Author
Constance Ibe-Whitmore
Regulatory translator · threat.cafe editorial persona
Fictional profile.
Constance turns vendor settings, standards and audit expectations into must, should and may obligations that security leaders can sign and defend. A fictional writer persona; articles are researched and fact-checked by the threat.cafe editors.
Writes on
- threat.cafe 8
8 posts
-
OWASP's two agent Top 10s, ASI and AST, mapped to controls you can actually test
OWASP's Agentic Applications list (ASI) and its incubating Agentic Skills list (AST) overlap on supply chain, drift and privilege. This crosswalk pairs each AST item with ASI risks, a test, and an honest tooling status.
-
Your MSP's AI agents have admin on your tenant: seven questions clients will ask, and good answers
When an MSP's own AI agents act inside client tenants, clients will ask about scope, oversight, data flow and exit. Good answers point to evidence (an inventory, scoped credentials, logs, a tested kill switch), not to a policy PDF.
-
The MCP spec's own security MUSTs, read by a buyer: five requirements to make any MCP vendor prove
The MCP spec already sets security obligations: no token passthrough, per-client consent, verified requests, exact-command consent, safe URL handling. Ask vendors to prove each, in the spec's own words.
-
KEV first, EPSS second, everything else on schedule: a written prioritisation policy for teams that will never patch 66,000 CVEs
With about 66,000 CVEs projected for 2026 and exploited ones well under 1%, rank by known exploitation, then by EPSS probability, and give each tier a written deadline. Template policy text included.
-
Two-thirds of AI users at work use personal accounts: moving coding agents to managed tenancy without a ban
DBIR 2026, via CRI, says 67% of AI users reach AI through non-corporate accounts on work devices. For coding agents that means no org policy on tools that run commands. Make the managed path easier, then enforce it on the device.
-
Before you approve coding agents org-wide: a seven-condition rollout gate for security leaders
Approve an org-wide coding-agent rollout when seven verifiable conditions hold - inventory, managed settings, a deliberate default mode, an artifact policy, egress limits, a decision log and a tested runbook. Most take days, not months.
-
When an agent causes the loss and there's no attacker: the cyber-insurance trigger gap and what to ask your broker at renewal
Cyber policies usually respond to attacks and breaches. An authorised agent that deletes data or sends it to the wrong place may fit neither. Ask your broker, in writing, which clause would respond.
-
Agent-governance maturity model: five observable stages from 'anything installs' to 'enforced, logged, tested'
A five-stage model for AI coding-agent governance across six dimensions, where every stage is defined by evidence an auditor can inspect. Your stage is your weakest dimension, which makes it hard to game.
