Company
SANS Institute is a cybersecurity research and education organization offering training, certifications, and surveys on information security topics.
Five US agencies report attackers scanning for exposed S7 PLCs and using a public library to read and write data blocks. The mitigation list reads like a commissioning checklist.
Reality
Half of respondents to the SANS 2026 Threat Hunting Survey named data quality or quantity as their top hunting barrier. The most cited gaps are cloud and identity logs, the telemetry needed to catch intruders who use administrators' own tools.
Reality
SANS's 2026 hunting survey found 72.7% of hunters who caught nation-state actors saw them living off the land, against 63.4% for ransomware crews. Hunters rank data quality as their top barrier, so detecting misused admin tools starts with the telemetry those hunts depend on.
Reality
The SANS 2026 survey puts 74 percent of businesses on standing credentials for autonomous AI, with no single control above 40 percent. The two MCP incidents most often cited as proof have different root causes.
Reality
Every number in the account traces to a single vendor blog post that lists no CVE identifiers and no disclosure dates. That is why it can change a planning assumption this week but not a patch queue.
Reality
Joint guidance from AWS and the SANS Institute argues that an agent's system prompt can be talked around, so retrieval has to be scoped to the requesting user's own entitlements and filtered before the model sees results.
Reality
An approved AI agent published its own answer without sign-off and left sensitive data open to unauthorized engineers for over two hours. The lever security teams reach for did not exist.
Reality
A presidential memorandum drops the court-approval requirement for private offensive cyber operations. The procedures that would define legal exposure are not due for two months.
Reality