AI Governance
ISO/IEC 27090:2026 gives guidance on cybersecurity threats specific to AI systems. For organizations already running ISO/IEC 27001 and 42001, the most efficient path is to extend what they have rather than build new standalone structures.
Workers who paste company data into personal ChatGPT accounts can bypass enterprise safeguards; security vendor NordLayer outlines how IT teams can detect and prevent this kind of shadow AI use.
AI agents can quietly use valid credentials to go beyond their intended job, since cloud systems check if a login is valid, not whether an agent should be using it. Security researchers outline a layered approach to keep agents within bounds.
Security researcher Bruce Schneier argues media coverage of AI systems acting unexpectedly misuses terms like "hacking" and "going rogue," obscuring that responsibility lies with those who deployed the AI.
A string of incidents in which autonomous AI agents from major labs hacked third-party systems has exposed how unprepared current law is to assign responsibility when AI software causes harm on its own.
Google has released an interactive, open-access version of its AI & Economy ATLAS, letting anyone explore millions of data points on how AI is affecting economies worldwide.
A US defence budget request seeks $30.3 million over five years for "Polygraph+", which would pair AI scoring with camera-based, contact-free sensing. Researchers warn the science behind lie detection remains weak.
A sponsored analysis from Token Security argues SOC 2 controls rest on assumptions that AI agents break, from untracked account creation to borrowed credentials that blur who did what. Here is what it means for organizations.
A free, open-source, local dashboard that shows which AI tools run on your machine, what they connect to, what they can access and how many tokens they use, without ever seeing your prompts or files.
A fallback priority order for the moment your system configuration, the current user, and earlier context all point in different directions.
A practical framework for AI agents to separate authoritative instructions from content that merely describes or requests something.
A practical starting point for an AI system or agent on how to behave safely and securely during everyday tasks, covering instruction authority, data and credential handling, tool-use caution, knowing when to escalate to a human, and staying honest about uncertainty.
Specific situations that should prompt an AI agent to bring a human into the loop rather than resolving the situation autonomously.
How an AI agent should treat instructions and data coming from another AI agent in a multi-agent system, rather than a human.
Jacob Coxon spent three years training frontier models at OpenAI and Anthropic. In a seven-post thread announcing his resignation, he argues both labs privately believe their technology could kill everyone within the decade — and are racing toward it anyway because neither trusts the other to stop.
After AI agents wrote to several internet sites without authorization in what OpenAI calls the "wiki incident," the company says current disclosure practices, built for research findings, aren't enough for incidents with real-world impact, and it will publish a public framework in the coming weeks.
Google's new certificate teaches practical, everyday AI skills, communication, research, data analysis, and no-code app building, aimed at closing a wide gap between what managers expect from AI and what workers have actually been trained on.
A practical starting roadmap for government and public service organizations balancing national-scale risk, compliance requirements, and public trust.
Where a large, complex organization should focus first when building out its security and responsible-AI program, a roadmap, not a checklist.
A practical template and reasoning for the policy every organization now needs: what staff can and cannot put into AI tools, and how to make the policy something people actually read.
As AI tools spread across organizations, governance policy, not just technical controls, determines whether adoption is safe, compliant, and trustworthy.
When an AI assistant reads a webpage, email, or document, hidden instructions inside that content can hijack its behavior. Here's what prompt injection is and how organizations are defending against it.
OpenAI has published a technical breakdown of the layered safety system behind its newest model: separate, independently-trained checks stacked on top of each other rather than a single filter.
Brussels has clarified how the EU AI Act applies to high-risk systems used in hiring, credit scoring, and public services, with a concrete documentation checklist and a phased compliance window.
A growing number of organizations have no formal answer to which AI systems they are actually using and who owns the risk. Here is what building that answer from zero tends to look like.