Cloud Security Partners

302 publicly disclosed AI security incidents in one year. That’s the number I keep coming back to from FireTail’s State of AI Security 2026 report. When I talk with security leaders, they’re asking the same things: Where is AI actually getting exploited? What controls make a difference? And what can we fix this quarter, not someday? On October 27 at 12:00PM ET, I’m sitting down with Jeremy Snyder, CEO of FireTail.ai and author of the report, to work through those questions. 45 minutes, with live Q&A. Join us, and bring your questions. Register: https://luma.com/tkiyoy2f #AISecurity #CloudSecurity #CISO

Most agent security guidance is about the agent: its identity, its tools, its context. That work belongs to the agent team. The cloud security team owns something different. Deny-by-default egress is a design goal for the agent; in your account it is a VPC with no route out. Least privilege is a design goal; in your account it is the policy on the agent's role. Our new post is ten questions for the account an agent lands in, plus the three to start with when the answer is no across the board. #CloudSecurity #AWS #AISecurity #IAM

A scan says a known weakness appears to be present. A penetration test says an in-scope attack path is exploitable under the tested conditions. Different evidence, different decisions. Here’s the gap that matters. A customer portal is fully patched. Scans come back clean. A customer signs in, opens an invoice they’re allowed to see, changes the identifier in the request, and gets someone else’s invoice. The app never checked whether that account should have access. No signature catches that. Finding it takes accounts at different permission levels and someone who understands who owns which record. Full breakdown, plus what each compliance framework actually expects >>> What’s your current cadence? Comment below 👇

A cloud environment rarely becomes risky because a team ignored security. The estate just changes faster than the habits around it. Accounts multiply, permissions drift, a service ships Friday while the team is already on the next priority. We published our cloud security assessment checklist: 65 checks across AWS, Azure, and Google Cloud, grouped into nine domains. Each row carries a verification approach, the evidence to retain, and a suggested owner for the fix. The working Google Sheet is available without a form. #CloudSecurity #AWS #Azure #GCP #CISO

An agent reads logs, queries cloud config, spawns a worker, and changes a production setting. Security asks who made the change. "The application role" is technically accurate. It also leaves every useful question unanswered: which agent, which run, which human sent it, and whether that permission should have been available at all. Our new post covers what agentic IAM actually requires: per-agent principals, short-lived audience-bound tokens, token exchange that preserves the human behind the task, and fresh authorization at every delegation hop. Full writeup, including the token exchange pattern that keeps the human attributable. 👇

Shipping fast is easy. Knowing your last deploy didn’t open a gap is harder. Get your free AWS Security Score. Ten questions from security engineers. No scanner, no OAuth. 5 minutes.