Teleport released three new features for its Beams runtime to track what AI agents do, detect unexpected behavior, and score risk levels. The webinar covers how to audit agent sessions, write policies that catch workarounds, and triage activity at scale using MITRE ATT&CK mapping.

• Session Summaries compress multi-hour agent logs into 30-second summaries with operations, security actions, and risk levels
• Agentic Classifiers catch agents attempting policy workarounds through LLM proxy-level audit across Claude, OpenAI, and other models
• Risk Scoring tied to MITRE ATT&CK framework lets small teams triage agent activity without manual review of every session

Tailscale is a mesh networking tool that replaces traditional VPNs by creating encrypted connections between devices without requiring a central server. It handles NAT traversal automatically, works across clouds and on-premises infrastructure, and uses identity-based access control instead of managing certificates manually.

• Tailscale creates encrypted mesh connections between devices without a central server, automatically handling NAT traversal issues (double NAT, blocked ports) that break traditional VPN/WireGuard setups
• It flips default network security posture—devices are private by default and must be deliberately exposed, rather than exposed by default and needing to be locked down
• Real-world use cases span managing home Kubernetes clusters remotely, connecting field robots, and multi-cloud/on-prem access, all set up in minutes with minimal config
• Compares favorably to OpenVPN through fixed IPs, DNS support, SSO-backed GUI access controls, and scaling to many devices without manual key/certificate management

This TLDR covers Accenture’s $4.2 billion cybersecurity deal to buy Dragos, runZero, and NetRise for OT security, plus the hidden risks of free VPNs and streaming apps turning into residential proxies. It also looks at Cisco’s phased move to cloud SSE, Amazon’s push against human-in-the-loop AI governance, OpenAI’s new spend controls, the launch of enterprise-managed OAuth for MCP, Microsoft’s messy AI rollout, and an internal Copilot-powered analytics agent.

• Accenture is spending $4.2B to buy Dragos, runZero, and NetRise, betting on consolidated OT security as a growth market.
• Infoblox found 65%+ of cloud customers' networks are making DNS calls to residential-proxy domains (500B+ queries/month in 2026), showing free VPNs and streaming apps are quietly turning corporate devices into proxy infrastructure.
• Amazon Security argues human-in-the-loop approval doesn't scale for AI agents and is shifting to identity-based, risk-scored permissions instead of manual checks.
• Microsoft is shipping default-on Copilot features in Windows/Office faster than IT can build governance for them, creating friction, while internal tools like Cisco's SSE migration (18% fewer tickets) and Qubot's natural-language data queries show more controlled rollouts working better.

SysWarden is a Go-based host intrusion prevention system that enforces CIS Level 2 hardening and integrates global threat intelligence to block attacks at network and application layers. It manages nftables/iptables rules, runs a memory-safe WAF daemon, protects container workloads, and provides real-time telemetry and HA clustering without resorting to shell scripts. It installs via standard .deb/.rpm packages on enterprise Linux and offers live alerts and a TUI dashboard.

• Written entirely in Go with no bash scripts or cron jobs—firewall rules, systemd units, and telemetry loops run via os/exec wrappers and goroutines instead of shell scripting.
• Enforces automated CIS Level 2 hardening and blocks threats across layers 2-7 (MAC/ARP filtering, IP/CIDR/ASN/GeoIP rules, TCP-flag anomaly detection, and a built-in WAF for HTTP-layer attacks like SQLi/RCE/LFI).
• Positions itself as a Fail2ban replacement (memory-safe async log parsing) and a lighter alternative to agents like CrowdStrike for container protection, since it avoids kernel modules entirely.
• Ships as native .deb/.rpm packages for major enterprise distros (Debian 12/13, Ubuntu 24.04+, RHEL/AlmaLinux/Rocky 9+, Oracle 10+, Fedora 40+) with SHA256-verified installation and a TUI dashboard for monitoring.

This issue highlights the challenge of aligning an LLM’s “latent ontology” with a company’s “structural ontology” to avoid agent errors, and warns that unmanaged shadow AI magnifies existing governance and security gaps. It also covers Zscaler’s new zero-trust platform for AI agents, Salesforce’s acquisition of m3ter for usage-based billing, and Ivanti’s patch for Sentry vulnerabilities.

• The hard part of enterprise AI isn't building an ontology—it's detecting where the LLM's latent concept-space drifts from the company's defined one, since that drift is what causes agents to pull wrong data and err.
• Shadow AI tools are proliferating unmanaged through SaaS, identity platforms, and API keys, amplifying governance and security blind spots IT already failed to close with cloud and access control.
• Zscaler launched a zero-trust security stack specifically for AI agents (AI Broker, Endpoint AI Security, AI Access Graph, plus expanded AI Protect with red-teaming) to monitor and restrict agent-to-agent and machine-to-cloud traffic.
• Salesforce acquired m3ter to build usage-based billing directly into Agentforce, letting it meter AI compute/API consumption natively instead of enterprises stitching together third-party billing tools.

Zscaler unveiled a zero trust platform to secure autonomous AI agents’ data access, communications and device activity. It adds an AI Broker for agent-to-agent and data calls, endpoint AI threat detection, an AI Access Graph for mapping identities and data flows, and expanded AI Protect controls. This aims to give each AI agent its own identity, permissions and real-time monitoring.

• Zscaler launched a zero trust platform giving each AI agent its own identity, permissions, and real-time monitoring, built on four pieces: an AI Broker, Endpoint AI Security, an AI Access Graph, and expanded AI Protect controls.
• Dell'Oro Group forecasts the AI systems security market will grow from near zero to $8 billion by 2030, with nearly 60 vendors already competing.
• Analysts warn agents shouldn't inherit trust just because a user launched them—without unique identities and scoped permissions, compromised or misconfigured agents could move laterally and escalate privileges in seconds.