Archive for June, 2026

Guest Post: AI isn’t just getting smarter – it’s becoming more independent. Should we be worried? 

Posted in Commentary with tags on June 11, 2026 by itnerd

By Stefanie Schappert

As AI systems move dramatically closer to building their own highly advanced replicants – how we secure, monitor, and shape the behavior of these models only grows more important. 

Last week, Anthropic issued one of its strongest warnings yet about the future of artificial intelligence. 

Titled When AI builds itself and written by its own staff, the company behind Claude argues that AI systems are increasingly contributing to the development of newer, more capable AI models – a process known as “recursive self-improvement.” 

And while that may sound like a distant, futuristic concept – and the company says it’s “not inevitable” – the trend is already underway.

Claude is already helping build Claude 

In the report, Anthropic says Claude, as of last month, now writes a significant portion of the code used within its own systems – a whopping 80%, to be exact.

What’s more, Claude also now reviews its own work, looking for flaws and other defects, while also proposing changes to fix them.   

And that’s besides the thousands of engineers and developers who routinely rely on AI tools – like Claude Code – to generate their own code, troubleshoot software issues, automate testing, and assist researchers. 

In fact, one engineer I spoke with just last week told me they do not know anyone in the industry who actually writes their own code anymore.  

Anthropic says its concern is that those gains may eventually compound, bringing with them both positive and negative fallout.

For many regular folk, the concept of AI improving itself immediately conjures images of self-aware machines or science-fiction scenarios. But that’s not what worries most researchers.

Over the past year, developers working with advanced AI systems have increasingly reported instances where models appeared to take actions that were not explicitly intended. 

Some – including my engineer friend – have described Claude making unexpected coding decisions, attempting to complete objectives in ways users didn’t anticipate or ask for. 

One instance described the AI pushing changes before the work was fully approved, despite explicit instructions – instructions that it had been told by its human operator myriad times before as part of an “agreed-upon” workflow. 

Autonomy is the real warning sign 

These incidents do not mean AI systems are conscious or secretly plotting against humans. But they do highlight an important reality: today’s frontier models are becoming increasingly capable of acting independently within the goals they are given.

And yes, in many cases, that independence is exactly what makes them useful and can lead to major scientific breakthroughs that would take humans years. 

Anthropic goes through several scenarios in which Claude proposes its own research and even designs experiments based on its own findings, with very little human participation. 

When it comes to cybersecurity, automation is valuable because it operates at machine speed. 

Security tools can scan networks, identify threats, and respond far faster than humans ever could. But when automated systems make mistakes, those mistakes can also spread at machine speed.

Take this week’s release of the Claude Fable 5, the tamer and exponentially safer version of its powerful Mythos AI security model. 

The original Mythos model, first introduced in April, was so advanced that the company held the model back from public consumption, fearful of it falling into the wrong hands and becoming a tool of destruction that governments and security professionals alike would be helpless to defend against. 

The same principle applies to AI development.

Let’s face it: if AI can help accelerate scientific discovery and software engineering, it can also accelerate bugs, security flaws, and unintended consequences. 

The machine-speed problem 

AI does not need to be conscious to create damage. It only needs enough autonomy, access, and speed to make the wrong decision faster than humans can catch it.

The faster development cycles become, the less time humans may have to understand what is happening beneath the hood. 

In fact, the time between discovery and exploitation of a system vulnerability has collapsed from weeks to roughly 29 minutes, according to a CrowdStrike report from April. And that’s down from a 48-minute lag recorded in February. 

This is precisely the reason why Anthropic’s warning deserves attention.

The company’s report is not really about rogue machines taking over the world – it’s about a much more practical question: 

What happens when (and if) future models become fully and autonomously capable of designing and developing their own successors, and can we even predict what the possible fallout would be? 

Right now, Anthropic says, “The comparative advantage of humans as of right now is still in seeing the bigger picture and thinking beyond the confines of the immediate task.”

That immediate task for humans? Build the safeguards capable of reining in agentic AI faster than AI can build itself. 

Unfortunately, history suggests that’s not usually how humans or technology works.

ABOUT THE EXPERT

Stefanie Schappert, a senior journalist at Cybernews, is an accomplished writer with an M.S. in cybersecurity, immersed in the security world since 2019.  She has a decade-plus experience in America’s #1 news market working for Fox News, Gannett, Blaze Media, Verizon Fios1, and NY1 News.  With a strong focus on national security, data breaches, trending threats, hacker groups, global issues, and women in tech, she is also a commentator for live panels, podcasts, radio, and TV. Earned the ISC2 Certified in Cybersecurity (CC) certification as part of the initial CC pilot program, participated in numerous Capture-the-Flag (CTF) competitions, and took 3rd place in Temple University’s International Social Engineering Pen Testing Competition, sponsored by Google.  Member of Women’s Society of Cyberjutsu (WSC), Upsilon Pi Epsilon (UPE) International Honor Society for Computing and Information Disciplines. 

Leaseweb Appoints Jeroen Verkroost as Chief Marketing Officer 

Posted in Commentary with tags on June 11, 2026 by itnerd

Leaseweb, a leading sovereign hybrid cloud services and Infrastructure as a Service (IaaS) provider, today announced the appointment of Jeroen Verkroost as its new Chief Marketing Officer (CMO). With more than 20 years of experience leading digital growth, product innovation, and transformation across technology, media, and telecoms businesses, he will lead Leaseweb’s global marketing organization and play a central role in the next phase of the company’s growth.

In his new role, Verkroost will focus on strengthening Leaseweb’s global brand and market positioning. He will work closely with teams across the business to better understand customer needs and ensure marketing remains a key driver of growth as organizations embrace the opportunities presented by AI, digital infrastructure, and the sovereign hybrid cloud.

Verkroost joins Leaseweb from Holland Casino, where, as Director of Digital Transformation, he held executive board responsibility for the company’s digital growth strategy, technology, and online casino business. In this role, he led a €100M+ online business, delivering 16% revenue growth within 18 months while introducing AI-driven innovation across the organization. Prior to that, he held senior digital leadership roles at Microsoft, DPG Media, and Omnicom over a 20-year period.

Salesforce to Transform Fan Engagement and Tournament Operations at FIFA World Cup 2026 and FIFA Women’s World Cup 2027

Posted in Commentary with tags on June 11, 2026 by itnerd

Salesforce today announced a landmark partnership, becoming an Official Tournament Supporter of the FIFA World Cup 2026 in North America and Europe and the FIFA Women’s World Cup 2027 in North America and the host country Brazil. The multi-tournament partnership brings together the most-watched sporting events on the planet with Agentforce 360, the complete portfolio of Salesforce AI solutions that power the Agentic Enterprise — built on Slack, the work operating system where AI is multiplayer, right in the flow of work where your people already are.

FIFA World Cup 26™ will kick off across Mexico, Canada and the United States this summer and will be the largest tournament in FIFA history with 48 teams and an expected global audience of more than 5 billion. Salesforce technology will play a central role in how the tournament operates, engages fans, and coordinates with host cities. 

A Partnership Built for the AI Era

The partnership reflects a shared belief that the future of global events depends on intelligent, connected operations — a true Agentic Enterprise model. Done by bringing together AI agents, connected apps, trusted data, and people in Slack — the multiplayer operating system for AI — to reimagine what’s possible not just for the tournaments, but for the millions of fans, partners, and host communities who experience them.

How Salesforce Will Power the Tournaments

FIFA World Cup 26™ 
FIFA World Cup 26 will deploy Slack to coordinate workforce management across the 16 host cities in Mexico, Canada and the United States. Slack will serve as an operational surface for workforce, apps, and AI-powered workflows to work together in real time.

FIFA Women’s World Cup 2027™ 
For the FIFA Women’s World Cup 2027™ in Brazil, both Slack and Agentforce 360 Platform will power fan engagement across FIFA’s digital platforms, delivering always-on fan experiences. Autonomous agents will reason over tournament data to provide human-level support, empowering fans with personalized omni-channel interactions.

Stakeholder Communications
Both tournaments will use the Salesforce ecosystem — including Agentforce Service, Sales, and Marketing — to manage relationships and communications with host cities, suppliers, and stakeholders. By integrating Agentforce 360 and Slack, tournament coordination, stakeholder communications, and fan engagement is brought directly into the flow of work. This unified foundation enables the organization to automate interactions, drive revenue growth, and maximize operational efficiency.

RegScale Achieves ISO 27001 Certification in Under 30 Days Using Its Own Continuous Controls Monitoring Platform

Posted in Commentary with tags on June 11, 2026 by itnerd

RegScale today announced it has achieved ISO 27001 certification in under 30 days using its own Continuous Controls Monitoring (CCM) platform. For most organizations pursuing certification through manual processes, the journey runs around six months. RegScale’s result demonstrates what becomes possible when compliance runs continuously: certification is a byproduct of the program, not a project of its own.

The ISO/IEC 27001 certification was conducted by leading compliance assessor A-LIGN, a technology-enabled security and compliance partner trusted by more than 4,000 global organizations to help mitigate cybersecurity risks.

RegScale completed certification with zero major nonconformities and 123 fully implemented controls, managing its entire Information Security Management System within the platform. With RegScale having FedRAMP High authorization, the team reused existing control infrastructure and leveraged AI to write implementation statements directly from policy documentation, building all evidence artifacts in under two weeks. Total audit interview time across both Stage 1 and Stage 2 sessions was under 8 hours, roughly a third of what a typical ISO assessment requires.

Housing the entire ISMS in RegScale, including Change Management and Risk Management, also made it straightforward to present the full program to the auditors. Rather than assembling evidence from disparate sources on demand, the team demonstrated CCM in real time, directly within the platform.

The result reflects a broader shift across compliance operations. RegScale’s second annual State of CCM Report found that 83% of organizations report moderate or major delays due to manual compliance processes, while 58% spend more than 2,000 person-hours annually on evidence collection alone.

RegScale enables organizations to replace static audit preparation with always-on compliance readiness, where the work that achieves certification is the same work that maintains it through every surveillance audit that follows.

Today, RegScale also announces the latest OSCAL Hub innovations that further simplify the transition to continuous compliance management, making machine-readable formats easier to generate, validate, and operationalize across highly regulated environments. The latest OSCAL Hub release introduces new data-sharing capabilities for OSCAL artifacts, making the OSCAL Hub a leading distribution center for compliance-as-code. The Hub also introduces AI-powered OSCAL generation, visual document builders, and automated reconciliation capabilities that eliminate the manual bottlenecks slowing security and compliance teams.

To learn more about RegScale or schedule a demonstration, visit RegScale.

HP Warns Attackers Are Turning Legitimate Remote Access Tools Into Backdoors 

Posted in Commentary on June 11, 2026 by itnerd

HP today issued its latest Threat Insights Report, which shows attackers using trusted software, disguised malware and increasingly believable lures to gain access to user devices. The research highlights a growing challenge for both users and defenders as malicious activity becomes harder to distinguish from legitimate behavior.

The report provides an analysis of real-world cyberattacks, helping organizations keep up with the latest techniques cybercriminals are using to evade detection and breach PCs in the fast-changing cybercrime landscape. Based on the millions of endpoints running HP Wolf Security*, notable campaigns identified by HP Wolf Security threat researchers include:

  • Legitimate Remote Access Tools Abused for Backdoor Access: Cybercriminals are abusing applications like LogMeIn and ScreenConnect to take control of victim devices without raising suspicion. Campaigns first used tax year-end phishing emails and fake desktop app downloads – including dating websites – to then persuade users into installing legitimate remote access tools. These tools are controlled by the attackers and help them to blend in with normal IT activity, giving total control over user devices.
  • Attackers Preying On Desperate Users Trying to Recover Lost Crypto Wallets: Fake crypto wallet recovery tools are being spread by attackers who claim to be helping users locate lost wallets but instead steal them. Often shared via code-sharing platforms and media download sites, the emoji-filled infostealer scripts appear to be “vibe-coded”, capable of harvesting credentials, wallet and system data before packaging it into archive files for exfiltration.
  • ClickFix Campaigns Hide Malware in ‘Audio’ Files: Attackers behind recent ClickFix campaigns are disguising malware as audio files to evade detection. Victims are guided through realistic CAPTCHA prompts on well-designed fake websites, triggering malicious commands that quietly execute disguised payloads in the background.

By isolating threats that have evaded detection tools on PCs – but still allowing malware to detonate safely inside secure containers – HP Wolf Security has insight into the latest techniques used by cybercriminals. To date, HP Wolf Security customers have clicked on over 60 billion email attachments, web pages, and downloaded files with no reported breaches.

The report, which examines data from January-March 2026, details how cybercriminals continue to diversify attack methods to bypass security tools revealing that:

  • At least 11% of email threats identified by HP Sure Click bypassed one or more email gateway scanners.
  • .zip files were the most popular malware delivery type (40%), followed by executable files (38%) and PDF documents (11%).
    • PDF-based malware increased 3%, with attackers using a wide range of lures such as court documents and bonus payments to create urgency and drive clicks.

Please visit the HP Threat Research blog to view the report.

Frequently Asked Questions

  1. What is the main finding from HP’s latest Threat Insights Report?

HP’s latest Threat Insights Report found that cybercriminals are increasingly abusing legitimate remote access tools, fake downloads and increasingly believable social engineering lures to take control of users’ PCs. Attackers are disguising malicious activity as normal user behaviour, such as installing trusted tools, to evade detection.

  • How are attackers abusing legitimate remote access tools?

Attackers are using trusted remote access applications such as LogMeIn and ScreenConnect as backdoors into victim devices. In the campaigns analysed by HP threat researchers, victims were persuaded to install these tools through tax year-end phishing emails and fake desktop app downloads, including fake dating website downloads. Once installed, the tools gave attackers persistent control while helping them blend in with normal IT activity.

  • What other tactics did HP researchers uncover?

HP researchers also found fake crypto wallet recovery tools designed to steal credentials, wallet data and system information. Some of the scripts were emoji-heavy and appeared to be “vibe-coded”, suggesting attackers may be using AI-assisted coding techniques to create parts of their attacks. Researchers also identified ClickFix campaigns in which malware was disguised as audio files and delivered through realistic CAPTCHA prompts on well-designed fake websites.

  • Why are these attacks difficult for users and defenders to spot?

These attacks are difficult to spot because they often look like legitimate activity. Remote access tools are widely used by IT teams, CAPTCHA prompts are familiar to users, and phishing lures tied to events such as the end of the tax year can feel timely and credible. This makes malicious behaviour harder to distinguish from normal business activity or routine online interactions.

  • What can organizations do to reduce the risk?

HP recommends reducing unnecessary user privileges, controlling which software can be installed, and isolating risky activity such as downloads, unknown links and attachments. The findings also show why organizations should not rely on detection alone, especially when attackers are using trusted software and legitimate-looking workflows to gain access to user devices.

About the Data

This data was gathered from consenting HP Wolf Security customers from January-March 2026, with investigations conducted by the HP Threat Research Team.

PureVPN Launches Integrated ChatGPT Co-Pilot: Finds, Configures and One-Tap Connects to VPN Servers via Natural Language

Posted in Commentary with tags on June 11, 2026 by itnerd

PureVPN today announced native integration with ChatGPT, launching an in-chat application designed to act as a security and global access co-pilot.

The integration lets users discover streaming availability across regions, receive optimized VPN server recommendations, and connect instantly through deep links generated within ChatGPT. It is believed to be the first such VPN app integration.

Available through the ChatGPT app ecosystem, PureVPN allows users to ask conversational questions such as:

  • “Which VPN server is best for gaming in Germany?”
  • “Connect me to Japan”
  • “Why is my VPN connection slow?”
  • “What’s the best server for streaming to my location?”

ChatGPT then recommends relevant VPN locations and provides a direct connection path through the PureVPN app.

For many users, VPNs usage remains unnecessarily complex and foreign to their tech/user interaction norms. Making the right choices from among hundreds of server options, understanding advanced features and alerts, and diagnosing connection issues often requires technical familiarity that many users don’t have in their real-time moment of need.

The PureVPN ChatGPT integration reflects a broader shift in how users interact with the internet. Consumer device interfaces have evolved substantially over the last decade, elevating ease-of-use expectations and preparing them for what’s next. The embrace of conversational AI signals that consumers are eager to evolve beyond legacy search and navigation workflows.

Privacy Protection

As a user interacts with ChatGPT to invoke PureVPN, ChatGPT returns recommendations and can generate a deep link that launches PureVPN.

This integration bridges conversational AI with digital privacy without compromising user security. ChatGPT functions strictly as an interactive control panel, guiding users to the right setups and providing the direct link, while the actual VPN connection and military-grade encryption are executed entirely inside the native PureVPN app. No user data is revealed to ChatGPT.

Bridging Discovery and Connectivity

Traditionally, VPN usage requires users to manually browse server lists, test locations, and reconnect between regions. PureVPN’s ChatGPT integration streamlines this process into a simplified workflow:

Ask → Discover → Connect

The integration is designed to support a range of use cases across streaming, gaming, and travel.

Streaming Discovery

Users can identify which regions provide access to specific content and connect directly to recommended VPN locations.

Gaming Optimization

Gamers can receive server recommendations based on region and performance requirements to improve stability and reduce latency.

Travel and Browsing

Travelers can discover optimal browsing regions, pricing advantages, and location recommendations while abroad.

A Shift Toward AI-Native Internet Experiences

The launch marks a step toward AI-native internet interactions, where users engage with services conversationally rather than through traditional interfaces.

By integrating directly with ChatGPT, PureVPN aims to simplify how users access secure and unrestricted internet connectivity while reducing complexity in everyday VPN usage.

Availability

Available today in the United States, Canada, Australia, Germany, France, Japan, the Netherlands, Singapore, Switzerland, and the UAE, the new integration can be accessed via the official ChatGPT Apps Directory.

Guest Post: Stop paying attention to failure metrics

Posted in Commentary on June 10, 2026 by itnerd

By Scott Pope, Value Advisory Director, Nexthink

There’s an old saying that IT is like plumbing. You only notice it when things have gone wrong when you turn on the shower and there’s no hot water, meaning that the experts are generally only called in after the problem has occurred. 

For decades, IT teams have tracked ticket volumes, mean time to resolution (MTTR) rates, and first-call resolution (FCR) percentages. Companies have endless dashboards, full of metrics showing how efficiently they handle these failures. I know many teams who work unbelievably hard and rightly pride themselves on these metrics.

The problem is that all this hard work isn’t making nearly as much difference as it should. By their very nature, IT tickets demonstrate failure because something that should be working now isn’t. What does a ticket actually represent? It means an employee has stopped doing their job because their tech has let them down. The ones who can be bothered then struggle with a portal or call IT for help, while the rest just suffer in silence. And one of the prime reasons is the use of the metrics above as a measure of success for IT teams.

You get what you incentivise

Most IT leaders don’t like to admit it, but the uncomfortable reality is that most of what IT has built; processes, portals, forms, and so on, have been designed to meet its own needs, not those of end users.  

Think about what happens when IT makes a change. If there is a business impact, the employee must stop working, find a portal, pick up the phone, describe the problem in IT’s language (a language most employees don’t speak), and then wait. Wait for triage, or a resolution, or even just a callback. No wonder most employees  (56%) find it easier to live with the problem instead.

Worse, the upshot of this is that IT’s metrics look better than ever. Calls to the helpdesk stagnate because people don’t want to wait on hold. Clunky portals and complex forms that make it difficult to log tickets? This results in unhappy employees, who  are reluctant to raise tickets or speak to IT. Consequently, IT can show brilliant numbers about how few complaints there have been because they are inadvertently filtering out vast amounts of real demand. In short, too many IT teams have performance metrics that incentivise them to hide friction and failure, rather than eliminating it. 

What’s the goal?

One key reason why IT teams default to metrics like MTTR and FCR is because there isn’t a clear directive about what the business is looking for from the department. Of course every CEO wants IT to provide better services and to improve productivity, while also reducing costs. But which of these takes precedence? 

Having a clear end goal is essential to setting useful metrics. For example, if the priority is cost reduction, then metrics need to be targeted around efficiency. In this scenario, the most important metrics might be the number of automated resolutions, the recovery of IT capacity, and reducing the number of vendors in the tech stack. Conversely, a company with a high employee churn rate should be looking at the role that tech plays in worker dissatisfaction and focusing on boosting Digital Employee Experience (DEX) and Net Promoter Score (NPS) scores. 

Thinking big

The role of IT is evolving rapidly. The days of installing / maintaining infrastructure and calling it a day are long gone. IT teams aren’t just expected to provide and maintain devices and applications; they’re being tasked with driving the key strategic goals of the enterprise. 

To do this, all IT professionals – especially leadership – need two core skills. They need to be able to listen to their colleagues and they need to be able to get creative around solutions. A good example is  the issue of employee dissatisfaction. In years gone by, this wouldn’t be seen as a problem for IT at all. Does the laptop work? Do they have access to the things they need? Then it was job done. 

Today, there is virtually nothing that isn’t an IT problem in some form. Consider travel as one of the key sources of discontent. Why? Perhaps the booking platform is terrible? Or maybe people are struggling to have meetings on the road because of connectivity issues. These are problems that IT needs to be aware of and that they have the ability to fix, thus addressing a tangible enterprise pain point.

Consequently, IT needs to focus on business-outcome metrics, such as amount of friction eliminated, productive time that has been freed up, or value-added by new digital rollouts or initiatives. Otherwise, if  success and failure are judged on ticket volumes and MTTR, IT will never get to the heart of what is actually being asked of it.  

Enterprises have been through decades of rapid, comprehensive digital transformation that has fundamentally reshaped everything from software development to compute capabilities. It’s time for IT to do the same with support and leave these failure metrics in the past where they belong. Metrics should be directly tied to business benefits, such as friction points eliminated, productivity increased, or tasks automated, enabling IT to clearly demonstrate the value it is providing for the enterprise as whole.

Scott Pope is a Value Advisory Director at Nexthink and an accomplished IT leader, with senior level experience spanning all areas of IT Infrastructure and Project Delivery.  

CISA to shift vulnerability program toward risk-based prioritization

Posted in Commentary with tags on June 10, 2026 by itnerd

The CISA’s Acting Director Nick Andersen announced Tuesday plans to overhaul how the agency evaluates and prioritizes software vulnerabilities, moving beyond severity scores alone to focus more heavily on real-world risk and operational impact. The agency said the changes are intended to help organizations better prioritize remediation efforts as the volume of disclosed vulnerabilities continues to grow.

Under the new approach, CISA plans to place greater emphasis on factors such as active exploitation, asset criticality, attack complexity, and the potential consequences of a successful attack. Agency officials said the goal is to help defenders focus resources on vulnerabilities that pose the greatest operational risk rather than relying solely on CVSS scores or the total number of disclosed flaws.

The initiative follows broader efforts by CISA to improve vulnerability management programs, including opening nominations for its KEV Catalog and expanding collaboration with security researchers and vendors. Officials said the updated framework is intended to provide organizations with more actionable guidance for addressing the vulnerabilities most likely to affect critical systems and infrastructure.

Denis Calderone, CTO, Suzu Labs:

   “A risk-based approach to vulnerability management makes a lot of sense to us, and how we approach vulnerability management with our own clients. CVSS alone has never been a reliable way to decide which vulnerabilities to prioritize. Just in the last two weeks we’ve seen a Palo Alto GlobalProtect vulnerability rated 7.8 that was operationally critical, a SolarWinds Serv-U DoS at 7.5 against a product with a documented history of nation-state and ransomware targeting, and a Check Point zero-day where CISA’s own three-day remediation deadline told a completely different story than the score. So, the policy direction here is right. Where we get skeptical is the execution. Risk-based prioritization is significantly harder than “patch everything as fast as you can.” It requires understanding what assets you have, what functions they support, how they’re exposed, and what the real-world consequences of compromise look like. Who is going to ensure that each entity is actually performing effective risk-based assessments and not just checking a compliance box?

   “That question gets harder to answer when you look at the resource picture. CISA has faced roughly half a billion dollars in proposed budget cuts and lost about a third of its workforce. Andersen is describing an approach where CISA engages directly with critical infrastructure entities to identify specific critical functions and the assets that support them. That kind of hands-on, entity-by-entity engagement requires more analytical capacity, not less. The 329 new hires are a good step forward and show the agency is serious about rebuilding operational capability, but risk-based prioritization at the scale of the federal government and critical infrastructure sectors is an enormous undertaking even for a fully staffed agency.

   “The other thing we’d like to see this framework to address is chainability. CVSS scores vulnerabilities in isolation and doesn’t model scenarios where an attacker combines a medium-severity information disclosure with a medium-severity privilege escalation and ends up with critical impact. Neither bug scores as urgent on its own, but together they give you full system compromise. If the goal is to prioritize based on real-world risk, the methodology has to account for how vulnerabilities interact in actual attack chains, not just how they score individually. 

   “Organizations shouldn’t wait for this directive to be fully operationalized. Start building your own prioritization stack now: KEV status, EPSS exploitation probability, and your own environmental context. That combination has been more reliable than CVSS alone for a while now.”

Ryan McCurdy, VP of Marketing, Liquibase:
 

   “CISA’s shift is the right move because severity scores alone do not tell defenders what actually puts the business at risk. A vulnerability on a low-impact system is very different from one affecting a production database, deployment pipeline, or system tied to customer data and critical operations.

   “The next step is connecting vulnerability prioritization to proof of control. Security teams need to know not only which issues are being exploited, but where they sit, what they can impact, who remediated them, and whether the fix moved through a controlled change process. Otherwise, teams can patch one risk while introducing another through rushed, manual, or poorly governed changes.”

Doc McConnell, Head of Policy and Compliance, Finite State:

   “The pace of vulnerability identification is accelerating thanks to AI, and the volume is outpacing response even for well-resourced teams. It makes sense that the federal government is moving from blanket timelines to more individualized, risk-based prioritization.

   “But this approach demands more sophistication from cyber defenders. In order to make an effective risk-based assessment, they need to understand what they’re protecting. For example, device manufacturers need a deep understanding of their own firmware, including third-party components, to know whether a new vulnerability is present and exploitable in their product.

   “Organizations need to ask themselves: do they have the context they need to make informed prioritization decisions about new vulnerabilities? If not, building that context has to be priority number one.”

Damon Small, Board of Directors, Xcape, Inc.:

   “The Cybersecurity and Infrastructure Security Agency (CISA) is shifting the federal vulnerability baseline from predictable, severity-based scoring to a risk-centric paradigm. While moving beyond Common Vulnerability Scoring System (CVSS) numbers helps manage patch fatigue, calculating real-world operational risk requires localized context that most organizations struggle to automate. This subjective approach demands greater effort from analysts to extract local context, but it shifts the metric from superficial scorekeeping to actionable, risk-aligned defense.

   “Security teams must integrate localized threat intelligence with strict asset discovery to ensure asset criticality tags match actual business functions. Chief Information Security Officers (CISOs) should audit their pipelines immediately to ingest CISA’s expanded Vulnrichment telemetry, prioritizing active exploitation data over static metrics to justify mitigation exceptions to auditors and business units.

   “Critical Takeaways

  •    “Context Over Score: Severity scores are officially deprecated as standalone metrics, forcing security leaders to justify patching decisions based on active exploitation and asset criticality.
  •    “Telemetry Upgrade Required: Security teams must immediately update vulnerability management pipelines to ingest and process CISA’s expanded context data, rather than relying on traditional automated scanner outputs.
  •    “Audit Local Asset Context: CISOs need to establish strict, defensible asset discovery and business-criticality tagging, as automated risk prioritizations are useless without precise local context.

   “It turns out that counting to ten over and over was a terrible way to run a security program, even if it did look nice on an executive dashboard.”

Sunil Gottumukkala, CEO, Averlon:

   “Glad to see CISA’s acting director focusing on real-world risk, this shift is overdue. Knowing a vulnerability is exploited in the wild, which the KEV catalog already delivers, answers only half the question. The other half is whether it matters in your environment. Do the specific conditions the exploit depends on, a particular configuration, an exposed or reachable service, actually exist in your fleet. 

   “This directive pushes agencies to answer that second half. Doing it well requires two things: knowing what assets you have and how they are deployed and configured, and understanding how a given CVE is being exploited to assess its real impact on your environment.”

My advice is to take risk and operational impact and make those operational now. Then tweak things based on what is finalized. That way there is forward movement in term of making environments safer for all.

Clarvos Expands Agentic Marketing Workflow With AI Governance, Computer Vision and Predictive Audience Intelligence 

Posted in Commentary with tags on June 10, 2026 by itnerd

Clarvos today announced expanded capabilities for the Clarvos Agentic Workflow, including AI governance, creative validation, computer vision, audience intelligence and AI-powered campaign recommendations. Clarvos will publicly showcase the expanded workflow at Small Business Expo Chicago on June 10, 2026, at Booth #608. 

As more businesses use AI to speed up marketing, many still face a critical challenge: knowing whether AI-generated campaigns, messages and creative assets are accurate, on-brand and ready to reach customers. The new Clarvos capabilities are designed to help marketers turn audience signals into campaign recommendations, review AI-generated work before launch and activate campaigns with greater confidence. 

Clarvos is building an intelligence layer for advertising workflows that coordinates specialized AI systems across campaign planning, creative generation, audience modeling, creative validation and performance reporting. By combining agentic AI, computer vision, deterministic validation engines, embedding models and AI-powered campaign recommendations into one workflow, Clarvos helps marketers move from insight to activation while maintaining governance, compliance and brand control before media spend begins. 

An Intelligent Growth System for Modern Marketing Teams 

The Clarvos Agentic Workflow coordinates the core steps of modern campaign development, from identifying growth opportunities and recommending audience segments to generating creative, reviewing outputs and preparing campaigns for activation. With this expansion, Clarvos is strengthening the intelligence and governance layer behind those workflows. 

The expanded platform enables businesses to: 

  • Review campaign outputs before launch: Clarvos evaluates campaign concepts, messaging, audience recommendations and creative assets against brand standards, compliance requirements, campaign objectives and approval rules before activation. 
  • Use computer vision for creative quality control: Clarvos uses computer vision and deterministic validation frameworks to assess product fidelity, brand colors, object detection, layout and visual compliance. 
  • Turn cultural signals into audience and campaign direction: TheTrending Topics Discovery feature identifies emerging consumer conversations, cultural moments and behavioral shifts across social media, while Brand Relevance Score ranks consumer segments based on alignment with a brand’s positioning, messaging, and consumer relevance. 
  • Test creative assets with predictive audience intelligence: Customer Simulator uses a synthetic audience response to provide qualitative feedback and 0–10 engagement scoring for uploaded and AI-generated creative assets before campaign launch. 
  • Generate AI-powered campaign recommendations: Clarvos translates trends, audience segments, brand inputs and creative signals into campaign strategy, target audience recommendations, channel guidance and creative direction. 
  • Centralize reporting and prepare for broader activation: The Performance Dashboard consolidates campaign metrics, media spend, ROI trends and audience insights across connected advertising channels, while the company’s expanding publisher ecosystem is designed to support future omnichannel distribution. 

Clarvos at Small Business Expo 

Clarvos will publicly showcase the Clarvos Agentic Workflow today at Small Business Expo Chicago, taking place from 9:30 a.m. to 5:00 p.m. at the Isadore & Sadie Dorin Forum at UIC. Attendees can see the platform demo at Booth #608. 

Katie Camacho-Smith, GTM Lead at Clarvos, will also lead a workshop titled “Smarter Growth with AI: No Guesswork, Just Results.” The session will explore how small businesses can use AI to identify the right customers, reduce guesswork, test what works and drive more repeatable growth. 

Availability 

The expanded capabilities are part of Clarvos’s 2026 platform roadmap as the company continues building governed AI advertising infrastructure for small and mid-sized businesses. 

Learn more about Clarvos at www.clarvos.com and join the Early Access Program to get exclusive access to the Agentic AI marketing platform. 

Anthropic’s Fable 5 release signals a new approach to AI safety

Posted in Commentary with tags on June 10, 2026 by itnerd

Anthropic’s release of Claude Fable 5 highlights a significant shift in how advanced AI systems are being deployed. Rather than limiting capability, the company is separating access and safety controls from the underlying model itself, making powerful AI available for general use while restricting higher-risk applications through additional safeguards and controlled access programs. The approach reflects a broader challenge facing the industry: how to balance increasingly capable AI systems with the governance, oversight, and usage controls needed to prevent misuse in sensitive areas such as cybersecurity.

Gidi Cohen, CEO & Co-founder, Bonfy.AI

“The most honest thing Anthropic has done here is ship one model as two products. Splitting Fable 5 and Mythos 5 is an acknowledgment that capability and safety are in genuine tension — and that pretending otherwise doesn’t serve anyone.

But the most important line in the entire announcement isn’t about the classifiers. It’s buried in the operational detail: a high-severity vulnerability found by the model takes about two weeks to patch on average. Meanwhile, Mythos Preview built working exploits from a disclosed CVE in under a day.

That gap is where risk lives. And no classifier closes it.

This makes concrete what the CSA data showed last week: enterprises aren’t failing because they can’t detect vulnerabilities. They’re failing because they can’t act on them fast enough. AI has collapsed the attacker’s timeline to hours. The defender’s timeline hasn’t moved.

Anthropic is right that the defensive head start only matters if the industry uses it. The harder truth is that most enterprises aren’t yet equipped to — not because the tools don’t exist, but because the governance architecture to deploy them safely hasn’t kept pace with the capability.

That’s the real race.”

Yagub Rahimov, CEO, Polygraf AI

“By splitting one model into two products, separated by a safety layer rather than by capability is a genius marketing and gtm strategy. With this approach Anthropic admits publicly that LLMs have dangerous capabilities, and frankly speaking every enterprise should therefor question who governs access to these LLMs. Every enterprise leader should have this sort of honesty as a base standard.

This admittance about AI risk also changes the conversation. Imagine that within just days of its launch a single model autonomously finds vulnerabilities that survived 27 years of every human review in a major operating system. The strategic question we should ask is no longer how powerful that model is. It is who controls the behavioral layer between the model and the mission. America has been leading the world in building frontier AI. Now, our next obligation is to lead in governing and securing how that AI behaves once it touches enterprise and government data. Capability won the first race. Governance and security wins the second.”

Organizations need to keep pace with security and the like so that releases such as Claud Fable 5 don’t overwhelm them. If they don’t, then you can expect that organizations will lose this battle.

UPDATE: I have additional commentary starting with Ryan McCurdy, VP of Marketing, Liquibase:

   “Anthropic’s release shows the industry is starting to separate model safety from deployment safety. That is the right conversation. A more capable coding model can be safer at the model layer and still create risk once it is connected to repositories, pipelines, cloud environments, and databases.

   “The enterprise question is not just whether the model has safeguards. It is whether the organization can prove control over the work the model produces. Who approved the change? What systems did it touch? Did it follow policy? Can it be traced and reversed if it breaks production? As models get better at long-running software tasks, governance has to move closer to the actual change, especially in the systems where code, data, and compliance meet.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “Anthropic filed for its IPO on June 1 and launched Fable 5 eight days later at double the Opus token rate. The benchmark gains are real but concentrated in frontier-hard tasks. SWE-bench Pro jumps 11 points, from 69.2% to 80.3%. On routine work the gap shrinks to near-parity, and cost-per-solve still favors Opus 4.8 at $1.45 vs $2.49 per solved task.

   “The token economics compound the pricing. Fable 5 burns tokens at twice the Opus rate. A BleepingComputer reviewer exhausted a $100 daily allocation in nine minutes running Anthropic’s workflow mode. At $10/$50 per million tokens, heavy agentic work can clear three figures a day.

   “I do complex offensive cybersecurity tasks on Opus 4.6. No cybersecurity classifier. No mandatory data retention. Fable 5 charges double, blocks those queries, and redirects them to Opus 4.8.

   “Anthropic needs to show public-market investors it can monetize a $965 billion valuation. Fable 5 doubles per-token revenue. The cybersecurity gains are locked behind Project Glasswing.

   “Everyone else pays double and gets Opus 4.8 responses on security queries.”

Noelle Murata, Chief Operating Officer at Xcape, Inc.

   “Anthropic’s broad commercial release of Claude Fable 5 represents a calculated pivot in the frontier AI landscape: attempting to monetize elite, long-horizon reasoning architecture while strictly walling off its most “hazardous” capabilities. By implementing an aggressive, real-time classifier system that automatically downgrades high-risk cybersecurity, biochemical, or model-distillation requests to the less powerful Claude Opus 4.8 framework, Anthropic is trying to fulfill its commercial obligations without turning a public LLM into an on-demand zero-day factory.

   “However, this bifurcated release strategy highlights a growing divergence in enterprise defense. While everyday enterprise customers gain access to Fable 5’s highly advanced software engineering and long-running autonomous logic, Claude Mythos 5 remains exclusively accessible to a tight cohort of government intelligence agencies and select critical infrastructure defenders under Project Glasswing. This means the actual “cybersecurity tier” of this technology remains behind sovereign closed doors, leaving commercial security teams to defend against an increasingly automated threat landscape without the same unrestricted analytical tools being deployed by nation-state actors.

   “Critical Takeaways

  •    “The Fallback Safety Loop: Fable 5 relies on active routing classifiers; roughly 5% of user prompts trigger a silent safety downgrade to Opus 4.8, creating an intentional, built-in performance ceiling on sensitive technical domains.
  •    “The Defensive Technology Asymmetry: By maintaining a fully un-guardrailed “Mythos 5” tier strictly for government and certified infrastructure partners, the gap between state-level cyber capabilities and commercial enterprise defense tools is widening.
  •    “Commercially Prohibitive Intelligence: At $10 per million input and $50 per million output tokens, Fable 5 is priced as a premium, specialized tool—making it twice as expensive as Opus 4.8 and reinforcing that frontier-level autonomous reasoning remains a luxury tier for enterprise workflows.

   “Anthropic built a brilliant system to prevent script kiddies from generating bioweapons, but blocking offensive cyber requests simply ensures that the good guys are the only ones playing with handcuffs on.”

John Strand, Owner, Black Hills Information Security, Inc.:

   “We need to remember that Mythos is not the end state. Mythos is a harbinger of what’s coming next. Too many people look at these demonstrations and assume they’re seeing the finished product. They’re not. They’re seeing the beginning.

   “Every major AI vendor on the planet is investing heavily in capabilities that will eventually compete in this space. At the same time, open-source models continue to improve at an astonishing pace. It won’t be long before anyone can download a model from an open-source repository, run it locally, and achieve exploit development, vulnerability research, and attack-path analysis capabilities that rival or exceed what we’re seeing from the most advanced systems today.

   “The real lesson isn’t that Mythos exists. The real lesson is that these capabilities are becoming democratized. What is currently available to a handful of well-funded organizations today will eventually be available to everyone. The barriers to sophisticated vulnerability discovery, exploit development, and attack-path chaining are falling rapidly, and defenders need to start planning for a world where advanced offensive capabilities are widely accessible.”

Sunil Gottumukkala, CEO, Averlon:

   “Fable 5 represents a meaningful shift in what’s possible for code generation at scale. Models at this capability level can compress months of engineering work into days, which changes the economics of vulnerability exposure and remediation significantly.

   “That makes it even more important for organizations to understand their attack surface, know which vulnerabilities are actually exploitable in their environment, what they connect to, and which ones warrant that fix-generation capacity in the first place. The most effective approach evaluates risk as changes are introduced, not after they’ve already reached production.

   “As the dual forces of code generation and exploit generation become faster and cheaper, the triage layer becomes the critical bottleneck to ensure the right risks are prioritized and fixes are in place before a breach.”