The attacker's clock is faster than the defender's

Google and ServiceNow push agents deeper into enterprise operations

Google announced Google Cloud Modernize with purpose-built agentic migration capabilities, including an EKS-to-GKE Migration Agent in public preview that discovers AWS EKS environments, translates Kubernetes manifests, maps storage and networking needs, and prepares workloads for GKE, with human approval points built in. ServiceNow announced AI Workflow Factory and Autonomous Engineer, designed to identify workflow opportunities and automate planning, building, and testing; ServiceNow says Autonomous Engineer includes unattended coding capabilities, governed under AI Control Tower. A good model for agentic infrastructure: AI proposes, deterministic systems validate, a human authorizes, controlled automation executes. The security questions for these tools: which repositories can they modify, which secrets can they retrieve, can they deploy, who approves production, and can every action be attributed and reversed?

CIO — Google overhauls cloud modernization portfolio with new AI agents|ServiceNow Newsroom — AI Workflow Factory and Autonomous Engineer

Threat actors are applying AI across the attack chain — the change is speed, not objective

Microsoft says threat actors are applying AI across vulnerability research, reconnaissance, phishing, exploit and malware development, data analysis, and post-compromise activity. Objectives remain familiar: access, persistence, credential theft, espionage, fraud, data theft, disruption. The change is speed, scale, economics, and autonomy. Microsoft says frontier systems have completed complex multi-stage attack evaluations, including one controlled evaluation with a 32-stage attack chain, while fully autonomous sophisticated attacks are not yet the norm. The near-term threat: one human operator controlling far more attack capacity.

Microsoft Security Blog — Insights from the 2026 Digital Defense Report

Authorization is becoming more important than authentication

Yesterday's equation was Exposure × Authority × Time × Adversary Speed × Trust. Today's Exchange story adds a term: Authorization. Authentication tells us an identity passed the door. Authorization determines what happens after it gets inside. An agent may be properly authenticated, its token legitimate, its API call valid, and its request still dangerous. The security question becomes: what is this identity allowed to do, under what conditions, for how long, and how quickly can we revoke that authority? That is where IAM, Zero Trust, cloud security, and AI security are converging. Alongside it: human-in-the-loop is becoming an architectural control, and security operations need to move from scheduled to continuous — weaponization under 24 hours against enterprise remediation of 30 to 60 days is not a gap scheduling can close.

Qualys TotalAppSec receives FedRAMP High authorization

Qualys announced TotalAppSec received FedRAMP High authorization on the Qualys Government Platform, expanding application and API security tooling available for High-impact federal environments. The underlying policy direction: application and API inventory, exploitability, asset criticality, and continuous evidence increasingly matter alongside traditional host vulnerability scanning. Qualys ties the offering to CISA BOD 26-04 and NIST SP 800-228; treat vendor performance claims as vendor claims. For federal cyber roles, KEV prioritization, API security, continuous monitoring, exposure validation, and evidence-driven remediation are increasingly valuable.

Qualys — TotalAppSec is now FedRAMP High authorized