Latest cybersecurity reporting from selected sources.

SB 315 Requires Annual Independent Audits, 72-Hour Incident Reporting for AI GiantsGov. JB Pritzker signed bipartisan legislation making Illinois the first state to require annual independent safety audits of frontier AI developers, going beyond California and New York frameworks with incident reporting deadlines, whistleblower protections and penalties up to $3 million.

When You Consume AI, You Inherit Every Upstream Risk You Can't SeeMost enterprises don't build AI, they consume it through APIs, open-source models and orchestration frameworks. Each layer inherits upstream risk with little visibility. This piece maps the four-layer AI supply chain and the existing security disciplines that bring it under control.

Microsoft-Owned GitHub, Which Runs npm, Previews Supply-Chain Security FixesThe popular Mastra AI framework, used to build artificial intelligence agents, workflows and retrieval-augmented generation pipelines, has been poisoned by attackers, and Microsoft-owned GitHub has advised all developers to downgrade Mastra, pending compromised packages being found and eradicated.

Paul Watts of Keywords Studios on Business Alignment, AI Hype and Workforce RiskCybersecurity leaders who still operate through the lens of frameworks and risk registers could be irrelevant in a world where business moves without them, said Paul Watts, CISO at Keywords Studios. He recommends investing in both AI and people to sustain operations over the long haul, he said.

Healthcare Coordinating Council Highlights AI Risks, Potential Medical MishapsHealthcare organizations face an array of difficult cybersecurity, privacy, patient safety, supply chain and operational resiliency issues as they roll out artificial intelligence tools. A new Health Sector Coordinating Council playbook aims to help by providing a voluntary governance framework.

White House Cuts Proposed AI Review Period From 90 Days to 30President Trump signed an executive order creating a voluntary framework for evaluating advanced AI systems with significant cybersecurity capabilities, directing NSA, Treasury and CISA to establish classified benchmarks while avoiding mandatory licensing or preclearance requirements.

Analysts Say White House Must Quickly Replace Shelved AI FrameworkU.S. President Donald Trump's decision to abruptly shelve an artificial intelligence executive order aimed at creating a federal review process for frontier models doesn't annul the need for the federal government to work with frontier model makers to address risks, say cybersecurity experts.

New Memo Replaces SolarWinds-Era Rules With Risk-Based ModelThe White House issued a new memo replacing SolarWinds-era logging mandates with a narrower framework focused on risk, threat hunting and forensic readiness as agencies confront faster artificial intelligence-enabled intrusions across federal networks.

License Frontier AI to Practice Medicine, Argues JAMA ArticleScrutiny is intensifying around the quickly evolving role that AI is playing in healthcare. That includes issues around the transparency and safety of consumer health chatbots and also whether a new clinical AI licensing framework is necessary to protect the integrity of medicine.

System Translates Detection Rules Across Security PlatformsResearchers developed an AI framework that converts threat detection rules between major SIEM platforms including Splunk, Microsoft Sentinel and QRadar. The system uses LLMs and automated validation steps to preserve detection logic during migrations that often require months of manual work.

Also, HexDex Arrest, Black Axe Crackdown, LeRobot RCE FlawThis week, election threats resurfaced. A prolific hacker arrested. Black Axe network disrupted. China-linked disinformation targets Tibet. Exploited ScreenConnect and Windows flaws raise alarms. Minecraft gamers hit with stealer malware. A critical AI framework bug enables remote code execution.

Early Tests of New Anthropic AI Model Show Fast Detection, Better Flaw CorrelationCrowdStrike's early testing of Anthropic's new Claude Mythos Preview AI model shows faster vulnerability detection and improved cross-system context, signaling a shift toward AI-driven security operations that compress discovery-to-response timelines and force new defensive frameworks.

Proofpoint CEO Sumit Dhawan on Applying Human Insider Risk Safeguards to AI AgentsAI agents behave like humans and carry the same risk profile. They operate non-deterministically, can be manipulated through prompt engineering and lack any inherent code of conduct, so they require a purpose-built integrity framework to govern their behavior, says Sumit Dhawan, CEO at Proofpoint.

Meerah Rajavel of Palo Alto Networks on AI Security, Governance and Use-Case FitAs AI outpaces governance and security frameworks, enterprise leaders face a more pressing question: How can they move fast without losing control? Meerah Rajavel of Palo Alto Networks says organizations need security guardrails, clear use cases and firm limits on probabilistic AI.

Federal Proposal Pushes AI Adoption While Avoiding Regulatory DetailThe White House AI framework urges rapid deployment and federal alignment to counter China while proposing guardrails on fraud, safety and speech - but leaves unresolved conflicts on IP, content regulation and state preemption that Congress must navigate.

Fraud Specialist David Barnhardt on Addressing Authentication Risks of Agentic AIFinancial institutions are racing to deploy AI agents that can initiate payments, approve transactions and freeze accounts. But traditional authentication frameworks assume there's a human on the other end. As agentic AI use grows, banks are facing an authentication crisis that demands new controls.

Countries Are Pouring Billions Into Domestic AI Stacks to Escape US-China DominanceBy 2027, more than one-third of the world's nations will be locked into region-specific AI platforms built on proprietary data, infrastructure and governance frameworks, according to Gartner. Nations are now safeguarding LLMs in the same way they do critical infrastructure.

Deal Targets GenAI Risks, Prompt Injection Attacks and Autonomous AgentsProofpoint has acquired AI security startup Acuvity to address fast-evolving risks tied to generative AI, prompt injection and autonomous agents. The company says intent-based guardrails and deep AI forensics will help enterprises secure tools such as ChatGPT, Claude and emerging agent frameworks.

Deal Targets GenAI Risks, Prompt Injection Attacks and Autonomous AgentsProofpoint has acquired AI security startup Acuvity to address fast-evolving risks tied to generative AI, prompt injection and autonomous agents. The company says intent-based guardrails and deep AI forensics will help enterprises secure tools such as ChatGPT, Claude and emerging agent frameworks.

Experts Advise Moving From Verifying Identities to Knowing Agent IntentionsFinancial institutions are rushing to deploy AI agents capable of autonomously initiating transactions, approving payments and freezing accounts in real time. But AI agents are creating a "dual authentication crisis" that traditional security frameworks cannot address.