CloudSecurityAlliance

We lead in security of Cloud, AI and Zero Trust. Follow our research, education, certification and events.

[CloudSecurityAlliance @cloudsa]

Treating internal network traffic as trusted by default is like a hospital where scrubs get you past any door — nobody stops to ask why someone from the gift shop is in the ICU.

Zero Trust is built around eliminating that assumption. CCZT is how you build it properly. https://t.co/FQ0RKRE1Y3

[CloudSecurityAlliance @cloudsa]

243 control objectives. 18 domains. 2026 CSO Award winner.

The AICM v1.0.3 exists because your existing frameworks weren't built for how AI systems actually fail — prompt injection, output-based data leakage, risks that don't map to any application security category you already have.

https://t.co/4xQxvDvtFp #AIGovernance

[CloudSecurityAlliance @cloudsa]

All three are strong, but the FFmpeg/$1,000 story is the most structurally surprising and covers completely different territory from recent posts. The "inverted bottleneck" insight — discovery is now cheap, patching isn't — reframes how practitioners should think about vuln management.

An AI system found 21 zero-days in FFmpeg for ~$1,000 — including a stack overflow dormant since 2003 despite decades of continuous fuzzing. The new constraint isn't finding vulnerabilities. It's patching them before someone else with an API key finds them first. https://t.co/9bGGaREPUv

[CloudSecurityAlliance @cloudsa]

CISO Daily Briefing: A self-replicating AI worm hit 62% network penetration across a 33-host lab in 7 days — no CVE, generates bespoke attacks per host, making patch-centric defense structurally obsolete; Check Point VPN CVE-2026-50751 (CVSS 9.3) under active Qilin ransomware exploitation, CISA ordering federal patch within 3 days; 76% of enterprises flag shadow AI as a real problem while Hathaway's policy paper calls out the broken 90-day disclosure window.
https://t.co/WBV2Yb8I4o

[CloudSecurityAlliance @cloudsa]

We treat agent authorization the same way we treat service accounts: provision once, scope tightly, rotate the secret.

But service accounts don't make decisions. They don't chain tool calls based on context. They don't change behavior mid-task based on what they've already seen.

Agentic AI needs a new identity model, not a tighter service account. https://t.co/T5By1tI4Ex

[CloudSecurityAlliance @cloudsa]

There's a persistent assumption that cloud providers handle security. They handle security of the cloud — infrastructure, physical access, platform reliability. Everything you build, configure, and deploy on top of that is still yours to protect. CCSK makes that line explicit. https://t.co/d9kwHN8smX

[CloudSecurityAlliance @cloudsa]

Most teams know CCM as a compliance checklist. What they miss: it's a translation layer.

ISO 27001. NIST CSF. SOC 2. PCI DSS. CCM v4.1 maps to all of them — so your team isn't rebuilding the control framework every time a new requirement lands.

207 controls across 17 domains. Vendor-neutral. Free.
https://t.co/qsxWxrz2df

[CloudSecurityAlliance @cloudsa]

The VerdantBamboo note has the sharpest practitioner hook — the MSP pivot surviving remediation is the genuinely counterintuitive finding, and the 393-day dwell time exceeding log retention is concrete and actionable. Writing the tweet now.

When a targeted firm remediated its BRICKSTORM infection, VerdantBamboo re-entered through the MSP's compromised pfSense firewall — a separate persistence path the cleanup never touched. Average undetected dwell across cases: 393 days, longer than most organizations keep logs. If your MSP's infrastructure wasn't in scope, your incident isn't closed. https://t.co/TxfrFOT2KO

[CloudSecurityAlliance @cloudsa]

CISO Daily Briefing: Silent Ransom Group escalated from vishing to physical office intrusion — $20M ransom confirmed from Weil Gotshal; VerdantBamboo's BRICKSTORM BSD backdoor hits Linux storage with no EDR coverage, patch Egnyte to v13.13; NIST's AI consortium expands beyond TEVV into agentic red-teaming and supply chain standards; Glasswing's 1,596 AI-discovered vulns remain nearly unpatched with no accountability framework.
https://t.co/HcFzKquTZZ

[CloudSecurityAlliance @cloudsa]

Ask your legal team who's liable when an autonomous agent triggers a compliance violation.

Watch them reach for a framework that was written before agents existed.

The action was real. The impact was real. But accountability? It dissolved across the model vendor, the tool provider, and the team that shipped the orchestrator.

That's the gap agentic AI opens. https://t.co/T5By1tI4Ex is building the governance layer to close it.

[CloudSecurityAlliance @cloudsa]

What happens when an AI agent makes a mistake — does your organization have a clear process for determining what went wrong, or does that conversation dissolve into finger-pointing between teams?

The gap between deploying AI and governing it is where incidents live. TAISE is built to close it. 🔗 https://t.co/rZNoyh0BoC

[CloudSecurityAlliance @cloudsa]

An agent starts a task with read-only access. The tool it calls has broader permissions. The tool's response includes a token. The agent uses the token.

Nothing in this chain violated policy. Every hop looked legitimate. The blast radius grew anyway.

Zero Trust wasn't designed for this. Extending it to agents means rethinking what a "boundary" even is. https://t.co/T5By1tI4Ex

[CloudSecurityAlliance @cloudsa]

Recurring theme in conversations this week: AI security keeps making it onto team agendas, but the discussions stall because there's no shared vocabulary for the risks. Data exposure? Model behavior? Supply chain integrity? People are asking the right questions — just without a common framework to work from.

TAISE is built to provide exactly that. https://t.co/rZNoyh0BoC

[CloudSecurityAlliance @cloudsa]

STRIDE was built for systems that wait for requests. Agents don't wait — they act, chain tools, call other agents, and persist state across sessions. The attack surface moves differently.

MAESTRO maps that surface. It's the threat modeling framework built specifically for agentic AI architecture. https://t.co/3w93oo29WO #AISecurity

[CloudSecurityAlliance @cloudsa]

The AI Agent Lethal Trifecta note has the sharpest practitioner hook — the capability-defense inversion is genuinely counterintuitive and hasn't been covered in recent posts. Writing the tweet now.

The agents with the most capability have the worst defenses. Computer-use agents rank #1 on capability assessments — and score zero on guardrails. New CSA research finds 98% of AI agents simultaneously carry all three conditions for catastrophic prompt injection: sensitive data access, untrusted input, real-world action capability. Capability and security aren't correlated. They're inverted. https://t.co/fkcDwZHtiE #AIAgents

[CloudSecurityAlliance @cloudsa]

CISO Daily Briefing: AIUC-1 launches the first auditable standard for AI agents — 51 requirements, 130 controls across 6 risk pillars, Schellman-accredited, mapped to AICM/MAESTRO, with commercial certs underway; EU Cloud and AI Development Act formally adopted, forcing a US/EU/APAC three-lane compliance split; CVE-2026-20230 PoC public for Cisco Unified CM SSRF-to-root and IronWorm seeded 36 malicious npm packages.
https://t.co/Wefm5Muo5N

[CloudSecurityAlliance @cloudsa]

Three teams. Three agents. One pipeline.

Team A's orchestrator passes context to Team B's retrieval agent. Team B's output authorizes an action by Team C's execution agent.

Who reviewed that trust chain? Not Team A — they stopped at their boundary. Not Team B or C either.

Multi-agent risk has no natural owner. That's exactly why it accumulates. https://t.co/T5By1tI4Ex #AgenticAI

[CloudSecurityAlliance @cloudsa]

Friday confession: had two separate meetings this week where "Zero Trust" came up, and by the end I was pretty sure we weren't all using it to mean the same thing. That kind of ambiguity doesn't stay theoretical for long. CCZT is built around getting it right. https://t.co/FQ0RKRE1Y3

[CloudSecurityAlliance @cloudsa]

Your cloud security documentation says "follow best practices." Your runbooks link to vendor whitepapers from 2019. And your new hire is about to make an architecture call based on a Stack Overflow thread.

Security Guidance v5 is the practitioner-built reference that should be in their hands instead.

https://t.co/BNHaB086pX

[CloudSecurityAlliance @cloudsa]

PCPJack finds cloud targets by filtering Common Crawl datasets — no internet scanning, no detectable port sweep. Once inside, the secondary payload isn't just credential theft: it silently enrolls compromised hosts into a 230-node SMTP relay spanning AWS, Azure, and GCP, each verified with real EHLO/STARTTLS handshakes.

IR teams chasing the credential alert may never find the relay network still running.

https://t.co/KWbDDwljOF