Janet Worthington
Senior Analyst
Author Insights
Blog
Break Out Of The Vulnerability Matrix At Forrester’s Security & Risk Forum 2026
Security teams are hearing two competing stories. In one, AI completely rewrites the rules of vulnerability discovery, exploitation, and remediation. In the other, AI simply adds speed and scale to problems that security programs already understand. The reality lies somewhere in between. Discovery Is Accelerating Faster Than Decision-Making AI analyzes code, generates findings, and proposes […]
Blog
PHP2Shell Leak Sends Security Teams Scrambling
At 14:00 UTC on October 21, PHP released patches to two critical CVEs, both of which can lead to remote code execution. CVE-2026-109618 addresses an RCE through an out-of-memory error, and CVE-2026-109619 addresses an RCE through a stale global-state issue. The flaws were discovered by researchers at Wiz and Calif, the latter as part of […]
Hear more from Janet Worthington
Upcoming Events
Security & Risk Forum
Forrester Forum Singapore
Forrester Forum Sydney
Upcoming Webinars
Check back soon for upcoming webinars.OnDemand Webinars
Check back soon for on-demand webinarsBlog
Your Software Supply Chain Risk Doesn’t Stop At Your Suppliers
Software supply chain security is no longer just about knowing which open-source libraries are in your applications. Attackers are compromising developer environments, build systems, trusted distribution channels, and even security tools such as container security and infrastructure-as-code scanning tools. AI now adds another layer of dependencies to evaluate and protect. The result is an interconnected […]
Blog
The Future Of AppSec May Be Autonomous, But The Present Is Surprisingly Practical
AI is no longer a future feature in application security; it is rapidly becoming a core part of how application security (AppSec) tools identify, prioritize, and remediate risk. Yet despite aggressive vendor investment, adoption remains constrained by trust concerns, questions about value, and uncertainty about pricing models. In our new report, The State Of Artificial […]
Blog
An AI Security Facepalm: OpenAI’s Evaluation Became Hugging Face’s Incident
When an AI evaluation becomes a real-world security incident, leaders can no longer view model testing as a low-risk exercise. The OpenAI and Hugging Face incident reveals how agentic AI can cross trust boundaries, exploit vulnerabilities, and create business risk long before deployment.
Blog
From Watchdog To Working Dog: Datadog And The Expanding Control Layer
IT Control Plane Implications Of DASH by Datadog 2026 A couple weeks ago, I went to New York, where DASH by Datadog was held at the Javits Center. My main takeaway: I need to expand my sense of where an IT management platform can come from. For some years, I have argued that two dominant […]
Blog
Total Recall: A Cautionary Fable Of Anthropic And The US Government
On Friday, June 12, the same model class covered by our previous blog post went dark. Anthropic suspended Fable 5 and Mythos 5 worldwide after the US Department of Commerce issued an export control directive, which led to requests from prominent cybersecurity pros to undo the action. The bypass that triggered the export controls, per […]
Blog
How Fable 5 And Mythos 5 Change AI Security, Data Retention, And Vendor Risk
Anthropic’s Fable 5 and Mythos 5 is the most 2026 product launch you’ll read this year. The same model can find nation-state zero days, design novel drug candidates, and play FireRed on a Gameboy Advance with nothing but screenshots. And for the gaming fans out there, yes, we got Fable 5 before Fable 4. These […]
Blog
OpenAI’s Daybreak Promises To Improve AppSec But Introduces A New Pricing Model: Five Buyer-Side Implications For CISOs
OpenAI recently announced Daybreak, its vision for making agentic application security faster and more capable. While promising, Daybreak will also make security more expensive per unit of work. In this model, customers will pay for tokens and multiagent workflows burn tokens. CISOs and CIOs should budget for application security (AppSec) line-item inflation, not deflation, with […]
Blog
Five Eyes Cybersecurity Agencies’ Careful Agentic AI Adoption Guidance, Operationalized By AEGIS
On May 1, 2026, six national cybersecurity agencies — CISA, the NSA, Australia’s ASD ACSC, and their counterparts in Canada, New Zealand, and the UK — published “Careful adoption of agentic AI services.” This joint guidance is the first coordinated multigovernment security guidance specifically targeting agentic AI systems, and it carries the full weight of […]
Blog
Not A Vendor, Still A Breach: Vercel’s Third-Party Risk Failure
Some security incidents are complex. The Vercel incident is more troubling because it was predictable. The attackers did not exploit a procurement gap. They exploited a definition gap. Here’s what happened. A Vercel employee signed up for Context.ai’s AI Office Suite using a corporate Google account and clicked something effectively equivalent to “Allow All,” granting […]
Blog
Game Over For Trust: A Roblox Cheat Gives Attackers The Advantage
A cascading supply chain attack did not start with a zero-day exploit, an unpatched vulnerability, or a brute-force attack. It started with a bored employee wanting to get ahead in an online game. A Context.ai employee downloaded a Roblox game cheat, an unofficial script for an online game that came bundled with Lumma Stealer malware […]
Blog
Project Glasswing Shows That AI Will Break The Vulnerability Management Playbook
Anthropic, along with 11 other companies, recently announced Project Glasswing — an initiative that aims to secure software in the wake of advances in AI capabilities, most notably Anthropic’s Claude Mythos Preview frontier model. Project Glasswing is made up of a who’s who of tech companies, cybersecurity vendors, and others: Amazon Web Services, Anthropic, Apple, […]
Blog
RSAC Innovation Sandbox 2026: Two Sides Of AI On Display
AI already runs inside most enterprises. Forrester’s Q4 2025 AI Pulse Survey shows that 50% of organizations are piloting agentic AI, while 24% have it in production. Security teams are catching up after the fact. The RSAC Innovation Sandbox (ISB) finalists — Charm Security, Clearly AI, Crash Override, Fig Security, Geordie AI, Glide Identity, Humanix, […]
Blog
Agentic Development Security: Why AppSec Needs A New Operating Model
Application security testing (AST) has reached an inflection point. The market is crowded, capabilities overlap, and detection alone is no longer a source of durable differentiation. DevOps platforms embed security features. Cloud-native application protection platform vendors continue to push left. Application security posture management specialists offer open-source scanning technologies. And AI frontier labs such as […]
Blog
RSAC 2026: An AI Coming-Of-Age Story Without The Romance
RSAC Conference 2026 has come and gone. Gone, too, are the petting zoos of yesteryear, replaced this year by — of all things — pop-up tattoo parlors. Or as one attendee observed, “We’ve traded livestock for live needles.” This year’s attendance of over 43,500 was flat compared to 2025, but the sessions and exhibit floor […]
Blog
App Security Is Evolving Fast: Here’s What Security Leaders Should Know
The application and product security landscape is evolving as threat actors demonstrate greater sophistication, placing increased demands on security programs.
Blog
No, You Can’t Just Vibe Code Commerce — Yet
“What coding?” Vibe coding is the cute term for using genAI systems to create, debug, or update programming code. People can use it without knowing how to write a line of code themselves. What this means: Lots of people are generating code they don’t understand. It’s not just developers using these tools to code faster; for example, it’s schoolteachers writing their […]
Blog
Regulators Are Moving On SBOMs — But Is Your Compliance Program Keeping Pace?
Software bill of materials (SBOM) requirements are advancing rapidly, and the time for “wait and see” is quickly running out. The global regulatory landscape for software supply chain security is shifting from recommendations to mandates, yet many organizations remain unprepared. What you do now will determine whether your company is ready or left behind as […]
Blog
What We’re Looking Forward To At The RSAC 2026 Conference
The annual RSAC Conference in San Francisco is the cybersecurity industry’s biggest event of the year. For the analysts attending, RSAC Conference week provides an opportunity to learn about cybersecurity trends and topics, meet with vendors and clients, and share our insights and observations. It’s also an excellent opportunity to meet our daily step goals […]
More posts