In his announcement, Gallegos highlighted his enthusiasm for collaborating with a talented team and contributing to the growth of Sophos’ MSSP partner ecosystem. His new position will focus on supporting the company’s MSSP program as it looks to strengthen its partner network and expand its market presence across the region.

The MSSP model plays an important role in the cybersecurity industry by enabling service providers to deliver managed security capabilities to organizations that need continuous protection against evolving cyber threats. As businesses increasingly rely on external security expertise, strong partnerships and scalable service delivery programs remain important to the growth of the managed security market.

Also Read: James Serassio Joins Glow as Head of Strategic Initiatives 

Gallegos’ appointment comes at a time when cybersecurity providers are focused on expanding partner-led business models and helping organizations address increasingly complex security requirements. His role at Sophos will place him within this partner-focused growth strategy, with an emphasis on scaling the MSSP program across the Americas.

The announcement marks a new chapter in Gallegos’ professional journey. By joining Sophos in this leadership position, he will contribute to the company’s efforts to develop its MSSP channel and strengthen relationships with service provider partners.

His appointment also reflects the continued importance of channel partnerships in delivering cybersecurity solutions to businesses across different industries.

The post Victor Gallegos Joins Sophos as MSSP Partner Director for Americas appeared first on ITDigest.

Microsoft’s Digital Defense Report 2026 found that exposed cloud workloads faced attacks within an average of just 5.3 hours. This means there is no time for painstakingly slow investigations or disconnected teams.

AI in network and security operations is bringing a new perspective-empowering enterprises to proactively predict anomalies, correlate threats, and speed up response. Here we take a closer look at the architecture, deployment, and protection of this change.

The Catalysts Driving NOC and SOC Convergence

Traditional Network Operations Centers (NOCs) and Security Operations Centers (SOCs) often work in separate environments. NOC teams focus on network availability, performance, and uptime, while SOC teams monitor threats, investigate suspicious activity, and protect enterprise systems. This division creates blind spots. It might seem like just another performance degradation to the NOC, but the SOC is actively investigating a security alert unaware that it is the same problem that’s affecting the network. When teams have siloed tools and minimal context, investigations take longer and real issues go unrecognized.

Today’s nexus of network disruption and security threats may be making the distinction less and less tenable. For example, a DDoS event can generate enough network noise to mask the efforts of an attacker trying to exfiltrate data. Or an innocuous network configuration error can create an attack surface that hackers may exploit. AI empowered network and security operations bridge the gap by consolidating network performance and security events.

This means a common telemetry layer. Integrate logs, Net Flow, SNMP, EDR telemetry etc. into one operational data fabric in the 9 June 2016 Google Security Operations update, a model is described that brings together visibility across endpoints, on-premises firewall, identity system, network equipment and custom logs into one shared, tangible, attack story. With this context, teams can know what’s happening and why.

Also Read: Securing AI Agents in Enterprise IT Environments: Best Practices for Managing Security Risks 

Core Architectural Pillars of AI-Enabled Operations

There are three capabilities to AI-powered network and security operations. Predictive monitoring detects anomalous behavior, threat correlation correlates disparate signals and automated response empowers teams to contain before it spreads.

Pillar 1. Predictive Analytics and Dynamic Baseline Monitoring

The extensive training of the AI that occurs in the ‘un-supervised machine learning’ phase defines normal behavior for network traffic, protocol usage, and bandwidth utilization. As these baselines are constantly monitored, the AI can alert teams to slight variations in usage that traditional threshold-based tools might overlook. This enables teams to head off congestion as it begins to develop.

Pillar 2. Automated Noise Reduction and Threat Correlation

AI joins isolated telemetry from firewalls, identity services, endpoint solutions and cloud activity logs to create a single attack story. Connecting the dots enables security analysts to understand attacker TTPs and enables targeted investigations.

Amazon Guard Duty’s AI investigations preview, which was announced on June 23, is an example. Reviewing hit details, activity over the last 90 days, affected resources, and attacker indicators using threat intelligence and knowledge graphs and provides confidence-scored analysis, attack labels, evidence, and recommended actions.

Pillar 3. Closed-Loop Self-Remediation and SOAR Integration

Security orchestration tools can kick off actions like endpoint isolation, VLAN movement, and dynamic firewall rule creation. AI-driven network and security operations can speed up these activities, but humans should still be involved in approving any changes that might impact vital infrastructure.

Comparative Analysis of Legacy and AI-Enabled NetSecOps

AI-powered network and security operations transform the process of identifying, analyzing, and handling security incidents. The contrast between both is made evident through major operations aspects.

AI copilots provide another level of support for, particularly, Tier-1 analysts conducting repetitive investigations. Analysts can ask questions in natural language, obtain incident context, and troubleshooting directions without switching screens. They can also have copilots create runbooks for common, repeat problems so analysts don’t have to do this manually. These functions can be very helpful, but AI depends on well-curated data, and then validated by a human. AI can enable quick decisions, but also cause operational risk when it makes poor suggestions.

Enterprise Implementation Framework for Moving from Reactive to Autonomous Operations

Organizations utilizing AI for network and security operations need to build capabilities gradually. Putting resources into automation without having data and process infrastructure in place may expose organizations to more risks than benefits.

Phase 1. Data Normalization and Ingestion

Begin with network and security telemetry: Normalize network metrics, VPC logs, and syslog feeds. Make the signals from various sources comparable and useful. If this isn’t done, your AI models may produce false positives, or not connect the dots between events.

Phase 2. Supervised Triage and Assistive AI

Assist analysts with incident context, incident summaries and troubleshooting recommendations. In this case, analysts would review and approve AI recommendations before acting. This helps build confidence and uncovers data quality issues and model deficiencies.

Phase 3. Governed Automation with Human Oversight

Once workflows become reliable, enterprises can automate routine Tier-1 triage and predefined responses. However, changes to core infrastructure should require human authorization.

AWS’s Automated Security Response AI Toolkit, published on August 31, illustrates this approach. AWS states that the guided prompts along with the intrinsic safety measures cut down the time for developing custom remediation solutions from days/weeks to just a few hours. AWS works in conjunction with Amazon Inspector, GuardDuty, and Macie.

Governance, Security, and Guardrails for Operations AI

Increased automation results in increased attack surface. Data poisoning can pollute the data that trains/operates models and adversarial prompt injection can trick operational LLMs into recommending harmful tasks. Model drift is an additional risk since nagging model changes in behavior can erode the previous model’s ability to make accurate predictions. For business, it requires regular monitor of models, controlled agent access and approval from human before going ahead with a risky action.

Auditability is important too. All decisions made by automation, all modifications of permissions, all remediation actions need to generate a record on ITSM tools like Jira or Service Now. This will provide security teams the information they need to facilitate any investigation.

New on Nov 5, Dynamic Permissions from Microsoft Let Agents Conduct High-Impact Tasks: Dynamic permissions are task scoped agent permissions only available while a specific task is executing. Dynamic Agent Risk recalculates access when behavior or context change. Dynamic Conditional Access can limit resources or escalate for human approval.

Conclusion and Strategic Next Steps

Autonomy of network and security operations through AI technologies is becoming crucial as environments become more complicated and threats evolve faster. However, autonomy without governance may transform a good efficiency solution into a significant risk. CIOs and CISOs need to start with the consolidation of network and security telemetry and subsequent introduction of AI copilot functionality that will help analysts. Only when they are certain about the quality of data, proper response processes and access control measures, CIOs and CISOs can consider closed-loop execution.

The post AI-Enabled Network and Security Operations: How Enterprises Are Transforming IT Management and Cyber Defense appeared first on ITDigest.

Enterprise technology is moving beyond AI experimentation toward large-scale deployment, bringing new demands for specialist expertise, secure infrastructure and tighter governance. This week’s developments from EXL’s acquisition of Aimpoint Digital to new controls for AI agents and quantum-ready security show how companies are reshaping their technology strategies. At the same time, the growing use of autonomous browser agents is creating attack surfaces that traditional cybersecurity measures may not adequately address.

Three Developments Worth Watching

• EXL acquires Aimpoint Digital: The deal strengthens EXL’s ability to help enterprises move AI initiatives from experimentation into production.
• Citrix addresses agentic AI governance: New workspace and access controls recognize AI agents as a growing category of enterprise users requiring oversight.
• IonQ expands its security portfolio: The completed Elisity acquisition brings zero-trust capabilities into IonQ’s broader quantum security strategy.

Together, these moves point to a new enterprise priority: scaling AI requires not just more capable models, but the infrastructure, access controls and security architecture to manage them responsibly.

Technology News

EXL Acquires Aimpoint Digital to Expand AI Capabilities

EXL has acquired Aimpoint Digital, adding approximately 250 data and AI specialists to its capabilities across analytics, engineering and enterprise AI. The acquisition strengthens its ability to support clients through the full AI lifecycle, from strategy and development to deployment and managed operations.

The strategic value lies in addressing the persistent gap between successful AI pilots and production-scale adoption. Combining specialist talent with EXL’s global delivery infrastructure could help enterprises operationalize AI across complex workflows. It also intensifies competition among IT services providers to offer measurable business outcomes rather than isolated AI projects.

Governing the Non-Human Workforce: How Citrix’s Agentic Workspaces and Governance Framework Reshape Enterprise AI

Citrix is advancing agentic workspace capabilities through SecurSpaces and SecurAccess, designed to give AI agents controlled environments and governed access to enterprise resources. The approach includes isolated workspaces, credential management, access controls and session-level oversight.

As agents begin performing tasks across business applications, organizations face a new identity and governance challenge: software is no longer simply executing predefined scripts but acting with permissions that can expose sensitive systems. Citrix’s model reflects a shift toward treating agents as non-human workforce members, with security boundaries, accountability and lifecycle controls comparable to those applied to employees.

Lumen and Microsoft Expand AI Collaboration

Lumen and Microsoft have expanded their strategic collaboration to support enterprise AI infrastructure, combining Lumen’s network capabilities with Microsoft’s cloud ecosystem. The partnership includes expanded connectivity and go-to-market initiatives intended to help organizations move data more efficiently across AI environments.

As enterprises deploy retrieval-augmented generation and autonomous agents, network performance and reliable data access become central to AI effectiveness. The alliance highlights how AI competition extends beyond chips and models to the underlying connectivity that links distributed data, cloud platforms and applications. Network providers are increasingly becoming strategic participants in enterprise AI delivery.

CrowdStrike Integrates Lovable Workspaces With Falcon Shield

CrowdStrike and Lovable are collaborating to bring Lovable-created applications and workspaces into CrowdStrike’s Falcon Shield security environment. The integration is designed to help organizations discover applications, identify exposed secrets and credentials, and strengthen visibility and governance as more employees build software using AI-powered development tools.

The partnership addresses a growing blind spot in enterprise security: applications can now be created faster than traditional IT approval and review processes can keep pace with. Citizen development expands innovation, but also increases the risk of unmanaged software and exposed data. Security platforms will need to extend oversight closer to where applications are created, not simply where they are deployed.

IonQ Completes Elisity Acquisition to Unite Security Technologies

IonQ has completed its acquisition of Elisity, bringing the company’s identity-based zero-trust security capabilities into IonQ’s broader quantum security portfolio. The combination is intended to connect enterprise access controls with technologies such as post-quantum cryptography and quantum key distribution.

The deal signals IonQ’s ambition to build a broader security business around the anticipated transition to quantum-resistant systems. For enterprises, the challenge is not only preparing encryption for future quantum threats but also managing access across increasingly complex networks today. The opportunity will depend on how effectively IonQ integrates these capabilities into deployable, interoperable security offerings.

Featured Article

Prompt Injection: Why the Next Big Hack Will Arrive as an Ad

Ali Hayat explores how targeted advertising could become a delivery channel for prompt injection against AI browser agents. Drawing on Citizen Lab’s AdFection investigation, he explains how ad auctions can single out devices while malicious instructions hidden in page content could manipulate agents with access to sensitive accounts. The article argues that organizations must restrict agent permissions, monitor activity and treat advertising content as untrusted input.

ITDigest Weekly Observations

This week’s developments reveal two sides of enterprise AI expansion. Organizations are investing in the talent, networks and platforms needed to put AI into production, while security providers are racing to govern the agents and applications that accompany adoption. The emerging risk is that AI systems can inherit broad access while interacting with untrusted content—including advertising. As agentic technology spreads, will enterprises build security and governance into deployment from the outset, or continue treating them as controls to add after adoption?

The post ITDigest Weekly Roundup: Enterprise AI Scales Up as Security, Infrastructure and Governance Take Priority appeared first on ITDigest.

Covering identity threat detection, endpoint defense, security information and event management (SIEM), and behavioral awareness training, the expanded platform enables organizations to close exploitable attack surfaces and sever adversary pathways at machine speed.

Tapping Into Ecosystem-Wide Scalability for Delivering “Herd Immunity” to Fleets

Modern cyber-attacks are enabled by toolkits that automate processes across cloud infrastructure and endpoints within minutes. In order to combat against such fast-paced attacks such as identity theft, session hijacking, and ransomware attacks from remote locations, it becomes important for any defense system to provide automated response solutions.

This is where Huntress can leverage the intelligence gained from its operating footprint that consists of over 300,000 companies, 17 million identities, and 6 million secured endpoints. If there is any sign of malicious activity occurring on one system, it translates them into protection policies for all the fleets. With this comprehensive information coupled with continuous human verification of the same from its 24/7 AI-centric Security Operations Center (SOC), Huntress can neutralize the threat.

Also Read: CrowdStrike to Acquire Automated AI Security Testing Pioneer Dreadnode to Secure Agentic Systems Before Deployment 

Key technical enhancements and product updates across the platform include:

Adversary Infrastructure Blocking (Managed ITDR): Converts confirmed attacker hosting, relay, or proxy nodes into proactive defense mechanisms. When an identity exploit is confirmed, the platform systematically generates and applies blocking Conditional Access policies across all participating Microsoft 365 environments on the same business day, blocking threat actors at sign-in.

Malicious Service Principal Neutralization (Managed ITDR): After researching the compromise of vendors in supply chain, this functionality will watch out for service principal authentications, notify administrators of incidents in structured form, and block all compromised non-human identities. The module is available for organizations that have license of Microsoft Entra ID P1 level or above and will provide more insight on permissions of enterprise applications without manual partner intervention.

Lookback Tenant Audits (Managed ITDR): Searches for 180 days of pre-onboarding authentication logs of newly created Microsoft 365 tenants. The engine reveals concealed IoCs of token theft, adversary-in-the-middle (AiTM), compromised browsers, and compromised data center logins, stopping any active sessions right away on the first day.

Brute Force Sentry (Managed SIEM): Detects ongoing brute-force attacks against Windows RDP, RD Gateway, RDWeb, and Linux SSH connections. Through cross-correlating failed authentication attempts and successful authentication events, the engine will allow visibility into the exposed infrastructure and targeted accounts.

In-the-Flow Defense Drills (Managed SAT): Connects endpoint detections directly with real-time end-user training. When Managed EDR neutralizes an execution attempt such as a ClickFix exploit the system triggers an immediate contextual notification guiding the employee through a brief training module on that specific tactic, transforming an active intervention into a preventative habit.

Remote Ransomware Disruption (Managed EDR): Counters unauthorized lateral ransomware attacks that launch from unmanaged, compromised devices on the same internal network. Using Huntress Ransomware Canaries, Managed EDR detects early malicious encryption behavior and immediately terminates network communications between the unmanaged threat vector and protected devices.

Identity Posture Assessment (Managed ISPM): Delivers on-demand posture evaluations for Microsoft 365 tenants benchmarked against the Huntress Identity Security Framework, pairing gap analysis with automated configuration rollouts.

Unfiltered Industry Statements and Executive Commentary

“Defending against threats moving at machine speed requires knowing the adversary better than anyone else and anticipating their next move by continuously learning from every attack and leveraging our scale and elite security researchers to turn that intelligence into stronger protection,” said Prakash Ramamurthy, Chief Product Officer at Huntress. “These innovations demonstrate how we’re bringing together unrivaled human expertise, AI, and real-world threat intelligence to protect businesses at the speed adversaries operate.”

“At Courser, our goal is to give all businesses access to the same level of cybersecurity protection and expertise that larger enterprises rely on, without the cost or complexity,” said Steven Drew, Chief Technology Officer at Courser. “Huntress is an important part of that strategy, bringing advanced threat detection, expert threat research, and a 24/7 security operations center to our broader security offering. Their continued innovation helps us strengthen protection across our network of managed service providers and deliver better security outcomes for the businesses we serve.”

“The fact that Managed SAT from Huntress is built on real tradecraft that their SOC is seeing in the wild has helped us demonstrate to school administrators and users how an entire district could be compromised in just a few minutes,” said Michael Codis, Systems & Network Administrator, Hunterdon County Educational Services Commission. “Showing how that risk comes to life is incredibly powerful. It helps administration of the districts we support understand just how quickly an attack can unfold and equips our users with the knowledge and skills to stay vigilant and protect themselves and our school systems against whatever kind of threat they may face.”

The post Huntress Rolls Out Advanced Agentic Security Platform Capabilities to Neutralize Cyber Threats at Machine Speed appeared first on ITDigest.

“Over the past few years, enterprise AI has moved from ad-hoc experimentation to company-wide deployment. That shift, while introducing significant corporate efficiencies and innovation, has also created security blind spots: an entire layer of administrative and access activity sits outside traditional monitoring,” said Tim MalcomVetter, General Manager of Coalition Security and Co-founder of Wirespeed. “These new integrations help close that gap.”

Rather than treating AI platforms as isolated silos, Wirespeed ingests their administrative telemetry and correlates it with the rest of a business’s security stack. Wirespeed monitors high-impact changes to enterprise AI configurations that could expose sensitive data, suggest non-compliance, grant unauthorized access to the wrong users, or remove a spend limit. When potentially risky behavior or account takeover is detected, Wirespeed will investigate the alert and escalate it.

Also Read: Ontinue Extends Microsoft ISOC with 24/7 Managed Security Operations Through New MXDR Essentials Service

More specifically, Wirespeed’s Enterprise AI Security Integrations offer:

• Rapid Protection: Automated analysis of anomalous behavior from enterprise admin-level logs, guarding access to an organization’s most powerful systems even faster than the AI itself can think.
• Unified Security: Standardizes threat detection policies across AI tools in one platform that’s already protecting against network, SaaS, cloud, and endpoint threats.
• Immediate Control: Converts real-time behavioral anomalies into immediate network enforcement, isolating compromised systems before data can leave the perimeter.

With the addition of these Enterprise AI Security Integrations, Wirespeed now connects to more than 100 security and IT tools, spanning endpoint detection, identity providers, network and perimeter security, email security, cloud, SaaS, attack simulation, and ticketing and Professional Services Automation (PSA) platforms. By connecting all these different signals, Wirespeed gives security teams fuller context for investigations and can respond autonomously.

“Wirespeed layers onto the tools businesses already trust, allowing them to strengthen detection and response without replacing their stack. With all of these integrations, businesses can connect through APIs no downloads, no agents, no vendor lock-in, and no rip-and-replace  making using Wirespeed as easy as possible,” MalcomVetter continued.

The post Coalition Launches Enterprise AI Security Integrations appeared first on ITDigest.

This solution is intended to solve the problem of one of the most rapidly growing attack surfaces in enterprises: autonomous and natural language software development. The platforms like Lovable enable developers from the departments of marketing, sales, products, and operations to develop and launch production-ready web applications through conversational prompts. At the same time, such solutions create an explosion of “Shadow AI” and ungoverned digital assets as the employees who do not have any technical background can build AI-generated applications that include hardcoded API keys, exposed database credentials, wide access permissions, and un-sanitized input data.

“AI is turning every employee into a builder. That’s a massive opportunity for business, and a fundamental shift in how enterprises need to think about security,” said Daniel Bernard, chief business officer, CrowdStrike. “Software is being built and deployed at unprecedented speed, expanding the enterprise attack surface. Together with Lovable, we’re bringing AI-built applications into the Falcon platform, giving organizations the visibility to embrace AI-powered development without losing control of risk.”

Under the Hood: Extending SSPM to Conversational Code Workspaces

Historically, application security focused on centralized source repositories like GitHub or GitLab, relying on static application security testing (SAST) and dynamic testing (DAST) pipelines managed by professional software engineers. AI creation platforms bypass these traditional CI/CD choke points entirely, deploying functional apps directly from conversational prompts to live cloud domains.

Also Read: Bridging the Data Highway: How Lumen and Microsoft’s Expanded Alliance Redefines AI and Enterprise IT Infrastructure

The technical integration between CrowdStrike and Lovable helps in filling the gaps in visibility through an integrated governance approach:

Exposed Application Discovery: Scans automatically and maintains inventory of all published applications from Lovable platform, detects publicly accessible endpoints and privately shared projects that are exposed to the outside world.

Secret and Risk Detection: Detects projects that have exposed hard-coded credentials, unhidden API keys, unverified third-party packages, or security warning from Lovable’s built-in Security Center.

Identity and Access Governance: Audits the enforcement of Single Sign-On (SSO), project owner hierarchy, permissions of external collaborators, and third-party API access.

SaaS Inventory: Collects data on Lovable workspaces, members, and published projects into a centralized Falcon Shield console for SOC teams.

Strategic Impact on the Cybersecurity and IT Industry

Bringing AI software creation platforms under unified security posture management signals fundamental structural shifts across the Cybersecurity and Enterprise IT landscape:

1. Transitioning SSPM and AppSec to “AI-Native Software Creation”

Application security tools were originally built under the assumption that trained developers authored code inside approved repositories with structured pull-request reviews. The mainstream adoption of AI application builders invalidates that paradigm. The CrowdStrike-Lovable partnership establishes a new category requirement: AI-generated application security. Cybersecurity vendors can no longer restrict their monitoring to conventional developer toolchains; they must govern prompt-driven software engines wherever citizen developers build.

2. Recasting Shadow IT in the Age of Autonomous Code Generation

Over the past decades, the term “Shadow IT” was used by CISOs to describe unauthorized SaaS licenses (e.g., file-sharing or messaging services). However, now Shadow IT is shadow development, which refers to employees who develop, publish, and deploy their applications that process sensitive company data without any IT involvement. Embedding security posture capabilities directly into AI development engines can help to close the gap between IT policy and employee innovation and give visibility into shadow apps before any security breach occurs.

3. Enforcing “Security-by-Design” for Non-Technical Citizens

Citizen developers have no knowledge about security measures like proper coding, authentication handshake, and input validation. Asking non-technical people to implement security settings or inspect code repositories would inevitably lead to security gaps. Natively checking security posture on platforms like Lovable would guarantee that baseline security policies (including SSO and secrets masking) are automatically enforced right during the creation process.

Effects on Businesses Working in the Cybersecurity & IT Industry

Alignment of the strategies of CrowdStrike and Lovable provides clear benchmarks in terms of operations and competition in the field of business, software providers, and security purchasers:

Reduced Risk from AI Experimentation: Procurement managers and CIOs of enterprises can more safely authorize AI application creators within their own teams, as apps will be constantly monitored by the enterprise’s existing security system.

Demise of Niche Code Scanners: Software that scans only traditional code bases will be increasingly consolidated into unified platforms like Falcon that analyze telemetry across endpoints, cloud workloads, identities, and AI applications in one pane of glass.

Reduced Risk of Regulatory Compliance Violations and Data Theft: Proactively identifying exposed databases and unauthenticated APIs helps avoid any serious compliance issues under the global laws of data protection.

Conclusion

CrowdStrike and Lovable’s partnership marks a vital maturation point for generative AI in the enterprise. By pairing Lovable’s accessible software creation engine with CrowdStrike Falcon Shield’s enterprise-grade governance, the alliance proves that rapid, prompt-driven innovation does not have to come at the expense of corporate resilience. For the broader cybersecurity and IT industry, this release demonstrates that securing modern enterprises requires extending continuous visibility from the traditional developer repository all the way to the citizen creator’s prompt.

The post Securing the Citizen-Developer Boom: How CrowdStrike and Lovable’s Alliance Redefines Cybersecurity and IT Governance appeared first on ITDigest.

The acquisition deal, which was announced at Fal.Con Europe 2026, involves the integration of automated red teaming and vulnerability testing within the CrowdStrike Falcon® platform. Through continuous testing of machine learning models, applications, and autonomous agents prior to implementation, CrowdStrike provides companies with control to identify any weaknesses in the system.

Addressing the Blind Spots in Architectural Application Security of Conventional Approaches

There is nothing more disruptive than the explosion in agentic workflows and large language models to conventional approaches towards software testing. Conventional techniques for cyber testing were devised for the deterministic nature of static code paths that behaved uniformly in identical conditions. In today’s world of AI and autonomous systems, the inherent probabilities and dynamism in such systems make them susceptible to new adversarial threats like prompt injection, jailbreaks, and loop reasoning attacks.

Also Read: CrowdStrike Expands Deloitte Partnership Across Cybersecurity Advisory and Operations 

Due to the presence of such threats in underlying model weightage and semantic reasoning flows, conventional application security tools often miss out on them. The stakes are huge when organizations are looking to deploy such agents in their business processes.

The planned acquisition expands CrowdStrike’s presence into early development and pre-production testing stages, reinforcing its position within the AI Detection and Response (AIDR) category. The combined solution is slated to achieve general availability within the fourth quarter of CrowdStrike’s fiscal year 2027.

Key technical capabilities delivered by Dreadnode across the Falcon platform include:

Red Team Automation at Scale: Enables operators to scope out evaluations with natural language prompts. The engine automatically generates tests for more than 100 well-known attack vectors, including sophisticated multi-step exploitation, jailbreak, prompt injection, and targeted attacks on individual agents.

Regulatory and Threat Standardization Mapping: Categorizes findings based on their impact and maps them to key regulatory frameworks, including the OWASP Top 10 for LLMs, the OWASP Agentic Security initiative (ASI01 – ASI10), MITRE ATLAS, and the NIST AI Risk Management Framework (AI RMF), to document audit information necessary for making go/no-go decisions regarding production use.

Repository Scanning: Evaluates AI weights, model registries, code repositories, and dependencies before release.

Operator Governance in Human-in-the-Loop Mode: Empowers security analysts to manually update the classification of findings, change severity levels, and add their own reasoning, ensuring instant synchronization of risk scores across enterprise-level dashboards.

Two-Way Integration with Falcon Guardian and SafeMind: Transforms testing results into actionable policies on the Falcon Guardian side for hardening runtimes and uses testing metrics to train CrowdStrike SafeMind security models.
Unfiltered Industry Statements and Executive Commentary

“Enterprises are deploying AI faster than they can prove it is secure. A model can be jailbroken, an agent can be manipulated, and most organizations have no way to find those flaws until the AI is already in production,” said George Kurtz, CEO and founder of CrowdStrike. “With Dreadnode, CrowdStrike will give every enterprise the power to trust AI and deploy faster, with confidence.”

“AI fails in ways traditional testing was never designed to catch, and the people best equipped to find those failures think like attackers. We founded Dreadnode to expose those weaknesses before AI reaches production,” said Brad Palm, CEO of Dreadnode. “As part of CrowdStrike, we will bring Automated AI Security Testing to every enterprise, helping teams confidently find and fix weaknesses.”

Expanding CrowdStrike’s Cyber Superintelligence Lab

Following the close of the transaction, the Dreadnode engineering and research organization will merge into CrowdStrike’s Cyber Superintelligence Lab. The integration adds dedicated adversarial AI talent to CrowdStrike’s research teams while leveraging Dreadnode’s testing frameworks to evaluate frontier model resilience, accelerating research into secure enterprise agent architectures.

The transaction consideration is structured primarily in cash, alongside equity subject to vesting provisions. The acquisition is projected to close during CrowdStrike’s fourth quarter of fiscal 2027, subject to customary regulatory reviews and closing conditions.

The post CrowdStrike to Acquire Automated AI Security Testing Pioneer Dreadnode to Secure Agentic Systems Before Deployment appeared first on ITDigest.

The partnership was launched at Fal.Con Europe in Barcelona and combines the executive level governance and security operations in a holistic way. With the help of the next-gen SIEM technology and risk intelligence powered by artificial intelligence (AI) from CrowdStrike incorporated into Deloitte Spain’s advisory approach and MXDR operations, the companies offer a structured solution to modern cybersecurity challenges.

Connecting Executive Risk Prioritization Directly to Operational Security

There is a growing problem of the discrepancy between what is seen in the boardrooms and what happens in Security Operations Centers (SOCs). On one hand, executive management considers risks associated with cyberattacks in monetary terms, in terms of business continuity, and according to regulatory requirements. On the other hand, SOC specialists have to deal with an array of technical telemetry within the framework of point solutions. This often causes delayed response to threats and vulnerability gaps.

Also Read: Collective Secures $100 Million in New Capital to Advance AI-Driven Financial Operating System for the Solo Economy

CrowdStrike-Deloitte Spain collaboration is designed to bridge this gap, providing a coordinated approach in three key areas of the cybersecurity cycle:

Advising (Identify and Prioritize Risks): Leverages the capabilities of CrowdStrike Falcon IQ for objective, quantitative visibility of exploitable security exposure. Deloitte includes technical insights in its Innovation Workshops aimed at helping the executive management turn telemetry into long-term roadmaps in accordance with regulatory requirements and business priorities.

Implementing (Modernize Security Operations): Enables a transition from costly, legacy security solutions to the unified Falcon platform, with migration to Falcon Next-Gen SIEM.

Operate (Deliver AI-Native Managed Security): Pairs CrowdStrike’s AI-driven detection engines with Deloitte’s managed security operations. The solution is orchestrated through Deloitte’s EMEA Cybersphere Center (ECC) in Madrid, providing 24/7 threat hunting, telemetry analysis, and rapid breach remediation at scale.

“Finding risk is only half the battle. What matters is how quickly you can act on it and evolve strategy for the future,” said Daniel Bernard, chief business officer at CrowdStrike. “Falcon IQ brings AI-powered risk intelligence into Deloitte‘s advisory engagements, connecting what matters in the boardroom with what needs to happen in the SOC. Together, we’re helping enterprises move from finding to fixing, turning security priorities into action and long-term winning strategies.”

“Cybersecurity has become a strategic business imperative, requiring organizations to connect risk management, technology, and business priorities,” said Edward James Moore, Cybersecurity Partner at Deloitte Spain. “Expanding our collaboration with CrowdStrike into risk advisory helps clients move beyond point solutions, combining strategic risk insight with AI-native technology to make informed security investments and carry those priorities through implementation and ongoing operations.”

Scaling Managed Cyber Defense Across EMEA

With the implementation of continuous monitoring at the EMEA Cybersphere Center in Madrid, Deloitte Spain provides organizations access to operational support from the region along with AI-based protection measures. This partnership addresses the issue of fragmented tools by enabling enterprises with visibility from the level of executive governance to SOC intervention.

The post CrowdStrike Expands Deloitte Partnership Across Cybersecurity Advisory and Operations appeared first on ITDigest.

Also Read: Everforth Partners With WisdomAI to Advance Trusted Enterprise AI Decision-Making 

“AI is changing how security teams find answers, but not who they trust with the hard calls,” said Paul Henderson, Chief Product Officer at IANS. “Microsoft Copilot puts IANS intelligence into the tools security teams already work in. With Copilot, the whole security team can see not just what an expert would advise, but what organizations like theirs actually did, and with what results. When a decision needs a deeper conversation, our Faculty are still the people they talk to.” The IANS MCP Server is available to eligible clients with subscriptions that include MCP access and Microsoft Copilot licenses. The integration is also available through Claude, extending access to IANS cybersecurity intelligence across multiple AI platforms.

Read More: IANS Launches Practitioner-Validated Cybersecurity Intelligence in Microsoft Copilot

The post IANS Integrates Practitioner-Validated Cybersecurity Intelligence into Microsoft Copilot appeared first on ITDigest.

As per the partnership announcement, the extended partnership is based on a ServiceNow native ChatGPT plugin that enables users to turn conversational requests into enterprise actions using ChatGPT in an auditable way without switching out of the chat interface. Leveraging ServiceNow’s Action Fabric, this collaboration enables IT/operations staff to investigate incidents, evaluate change risk, coordinate on-call response, and update the system of record tickets within ChatGPT while preserving all business logic, role-based permissions, and compliance constraints. The future roadmap includes embedding OpenAI’s Codex and reasoning capabilities in ServiceNow’s AI Workflow Factory, automatic vulnerability mitigation in ServiceNow’s “Shift Zero” cybersecurity framework, and integrating OpenAI with ServiceNow’s Control Tower Alliance program for multi-agent governance.

“When two industry-defining innovators come together, a new chapter of business reinvention begins. OpenAI is pioneering the frontier of artificial intelligence. ServiceNow is the Super Intelligence Control Tower that orchestrates, secures, and governs AI across the enterprise. Together, we are unlocking extraordinary value for our customers by turning world-class reasoning into trusted execution at global scale.”

Under the Hood: From Passive Reasoning to Governance-enabled Enterprise Execution

Traditionally, implementing generative AI across enterprise IT processes involved an intrinsic friction point, which was the gap between the natural language reasoning ability of AI and the systems of record. Whereas employees were able to leverage the capabilities of the LLM to analyze technical log information and generate post-event reports, performing any actions such as modifying CMDBs, granting cloud permissions, and editing firewall settings required a switch back to enterprise portals.

Also Read: Breaking the Legacy Bottleneck: How the TCS and Workato Alliance Accelerates Enterprise Integration Modernization with AI 

The expanded architecture between OpenAI and ServiceNow resolves these operational bottlenecks through a three-part integration model:

Action Fabric Plugin Architecture: Connects ChatGPT directly to an organization’s private ServiceNow instance, allowing users to query, analyze, and execute governed actions inline while ServiceNow acts as the deterministic policy and audit engine.

Agentic Software Development (Codex Integration): Integrates Codex into ServiceNow’s AI Workflow Factory to power autonomous code generation and legacy app modernization, enabling engineers to generate production workflows from natural language.

Closed-Loop Security Triage: Combines OpenAI’s code analysis with ServiceNow’s asset and access telemetry to prioritize, validate, and remediate high-risk attack paths across distributed networks and identities before exploits occur.

Strategic Impact on the Enterprise Automation and ITSM Industry

Bridging frontier foundation models with enterprise workflow engines introduces fundamental structural shifts across the Enterprise Automation and IT Service Management landscape:

1. From Read-Only Copilots to Agentic Action Layers

Enterprise AI has been hindered for years by its passive capabilities, allowing it to provide answers without changing anything within the business logic. The integration of ChatGPT with the Action Fabric of ServiceNow represents the next step for the industry in terms of action-oriented agentic workflows. Instead of being evaluated solely based on ticket logging or search capabilities, IT service management tools will now be tested on how efficiently they are able to perform a complex sequence of actions in third-party software environments.

2. Breaking Operational Silos in Incident and SecOps Management

The inefficiencies of many IT departments have been long represented by a gap between the moment when a certain vulnerability or incident in a system is detected and the action needed to solve the issue, i.e., the change request. Integrating conversational reasoning, telemetry, and remediation into one control loop will decrease the mean time to detect (MTTD) and mean time to remediate (MTTR).

3. Building Guardrails for Large Language Models with Standardized Enterprise Grade Approach

LLMs tend to be limited by the fear of data leakage, un-monitored drifts and hallucinations. By rooting model outputs in the enterprise environment which guarantees access controls, logging, and approvals, it will provide a replicable template to address compliance challenges and allow enterprises to overcome the previous challenges of enterprise generative AI.

Overall Impact on Businesses Serving in the Enterprise Software Industry

The partnership between OpenAI and ServiceNow has established high standards for operations and competition within the enterprise software market for companies operating in:

Deprecation of Standalone, Non-Executable AI Chatbots: Single-use solutions and enterprise search bots that provide summarization but lack direct execution capabilities will quickly become obsolete. Buyers will prefer integrated solutions that allow the execution of tasks based on the intent of users.

Reduction in Operational Cost-to-Serve for IT Services: Digitizing level 1 and 2 helpdesk interactions such as password resets, software provisioning, and incident identification allows firms to scale their digital operations without requiring proportionate increases in the size of their IT staffs.

Accelerating Legacy Modernization Velocity: Equipping developers with agentic tools like Codex inside established workflow builders allows enterprises to refactor legacy technical debt and deprecated integration scripts significantly faster, reducing software maintenance overhead.

Conclusion

The growth of the OpenAI-ServiceNow partnership is one of the key milestones in the digital transformation of enterprises. With this collaboration, enterprises can integrate the latest cognitive computing abilities with their business processes to create a connection between conversational AI and controlled business operations. For the entire enterprise automation industry, the announcement is an example of how the real value of enterprise AI comes from intelligent conversations turning into automated actions.

The post Closing the Execution Gap: How the OpenAI and ServiceNow Partnership Expansion Redefines Enterprise Workflow Automation appeared first on ITDigest.