InfoSec Relations

On June 22, 2026, the cyber security agencies of the Five Eyes alliance, the United States, United Kingdom, Canada, Australia, and New Zealand, took the rare step of issuing a joint statement warning that AI is transforming cyber risk on a timeline of months, not years. When five of the world's most capable cyber defense agencies speak with one voice, it is a signal that something has shifted.

In March, an Iran-linked group calling itself Handala claimed a cyberattack on the medical device maker Stryker, disrupting a company most people would never connect to a conflict in the Middle East. Weeks later, CISA and the FBI reported Iranian-affiliated actors disrupting programmable logic controllers across US water, energy, and government systems.

AI agents no longer just answer questions. They browse the web, call APIs, write code, and access enterprise data, often with minimal human intervention. That shift from passive tool to autonomous actor is one of the most exciting developments in the field, and it opens a class of security risk that existing frameworks were never designed to handle.

How do attackers actually reach the cloud control plane, and why is it the layer that matters most to them? Siri Varma Vegiraju, a tech lead on Microsoft Azure Security, joins Offensive Engineering to walk through the real attack paths against cloud infrastructure, from stolen secondary credentials to token abuse, and to explain what defenders consistently assume they have covered when they do not.

A former US diplomat and senior Pentagon official breaks down how Iran turns cyber operations into statecraft, and the seven things CISOs should do about it. How do states turn cyber operations into instruments of power? Former US diplomat and senior Department of Defense official Armand Cucciniello III joins InfoSec Leadership to break down how nation-states use cyber as a tool of signaling, coercion, and statecraft, using Iran as the case study.

Security governance for agentic AI has focused almost entirely on the reasoning layer. What agents decide, which detections they act on, whether a human signs off before a consequential action runs. That work matters, and it is not finished. But it leaves a different problem building underneath it. The Model Context Protocol layer connects agents to the tools, data sources, and APIs they need to function.

Attackers and State-sponsored groups have for years used automated tools against cloud infrastructure. But the speed of that threat has with the advancements in AI changed structurally. VulnCheck data cited in Sysdig's 2026 Cloud Native Security and Usage Report shows that in 2018, attackers took nearly a year to weaponize disclosed vulnerabilities. By 2023 it was eight days. At the end of 2025, React2Shell was being actively exploited only hours after public disclosure.

Government research networks exist to move information. They connect classified systems across agencies, share data between military contractors and federal institutions, and provide researchers across the Department of Defense, NASA, and the Department of Energy with persistent, authenticated access to sensitive materials. For the organizations that built them, this connectivity was an operational necessity.

The perimeter-based security model that most governments and institutions built their digital defenses around rested on a single assumption that held long enough to become doctrine. Internal networks were trusted. External traffic was suspect. The job of the security infrastructure was to keep the outside out, and everything inside the boundary was, by definition, safe enough to work with.