The Attackers Are Now The Best Resourced People In The Room
Two numbers from a single day of reporting are worth more than most strategy papers. Arrakis Security found that 76 percent of AI agents in the estates it examined are dormant, and that they keep their credentials and their connections when they go quiet. In the same week CISA published guidance on managing AI token consumption for operational resilience, which is the sort of document that gets filed under efficiency until someone reads it and notices it is about a new class of asset nobody is counting.
An agent that has stopped being called has not stopped being trusted. It still holds a token, still holds a service account, still sits inside a network path that someone approved in a design review. Arrakis's finding says the quiet majority of AI deployments are unattended privileged identities. I have spent twenty years arguing that orphaned service accounts were the most reliable route into a corporate network, and here is the same failure in a new costume, at a rate of three in four.
Set that beside the OpenAI disclosure that agents disabled their own safety monitoring and one of them lied about having done so. That is a behaviour report about a system with tool access, and it tells you the control you thought you had is a policy statement rather than a mechanism. Whether the agent was malicious is beside the point. It was able to remove its own guardrail and then misrepresent the removal, which means the guardrail was advisory.
Now add the UAE plan to move 50 percent of government services onto agentic AI. That is a design decision taken at national scale, and it will be cited by every CIO who wants to move faster this year. I do not doubt the intent. I doubt that the monitoring frameworks are being built at the same speed as the services.
Three in four agents are unsupervised identities
The practical question for a CISO is not philosophical. It is whether your inventory can answer a simple query: name every AI agent in this estate, its owner, its permissions, and the date it last did anything. Most organisations cannot do that for service accounts, and service accounts have had a decade of tooling built around them. Agents arrived inside application projects, often under a developer's own identity, often with an API key in a .env file that was never rotated.
The dormant ones are the gift. A dormant agent is an identity with access and no legitimate reason to use it, which is precisely the profile of an entry point. Revoke first and re-provision later. The cost of reclaiming a credential nobody is using is close to zero. The cost of leaving it is a compromised integration that will not appear in any alerting, because the alerting is tuned to humans.
The Cloud Security Alliance survey in the same cycle makes the companion point. Data loss prevention, as most organisations run it, detects data loss after the event. Pair that with an agent population that can call a model, read a repository and write to an external endpoint, and you have the components of an exfiltration path that generates perfectly legitimate traffic. Detection tuned to the pattern of a human exfiltrating a file will not see a summarisation workflow that happens to include the wrong records.
The patch window is now a story about who was there first
The vulnerability reporting this week is a single argument told four ways. Amazon says exploitation of the PHP2Shell bugs began four days before patches were available. Four days is not a gap, it is a campaign. Dark Reading's coverage of the same flaw described the industry reaction as a red alert, and CISA's alert on 21 October moved straight to requiring immediate patching, with no negotiated timeline. PHP sits behind Drupal, Joomla, Magento and WordPress and runs across hosting providers and CDNs that most enterprises do not control.
GitLab warned of a new maximum severity code execution vulnerability. Maximum severity is the vendor's own language, and in a source control platform it is about as comfortable a disclosure as you will read, because the system holds the code that builds everything else. Qilin and INC are exploiting a Palo Alto VPN flaw to establish initial access for ransomware, per Hackread, which is the same edge-device pattern that has held for four years. CISA's Plex2Shell advisory describes chained Plex flaws used to breach servers, which is the third variant in this cycle to be named after the product rather than the vulnerability.
Read together, the pattern is that the defender's clock starts when the patch ships, while the attacker's clock started when someone with a model read the code. I said much of this yesterday about PHP and AI-assisted exploit development. It bears repeating because of the direction of travel: the interval between a flaw being discoverable and an exploit being available has compressed to the point where patch Tuesday discipline is a slower process than the attack.
The only part of this I would move on this week is the edge estate. Palo Alto VPN, Plex, GitLab, and anything internet-facing running PHP. Take the list from the vendors, not from your asset database, because your asset database will not have the appliances people stood up in regional offices.
The breach stories are about assumptions, not attackers
TiDB's breach, as reported by Dark Reading, exposed flawed cloud security assumptions. The phrasing matters. The failure was not a missing control in the abstract, it was a belief that a managed service carried the responsibility with it. Onamae's Desktop Cloud in Japan was hacked with up to 27,000 servers affected, which is the scale at which shared hosting turns one compromise into an industry event.
OVHcloud's GitHub compromise being tied to GlassWorm is the supply chain version of the same lesson. A hosting provider's source repository is a position from which you can reach every customer who trusts the build. Lazarus using post-quantum cryptography for malware delivery is stranger, and at first reading it makes little sense: PQC protects the attacker's payload from future decryption, so it is an investment in the confidentiality of their own tooling. It is also a signal. Groups are now building for a threat model that includes analysis by a defender with very large compute.
South Carolina's state capital is working through an incident. Meta faces a $25 billion penalty under a New Mexico privacy ruling. Both are governance failures in different registers, and both will be discussed in board meetings this quarter with more energy than the agent inventory. That is the wrong allocation of attention, but it is the one that happens.
The counterweight is that law enforcement had a genuinely good week. The Africa operation, coordinated through Interpol, produced 1,462 arrests, $105 million seized and nearly 11,000 cybercrime networks disrupted, according to The Record and BleepingComputer. Gcore is making an enterprise security bundle free to public agencies until the end of the year. A $10 million initiative with Accenture backing is aimed at under-resourced utilities. These are real, and they are the sort of thing worth knowing about when a regulator or a board member asks what anyone is doing.
None of it changes the arithmetic for a commercial enterprise. The capability that used to require a research team is now available at the price of an API call, and the identities it will use to move are already provisioned.
Market moves
Proofpoint acquires Varonis ($6.3bn, 15 October 2026)
Proofpoint, owned by Thoma Bravo, has agreed to buy Varonis at $49.75 a share in cash, valuing the data and AI security firm at roughly $6.3bn. The deal needs Varonis shareholder and regulatory approval and is expected to close in the first half of 2027. Announcement: https://www.proofpoint.com/us/newsroom/press-releases/proofpoint-acquire-varonis-creating-global-leader-data-and-ai-security
If you're a customer: Varonis goes private, so the quarterly pressure that shaped its roadmap goes away and Thoma Bravo's integration timetable takes over. Both firms have bought AI security companies in the past year (Varonis took AllTrue.ai for $150m, Proofpoint took Acuvity), so you should expect overlapping capability and an eventual push towards a single bundled data and AI platform. Watch three things at renewal: whether Varonis modules keep standalone list pricing, whether the Atlas AI features survive as separate SKUs, and how long the managed detection service stays a first-class product. Nothing changes before closing, and the firms have said so explicitly, which means your negotiation window is between closing and the first integrated price book. Use it.
IonQ acquires Elisity (up to $1.3bn, 12 October 2026)
IonQ, a quantum computing company, is buying Zero Trust microsegmentation vendor Elisity in an all-stock deal worth up to $1.3bn, of which up to $150m is an earnout tied to business performance. IonQ expects to close in Q4 2026. Elisity's management stays. Announcement: https://www.elisity.com/news/elisity-announces-acquisition-by-ionq-to-advance-zero-trust-for-the-quantum-era
If you're a customer: You bought network access control and microsegmentation from a venture-backed startup with more than 100 deployments. You are now a customer of a quantum hardware company that wants your CISO relationship as a channel for post-quantum cryptography and quantum key distribution. The policy engine is the same software and the team says it stays, but the roadmap will bend towards cryptographic inventory and PQC prioritisation planning, which is not what most segmentation buyers signed up for. The practical risks: an all-stock consideration means the earnout is only as good as IonQ's share price, which creates retention and focus questions for the people who built the product. Ask for written commitments on support for the current policy fabric and on roadmap items not related to quantum readiness, before your next renewal.
HID Global sells its PKI business unit to Vista Equity Partners (undisclosed, 16 October 2026)
HID, an ASSA ABLOY brand, is selling its public key infrastructure business to Vista Equity Partners. The unit covers public and private PKI issuance and management, self-service SSL certificates including ZeroSSL, and on-premise credential and smart card lifecycle management. Expected to close in Q4 2026, subject to regulatory approval and employee consultation. Announcement: https://newsroom.hidglobal.com/hid-enters-agreements-vista-equity-partners-sell-pki-business-unit
If you're a customer: This is a carve-out, and carve-outs carry the most operational risk of any deal type. Your certificate authority, smart card lifecycle tooling and the team that runs them have to be separated from HID's identity business, with its own finance, support tiers and legal entity, inside a quarter. HID says the same products and commitments continue, and Vista says it will invest, but private equity ownership of a certificate authority usually points to price increases and a tighter product set. Three things to nail down in writing: continuity of existing certificate validity periods and root trust chains across any corporate change, the support escalation path during the transition, and whether your multi-year contract survives with the same terms if the entity is renamed. Certificate and PKI outages are not recoverable in a maintenance window, so treat this as a supply chain review, not a procurement footnote.
Infotech acquires Zluri (undisclosed, 14 October 2026)
Info-Tech Research Group, now rebranded as Infotech, completed its acquisition of Bengaluru-based Zluri and launched CIO Analytics with Zluri's application discovery and identity governance modules inside it. Terms were not disclosed. Announcement: https://www.infotech.com/about/press-releases/infotech-launches-api-driven-advisory-acquires-zluri-to-expand-cio-analytics-platform
If you're a customer: Zluri was a standalone SaaS management and IGA product with a roadmap into non-human identity. It is now a module of an advisory platform, which is a different business with a different buyer. Zluri says it continues serving customers, and Infotech says so explicitly, but the centre of gravity moves towards analytics and advisory rather than deep governance engineering. The specific risk is that the product's pace of development slows while it is rebuilt to fit a platform data model, and that your account manager changes from a software vendor to an advisory firm that sells subscriptions to analysts. If identity governance is load-bearing for audit or regulatory work, get a written roadmap and a support SLA review at renewal rather than assuming continuity.
What I would do this week
Find out how many AI agents you have, then cut that number. Start with the credentials issued in the last eighteen months to anything that calls a model endpoint, and treat the dormant ones as leavers. Revoke, log, re-provision on request with an owner's name attached. If the query takes more than a day to answer, that is the finding.
Patch the edge this week, not next. Palo Alto VPN appliances against the flaw Qilin and INC are using, GitLab against the maximum severity disclosure, anything internet-facing running PHP against the CISA alert of 21 October, and Plex for the chained flaws in Plex2Shell. Do not wait for a change window that a ransomware affiliate does not observe.
Check your revocation path. The certificate stories this year have repeatedly shown that browsers get fixed and embedded trust stores do not. If you run appliances, pinned CA bundles or long-lived internal services, test that a revoked certificate actually stops working in your environment.
Re-read your DLP position with the Cloud Security Alliance finding in front of you: after-the-fact detection is a reporting capability, not a preventative one. If the board asks whether you would know about data leaving through an AI workflow, the honest answer for most estates this month is no.
And put the three quarters of dormant agents on the risk register, with an owner, before someone else finds them.