DISC Infosec blog https://blog.deurainfosec.com/ Dedicated to information security assurance Information Security subject matter with related items Wed, 11 Nov 2026 18:16:36 +0000 en-US hourly 1 https://wordpress.org/?v=6.1.16 https://blog.deurainfosec.com/wp-content/uploads/2026/07/disc-logo-144x144.jpg DISC InfoSec blog https://blog.deurainfosec.com/ 32 32 You Can’t Fence Off Superintelligence: AI Governance Starts With You https://blog.deurainfosec.com/you-cant-fence-off-superintelligence-ai-governance-starts-with-you/ https://blog.deurainfosec.com/you-cant-fence-off-superintelligence-ai-governance-starts-with-you/#respond Wed, 11 Nov 2026 18:16:34 +0000 https://blog.deurainfosec.com/?p=36852 The Ship We All Share: Why AI Is a Civilizational Challenge, Not an AI War Nov 11, 2026 · @disc A two-week lead on a sinking ship What good is conquering artificial superintelligence two weeks ahead of your rival if the entire ship sinks? Watch the latest headlines around Jensen Huang, Silicon Valley boardrooms, and […]

The post You Can’t Fence Off Superintelligence: AI Governance Starts With You appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/you-cant-fence-off-superintelligence-ai-governance-starts-with-you/feed/ 0 Your AI Policy Isn’t Evidence. Here’s What Auditors Actually Sample https://blog.deurainfosec.com/your-ai-policy-isnt-evidence-heres-what-auditors-actually-sample/ https://blog.deurainfosec.com/your-ai-policy-isnt-evidence-heres-what-auditors-actually-sample/#respond Tue, 10 Nov 2026 16:58:56 +0000 https://blog.deurainfosec.com/?p=36707 AI Governance from Standards to Audit Evidence Nov 11, 2026 · @disc Effective AI governance requires more than compliance. It requires verifiable evidence. Every AI governance program eventually meets the same moment. An auditor, an enterprise buyer, or a regulator stops reading your policy and asks one question: show me. Show me the AI system […]

The post Your AI Policy Isn’t Evidence. Here’s What Auditors Actually Sample appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/your-ai-policy-isnt-evidence-heres-what-auditors-actually-sample/feed/ 0 Can Your AI Governance Survive Eight Questions? https://blog.deurainfosec.com/can-your-ai-governance-survive-eight-questions/ https://blog.deurainfosec.com/can-your-ai-governance-survive-eight-questions/#respond Fri, 06 Nov 2026 22:51:23 +0000 https://blog.deurainfosec.com/?p=36831 Can Your AI Governance Survive Eight Questions? Nov 6, 2026 · @disc Your AI is already in production. The only question is whether you can prove it is governed. The free DISC InfoSec AI Governance Scorecard answers that in eight questions and a few minutes, with a maturity score, a PDF report, and your top […]

The post Can Your AI Governance Survive Eight Questions? appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/can-your-ai-governance-survive-eight-questions/feed/ 0 You Can’t Govern AI You Can’t See: The Free AI Governance & Risk Exposure Assessment https://blog.deurainfosec.com/you-cant-govern-ai-you-cant-see-the-free-ai-governance-risk-exposure-assessment/ https://blog.deurainfosec.com/you-cant-govern-ai-you-cant-see-the-free-ai-governance-risk-exposure-assessment/#respond Thu, 05 Nov 2026 17:31:34 +0000 https://blog.deurainfosec.com/?p=36813 You Can’t Govern AI You Can’t See: The Free AI Governance & Risk Exposure Assessment Nov 5, 2026 · @disc Ask a leadership team how many AI tools their company uses and you’ll get a confident number. Ask how they know, and the room goes quiet. That silence is the real AI risk. It isn’t […]

The post You Can’t Govern AI You Can’t See: The Free AI Governance & Risk Exposure Assessment appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/you-cant-govern-ai-you-cant-see-the-free-ai-governance-risk-exposure-assessment/feed/ 0 Your ISO 27001 Certificate Has an AI-Shaped Hole in It https://blog.deurainfosec.com/your-iso-27001-certificate-has-an-ai-shaped-hole-in-it/ https://blog.deurainfosec.com/your-iso-27001-certificate-has-an-ai-shaped-hole-in-it/#respond Wed, 04 Nov 2026 18:27:25 +0000 https://blog.deurainfosec.com/?p=36776 Here’s a question I’m hearing more often in enterprise security reviews: “Show us how you manage AI model risk.” Plenty of teams with a clean ISO 27001 certificate go quiet at that point. They have their 93 Annex A controls covering access, encryption, logging and supplier security. All of it is solid, and none of […]

The post Your ISO 27001 Certificate Has an AI-Shaped Hole in It appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/your-iso-27001-certificate-has-an-ai-shaped-hole-in-it/feed/ 0 Someone Is Running Your AI Models Right Now. You’re Paying for It https://blog.deurainfosec.com/someone-is-running-your-ai-models-right-now-youre-paying-for-it/ https://blog.deurainfosec.com/someone-is-running-your-ai-models-right-now-youre-paying-for-it/#respond Tue, 03 Nov 2026 20:32:14 +0000 https://blog.deurainfosec.com/?p=36801 The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources Nov 3, 2026 · @disc The $100,000 Afternoon Cryptojacking took months to show up on a cloud bill. LLMJacking takes an afternoon. In incidents Mandiant worked through 2026, attackers ran up more than $100,000 in fraudulent model charges in a single day, […]

The post Someone Is Running Your AI Models Right Now. You’re Paying for It appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/someone-is-running-your-ai-models-right-now-youre-paying-for-it/feed/ 0 Your AI Agent Is Only as Secure as Its Harness: The Hidden Layer of AI Risk https://blog.deurainfosec.com/your-ai-agent-is-only-as-secure-as-its-harness-the-hidden-layer-of-ai-risk/ https://blog.deurainfosec.com/your-ai-agent-is-only-as-secure-as-its-harness-the-hidden-layer-of-ai-risk/#respond Tue, 03 Nov 2026 18:48:36 +0000 https://blog.deurainfosec.com/?p=36766 Nov 2, 2026 · @disc AI Agent Harness Security: The Hidden Layer of AI Risk (2026) The model proposes; the harness disposes. Why the software layer around your LLM is where agentic AI risk lives, and how to secure and govern it under OWASP ASI, ISO 42001 and NIST AI RMF. Every agentic AI conversation […]

The post Your AI Agent Is Only as Secure as Its Harness: The Hidden Layer of AI Risk appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/your-ai-agent-is-only-as-secure-as-its-harness-the-hidden-layer-of-ai-risk/feed/ 0 Your AI Is Live. Your Site Is Your Shop. Who’s Answering for Either? https://blog.deurainfosec.com/your-ai-is-live-your-site-is-your-shop-whos-answering-for-either/ https://blog.deurainfosec.com/your-ai-is-live-your-site-is-your-shop-whos-answering-for-either/#respond Mon, 02 Nov 2026 16:43:03 +0000 https://blog.deurainfosec.com/?p=36730 Your AI Is Already in Production. Is It Governed?DISC InfoSec AI Infrastructure, Agents & Applications Assessment Most small firms didn’t design their AI stack; it piled up. There’s a model API in the website, an agent with inbox access, and a plugin someone installed to solve last Tuesday’s problem. Each one works, and each one […]

The post Your AI Is Live. Your Site Is Your Shop. Who’s Answering for Either? appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/your-ai-is-live-your-site-is-your-shop-whos-answering-for-either/feed/ 0 Sam Altman Just Issued His Scariest Warning Yet — Fear Tactic or Real Signal? https://blog.deurainfosec.com/sam-altman-just-issued-his-scariest-warning-yet-fear-tactic-or-real-signal/ https://blog.deurainfosec.com/sam-altman-just-issued-his-scariest-warning-yet-fear-tactic-or-real-signal/#respond Fri, 30 Oct 2026 17:50:59 +0000 https://blog.deurainfosec.com/?p=36722 Altman Warns of AI’s Growing Risks: What Businesses Must Do Now to Protect Themselves. Altman Just Issued His Scariest Warning Yet — Fear Tactic or Real Signal? Oct 30, 2026 · @disc The headline problem Every few months, an AI CEO says something alarming and the internet splits in two. One camp hears a prophet. […]

The post Sam Altman Just Issued His Scariest Warning Yet — Fear Tactic or Real Signal? appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/sam-altman-just-issued-his-scariest-warning-yet-fear-tactic-or-real-signal/feed/ 0 Uncover Hidden Subdomains and Expand Your View of the Attack Surface with Subdomains Lookup https://blog.deurainfosec.com/uncover-hidden-subdomains-and-expand-your-view-of-the-attack-surface-with-subdomains-lookup/ https://blog.deurainfosec.com/uncover-hidden-subdomains-and-expand-your-view-of-the-attack-surface-with-subdomains-lookup/#respond Wed, 28 Oct 2026 18:26:50 +0000 https://blog.deurainfosec.com/?p=36713 Uncover Hidden Subdomains and Expand Your View of the Attack Surface with Subdomains Lookup Oct 28, 2026 · @disc The subdomain you forgot is the one attacker find first Your security program protects the assets you know about. Attackers start with the ones you don’t. Every organization has a version of the same story: a […]

The post Uncover Hidden Subdomains and Expand Your View of the Attack Surface with Subdomains Lookup appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/uncover-hidden-subdomains-and-expand-your-view-of-the-attack-surface-with-subdomains-lookup/feed/ 0 When the Malware Talks to Your SOC: T1685.007 and the Attack on AI Defenders https://blog.deurainfosec.com/when-the-malware-talks-to-your-soc-t1685-007-and-the-attack-on-ai-defenders/ https://blog.deurainfosec.com/when-the-malware-talks-to-your-soc-t1685-007-and-the-attack-on-ai-defenders/#respond Tue, 27 Oct 2026 18:58:34 +0000 https://blog.deurainfosec.com/?p=36703 When the Malware Talks to Your SOC: T1685.007 and the Attack on AI Defenders Oct 27, 2026 · @disc The attacker is now writing for your analyst, and your analyst is a model For twenty years, malware has been written to fool two audiences: the operating system and the human analyst. MITRE ATT&CK v20, released […]

The post When the Malware Talks to Your SOC: T1685.007 and the Attack on AI Defenders appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/when-the-malware-talks-to-your-soc-t1685-007-and-the-attack-on-ai-defenders/feed/ 0 Prompt Engineering for Agents: Your System Prompt Is Now Production Code https://blog.deurainfosec.com/prompt-engineering-for-agents-your-system-prompt-is-now-production-code/ https://blog.deurainfosec.com/prompt-engineering-for-agents-your-system-prompt-is-now-production-code/#respond Mon, 26 Oct 2026 19:32:50 +0000 https://blog.deurainfosec.com/?p=36669 Prompt Engineering for Agents: Your System Prompt Is Now Production Code Oct 26, 2026 · @disc Why agent prompts are a governance problem In an agent framework, the system prompt is the closest thing you have to source code. It defines the agent’s role, what it may and may not do, how it calls tools, […]

The post Prompt Engineering for Agents: Your System Prompt Is Now Production Code appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/prompt-engineering-for-agents-your-system-prompt-is-now-production-code/feed/ 0 US Banks Are Blocking Third-Party AI Agents from Customer Accounts https://blog.deurainfosec.com/us-banks-are-blocking-third-party-ai-agents-from-customer-accounts/ https://blog.deurainfosec.com/us-banks-are-blocking-third-party-ai-agents-from-customer-accounts/#respond Fri, 23 Oct 2026 01:00:26 +0000 https://blog.deurainfosec.com/?p=36693 US Banks Are Blocking Third-Party AI Agents from Customer Accounts Why the first big agentic-AI standoff is happening at the bank login page, and what every SaaS and fintech builder should take from it Oct 22, 2026 · @disc US banks are not banning AI. They are banning unverifiable delegation: software that logs in with […]

The post US Banks Are Blocking Third-Party AI Agents from Customer Accounts appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/us-banks-are-blocking-third-party-ai-agents-from-customer-accounts/feed/ 0 Traditional vs. Agent Frameworks: Same Dimensions, Different Liabilities https://blog.deurainfosec.com/traditional-vs-agent-frameworks-same-dimensions-different-liabilities/ https://blog.deurainfosec.com/traditional-vs-agent-frameworks-same-dimensions-different-liabilities/#respond Thu, 22 Oct 2026 17:59:02 +0000 https://blog.deurainfosec.com/?p=36665 Traditional vs. Agent Frameworks: Same Dimensions, Different Liabilities Oct 16, 2026 · @disc Why the agent shift is a liability shift Agent frameworks move the most important decisions in your software from build time to runtime, and from your developers to a model. Every control you built for traditional software assumed the opposite. In traditional […]

The post Traditional vs. Agent Frameworks: Same Dimensions, Different Liabilities appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/traditional-vs-agent-frameworks-same-dimensions-different-liabilities/feed/ 0 The Controls Are Still Being Written: Governing AI When the Technology Outruns the Audit https://blog.deurainfosec.com/the-controls-are-still-being-written-governing-ai-when-the-technology-outruns-the-audit/ https://blog.deurainfosec.com/the-controls-are-still-being-written-governing-ai-when-the-technology-outruns-the-audit/#respond Tue, 20 Oct 2026 18:33:14 +0000 https://blog.deurainfosec.com/?p=36686 The Controls Are Still Being Written: Governing AI When the Technology Outruns the Audit Oct 20, 2026 · @disc “The technology is ahead of the governance and compliance. Control frameworks and audits are still being worked through.” That sentence is the honest state of AI assurance in late 2026. Your engineering team ships an agent […]

The post The Controls Are Still Being Written: Governing AI When the Technology Outruns the Audit appeared first on DISC InfoSec blog.

]]> https://blog.deurainfosec.com/the-controls-are-still-being-written-governing-ai-when-the-technology-outruns-the-audit/feed/ 0