Skip to content
T threat.cafe

Tag

#managed-settings

7 posts

  1. · Nadia Ferreira-Strand · MSP and SMB channel · on threat.cafe

    Your clients' staff are installing AI agents: an MSP's first 90 days of agent governance

    MSP AI guidance covers chat tools and data leakage. Clients now run coding agents that install packages and load MCP servers. A 90-day plan - discover, set a default policy, enforce on managed endpoints, report.

  2. · Priya Venkatraman · Enforcement architecture · on threat.cafe

    Allowlist, denylist or both? Designing MCP server policy after GitHub's enterprise allowlists

    An allowlist stops servers nobody approved. A denylist stops approved servers that later turn bad. MCP policy needs both, matched on URL or command, never on name alone.

  3. · Nadia Ferreira-Strand · Incident response · on threat.cafe

    Tabletop: a malicious MCP server in your engineering org, with the kill-switch question every team fails

    A 60-minute tabletop built from the postmark-mcp case. Five injects, a scoring sheet, and the question most teams cannot answer yet - how fast can you turn one MCP server off on every machine?

  4. · Tobias Lindqvist-Rao · Enforcement architecture · on threat.cafe

    Five Claude Code hook settings that quietly turn agent enforcement into advice

    Exit 1 does not block. A timed-out hook does not block. The if filter is best-effort. Plugin tools carry prefixed names. User hooks merge in unless managed-only mode is on. Check all five before you call a hook a control.

  5. · Constance Ibe-Whitmore · Governance and leadership · on threat.cafe

    Two-thirds of AI users at work use personal accounts: moving coding agents to managed tenancy without a ban

    DBIR 2026, via CRI, says 67% of AI users reach AI through non-corporate accounts on work devices. For coding agents that means no org policy on tools that run commands. Make the managed path easier, then enforce it on the device.

  6. · Constance Ibe-Whitmore · Governance and leadership · on threat.cafe

    Before you approve coding agents org-wide: a seven-condition rollout gate for security leaders

    Approve an org-wide coding-agent rollout when seven verifiable conditions hold - inventory, managed settings, a deliberate default mode, an artifact policy, egress limits, a decision log and a tested runbook. Most take days, not months.

  7. · Tobias Lindqvist-Rao · Enforcement architecture · on threat.cafe

    Skill scanning in Claude Enterprise skips API uploads, pre-existing skills and ZDR orgs: closing the gaps

    Claude Enterprise skill scanning checks new uploads and edits in claude.ai and Cowork. Anthropic's docs say it skips Skills API uploads, pre-existing skills, and CMEK, ZDR and HIPAA-ready orgs. A control for each gap.