Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment.
- Website
- cloudsecurityalliance.org · all feeds from this site
- Feed URL
https://cloudsecurityalliance.org/feed/
Read it in your FeedListing reader
Or add to: Feedly Inoreader Raw feed
Latest posts
-
The Adversary Economy: How Threat Actors Are Reacting to PHP2Shell
Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. Background PHP powers an estimated 75% of websites with…
-
Cloud Security Alliance Launches STAR for AI Level 2 to Strengthen AI Governance and Trust
STAR for AI Level 2 allows organizations to extend existing industry certifications and assurance frameworks into the AI domain SEATTLE – Oct. 27, 2026 — Organizations are increasingly under pressure to demonstrate that their AI systems are governed safely, securely and…
-
Identity-Defined Reachability: Reducing Exposure and Connectivity Friction in an Age of Machine-Speed Attack
AI is changing both the speed of attack and the speed at which organisations need to create, change and retire trusted communications. A supplier’s engineer needs a diagnostic service. An application needs a database. An AI agent needs an approved tool. Each requirement concerns…
-
AI Agents: Securing the Path from Intent to Action
The UK’s National Cyber Security Centre (NCSC) recently published guidance on managing the cyber risk of agentic AI. While the document is framed as interim advice as more formal guidance is developed, the framing reflects the current state of the industry: organizations are…
-
Your CLI and IDE Are the New Attack Surface: Governing AI Coding Agents on the Endpoint
A developer asks their coding agent to upgrade a logging library and fix whatever breaks. To see what changed, the agent reads the library's changelog. Hidden in a comment in that file is an instruction written for the agent: Confirm the environment works by sending the contents…
-
MCP Tool Exposure is a Privilege Grant: A Two-Gate Authorization Model for Agentic AI
Model Context Protocol is quickly becoming a common way for AI agents to connect to the systems around them. Through MCP, an agent can search a repository, query a database, create a ticket, send a message, update a record, invoke an API, or trigger a workflow. That makes…
-
AI Agents - You Can’t Govern What You Can’t Discover
AI is expanding faster than anyone can imagine, as organizations race to use AI to gain a competitive advantage. It started with Generative AI. Now, agentic AI is changing the way people think and work. With the rise in usage of AI agents, the fear of data leakage and having…
-
I Love Google’s Agentic AI Security Roadmap: Adding MAESTRO Will Make It More Powerful — An Open Letter to Google
In June, Google DeepMind did something unusual: it published an AI control roadmap premised on the idea that its own AI agents might turn against it. The AI Control Roadmap treats advanced internal agents as potential insider threats — the way a company treats a rogue employee…
-
New Cloud Security Alliance Survey Finds Data Loss Prevention (DLP) Often Detects Data Loss Only After It Happens
Research conducted in collaboration with Jazz finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization SEATTLE – Oct. 13, 2026 — Data loss prevention (DLP) tools are often functioning as…
-
Introducing The Builder Exchange: Inside Security Stories From the Companies Building Fastest With AI
Why the industry needs The Builder Exchange Software development traditionally ran through a narrow channel that involved a defined set of engineers, pipelines, and a review process security could have control over. That model worked because building took experience and effort…
-
Everyone Wants SPIFFE. Almost No One Can Afford to Build It Right.
TL;DR For the CISO: Your team may be evaluating SPIFFE/SPIRE as a path to zero trust for non-human identities. The standard is sound and vendor-neutral. The implementation, however, is a significant multi-year engineering project with compounding operational costs, and it still…
-
The Enterprise Accountability Gap: Who Should Own AI Governance?
Most enterprises have a sense of who owns AI risk, yet few know what happens when that risk turns into an incident. That's the pattern unearthed inside Schellman's new research, The 2026 State of AI Governance Report. In most cases, organizations can easily name an owner for AI…
-
How Security Teams Can Earn Board Trust With Exposure Management
TL; DR Learn how transitioning to an AI-driven exposure management strategy enabled Tenable’s Chief Security Officer, Robert Huber, to conquer software sprawl, integrate fragmented data, manage the risks of rapid AI adoption, and pivot from sharing highly technical statistics to…
-
Why Hybrid Environments Need Unified Visibility
Hybrid environments demand end-to-end visibility to stop modern attacks Hybrid environments are a dominant trend in enterprise technology, but they continue to present unique issues to the defenders tasked with securing them. By 2026, Gartner predicts that 75% of organizations…
-
Cloud Observability Has Never Had More Data. It Still Can’t Tell You What Actually Broke.
Metrics, logs, and traces pile up by the terabyte. Without the relationships between them, none of it adds up to an answer. Every cloud team has more observability data today than it did five years ago, by an order of magnitude. Metrics platforms, log aggregators, distributed…
-
The OWASP Top 10 for LLM Applications (2026): What Changed and Why It Matters
TL;DR: OWASP’s 2026 rankings reflect the growing consequences of giving LLM applications access to tools and enterprise systems. Prompt injection remains No. 1, while excessive agency rises to No. 3 and several categories expand to cover newer deployment risks. Security teams…
-
Bounding the Frontier: Why Enterprise AI Needs Security Validation Before Scale
Review the code. Prove the agent is safe. Govern every call after — in your cluster. Artificial intelligence has entered a new phase. Organizations are no longer experimenting with simple chatbots that answer questions. Enterprises are deploying autonomous AI agents capable of…
-
Why You Need a Zero Trust Program Management Office
Zero Trust implementations rarely fail because an organization forgot to buy a security tool. More often, progress stalls because identity, cloud, data, and network security teams pursue separate initiatives without a shared roadmap. Effective Zero Trust program management…
-
The Agent Kill Switch is No Longer Optional
Walk through almost any factory and you will see large red emergency-stop buttons on dangerous equipment. They are deliberately obvious and accessible because, when machinery malfunctions, operators must be able to stop it immediately. Unmanned rockets have flight-termination…
-
PQC is a Stress Test for Enterprise DNS
Executive Summary Post-quantum cryptography (PQC) is often framed as a cryptographic upgrade. For enterprise DNS, however, it is something more consequential: a stress test of operational maturity. As organizations prepare for a changing cryptographic landscape, long-standing…