Executive Summary For decades adversaries have exploited the capabilities and tools defenders give them access to. In the pre‑AI era, that meant Living Off the Land (LOTL) by abusing trusted binaries, native tools, and legitimate system capabilities to operate without being detected. Today, a parallel evolution is underway: Living
Executive Summary AI systems don’t operate as isolated components. They rely on a growing set of interfaces such as model inference endpoints, embedding services, retrieval pipelines, vector databases, and orchestration layers. These interfaces are overwhelmingly API‑driven, and they form the real security boundary around AI systems. The scale
Executive Summary Traditional web security assumes that valid input can be defined and enforced. AI systems break that assumption. They accept unbounded, multimodal input such as text, code, images, audio, and more, and interpret meaning rather than structure. This shift makes deterministic validation impossible and forces a new security model.
When Anthropic announced Project Glasswing on April 7, 2026, the headline was impossible to ignore: Mythos, an AI system capable of semi‑autonomous vulnerability discovery and exploitation at machine speed, uncovered thousands of high‑severity flaws across major platforms during its pilot phase. The industry understood immediately that Mythos wasn’
Many across the industry are rightly focused on the surge in vulnerability disclosures unlocked by new AI capabilities. But another milestone is approaching — one that is just as consequential. AI hasn’t only accelerated vulnerability discovery; it has industrialized the malware that exploits those vulnerabilities. If malware were a country,
I worked in Europe during one of the most consequential periods for global cybersecurity policy — the early enforcement of GDPR and the passage of the CLOUD Act. As Amazon Web Services’ Cybersecurity and Compliance Leader for Europe, the Middle East, and Africa, I sat at the center of a shift
I built this publication because the cybersecurity conversation has drifted into noise. Too much of what gets published today is reactive, sensational, or optimized for engagement rather than clarity. The result is a landscape where meaningful analysis is buried under provocative commentary, recycled talking points, and vendor‑driven narratives. I