Interview with Rob Allen from Threatlocker
Safely enabling agentic AI for BusinessesOpenClaw was the wakeup call and businesses wanted to know how to block it. “Easy,” Rob Allen said, “it’s already blocked if you’re using Threatlocker.” Now that things have settled down a bit, those same businesses want to allow their employees to experiment with agents. We discuss how they can do it safely.This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!Topic Segment
For this week’s topic segment, we’re discussing AI pentesting agents and how likely they are to get you into big legal trouble. You came home from Black Hat with a new, shiny AI pentesting agent. How can you be sure it isn't hacking the wrong company?News Segment
Finally, in the enterprise security news,- we check the vibes
- New MCP standard and AI text watermarking
- what does combatting “cyber-enabled crime” mean?
- A closer look at Cl0p
- One 3rd party was responsible for all the AI sandbox escapes and hacking
- reports
- vulnerabilities
- Comcast can track your movements with WiFi
- A novel solution to the AI datacenter water use concerns
Rob Allen, Chief Product Officer of ThreatLocker, is an IT Professional with three decades of experience assisting small and medium enterprises embrace and utilize technology. He has spent the majority of this time working for an Irish-based MSP, which has given him invaluable insights into the challenges faced by businesses today. Rob’s background is technical – first as a system administrator, then as a technician and an engineer. His broad technical knowledge, as well as an innate understanding of customers’ needs, made him a trusted advisor for hundreds of businesses across a wide variety of industries. Rob has been at the coalface, assisting clients in remediating the effects of, and helping them recover from cyber and ransomware attacks.
- If you’ve invested in threat intel and still can’t tie it to real risk reduction, you’re not alone. A lot of programs are collecting intel, but not operationalizing it across detection, response, or the business.So what’s actually working?At the Threat Intelligence Virtual Cybersecurity Summit on August 26th, you’ll hear how mature teams are turning intel into action and making it measurable.Security Weekly listeners can register for free at https://securityweekly.com/threatintel using the promo code: CSS26-SW
- Unlock the full InfoSec World experience with the All Access Pass, featuring premium workshops, exclusive content, VIP experiences, and expanded opportunities to connect with cybersecurity leaders across industries. Join us in Orlando, October 12–14. Listeners save 30% on their pass with code ISW26-SWSAVINGS at securityweekly.com/infosecworld2026.
Adrian Sanabria
- FUNDING/M&A, courtesy of the Security, Funded newsletter #257 – SASE and Sound
VIBE CHECK
Offense is compounding faster than defense. What actually closes the gap?
- 50% - Security-trained models for defense
- 25% - Regulatory teeth force companies' hands
- 8% - General frontier models for defense
- 8% - Cyber insurance forces focus via price
- 8% - Other (tell me)
FUNDING
- Corma, an Israel-based frontier AI model company for security operations, raised a $60.0M Seed from Sequoia Capital.
- Mindgard, a United Kingdom-based threat detection, red teaming, and security platform for AI models, raised a $30.0M Series A from Album VC.
- Cytix, a United Kingdom-based AI-powered penetration testing and vulnerability management platform, raised a $7.0M Series A from Northern Gritstone.
ACQUISITIONS
- CyberCatch, a United States-based security and compliance automation platform for defense contractors, was acquired by Datavault AI for $94.5M. CyberCatch has not previously disclosed funding.
- NEW PRODUCTS: The next generation of MCP
- NEW FEATURES: How Claude’s text watermarking works
Fascinating - it can't be removed, and is potentially only visible if you have a key. It doesn't sound like it would be hard to recover/recreate the key though. We'll find out, I guess.
- POLICY: Is this hack-back or cyber letters-of-marque?
The White House put out an interesting EO last week. We didn't talk about it last week, because I wanted time to read what others had to say before discussing. It's not an area I know a lot about. This is more complicated than a pentest at the nation state level!
There are many takes on this, but Rob seems to have a good grasp here, so I'm sharing his.
- HOW-TOs: How to spot AI images: A fact-checker’s guide
- STANDARDS: ETSI launches approval process for 17 European Standards supporting the Cyber Resilience Act – ETSI
A little over a year before the deadline to comply with these.
- BREACHES: Cl0p Ransomware: Attack Pattern in Threat Intelligence
An insightful look into Cl0p and their approach to cybercrime
- They almost always target file transfer products
- They've used 8 zero days across 10 campaigns in a 6 year period
- "indicates strategic specialization rather than opportunistic exploitation"
- Two years of scanning targeting MOVEit devices occurred before the attacks that compromised over 2600 organizations, suggesting that there are clues from attackers that could give defenders a heads up. GreyNoise has also been researching these 'scan, then attack' patterns that warn of impending zero-day exploitation.
- They are dormant for 10-14 months between campaigns. The guess is that these are research periods, looking for useful targets and zero days for the next batch of attack campaigns.
- Some good strategic and tactical recommendations in this writeup as well
- BREACHES: Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign
They apparently also created a custom webshell just for this campaign.
- AI BREACHES: Irregular Details How a Naming Error Let AI Models Attack a Real Company
Turns out there was one 3rd party behind all three AI lab sandbox escapes.
And their tagline, somewhat ironically is: "Irregular is the first frontier security lab with the mission of protecting the world in the time of increasingly capable and sophisticated AI systems."
XBOW with some shaaaaade
- REPORTS: Blue Report 2026: Enterprise Security Performance Benchmarks
The results are painful, but unsurprising. No Zero Trust, everything's flat, lateral movement is easy. Crispy outside, squishy inside. Not much has changed.
- VULNERABILITIES: Red Agent Exploits Snowflake Vuln Missed by Github Copilot
AI creates vulnerability AI exploits vulnerability Welcome to the future
- VULNERABILITIES: CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why.
IT asbestos.
GET RID OF SSL VPNs
- RANSOMWARE: Beware the Ransomware Rescuer: Ransom Busters
Ransomware crews are now posing as incident responders/negotiators
- NOT SURE I LIKE THIS: Comcast turns your Xfinity WiFi into a home motion detector
- SQUIRREL: Liquid Death solves the datacenter water over-usage problem