SentinelOne > Prompt Security, 20 Years of Cyber Consolidation, AI SOC Market Landscape, Agentic AI Security and Governance, CNA Scorecard, Secure AI Coding Assistants (TCO) & State of Exploitation
Welcome to Issue #59 of the Resilient Cyber Newsletter.
It’s Black Hat/Hacker Summer Camp week and the news cycle is in full effect, from product launches, publications, M&A and more.
I hope you enjoy the resources this week!
Thanks for reading the Resilient Cyber Newsletter! Subscribe for FREE and join 45,000+ readers to receive weekly updates with the latest news across AppSec, Leadership, AI, Supply Chain, and more for Cybersecurity.
Interested in sponsoring an issue of Resilient Cyber?
This includes reaching over 45,000 subscribers, ranging from Developers, Engineers, Architects, CISO’s/Security Leaders and Business Executives
Vulnerability management is broken - bloated backlogs, endless false positives, and constant pressure. Maze changes that. Our AI agents autonomously triage and resolve cloud CVE findings, cutting out the noise so your team focuses on what truly matters.
Think of it as having expert security engineers on demand: contextual, precise, and always on. Faster fixes, fewer escalations, and finally, a backlog you can get ahead of.
In this episode, we sit down with Sid Trivedi, Partner at venture capital firm Foundation Capital and host of the Inside the Network podcast.
Sid brings great insights around cybersecurity market trends, industry events such as Black Hat, and the impact that AI is having on the startup and venture capital ecosystem.
We discussed:
His team at Foundation Capital, where and how they invest, and how they identify opportunities.
Black Hat (Hacker Summer Camp) and the Startup Spotlight Competition: how they work, what teams are involved, and the benefits for the cyber and venture capital community.
Other Black Hat events include the Innovators and Investors summit and what they help facilitate.
M&A Headlines, from Palo Alto Networks (PANW) acquiring CyberArk to other rumors such as Datadog and Upwind, and what we’re seeing play out in the cyber industry related to platforms vs. best of breed.
How innovative startups can stand out and why a few players will never dominate the cyber ecosystem due to the countless niches, evolving threats, and changing technologies involved.
The impact of AI on the venture capital and investment landscape and what opportunities there are for AI when it comes to cybersecurity, both for attackers and defenders
The concept of Services-as-a-Software and the opportunity and Total Addressable Market (TAM) for labor and services work typically associated with software and why it is such an enticing opportunity for both founders and investors.
Sid’s podcast, “Inside the Network,” interviews industry leaders who have built defining companies, sharing their hard lessons, wisdom, and insights with the community.
The role of the CISO inevitably can feel overwhelming. Never-ending threats, new technologies, business goals, churn among your team, tool overload, budget constraints, etc.
This piece from longtime industry leader Caleb Sima helps hone in on what matters most. He phrased it as “a practice guide to protecting your most critical assets when budget, headcount, and political capital are tight.”
Caleb discusses constraints nearly all security leaders grapple with, such as:
A large and complex attack surface
Limited resources
Inevitability of breach
He lays out an approach leaders can take to protecting their organizations' crown jewels, which includes identifying them, finding them, and securing them using a threat assessment approach.
Another major GenAI Security acquisition is underway. This time, SentinelOne is acquiring Prompt Security in efforts to advance GenAI and Agentic AI security. This comes on the heels of Palo Alto Networks' (PANW) prior announcement to acquire Protect AI, which was announced during RSA, with the SentinelOne announcement coinciding with Black Hat.
This aligns with broader industry discussions and rumors about industry leaders racing to keep pace with the rise of GenAI and Agentic AI, ensuring their platforms and products stay relevant and position themselves as leaders regarding AI security.
Following the acquisitions of Protect AI and Prompt, M&A attention is turning to the remaining innovative startups focused on AI Security, such as Lasso, Aim, and Pillar Security.
This piece from CTech states that the above firms have already received acquisition offers from industry leaders such as Check Point, ZScaler, and F5. It will be interesting to see if the above firms or similar companies become the next in the string of AI Security acquisitions as industry leaders race to position themselves at the forefront of securing enterprise AI adoption.
Over the past couple of years, we’ve heard a lot of discussion around platformization and consolidation in the cyber industry. But what does that actually look like? This excellent piece from my friend
thoroughly lays out how 200 cybersecurity companies became 11 industry giants.
Ross draws parallels to the U.S. Department of Defense (DoD) Government Contracting ecosystem and discusses the four stages of industry consolidation and the factors that drive it.
This is a great read for folks looking to understand the cyber ecosystem and its key players' past, present, and future.
In a rare occurrence, former and current Government officials associated with CISA and the NSA publicly demonstrated a difference of opinion during a recent event related to Black Hat.
It involved CISA’s Communications Chief and former NSA Leader Rob Joyce. The difference of opinion was focused on the impact of scaling back the federal cyber workforce. The CISA official focused on refocusing CISA on its core mission as part of the workforce reductions, while industry security leader Rob Joyce stressed the impact it will have on the Federal cybersecurity landscape, arguing it sets the ecosystem back in terms of security, when it was already struggling
As we continue to see the rising adoption and excitement around agents, many are beginning to explore how they can be exploited and the implications for organizations.
This latest piece from AI security leader Lasso explores how agents can be exploited to move laterally across environments and systems. It demonstrates how malicious content can be read by an agent and then subsequently acted upon through later operations on other systems that the agent interfaces with.
Lasso explains how, through AI agents' unified operational identity, attackers can leverage indirect prompt injection and the unchecked flow of information across traditionally isolated identities to propagate malicious actions across various system boundaries.
One of the areas seeing the most interest within Cybersecurity for AI use is arguably SecOps, based on the number of startups and venture capital allocation. But trying to understand the AI SOC market landscape can be difficult with so many different players, capabilities, and more to make sense of.
One key theme missing from many conversations about the excitement and adoption of Agentic AI is Security and Governance. IBM's latest Cost of a Data Breach Report evidenced this, finding that the majority of organizations lacked policies and processes to govern Agentic AI (and AI more broadly).
That's why this publication from OWASP GenAI Security Project is timely. It covers the State of Agentic AI Security and Governance, including:
A taxonomy for agents and their various use cases
Agent frameworks and the protocol landscape, for interacting with tools, communication between agents and taking actions
Threats and Mitigations for various risks associated with Agentic AI
A look at both the regulatory and compliance landscape, as well as future trends and emerging requirements for Agentic AI
Another excellent publication by the OWASP® Foundation team, on a key topic as Agentic AI adoption and exploration heats up!
AppSec, Vulnerability Management, and Software Supply Chain Security
As most of us know, the vulnerability database and scoring ecosystem is a complete mess. From the near collapse and continued struggles of the NIST NVD to the continued irrelevance of CVSS for prioritization, organizations are drowning in CVEs, and more.
This new resource from Jerry Gambling presents a CNA Scorecard and looks to track CVE Data Completeness. Let’s say the figures aren’t pretty.
As he points out, only 2% of CVEs have CPE data, and only 5% have patching information. This hinders automation and leaves security teams in the dark about how to mitigate risks best.
Jerry defines 5 key categories for CVE Data Completeness, as identified below:
The figures speak for themselves and demonstrate the challenges downstream security teams face when understanding what software CVEs apply to or what relevant patches, fixes, and mitigations are.
One interesting development in the industry is the rising number of AI development platforms looking to add security capabilities natively. While many AppSec vendors are accustomed to filling gaps on native development platforms, cloud environments, etc., the introduction of capabilities focused on AppSec directly by the development platforms poses a challenge.
One such example is Claude Code's recent addition of code security review. They’re doing this via a GitHub Actions integration and the use of the/security-review command. The Claude team released a video showing how it works:
The Claude team states that it can help identify vulnerabilities such as:
SQL Injection
XSS
Authentication and Authorization Flaws
Insecure Data Handling
Dependency Vulnerabilities
This can be used to automate security reviews for new PR’s.
What will be interesting to see evolve is the token cost associated with usage of this capability, as well as how it impacts broader AppSec companies offering a similar capability and integrating with workflows associated with some of the leading AI coding platforms.
We know that coding assistants such as copilots and LLM development are seeing rapid adoption across the entire landscape. But what does it take to secure their use, and what is the total cost analysis of their usage?
As this piece from Endor Labs points out, teams are seeing 10-40% increases in code velocity because studies are finding that 62% of AI-generated code is also insecure by default, and developers using AI coding assistants are twice as likely to write insecure code.
Endor discusses how AI-generated code suffers from the same types of weaknesses as broader open source code, which makes sense given that the leading models are trained on large open source datasets. However, traditional SAST tools aren’t poised to meet some of the deeper design flaws and risks that AI code can introduce, either.
As Endor points out, manual code review wasn’t already scalable for a team with a few thousand developers, let alone their increased 10-40% improved code velocity and volume. Endor provides some helpful metrics to show the cost of code review with typical scenarios:
Endor is one of the AppSec organizations pioneering the use of Agentic AI for AppSec use cases, such as multiple agent personas to do security reviews of PR’s, classify risk, prioritize issues, and more. They lay out some of the metrics below based on the use of AI Security Code Review, which is saving thousands of hours annually:
I dove deep into Endor Lab’s CEO, Varun Badhwar, on these topics on an episode of Resilient Cyber titled “AI for AppSec - Beyond the Buzzwords”:
It’s always good to reflect back on the state of vulnerability exploitation to understand key themes and trends. This piece from my friend Patrick Garrity over at VulnCheck provides exactly those insights along with some great visualizations.
They identified:
432 CVE’s that were being reported as being exploited for the first time
32.1% of KEVs had exploitation evidence on or before the day the CVE was issued, an increase from 23.6% in 2024.
Reported exploitation attributed to threat actors in China and North Korea decreased while exploitation attributed to Russia and Iran threat actors increased.
26.9% of KEVs first seen in the 1H-2025 were still awaiting analysis by NIST
While Open Source Software is impacted by a growing number of exploited vulnerabilities, our research shows that proprietary software such as CMS platforms and plug-ins, network edge devices, and server software are larger contributors to mass exploitation - not necessarily open source software.
147 of 181 unique CVEs that were used by known threat actors had evidence of exploitation prior to 2025, demonstrating that threat actor exploitation disclosure often lags behind disclosure of initial exploitation evidence.
Some really interesting insights here to call out, such as the fact that 32% of KEV’s are zero days with evidence of exploitation before a CVE is even issued, and the ongoing struggles of the NIST National Vulnerability Database (NVD) when it comes to analysis. Lastly, despite all the hype and focus on open source in the context of software supply chain security, proprietary software vendors and products are still the primary attack vector impacting the ecosystem.
