DISC Infosec blog https://blog.deurainfosec.com/ Dedicated to information security assurance Information Security subject matter with related items Fri, 23 Oct 2026 01:00:30 +0000 en-US hourly 1 https://wordpress.org/?v=6.1.15 https://blog.deurainfosec.com/wp-content/uploads/2026/07/disc-logo-144x144.jpg DISC InfoSec blog https://blog.deurainfosec.com/ 32 32 US Banks Are Blocking Third-Party AI Agents from Customer Accounts https://blog.deurainfosec.com/us-banks-are-blocking-third-party-ai-agents-from-customer-accounts/ https://blog.deurainfosec.com/us-banks-are-blocking-third-party-ai-agents-from-customer-accounts/#respond Fri, 23 Oct 2026 01:00:26 +0000 https://blog.deurainfosec.com/?p=36693 US Banks Are Blocking Third-Party AI Agents from Customer Accounts Why the first big agentic-AI standoff is happening at the bank login page, and what every SaaS and fintech builder should take from it Oct 22, 2026 · @disc US banks are not banning AI. They are banning unverifiable delegation: software that logs in with […]

The post US Banks Are Blocking Third-Party AI Agents from Customer Accounts appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/us-banks-are-blocking-third-party-ai-agents-from-customer-accounts/feed/ 0 Traditional vs. Agent Frameworks: Same Dimensions, Different Liabilities https://blog.deurainfosec.com/traditional-vs-agent-frameworks-same-dimensions-different-liabilities/ https://blog.deurainfosec.com/traditional-vs-agent-frameworks-same-dimensions-different-liabilities/#respond Thu, 22 Oct 2026 17:59:02 +0000 https://blog.deurainfosec.com/?p=36665 Traditional vs. Agent Frameworks: Same Dimensions, Different Liabilities Oct 16, 2026 · @disc Why the agent shift is a liability shift Agent frameworks move the most important decisions in your software from build time to runtime, and from your developers to a model. Every control you built for traditional software assumed the opposite. In traditional […]

The post Traditional vs. Agent Frameworks: Same Dimensions, Different Liabilities appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/traditional-vs-agent-frameworks-same-dimensions-different-liabilities/feed/ 0 The Controls Are Still Being Written: Governing AI When the Technology Outruns the Audit https://blog.deurainfosec.com/the-controls-are-still-being-written-governing-ai-when-the-technology-outruns-the-audit/ https://blog.deurainfosec.com/the-controls-are-still-being-written-governing-ai-when-the-technology-outruns-the-audit/#respond Tue, 20 Oct 2026 18:33:14 +0000 https://blog.deurainfosec.com/?p=36686 The Controls Are Still Being Written: Governing AI When the Technology Outruns the Audit Oct 20, 2026 · @disc “The technology is ahead of the governance and compliance. Control frameworks and audits are still being worked through.” That sentence is the honest state of AI assurance in late 2026. Your engineering team ships an agent […]

The post The Controls Are Still Being Written: Governing AI When the Technology Outruns the Audit appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-controls-are-still-being-written-governing-ai-when-the-technology-outruns-the-audit/feed/ 0 If Your Frontier Model Vanished for 3 Weeks, Would Your Business Stop? https://blog.deurainfosec.com/if-your-frontier-model-vanished-for-3-weeks-would-your-business-stop/ https://blog.deurainfosec.com/if-your-frontier-model-vanished-for-3-weeks-would-your-business-stop/#respond Sun, 18 Oct 2026 17:20:53 +0000 https://blog.deurainfosec.com/?p=36680 The Great AI Pullback: Sovereignty, Small Models, and the Runtime Controls Regulated Industries Now Demand Oct 18, 2026 · @disc Regulated firms are not abandoning AI. They are taking it back in-house. The question in the boardroom has changed from “which model is smartest?” to “who controls the model, the data, the runtime, and the […]

The post <strong>If Your Frontier Model Vanished for 3 Weeks, Would Your Business Stop?</strong> appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/if-your-frontier-model-vanished-for-3-weeks-would-your-business-stop/feed/ 0 The Evidence Lifecycle: Which Organizational Events to Log for Liability — and How Long to Keep Them https://blog.deurainfosec.com/the-evidence-lifecycle-which-organizational-events-to-log-for-liability-and-how-long-to-keep-them/ https://blog.deurainfosec.com/the-evidence-lifecycle-which-organizational-events-to-log-for-liability-and-how-long-to-keep-them/#respond Fri, 16 Oct 2026 17:26:24 +0000 https://blog.deurainfosec.com/?p=36643 The Evidence Lifecycle: Which Organizational Events to Log for Liability — and How Long to Keep Them Oct 16, 2026 · @disc infosec Why logs are your liability defense When an auditor, regulator, or plaintiff’s attorney asks “prove it,” your logs are the only answer that counts. Policies show intent. Logs show what actually happened, […]

The post The Evidence Lifecycle: Which Organizational Events to Log for Liability — and How Long to Keep Them appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-evidence-lifecycle-which-organizational-events-to-log-for-liability-and-how-long-to-keep-them/feed/ 0 14 Months to Comply. 12 Months of Work. The High-Risk AI Playbook Nobody Has Started https://blog.deurainfosec.com/14-months-to-comply-12-months-of-work-the-high-risk-ai-playbook-nobody-has-started/ https://blog.deurainfosec.com/14-months-to-comply-12-months-of-work-the-high-risk-ai-playbook-nobody-has-started/#respond Wed, 14 Oct 2026 19:10:51 +0000 https://blog.deurainfosec.com/?p=36630 The High-Risk AI System Readiness Playbook How to find, fix, and prove control over your highest-risk AI before the regulator — or your biggest customer — asks Oct 11, 2026 · @disc You have roughly 14 months until the EU AI Act’s Annex III high-risk obligations apply on 2 December 2027, and a credible readiness […]

The post 14 Months to Comply. 12 Months of Work. The High-Risk AI Playbook Nobody Has Started appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/14-months-to-comply-12-months-of-work-the-high-risk-ai-playbook-nobody-has-started/feed/ 0 Your biggest AI risk isn’t hackers. It’s your own data walking out the door https://blog.deurainfosec.com/your-biggest-ai-risk-isnt-hackers-its-your-own-data-walking-out-the-door/ https://blog.deurainfosec.com/your-biggest-ai-risk-isnt-hackers-its-your-own-data-walking-out-the-door/#respond Mon, 12 Oct 2026 17:10:23 +0000 https://blog.deurainfosec.com/?p=36622 10 Risks of Data Leakage in the Age of AI — and How to Mitigate Them Oct 12, 2026 · @DISCInfoSec Your data no longer leaks through the firewall. It leaks through the prompt box, the context window, the agent’s tool call, and the memory file nobody knew existed. For twenty years, data loss prevention […]

The post Your biggest AI risk isn’t hackers. It’s your own data walking out the door appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/your-biggest-ai-risk-isnt-hackers-its-your-own-data-walking-out-the-door/feed/ 0 The cheapest security control you’ll ever implement is the component you decided not to build https://blog.deurainfosec.com/the-cheapest-security-control-youll-ever-implement-is-the-component-you-decided-not-to-build/ https://blog.deurainfosec.com/the-cheapest-security-control-youll-ever-implement-is-the-component-you-decided-not-to-build/#respond Fri, 09 Oct 2026 19:09:09 +0000 https://blog.deurainfosec.com/?p=36611 Less Engineering. More Effective AI Agents. Why the simplest agent harness is also the most secure, most governable, and most auditable one… Every component you add to an AI agent is a component an attacker can reach, an auditor must test, and your team must explain after an incident. That is the whole argument of […]

The post The cheapest security control you’ll ever implement is the component you decided not to build appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-cheapest-security-control-youll-ever-implement-is-the-component-you-decided-not-to-build/feed/ 0 AI Handoffs: How Uncertainty Propagates—and How to Fix It https://blog.deurainfosec.com/ai-handoffs-how-uncertainty-propagates-and-how-to-fix-it/ https://blog.deurainfosec.com/ai-handoffs-how-uncertainty-propagates-and-how-to-fix-it/#respond Mon, 05 Oct 2026 19:37:13 +0000 https://blog.deurainfosec.com/?p=36598 Probabilistic Lineage: How Much Uncertainty Was Already Baked Into the Input? Upstream models classify, repair, and infer before your main model ever sees the data. Nobody tracks how much probability shaped the input. The research landscape, the traps, and a workable design. Here’s a question I keep coming back to, and I don’t think the […]

The post AI Handoffs: How Uncertainty Propagates—and How to Fix It appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/ai-handoffs-how-uncertainty-propagates-and-how-to-fix-it/feed/ 0 The Security Risks Hiding in AI Agent Memory https://blog.deurainfosec.com/the-security-risks-hiding-in-ai-agent-memory/ https://blog.deurainfosec.com/the-security-risks-hiding-in-ai-agent-memory/#respond Tue, 29 Sep 2026 16:25:09 +0000 https://blog.deurainfosec.com/?p=36586 The Security Risks Hiding in AI Agent Memory Agent memory is the least-governed data store in most enterprises, and it is filling up with secrets. An agent that remembers can be taught. An agent that can be taught can be poisoned. And whatever it has learned sits somewhere, usually in plain text, usually outside any […]

The post The Security Risks Hiding in AI Agent Memory appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-security-risks-hiding-in-ai-agent-memory/feed/ 0 AI Log Retention: Why Every AI Log Doesn’t Deserve the Same Shelf Life https://blog.deurainfosec.com/ai-log-retention-why-every-ai-log-doesnt-deserve-the-same-shelf-life/ https://blog.deurainfosec.com/ai-log-retention-why-every-ai-log-doesnt-deserve-the-same-shelf-life/#respond Fri, 25 Sep 2026 21:29:08 +0000 https://blog.deurainfosec.com/?p=36583 DISC INFOSEC  |  AI GOVERNANCE AI Log Retention: Why Every AI Log Doesn’t Deserve the Same Shelf Life Your AI logs are either your best evidence or your biggest liability. The retention period decides which. Most teams I assess have exactly one AI log retention setting: whatever the vendor or the SIEM shipped with. Thirty […]

The post AI Log Retention: Why Every AI Log Doesn’t Deserve the Same Shelf Life appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/ai-log-retention-why-every-ai-log-doesnt-deserve-the-same-shelf-life/feed/ 0 The AI Agent Harness Is the New Security Boundary https://blog.deurainfosec.com/the-ai-agent-harness-is-the-new-security-boundary/ https://blog.deurainfosec.com/the-ai-agent-harness-is-the-new-security-boundary/#respond Thu, 24 Sep 2026 17:22:37 +0000 https://blog.deurainfosec.com/?p=36574 The AI Agent Harness Is the New Security Boundary Everyone is talking about securing the AI model. But for AI agents, the model may not be the most important security boundary. The real security boundary is the harness. Think of the model as the reasoning engine. The harness is the scaffolding that turns reasoning into […]

The post The AI Agent Harness Is the New Security Boundary appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-ai-agent-harness-is-the-new-security-boundary/feed/ 0 Stop asking what your agent can do https://blog.deurainfosec.com/stop-asking-what-your-agent-can-do/ https://blog.deurainfosec.com/stop-asking-what-your-agent-can-do/#respond Mon, 21 Sep 2026 20:12:45 +0000 https://blog.deurainfosec.com/?p=36552 The Harness Is the Contract: Declared, Bounded, Verifiable Stop asking what your agent can do. Ask whether every consequential path was declared, bounded, and left evidence a third party can verify. A practitioner’s framework for governing the harness, not the model. Most AI governance effort is aimed at the wrong object. Teams assess the model […]

The post Stop asking what your agent can do appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/stop-asking-what-your-agent-can-do/feed/ 0 You can’t put a human in the loop of a system that kills its agents every 3 minutes https://blog.deurainfosec.com/you-cant-put-a-human-in-the-loop-of-a-system-that-kills-its-agents-every-3-minutes/ https://blog.deurainfosec.com/you-cant-put-a-human-in-the-loop-of-a-system-that-kills-its-agents-every-3-minutes/#respond Tue, 15 Sep 2026 19:30:14 +0000 https://blog.deurainfosec.com/?p=36544 Continuous Human Involvement Is a Fantasy. Continuous Human Authority Is an Architecture. How to govern a fleet of hundreds of ephemeral AI agents that spawn, act, and vanish in minutes — when nobody can watch them. Someone posed me a riddle recently, and it’s the sharpest challenge to “human-in-the-loop” orthodoxy I’ve heard in a while: […]

The post You can’t put a human in the loop of a system that kills its agents every 3 minutes appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/you-cant-put-a-human-in-the-loop-of-a-system-that-kills-its-agents-every-3-minutes/feed/ 0 Human Oversight vs Human Control: Where the Human Sits in AI Execution https://blog.deurainfosec.com/human-oversight-vs-human-control-where-the-human-sits-in-ai-execution/ https://blog.deurainfosec.com/human-oversight-vs-human-control-where-the-human-sits-in-ai-execution/#respond Wed, 09 Sep 2026 19:07:16 +0000 https://blog.deurainfosec.com/?p=36508 Where Does the Human Sit Relative to Execution? Outside the loop, in it, on it, or alongside it? The position determines what evidence exists, which risk tiers are defensible, and whether Article 14 oversight is real or theatre. Someone put a question to me recently that I thought was better than most of the governance […]

The post Human Oversight vs Human Control: Where the Human Sits in AI Execution appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/human-oversight-vs-human-control-where-the-human-sits-in-ai-execution/feed/ 0