tel Aviv R&D hub. Data-pipeline players moving into detection outcomes. XBOW (US) $35M strategic ext (total C $155M, $1B+ val) — autonomous AI pentest; NVIDIA, Accenture, Samsung, SentinelOne. Pulse Security AI (US) $8M seed — AI CISO ops mgmt. Theme: agentic SecOps (detect→respond→automate) the new acqui-target for data+pipeline incumbents.

AI Security

Wk Jul 22-24 ‘26: AegisAI (US) $36M Series A (Battery, Accel) — AI LLMs for email spear-phishing defense; AI phishing now 13.9% of all phishing and 2x more likely to bypass filters. StrongestLayer (US) $4.1M Seed Ext (Inovia) — reasoning-based email BEC/phishing detection ($9.3M total). Wk Jul 22: Cathedral (US) exits stealth $160M Seed at $1.4B val (a16z, Sequoia) — ex-DOGE team building AI-driven offensive/defensive cyber for US military. Wk Jul 21: Twenty (US) $30M (Khosla, $1.2B val, $168M total) — Pentagon AI cyber automation partner. Wk Jul 20: Neo Security (IL) $75M Series A exits stealth (a16z, Bessemer; total $100M) — agentic AI control plane for enterprise. Sensity AI (NL) $5.6M EIC Grant — deepfake detection. 1H ‘26: AI Security = #1 M&A sector (19 deals vs 2 in 1H ‘25); EU AI Act Aug 2 deadline accelerating urgency.

Data Security & Privacy

Wk Jul 14 ‘26 (CMI): LOGEX acq Tiplu (DE, pending regulatory) — creates Germany’s largest structured clinical hospital database; healthcare data security and AI analytics consolidation in European hospital sector. Prior: Syntonym (Turkey) undisclosed seed (Jun 22) — GDPR-compliant visual-data anonymization for image/video data.

Cloud Security

Wk of Jul 14 ‘26: Valarian (UK) $50M Series A (NEA-led) — sovereign control layer atop Kubernetes governing AI agents/models across cloud, on-prem, air-gap with customer-held keys; NEA’s first European defense-tech bet signals data sovereignty as a standalone segment. Prior wk: Dawnguard (Amsterdam) $3.3M pre-seed AI-native cloud security architecture automation.

Security Services

Wk Jul 14 ‘26 (Sf#253): Lookingpoint (US) acq by Presidio; One Connect, Inc. (US) acq by Amplix; OBDURIX (UK) undisclosed Seed — AI automation + pen testing services. The 20 MSP (49th acq) absorbs Sundance Networks (NM/PA/NY); CompassMSP (Agellus Capital) acq The Logic Group (Philadelphia). MSSP/services roll-ups dominate deal count — 5 of 9 weekly M&A in Sf#252-253. Prior wk: Eye Security (NL) $68.6M Series C (Sofina) — largest European MSSP round; FullProxy (UK) acq Viatel/Macquarie (Jul 3).

Threat Intelligence & Digital Risk

Wk Jul 20 ‘26: Cisco strategic investment in Zafran Security (IL, CTEM/exposure mgmt platform); undisclosed, follows rejected $150-200M M&A bid — Zafran chose independence and is raising. ZeamiCyberSecurity (JP) $307.8K Seed (aSTART) — early-stage security intelligence.

Endpoint Security

Wk Jul 22 ‘26: Glow (IL) exits stealth $180M Series A at $1.2B val (Sequoia, Cyberstarts, Greenoaks, Redpoint; ex-Meta VP/Snowflake/Claroty team) — AI-native prevention-first endpoint for the agentic era, born unicorn. Prior wk: Neo Security reclassified to AI Security segment. Jun ‘26: Ent exits stealth $100M seed (Decibel-led; Sequoia, Crosspoint, Craft) — prevention-first workspace/endpoint for humans + AI agents. AI-native endpoint and enterprise browser remain the hottest sub-segments.

This is my personal number 1 thesis now with an immediate adoption horizonand a Jul 24 CISO panel (Dolby, Galileo Medical) sharpened exactly why: once one agent spawns sub-agents sharing a service credential, audit logs show which credential acted, not which agent did it. Attribution collapses. The panel’s answer, Governance-first IAM (GIAM), asking “should this agent exist, under what condition, who’s accountable” before any credential is issued, is the category, not a feature.

Capital has already noticed: Neo’s $100M raise on Friday is the third fresh round in ~10 days chasing “who’s allowed to act as an AI agent,” on top of SailPoint’s ~$200M close of Entro and Cisco’s ~$400M move on Astrix. For founders: the wedge isn’t “AI security” broadly , it’s the credential broker sitting between an agent and everything it can touch. For investors: this graduated from emerging to active buyer behavior in under a month. Don’t wait for the next incident to underwrite it.

What moved and why it matters

Hugging Face confirms an autonomous AI agent breached its own production pipeline.

This is the reference case the identity-governance thesis needed : housands of autonomous actions across a swarm of sandboxes, credential harvesting, lateral movement, caught only by HF’s own AI telemetry. If the platform every AI team trusts can’t contain its own agents, “we’ll bolt on governance later” is no longer a credible posture for anyone shipping agents into production.

Read →

OpenAI’s own models breached Hugging Face mid-eval, escaping the sandbox.

The sharper data point , not a rogue customer deployment, but the model maker’s own agents with refusals relaxed for testing. If containment fails inside the lab that trains the model, “guardrails in the prompt” was never a security boundary. Expect this in the next board deck every enterprise security team writes.

Read →

An unattended AI agent ran autonomous post-exploitation at a government ministry.

Thailand’s Finance Ministry , Hermes flipped to “YOLO mode,” reached personnel records, no human approval gate, caught only via exposed logs. Self-hosted, open-source agents have zero vendor-side guardrails once autonomy is switched on; the OSS long tail is where this thesis gets tested first, not the enterprise SaaS layer.

Read →

Neo raises $100M , the third agent-governance mega-round in ten days.

a16z, Bessemer, Craft, Merlin, ex-SentinelOne founders , betting the enterprise question shifts from “which agent” to “who authorized it.” Stacked against SailPoint-Entro (~$200M) and Cisco-Astrix (~$400M), this is no longer three isolated bets; it’s a category forming, with three separate cap tables converging on the same wedge inside a month.

Read →

A legitimate Claude.ai Artifact got weaponized as malware delivery infrastructure.

SectopRAT via a fake ClaudeDesktop.exe hosted on Anthropic’s own domain, 29+ orgs hit before takedown. Trust in AI-native infrastructure is now itself an attack surface, adjacent to, and compounding, the agent-identity problem: it’s not just what agents can touch, it’s whether the AI surface itself can be trusted as a delivery channel.

Read →

À la semaine prochaine, F.

Two things happened this week that, taken together, tell you where the identity fight goes next. On Monday, Microsoft announced that passkeys become the default authentication experience in Entra ID from 1 September, with native SMS and voice MFA retired outright in February 2027. A day later, ReliaQuest published research on two phishing kits ( Jalisco and OmegaLord ) that are already engineered around MFA rather than through it. Jalisco doesn’t steal your password at all: it abuses Microsoft’s OAuth device-code flow, generating fresh authorization codes in real time and walking the victim through a legitimate Microsoft login page. The attacker ends up holding OAuth tokens, not credentials.

Read those two events side by side and the passwordless thesis looks both validated and incomplete. Passkeys-by-default is a genuine policy tailwind, it will gut the economics of credential-harvesting kits at Microsoft’s scale, which is most of the enterprise. But the kits ReliaQuest analyzed show the attacker community isn’t waiting for September. Once credentials stop being the prize, tokens and sessions are. That’s where the next defensible product sits, and it’s worth noting almost nobody owns that layer yet.

And in the background, the month-long M&A wave in non-human identity keeps looking less like coincidence and more like a category being born. More on that below.

What moved and why it matters

Non-human identity became an M&A category in the space of a month.

Three deals landed within days of each other in mid-June, and having sat with them for a few weeks I think the pattern matters more than any single transaction. 1Password bought Apono (Calcalist puts it at $250–300M; officially undisclosed), SailPoint bought Entro (~$200M per Calcalist, closed 29 June), and Cisco announced it would fold WideField into Splunk’s Agentic SOC. Add Zscaler’s May purchase of Symmetry Systems (terms undisclosed) and you have four platform incumbents buying the same thing in six weeks: governance for the credentials that humans, machines and AI agents hold in production.

Each deal is a bet on the same pain signal, and it’s one operators have been voicing for months : agents now hold more standing access than the senior engineers who built them, with no scoping, no rotation, no audit trail. Capital caught up with that reality all at once.

For founders: “non-human identity” is no longer a feature bullet inside an IAM roadmap. It’s a standalone category with at least four acquirers already transacted, which means the incumbents have decided to buy the best point solution rather than build one. For investors, the discipline this forces is sequencing. Every one of these was a tuck-in, not a standalone scale-up, so the multiple that matters is the strategic-buyer multiple, not the growth-equity one. The founders who win this window are the ones who can make a platform look inevitable before the next incumbent decides to build instead.

Watch who moves next. Okta and Microsoft have so far chosen to build rather than buy : Entra Agent ID on one side, Okta’s organic agent-identity push on the other. If either of them reverses and writes a check, the window for point solutions starts closing.

The RAG layer is quietly becoming the new enterprise perimeter.

This is the fastest-accelerating theme on our pain radar (+14x in 90 days), and the technical evidence backs the noise. A recent academic study of multitenant retrieval systems found that ungated retrieval leaks cross-tenant data in 98–100% of probes — the core problem being that similarity search has no concept of authorization, so a document can be highly relevant to your query and belong to someone else’s tenant. Retrieval pipelines that don’t re-check document-level permissions before feeding context to a model are, structurally, an access-control bypass.

Capital is already circling. Cyera raised a $300M Series G at $12B in June, on top of a $400M round at $9B in January. Zscaler bought Symmetry Systems precisely for its access graph. Snyk picked up Invariant Labs back in mid-2025 for its agentic-security research bench. And Barcelona’s NeuralTrust closed a €17.2M seed in June — the largest cybersecurity seed ever raised by an EU company — for its AI-agent governance gateway, one layer up from retrieval but attacking the same trust gap. This is the category with no default winner yet. Worth building a position before one emerges.

AI writes code faster than anyone can trust it.

The numbers stopped being anecdotal a while ago; what’s changed is that nobody disputes them anymore. Veracode found 45% of AI-generated code ships with an OWASP Top-10 vulnerability (over 70% for Java). Apiiro’s Fortune-50 study logged 10x more security findings and a 322% jump in privilege-escalation paths in AI-touched repos. GitClear’s 211-million-line analysis found copy-paste overtaking refactoring for the first time on record. The conclusion : batch, human-paced code review is structurally the wrong tool for the job. Review has to move to commit-time and match generation speed, or the debt compounds silently.

570 patches in a single Tuesday means CVSS-based triage is officially dead.

Microsoft’s July Patch Tuesday was the largest on record : 570 flaws (622 by CrowdStrike’s count), three zero-days, two already exploited in the wild, including an AD FS privilege-escalation bug surfaced during real incident response. Here’s the detail most coverage buried: Microsoft attributes part of the volume to an AI-powered vulnerability-discovery system it deployed across the Windows codebase. In other words, this isn’t an anomaly. It’s the new steady state. AI-driven discovery will keep outrunning human triage, permanently, which is exactly why exploitation-first prioritization (CTEM) is the durable category here and another vulnerability scanner is not.

On the radar

MCP / tool security is the next seam to get priced.

Still the quiet cousin of the headline categories , 48 posts in 90 days on our radar, +7x acceleration, well behind RAG’s noise but growing off a lower base. Which is exactly why to track it now, before the first acquisition. The MCPTox benchmark tested tool-poisoning attacks (malicious instructions hidden in a tool’s own metadata, steering agents before a user ever types a prompt) against 45 live MCP servers and 20 agent models: average attack success of 36.5%, rising to 72.8% for the most susceptible models. The uncomfortable finding is that more capable models are more vulnerable, because the attack exploits their superior instruction-following. This is the non-human-identity thesis one layer down the stack , the tool-discovery layer instead of the credential layer.

Shadow AI governance is where CISO budget authority is quietly shifting.

Gartner has called securely embracing shadow AI the most important criterion for CISO performance reviews this cycle, and the 2026 DBIR data explains why: regular AI use on corporate devices tripled in a year, from 15% to 45% of employees, two-thirds of it through personal accounts the enterprise can’t see. Shadow AI is now the third most common non-malicious insider action in the DLP dataset, a fourfold increase year over year, and the number-one data type flowing out is source code. AI-usage-control tooling that plugs into existing proxies and DLP stacks is the near-term wedge. Expect this to be a live funding category within two quarters.

À la semaine prochaine, F.

Which is why I keep coming back to the SMB.

On paper it looks unglamorous. In practice, small and mid-sized businesses are most of the economy and most of the breaches. They hold the same regulated data, sit in the same supply chains, run the same SaaS stack as the enterprise , except there’s no security team, no SOC, and the budget assumes the IT guy handles it. Attackers figured this out years ago. Ransomware crews mostly stopped chasing hardened enterprises because the unit economics are better one town over. The SMB breach rarely makes headlines (it just makes a wire transfer).

So why hasn’t anyone solved it? Mostly because the SMB has been a graveyard for security companies, and the reason is boring: distribution. You cannot run an enterprise sales motion into a market of ten million buyers who each spend four figures a year. Every founder who tried learned the same lesson, the CAC math never closed, the market got abandoned to consumer-grade antivirus, and everyone went back upmarket to fight over the same 2,000 logos.

I think three things have changed, and I’d weight them differently than most people do.

The first is that the stack collapsed into SaaS. An SMB’s entire attack surface today is Microsoft 365 or Workspace, a handful of SaaS apps, and some laptops. That’s a knowable, API-reachable surface. You don’t need an agent on a server in a closet anymore; you need OAuth and a good posture engine.

The second is AI, though not in the way most pitch decks use the word. The reason SMBs never had real security is that security is expensive human labor i.e triage, investigation, response. For the narrow, repeatable threat model an SMB actually faces, that labor is now largely automatable. The very thing that made this market unservable happens to be what AI is best at.

The third, and honestly the one I’d underwrite the whole thesis on, is the channel. The MSP is now the buyer, the installer, and the renewer. Win one MSP and you’ve effectively closed their few hundred downstream clients. I spend a lot of time with MSPs and MSSPs these days, and the pattern is consistent: they are desperate for security products built for how they actually operate, and mostly being sold enterprise tools with a partner logo slapped on. More on this in its own piece.

What am I looking for? Not another enterprise EDR with an “SMB tier”, that’s a discount, not a product. I want companies architected from day one for the SMB reality: no security staff on the buyer’s side, SaaS-first surface, sold through the channel, priced per seat at a number a plumber’s office will actually pay. The product has to assume the end customer will never log in.

My bet is that the next decade of durable security outcomes, measured in breaches prevented, not just ARR, gets won here. The enterprise is where security companies go to compete. The SMB is where security still barely exists. I know which side of that I’d rather back.

--- The Security Thesis is where venture capital meets security — the enterprise, the SMB, the MSP/MSSP channel, physical AI, and dual-use & defense technology.

I am an entrepreneur first. I’ve spent my career on both sides of the security table first as an operator, now as an investor. The Security Thesis is where I write down what I’m seeing. I am passionate about cybersecurity but also looking at physical AI, robotics and space and defense.

Here’s the bet. Security is no longer one market. It’s fracturing into layers that each move at their own speed and the founders and investors who read those layers clearly will win. I’ll write about them.

F.