Security management
Insights
Blog
AI Agents Need More Than Least Privilege — They Need Least Agency
For decades, cybersecurity professionals have relied on the principle of least privilege: Only give identities the access needed to perform their jobs. That principle remains essential. But AI agents have exposed its limits. An AI agent can have exactly the right permissions and still do the wrong thing Consider an agent authorized to issue customer […]
Blog
PHP2Shell Had Teeth, But The Real Story Is The Eclectic Mayhem
The week of October 20 was unusually chaotic, even without the PHP news. Not only did teams need to scramble to identify and understand the impact of emergency PHP vulnerabilities, but there were also critical vulnerabilities in Node.js, cryptographically weak keys issues by a certificate authority, exploited vulns in network security equipment, and potentially accidental […]
Turn Our Security Predictions Into Action
The next wave of AI risk won’t wait for static controls. Attend Security & Risk Forum November 9–10 to strengthen trust, build resilience, govern AI risk, and put stronger guardrails in place.
Blog
The eMudhra Certificate Authority Incident Is A Wake-Up Call For Enterprise PKI
The private key of a certificate authority (CA) should be one of the most secure secrets in digital infrastructure. In eMudhra’s case, eight CA private keys turned out to not be very secret. In fact, they were so weak that security researchers could derive them from their corresponding public keys almost instantly. Security researcher Scott […]
Blog
Predictions 2027: The Pursuit And Peril Of Control
More control won’t always mean better outcomes. Leaders who know where to set guardrails and how to deftly blend AI with human judgment will have a clear advantage in the year ahead.
Blog
Announcing Forrester’s 2026 Security & Risk Enterprise Leadership Award Winner: CITGO
CITGO is the winner of Forrester’s 2026 Security & Risk Enterprise Leadership Award. See how the company embeds security, risk management, and trust into business decisions, operations, and emerging technology planning.
Blog
Embrace Responsible AI To Forge The Trusted Future
As AI systems become more autonomous, security alone isn’t enough to build trust. Learn how responsible AI helps organizations govern AI agents, manage emerging risks, and keep systems aligned with business goals and values.
Blog
Thursdays With Erik: Educating Myself On Proactive Security Platforms
As a research director, I manage a team of analysts who cover a range of technologies outside my primary area of expertise (identity and access management). I’ve had to educate myself on these areas so I can oversee the quality of the analysts’ respective research and direct their research agendas. One area of personal interest […]
Who Controls AI In 2027?
As AI transforms B2B go-to-market strategy, technology, security, and customer experience leaders must balance control with adaptation. Forrester’s Predictions 2027 guides, blogs, and webinars reveal what that requires.
Blog
Oktane 2026 Recap: Okta Announces A Unified IAM Control Plane, With Agent Governance And Identity Details Remaining Unclear
At last week’s Oktane conference in Las Vegas, Okta unveiled its ambitious vision for transforming the Okta platform into a control plane for AI agents and extending deeper into AI security. The strategy was reflected throughout the event’s keynotes and product announcements, which focused heavily on agent identity, runtime authorization, agent-to-agent interactions, and ecosystem collaboration. […]
Blog
The AI Doomsday Circus: Don’t “Step Right Up!”
Don’t let AI doomsday headlines dictate your strategy. Stay grounded in what’s real, manage the risks you can control, and focus on the investments most likely to create new value.
Blog
Announcing The Forrester Wave™: Proactive Security Platforms, Q3 2026
Last week, we released The Forrester Wave™: Proactive Security Platforms, Q3 2026. This is the first evaluation of this market under this title, which has evolved from attack surface management and unified vulnerability management. Security teams have increasingly turned to vulnerability risk management, attack surface management, and exposure management to decide which weaknesses matter most. […]
Blog
Predictions 2027: It’s Going To Be Another “Hold My Beer” Kind Of Year For Security And Risk
AI failures, global outages, and physical disruptions will put security and risk leaders to the test in 2027. Explore three Forrester predictions and the steps organizations can take to strengthen governance, resilience, and readiness.
Blog
Manage Insider Risk To Protect Your Potential
National Insider Threat Awareness Month is drawing to a close. This year’s theme, “Protect Our Potential,” speaks directly to the impact that insider incidents can have. According to Forrester data, insider incidents account for 25% of data breaches, and a third of those incidents are due to malicious intent. Yet many organizations still don’t have […]
Secure AI Agents Before You Scale
Scaling AI agents shouldn’t mean scaling exposure. Download Forrester’s AEGIS playbook to set guardrails on intent, authority, and access so that adoption stays accountable, auditable, and defensible.
Blog
Context Is King: How Identity Context Will Drive Agentic AI Success
AI agents are putting traditional identity and access management approaches to the test. Discover why identity context will be essential to securing autonomous agents and scaling agentic AI with confidence.
Blog
Announcing The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026
Last week, Forrester published The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026. Since our last evaluation in 2023, the market has undergone a significant transformation. This transformation has been driven not only by the growing sophistication and breadth of threat intelligence requirements but also by the rapid adoption of agentic AI as organizations […]
Blog
The Information Security Leader’s Guide To Security & Risk Forum 2026
From securing AI and modernizing identity to strengthening governance and resilience, security leaders face a rapidly expanding mandate. See how Security & Risk Forum 2026 can help you stay ahead of emerging challenges.
Blog
OT Security’s Next Chapter Starts When Asset Discovery Stops Being The Goal
OT security has moved beyond simply identifying connected devices. Learn why leading organizations are shifting their focus toward reducing operational risk, strengthening resilience, and enabling safer IT and OT security collaboration.
Blog
Intent Is The New Epicenter Of Agentic Security
Cybersecurity spent decades trying to stop things from happening, identifying them, and then investigating what happened. Agentic AI challenges us with a much more difficult question: What was the system trying to do? Agents don’t just execute instructions. They interpret objectives, select tools, access data, cross systems, and change tactics. In most cases, a user […]
Blog
Announcing The Forrester Wave™ For Microsegmentation Solutions, Q3 2026: Not Your Parents’ Access Control Solution
For as long as I’ve been in cybersecurity, we’ve been trying to “adapt to the shifting threat landscape.” More recently, a number of vendors and security leaders alike have told me some version of a joke about how starting a microsegmentation project is a great way to get fired. But this is a market that […]
Blog
The Capital Connection: Exploring Washington, DC During Security & Risk Forum 2026
Security & Risk Forum 2026 brings security, risk, and resilience leaders to Washington, DC, a city where technology, governance, security, and public trust intersect every day. From iconic landmarks and Smithsonian museums to neighborhood cafes and networking-worthy restaurants, explore what to see and do while you’re in the nation’s capital.
Blog
The First Principles Of Cybersecurity Still Apply
As cyberthreats evolve and AI accelerates attacker capabilities, the most effective defenses remain the foundational practices many organizations overlook. Learn why recent attacks on critical infrastructure reinforce the need to focus on basic security principles before investing in new technologies.
More posts