CloudSecurityAlliance @cloudsa

Think of the last access permission someone in your organization was granted "temporarily." Is it still active? And if nobody can say who would notice, what does "least privilege" actually mean in your environment? CCZT is a good place to start looking for the answer: cloudsecurityalliance.org/education/cczt 🔐

Unpopular take: your system prompt is not a security control. "Never reveal customer data" is a request, not an enforcement. Anyone who can talk to the model can try to talk it out of that. Zero Trust for LLMs moves the boundary out of the prompt and into identity, authorization, and verification on every call the model makes. Start here: cloudsecurityalliance.org/research/publi… #ZeroTrust

This npm malware has no postinstall script and no binding.gyp. Scanners that look for install hooks see nothing. MALFEX ships a prebuilt .node DLL instead. It runs when the module is first required, and only if stdout is an interactive Windows console, so CI runners and sandboxes never trigger it. Then it pulls encrypted shellcode from GitHub. Check new dependencies for prebuilt binaries, not just install scripts. labs.cloudsecurityalliance.org/research/csa-r… #npm #SupplyChainSecurity

CISO Daily Briefing: BeyondTrust Remote Support zero-day (CVE-2026-102764, CVSS 9.3) was exploited ~6 weeks before the Oct 8 patch. PEERSTITCH, a memory-resident FortiOS implant, took credentials from 500+ FortiGates. EU AI Office draft enforcement rules let each investigative step restart a 5-year limitation clock; comments due Nov 9. 48% of European orgs maintain private forks while 94% use AI coding tools. labs.cloudsecurityalliance.org/research/ciso-…

Zero Trust rests on a quiet assumption: once you verify who or what is asking, its behavior is predictable. A laptop runs the same apps. An employee has a role. An agent can decide to try something new on any given run. Least privilege and continuous verification still apply, but they now have to cover what an agent is doing, not only what it holds. That's the gap CSAI is working on. csai.foundation #ZeroTrust

Something I keep noticing: when a cloud incident gets discussed, the hardest part usually isn't the technical fix. It's that the security team, the cloud team, and the business are each using the same words to mean different things. A shared vocabulary does more than most people expect. CCSK is a solid place to build one: cloudsecurityalliance.org/education/ccsk

An agent's memory gets seeded with one bad "fact" on Monday. By Friday, it's shaping decisions, tool calls, and what it tells other agents. No single component looked broken. The failure traveled across the system. That's the kind of threat MAESTRO is built to help you find before attackers do: threat modeling for agentic AI. cloudsecurityalliance.org/research/publi… #AIsecurity

Attackers backdoored AOMEI Backupper users by editing one unsigned config file on the vendor's update server, for as little as 5 minutes at a time. The MD5 check sat in the same file as the download URL, so whoever controlled the file controlled both. Victims spanned 11 countries. If your vendors don't sign update manifests with asymmetric keys, ask them why. labs.cloudsecurityalliance.org/research/csa-r… #SupplyChain

CISO Daily Briefing: One compromised ConnectWise Cloud Backup credential was used against 173 Microsoft 365 tenants; audit and revoke third-party app consent now. AOMEI update servers were tampered with in 5-10 minute windows, and a MALFEX npm package ships a compiled DLL addon. Embedded AI evaluators (METR at Anthropic) have no independence standards. Treat state-linked vendors, MSPs and backup tools as one exposure. labs.cloudsecurityalliance.org/research/ciso-…

When microservices took over, we learned the hard way that every service passing its own tests didn't mean the system was safe. We built tracing, service meshes, and ownership models. Agent-to-agent chains are the same lesson, with reasoning inside every hop. Who traces a decision across five agents and three teams? CSAI is working on that cross-domain gap: csai.foundation #AgenticAI

Friday security confession: somewhere in your cloud account there's a resource named "test-final-v2-DONOTDELETE," and nobody on the team knows who created it or what it's connected to. Everyone just walks around it like a sleeping dog. Knowing what you own, and what the provider owns, is where cloud security starts. CCSK covers those fundamentals: cloudsecurityalliance.org/education/ccsk 🙂

Your new cloud security hire asks, "Where do I start?" and the answer is a scattered folder of wikis, vendor docs, and tribal knowledge. Security Guidance v5 is the better starting point: one practitioner-built reference covering cloud security from architecture to operations. Hand it over on day one, and everyone builds from the same foundation. cloudsecurityalliance.org/research/guida… #CloudSecurity

The alleged OpenAI office bug was a thumb-sized recorder in an executive conference room. It drew power from the TV's USB port and was hidden in toilet paper. It was found two days after it was reportedly planted. A second device turned up five days later in an unattended bag. OpenAI says no weights, code or customer data were touched. CSA's takeaway: treat physical and insider risk as part of AI security architecture, and ask providers about it in vendor assessments. labs.cloudsecurityalliance.org/research/csa-r…

CISO Daily Briefing: Ivanti Connect Secure zero-day chain exploited since Oct 3, on CISA KEV; assume AD secrets exposed and rotate. Cisco Secure Email Gateway: second exploited root flaw in ~30 days. Next.js 16.4.1/15.5.28 fix two unauthenticated RCEs. UK AISI's eight voluntary frontier-AI priorities will shape vendor questionnaires. An OpenAI insider bugging arrest means asking model providers about physical and personnel security. labs.cloudsecurityalliance.org/research/ciso-…

Scenario already playing out: your vendor swaps the model behind an API endpoint on a Tuesday. Same name, same contract, slightly different judgment. Your agent's tool calls still pass every test. Nobody notices the change until it approves something it used to flag. You can audit the tool call. Can you audit what's behind the decision? Securing agents means knowing where the model came from, and what changed. That's the work at csai.foundation #AIsecurity

How most teams secure AI agents: lock down the model, then hope the rest behaves. But the risk sits in what agents can reach: tools, credentials, other agents, and the systems that decide what they're allowed to do. That's the agentic control plane. The CSAI Foundation, launched March 2026, exists to secure it. csai.foundation

Hot take: passing a compliance audit and being secure are two different achievements, and teams keep confusing them. A checklist tells you what to configure. It doesn't teach you why a control exists, so the first time the architecture changes, the checklist stops helping. Understanding the fundamentals is what lasts. CCSK builds it: cloudsecurityalliance.org/education/ccsk

Anthropic's red team tested whether open-weight models can copy themselves onto $55 Android TV boxes with 4GB of RAM. GLM-5.2 infected all 8 of 8 nodes in four of five trials. The hard part wasn't exploitation. It was setting up inference on weak hardware, and that's the step agents now handle. The authors estimate a 2M-device botnet could host ~133,000 copies of a 26B model. Watch for multi-gigabyte weight transfers on your IoT segments. labs.cloudsecurityalliance.org/research/csa-r…

CISO Daily Briefing: Microsoft's Patch Tuesday landed 1,411 flaws, 70 Critical, one exploited zero-day; with AI-assisted discovery, remediation capacity is now the failure mode. Norway fined Xandr €8.6M for relaying Grindr data; downstream recipients can't hide behind indirect receipt. Anthropic's red team shows sub-30B models can replicate on IoT devices; segment and inventory. labs.cloudsecurityalliance.org/research/ciso-…

When an employee leaves, HR triggers a checklist: badge off, accounts disabled, laptop returned. When an agent gets abandoned after a pilot, nothing triggers. Its keys keep working and its tokens keep refreshing. Non-human identities already outrun the human ones, and agents will widen the gap. Static inventories won't catch what these identities do. Runtime behavior will. Building that framework: csai.foundation #AgenticAI