Intruder, the company behind an AI-driven pentesting tool, reports that early attempts to assign AI agents strict, narrowly defined vulnerability-hunting tasks caused them to miss issues outside their assigned scope or misclassify findings. Giving agents no structure at all also failed, as unguided agents couldn't properly manage large applications despite occasionally finding interesting issues. The company says it settled on a middle ground: broad roles with freedom to explore, paired with guardrails to prevent damage.
bleepingcomputer.com
· 2026-10-15
FedRAMP has confirmed that its Vulnerability Detection and Response (VDR) and Vulnerability Exploitability Rating (VER) rules, issued in response to CISA's BOD 26-04, become mandatory for all cloud service offerings by December 7, 2026, with a grace period through March 7, 2027 for those under a corrective action plan. The rules replace the old monthly scan-and-POA&M model with scan frequencies and remediation deadlines tied to certification class and vulnerability severity, in some cases as short as 12 hours.
bleepingcomputer.com
· 2026-09-24
Google has launched Gemini 3.8 Flash, its third Flash-tier model release in just six weeks, alongside a specialized variant called Gemini 3.8 Flash Cyber aimed at vulnerability detection and mitigation. The company touts it as its strongest reasoning and coding model to date, with introductory API pricing of $0.75 per million input tokens and $3.75 per million output tokens through year-end before doubling.
arstechnica.com
· 2026-09-02
GoKawiil