DataDome recorded 7.9B AI agent requests in early 2026. A new report reveals widespread spoofing and visibility gaps that leave organizations exposed.
The post DataDome Report Finds Most Organizations Flying Blind as Agentic Traffic Surges appeared first on Security Boulevard.
DataDome recorded 7.9B AI agent requests in early 2026. Get the data on AI traffic volume growth, agent spoofing, and what this means for your site.
The post The AI Traffic Report: High Volume, Low Visibility, and a Growing Risk appeared first on Security Boulevard.
Written by Katie Barnett, Director of Cyber Security at Toro Solutions
Insider risk is still often framed around intent, with the focus placed on malicious employees, disgruntled contractors, or deliberate misuse of access for personal gain.
Those cases exist and they matter, but they are rarely where risk first begins, and they do not reflect how most insider-related incidents actually develop.
In reality, many cases take shape slowly and quietly. They are shaped by pressure, fatigue, disengagement, coercion, manipulation or personal strain rather than hostility. The behaviour that later causes harm is often preceded by long periods of stress, isolation, being influenced or unresolved workplace issues. By the time someone is formally labelled an insider threat,the opportunity for early, proportionate support has usually passed, and the organisation is left with far fewer options.
This is why treating insider risk purely as a disciplinary or compliance issue consistently falls short. In many situations, the underlying issue is one of wellbeing first, with security consequences following later, whether the organisation recognises that link or not.
Insiders are a significant and consistent factor in security incidents. Accenture[1] has reported that a significant proportion of security incidents involve insiders, many of which are linked not to sophisticated intent, but to frustration, opportunism, or poor judgement under pressure.
Research from the Ponemon Institute[2] also shows that many employees who leave an organisation take some form of sensitive data with them, often without seeing it as wrongdoing. These findings do not mean that most people are inherently risky. They show how easily people can justify their actions when they feel unsupported, unheard, or under strain.
Despite this, insider risk is still often pushed aside or handled in isolation. In many organisations it moves between HR, security, and legal teams without a shared understanding of what is really driving behaviour. When this happens, patterns are missed and early warning signs become normal, until a more serious incident finally brings the issue to senior attention.
How insider risk really develops
Insider risk rarely begins with a clear breach of policy. More often we find that it develops incrementally through small changes in behaviour that are easy to explain away, particularly in high-pressure or highly trusted roles.
Someone may start working excessive hours to manage workload, gradually bypassing controls that feel obstructive rather than protective. They may disengage from colleagues, become defensive when challenged, or withdraw from routine interaction. None of this suggests malicious intent in isolation, but it often marks the point at which judgement can begin to erode.
In roles with wide access and limited oversight, these issues can go unnoticed for a long time. As people grow more comfortable with the systems, informal shortcuts start to feel normal, and risk builds in the background. By the time leadership becomes aware, it’s often because something has already gone wrong.
In some cases, the influence is external. Individuals may be targeted by criminals, competitors or organised groups who exploit personal vulnerabilities, financial stress or emotional pressure. This does not always look like blackmail or explicit threats. It can begin with flattery, requests for small favours, or appeals to sympathy, and gradually escalate into access, information sharing or rule-bending that feels difficult to refuse.
Coercion does not always come from outside. In some environments it can arise internally through power imbalances, unrealistic expectations, or pressure from senior colleagues that makes it hard to say no without fear of consequences.
Connection without closeness
Modern ways of working have added a new layer of complexity. We are more digitally connected than ever, yet many people now experience their work in relative isolation. Messages replace face to face conversations, context gets lost, and informal check-ins happen far less often.
Judgement does not exist in a vacuum. Stress, fatigue, and emotional strain shape how people interpret information and how carefully they make decisions. When pressure rises and support feels distant, people are more likely to misread situations, take shortcuts, or justify behaviour they would normally question.
This is not just a wellbeing issue. It is a resilience issue. Emotional strain narrows perspective and makes people more open to influence, whether that influence comes from outside the organisation or from their own internal reasoning.
These dynamics are being intensified by wider economic uncertainty. Prolonged cost-of-living pressures, geopolitical instability, and sustained disruption across global markets are all putting strain on individuals’ finances.
Financial pressure affects how people behave. It makes it harder to focus, increases anxiety, and can reduce how seriously people think about consequences. Some may even feel they have little left to lose. This does not mean they intend to do harm, but it does raise risk, especially for those who have access to sensitive systems, information, or assets.
From a security point of view, money stress increases risk. When organisations treat financial wellbeing as separate from security, they overlook an important part of the problem.
Financial strain also increases susceptibility to manipulation. People under pressure are more likely to respond to offers of help, opportunities to “fix” problems quickly, or requests that promise relief from stress. From a security perspective, this creates conditions where coercion becomes easier and more effective, even when individuals have no intention of causing harm.
Why controls alone are not enough
When insider risk is identified, organisations often respond in a technical way by tightening access, increasing monitoring, and reinforcing policies, but while these actions are important, they rarely address the underlying conditions that allowed the risk to develop in the first place.
Controls alone do not reduce burnout. Monitoring does not ease financial pressure, and policy reminders do not restore sound judgement. In some situations, a poorly timed escalation can actually increase feelings of mistrust or isolation, which pushes risk further underground instead of resolving it.
Both research and practical experience show that behavioural warning signs often appear before any technical breach occurs, including changes in performance, disengagement, conflict with management, and financial difficulty, and when organisations wait until behaviour crosses a formal threshold, their options become limited and the consequences are usually far more severe.
Support does not mean ignoring misconduct or lowering standards, but instead means expanding the prevention toolkit so organisations can step in earlier, when the impact is lower and when individuals still have realistic options.
In practice, this often includes:
This approach reflects the direction set out in UK protective security guidance, which emphasises treating insider events as connected, strengthening leadership understanding, and addressing the reasons insider risk is often deprioritised or avoided.
Culture determines whether people speak up
In many insider cases, colleagues notice warning signs but decide not to raise them because they worry about getting someone into trouble, triggering an investigation, or being seen as overreacting.
Where people believe that raising concerns will lead to fair and supportive action, reporting becomes more likely, but where they expect blame or punishment, staying silent feels safer.
This is not a training failure. It is a cultural one.
The most effective insider risk programmes are often the least visible because they are built into everyday management practice, supported by leadership, and grounded in trust, and they recognise that people are both the greatest asset and the most complex part of any security system.
In a world that is increasingly connected but emotionally fragmented, emotional and financial pressures are no longer side issues. They are part of the risk landscape.
For organisations that are serious about resilience, insider risk must be understood not only through controls and compliance, but also through culture, support, and leadership judgement, and this shift does not weaken security. It strengthens it.
The post When insider risk is a wellbeing issue, not just a disciplinary one appeared first on Security Boulevard.
Learn how to implement cryptographic agility in MCP resource servers to protect AI infrastructure from quantum threats using PQC and modular security frameworks.
The post Cryptographic Agility in MCP Resource Server Orchestration appeared first on Security Boulevard.
How Secure Are Your Machine Identities and Their Secrets? How often do organizations truly consider the security of non-human identities (NHIs) within their systems? Where cybersecurity threats are evolving rapidly, the management of NHIs plays a crucial role in protecting digital assets across industries, particularly those heavily reliant on cloud infrastructure such as financial services, […]
The post How independent can AI ethics governance become appeared first on Entro.
The post How independent can AI ethics governance become appeared first on Security Boulevard.
Is Your Organization Ready to Harness the Power of AI Solutions for Budget Management? An often overlooked aspect is the management of Non-Human Identities (NHIs). With industries like financial services, healthcare, and DevOps rely increasingly on cloud-based infrastructures, the need for advanced security management has never been greater. But how does this fit? Understanding the […]
The post How do AI-driven solutions fit upscale budgets appeared first on Entro.
The post How do AI-driven solutions fit upscale budgets appeared first on Security Boulevard.
How Do Non-Human Identities Impact AI-Driven Decisions in Cybersecurity? Have you ever considered how machine identities, which we refer to with Non-Human Identities (NHIs), can influence AI-driven decisions in cybersecurity? When organizations continue to embrace cloud environments, securing these machine identities becomes paramount for ensuring business certainty and operational efficiency. When examining cybersecurity, NHIs provide […]
The post Why must businesses be certain about AI-driven operational decisions appeared first on Entro.
The post Why must businesses be certain about AI-driven operational decisions appeared first on Security Boulevard.
Overview This is an update to the Cyber Heads-up we posted back on March 4, 2026, with detailed information about Iranian threat activity tied to ongoing U.S./Israeli operations. Analysis At the start of hostilities with Iran, we at Assura took proactive steps to identify and create alerts for known Iranian-sponsored Indicators of Compromise (IOC). We… Continue reading Update: Iranian-U.S./Israeli Hostilities Lead to Increased Threat Landscape
The post Update: Iranian-U.S./Israeli Hostilities Lead to Increased Threat Landscape appeared first on Security Boulevard.
Lloyds Banking Group has launched an internal investigation after a technical error in its mobile banking applications allowed some customers to briefly see other users’ transaction details. The incident affected the mobile apps of several brands operated by the group, including Lloyds Bank, Halifax, and Bank of Scotland. According to the bank, the issue arose […]
The post Lloyds Banking Group Investigates Mobile App Data Exposure Affecting Multiple UK Banks appeared first on Centraleyes.
The post Lloyds Banking Group Investigates Mobile App Data Exposure Affecting Multiple UK Banks appeared first on Security Boulevard.
Presenter: Rik Farrow
Our thanks to USENIX Security '25 (Enigma Track) (USENIX '25 for publishing their Creators, Authors and Presenter’s tremendous USENIX Security '25 (Enigma Track) (USENIX '25 content on the Organizations' YouTube Channel.
The post USENIX Security ’25 (Enigma Track) – Usernames, Passwords And Security appeared first on Security Boulevard.
Most organisations assume DDoS (Distributed denial of service) protection is a box they’ve already ticked. If traffic spikes or an attack starts, the thinking goes, their provider will absorb it and move on. But in the real world it can be a different story. Many incidents aren’t caused by the scale of an attack alone, […]
The post Why Most DDoS Protection Fails: Solving for Continuity and Resilience appeared first on Blog.
The post Why Most DDoS Protection Fails: Solving for Continuity and Resilience appeared first on Security Boulevard.
When cybersecurity experts from the public and private sectors gathered this week, AI and critical infrastructure took a back seat to frontline defense in light of recent international headlines.
The post New Federal Strategies, Rising Risk From Iran Top Cyber Themes appeared first on Security Boulevard.
How Can Non-Human Identities Transform AI Security in Travel? The rapid integration of artificial intelligence (AI) across industries is reshaping how organizations manage security, especially in travel. But how can Non-Human Identities (NHIs) be a game-changer in AI security? With machine identities underpin the secure operation of AI systems, understanding their role is essential for […]
The post What makes AI in travel industry security powerful appeared first on Entro.
The post What makes AI in travel industry security powerful appeared first on Security Boulevard.
Can Machine Identities Be the Key to Greater Security in Healthcare Data Systems? Where data breaches are alarmingly frequent, the role of Non-Human Identities (NHIs) in safeguarding healthcare data systems has garnered increased attention. Understanding and harnessing the power of NHIs can significantly mitigate risks, enhance compliance, and improve operational efficiency across various industries, including […]
The post Are healthcare data systems supported by NHIs effectively appeared first on Entro.
The post Are healthcare data systems supported by NHIs effectively appeared first on Security Boulevard.
Are Your Cloud Security Strategies Providing the Reassurance You Need? Achieving confidence requires more than just traditional measures. Non-Human Identities (NHIs) are a pivotal component of robust cloud security strategies. These machine identities offer an evolved approach to managing cybersecurity risks, specifically addressing the gaps that often exist between security teams and research and development […]
The post How reassured can we be with our current cloud security strategies appeared first on Entro.
The post How reassured can we be with our current cloud security strategies appeared first on Security Boulevard.
I ran an experiment this week that I did not expect to be instructive, and it was.
Related: How ChatGPT is becoming Microsoft Office
The setup was simple. I had been working through a spontaneous personal essay — about cognitive … (more…)
The post MY TAKE: The AI magic is back — whether it endured depends on Amazon’s next moves first appeared on The Last Watchdog.
The post MY TAKE: The AI magic is back — whether it endured depends on Amazon’s next moves appeared first on Security Boulevard.
Presenter: Stacey Higginbotham, Consumer Reports
Our thanks to USENIX Security '25 (Enigma Track) (USENIX '25 for publishing their Creators, Authors and Presenter’s tremendous USENIX Security '25 (Enigma Track) (USENIX '25 content on the Organizations' YouTube Channel.
The post USENIX Security ’25 (Enigma Track) – Zombie Devices Are Running Amuck! appeared first on Security Boulevard.
Cyber threats are evolving at a pace that traditional security testing methods struggle to keep up with. Organizations today operate in highly complex digital environments with cloud platforms, APIs, microservices, and rapidly deployed applications. In such environments, manual security testing alone is no longer enough. This is where an AI pentesting tool becomes a critical […]
The post Best 5 AI Pentesting Tools in 2026 appeared first on Kratikal Blogs.
The post Best 5 AI Pentesting Tools in 2026 appeared first on Security Boulevard.
You have Sentinel. You have Defender. Here is what fills the autonomous investigation gap between detection and autonomous resolution.
The post D3 Morpheus for Your Microsoft Security Environment appeared first on D3 Security.
The post D3 Morpheus for Your Microsoft Security Environment appeared first on Security Boulevard.
This week’s McKinsey incident should be a wake-up call for every enterprise moving fast to deploy AI.
Not because AI itself is inherently insecure.
But because too many organizations are still thinking about AI security at the model layer, while the real enterprise risk sits in the action layer: the APIs, MCP servers, internal services, and shadow integrations that AI agents can reach, invoke, and manipulate.
That is the part most companies still do not see.
The technical details matter here. Public reporting described an internal AI platform with a broad API footprint, including more than 200 documented endpoints and a set of unauthenticated APIs that could allegedly be reached externally. The same reporting described potential exposure paths to tens of millions of chat messages, hundreds of thousands of files, user accounts, and system prompts. Whether or not every possible impact was realized, the takeaway for security leaders is clear: when internal AI systems are wired into weakly governed APIs, the blast radius can become enormous very quickly.
And this is not an isolated case.
The McDonald’s AI hiring incident points to the same structural problem. Different companies. Different workflow. Same core mistake. Reporting on that case described exposed administrative access, weak authentication practices, and the potential exposure of a massive pool of applicant records. Again, the story was not just about the chatbot. It was about the application and API infrastructure around it.
That is the lesson the market needs to understand.
The real risk is not the LLM. It is what the agent can do.A lot of the AI security market today is focused on prompts, model behavior, jailbreaks, and output controls.
Those matter.
But they are only one layer.
In the enterprise, AI agents do not create value by talking. They create value by taking action. They retrieve data, call APIs, invoke tools, access systems, trigger workflows, and increasingly operate through MCP servers and connected services.
That means the real blast radius of AI is determined by the action layer.
This is why the industry framing of “AI security” is still too narrow. The attack surface is no longer just the model. It is the full connected system around it.
McKinsey and McDonald’s security breaches are the same storyAt first glance, these incidents look different. McKinsey was an internal AI platform. McDonald’s was an AI-powered hiring workflow.
But structurally they are the same. Both point to a growing enterprise reality: organizations are connecting AI systems to internal and external application infrastructure faster than they are securing that infrastructure.
And in many cases, the weakest point is not a sophisticated model exploit. It is a plain old exposed API, weak authentication, forgotten endpoint, misconfigured access control, or third-party integration that quietly became internet reachable.
That is exactly why I believe one of the most dangerous categories emerging right now is shadow APIs connected to agents.
These are internal or lightly governed APIs that were never meant to become part of an external attack surface, but once they are connected to copilots, workflows, MCP servers, browser agents, coding agents, or AI applications, they effectively become part of one.
The company still thinks of them as “internal.” The attacker does not.
The blind spot: shadow APIs plus agent connectivityThis is the gap I worry about most for enterprises today. Every company has APIs it knows about. Many also have APIs it has forgotten, never fully documented, or does not realize are externally reachable.
Now add AI. The moment an agent is connected to those systems, or an MCP server is exposed with access to them, the attack surface expands dramatically.
What used to be obscure, low traffic, and semi-internal becomes:
That is the shift. In the pre-agentic world, a hidden or weakly governed API might sit quietly for months or years. In the agentic world, it only needs to be reachable once.
The new security model enterprises needIf you are deploying AI, you need to stop asking only: Is the model safe? and start asking:
The next generation of AI incidents will come from agents sitting on top of weak action layers: exposed APIs, unauthenticated services, forgotten integrations, and misconfigured MCP servers.
This is exactly why we built Salt SurfaceAt Salt, we have spent years helping enterprises discover and secure APIs they did not know were exposed. That problem now matters even more in the age of AI.
With Salt Surface, organizations can map their exposed API footprint, including AI-related APIs and externally reachable services, without deploying an agent or installing anything in their environment.
If you are building with AI, the first question should not be whether your prompt is protected. It should be whether your action layer is exposed.
The model is not the whole attack surface. The API layer is.
Get your free exposure scanIf you want to know whether your company has exposed APIs, AI-connected endpoints, or internet-reachable services, we will show you. No installation. No heavy lift. Just a domain and you get visibility into the attack surface you need to understand now.
Request your free Salt Surface scan today.
Roey Eliyahu is the Co-Founder and CEO of Salt Security, the leader in Agentic Security.
The post An AI Agent Didn’t Hack McKinsey. Its Exposed APIs Did. appeared first on Security Boulevard.
