Vulnerability Management

Jul 29, 2026 · 32:08

The Cost of a Data Breach 2026, and what we can learn from the Hugging Face hack

The discussion analyzes IBM's Cost of a Data Breach 2026 report, highlighting that the average breach cost is $4.99 million (a 12% increase). The central theme is the 'AI Tipping Point,' where attackers are weaponizing AI faster than defenses can deploy it. Key takeaways emphasize that basic security hygiene—such as proper access controls and encrypting PII at rest—remains critical, even in an advanced AI landscape. Furthermore, the analysis of the Hugging Face hack demonstrated how autonomous AI agents can chain zero-day vulnerabilities to breach systems, underscoring the need for open collaboration (e.g., Open Secure AI Alliance) and robust governance.

Key takeaways

1. Data Breach Costs are Rising 5:05

   The average cost of a data breach is $4.99 million, representing a 12% increase from the previous year (Cost of a Data Breach report).

2. Containment and Identification Remain Slow 6:52

   The mean time to identify and contain a breach remains high, averaging about two-thirds of a year.

3. Basic Hygiene is Paramount in the AI Era 8:58

   A significant finding is that 92% of organizations experiencing an AI-related breach lacked proper AI access controls, reinforcing that foundational security practices are non-negotiable.

4. The Need for Coalition Building 21:20

   The Hugging Face hack demonstrated the power of autonomous AI agents to chain vulnerabilities. The response requires collaborative efforts, such as the Open Secure AI Alliance, to share institutional knowledge.

• IBM Technology
• AI Security
• Data Governance
• Vulnerability Management
• Cyber Threat Intelligence
• Open Source AI
• Cost of a Data Breach Report 2026
• Open Secure AI Alliance

Watch on YouTube Full article

Jul 20, 2026 · 23:29

Through the AI Fog: The Architectural Decision Agentic Security Depends On — Manoj Nair, Snyk

As autonomous agents and frontier LLMs accelerate development speed, they simultaneously create a novel and expanding attack surface. The core security challenge is that probabilistic systems (like large models) cannot be trusted to police themselves. Data shows significant growth in the security backlog (108% quarter over quarter). To build safe, agentic software at scale, organizations must move beyond relying solely on model intelligence and implement deterministic verification layers that validate agent output, skills, and environment interactions.

Key takeaways

1. The Generator vs. Validator Problem 0:03

   A fundamental security principle is questioned: Can the system generating code (the generator) also be the system verifying it (the validator)? The answer, according to real-world data, is no.

2. Exponential Vulnerability Growth 0:07

   The security backlog for customers grew by 108% quarter over quarter (QoQ), indicating that the rate of vulnerability creation is outpacing remediation efforts.

3. New Attack Vectors in Agentic Systems 0:08

   Threats include 'toxic skills' (where a third or more of all available skills contain malware), insecure connections via MCP servers, and agents quietly copying PII into untrusted databases.

4. Deterministic Verification is Essential 22:06

   When testing for vulnerabilities, the latest frontier models found only 75% of issues in red team attacks, compared to a deterministic checker which achieved at least a 40% F1 score. This highlights that probabilistic systems require supplementary validation.

• AI Engineer
• AI Security
• Agentic Development
• LLM Governance
• Vulnerability Management
• Build Automation Security
• Snyk
• Evo

Watch on YouTube Full article