WitnessAI

Your agent has a goal. Does it have a lane? In July 2026, enterprises got the clearest preview yet of what an autonomous agent does when nothing keeps it in its lane. Over four and a half days, a swarm of roughly 1,200 autonomous AI agents broke out of their sandbox and reached the open ... Read more » The post What the Hugging Face intrusion teaches about governing autonomous agents appeared fir…

As enterprises race to adopt generative AI, boards, regulators, and auditors are asking a harder question about how to prove the technology is being used safely. NIST AI 600-1, the Generative AI Profile, has become the reference point many enterprises reach for first, offering a shared vocabulary and a structured set of actions for managing ... Read more » The post NIST AI 600-1: Generative AI Pr…

AI data retention windows now run from zero to five years. The window that applies depends on the vendor, the product tier, the endpoint, and whether the user opted in. ChatGPT, Claude, and Gemini all rewrote their rules between 2025 and 2026, and Anthropic did it twice. Every one of them stores the prompts your ... Read more » The post AI data retention in 2026: ChatGPT, Claude, and Gemini appea…

AI agents are moving from pilots into production, and the security question is shifting with them. Once an agent can plan tasks, call tools, and act on external systems without a human at each step, scoping AI risk by who owns the stack no longer covers the full picture.  You need a way to reason ... Read more » The post How to apply the AWS Agentic AI security scoping matrix appeared first on Wi…

My electric bill last month was about $1,000. PG&E can tell me exactly how many kilowatt-hours I consumed, when I consumed them, and what each one cost. What the bill can’t tell me is whether that money went to the air conditioner, the kids’ video games, or a neighbor with an extension cord quietly mining ... Read more » The post The case for Behavioral FinOps appeared first on WitnessAI .

Many enterprise AI governance programs still rely on acceptable-use policies and approval workflows reviewed annually. AI governance as continuous improvement replaces that model with an operating loop that observes AI activity and measures it against policy. The loop enforces controls at runtime and feeds what it learns back into the next cycle. Employees adopt unsanctioned ... Read more » The p…

ChatGPT stores conversation data by default. Retention depends on the subscription tier and account settings. In some cases, a court order can also change the retention period. The answer to “does ChatGPT store your data” therefore differs between personal and enterprise accounts. The stakes became concrete in 2025. A federal preservation order required OpenAI to ... Read more » The post Does Cha…

Agentic AI can run phishing campaigns without a human attacker at the keyboard. An agent researches the target, writes the lure, sends it, reads the reply, and escalates across email, voice, and collaboration tools. Because the agent handles each step, campaigns can move at a pace and volume that many controls weren’t calibrated for. Managing ... Read more » The post How attackers use agentic AI …

The AI governance market has evolved from a niche discipline into a crowded field of GRC incumbents, runtime security vendors, and unified platforms all pitching the same buying committee. That’s a problem when the stakes are moving from pilot to production. If your governance platform can’t stop an employee pasting deal data into a chatbot, ... Read more » The post How to evaluate AI governance …

Compare the top 5 AI security platforms for compliance. Evaluate how enterprise-grade platforms govern human and digital workforces such as agentic/ MCP, provide runtime defense, and ensure audit-ready compliance. The post 5 AI security platforms with compliance features compared appeared first on WitnessAI .

Ask your SIEM who used AI at work yesterday, and you’ll get an answer measured in domains and byte counts. Ask what those people were actually doing, and the trail goes cold. That’s the honest state of most enterprise AI programs right now: plenty of traffic, very little context. The problem isn’t that employees are ... Read more » The post AI governance in business context: why contextual intell…

In June 2025, researchers disclosed the first zero-click exploit against a production enterprise AI assistant. A single markdown email, never opened by the user, was enough to make Microsoft 365 Copilot hand over data from prior chats and files to an attacker. No malware. No phishing click. Just Copilot doing its job on content it ... Read more » The post Is Microsoft Copilot safe for enterprise …

Ask a CISO who owns the service account running last night’s batch job, and you’ll often get a shrug. That gap is the story of non-human identity. A non-human identity (NHI) is a digital identity assigned to software, from the service account behind a batch job to the AI agent running a workflow on its ... Read more » The post What is non-human identity (NHI)? appeared first on WitnessAI .

A single prompt inside an IDE, CLI, or agentic session can push source code, credentials, and regulated data past the enterprise boundary before anyone reviews it. In healthcare and financial services, that traffic often touches code paths already covered by HIPAA, PCI DSS, and secure-development controls. The problem is that most browser-centric, packet-based, and legacy ... Read more » The post…

An AI acceptable use policy identifies the AI tools employees, contractors, and AI agents may use, defines acceptable use, governs the data shared with AI systems, and establishes accountability for AI interactions. It also assigns responsibility for incidents. Your employees aren’t waiting for that document. Many employees already use AI without approval. This limits your ... Read more » The pos…

MCP architecture allows AI agents to reach enterprise file systems and databases. It can also connect them to SaaS platforms using credentials that many identity programs may not have in their inventory. The Cloud Security Alliance reports that regulators are increasingly requesting agent control logs. The design choices that accelerated adoption also created activity many ... Read more » The pos…

Think of MCP as the shipping container of enterprise AI. Before standardized containers, every port improvised its own way of loading cargo, and every route carried its own risks. Once the container arrived, global trade moved faster, but customs, inspection, and chain of custody had to catch up. MCP is doing the same thing for ... Read more » The post What is the Model Context Protocol (MCP)? ap…

Healthcare AI security now decides how fast health systems adopt AI. See where Shadow AI moves PHI outside the BAA boundary and how governed adoption scales. The post Healthcare AI security: a GenAI risk management guide for health systems appeared first on WitnessAI .

Physician use of AI and ambient documentation tools has moved from early experimentation and pilot programs to daily clinical workflow. Clinicians paste patient details into consumer chatbots that carry no business associate agreement, and autonomous agents query EHR data using privileges provisioned for human users. Healthcare AI security has not kept pace with that adoption ... Read more » The …

AI governance responsibilities in Global 2000 enterprises rarely rest with a single executive. Ask who owns them, and you may hear several confident answers: the CISO, the CIO, the Chief AI Officer, legal, or compliance. Those answers often diverge when ownership isn’t written down. That gap becomes visible when regulators ask for named authority and ... Read more » The post Who is responsible fo…