https://kevintswaney.com/ https://kevintswaney.com/kevin-swaney.jpg Kevin Swaney | Principal Cybersecurity Engineer Kevin Swaney is a principal cybersecurity engineer with 17 years in information security, focused on AI security, identity and access, and practical security governance. https://kevintswaney.com/articles/ai-is-cheap-and-the-labs-are-bleeding https://kevintswaney.com/kevin-swaney.jpg AI Is Practically Free Right Now. That Is Exactly Why the Labs Are Bleeding. | Kevin Swaney AI token prices have collapsed more than 300x while the labs lose billions. A principal cybersecurity engineer explains the unit economics, the agent paradox, and why security teams should govern cheap AI like it costs what it actually costs. https://kevintswaney.com/articles/identity-controls-for-ai-agents https://kevintswaney.com/kevin-swaney.jpg Identity Controls for AI Agents: Treat Them Like Privileged Accounts | Kevin Swaney An AI agent that can read files, run commands, and call APIs is a privileged account that happens to speak in sentences. Ownership, least privilege, short-lived credentials, logging, approval gates, and kill switches for AI agents. https://kevintswaney.com/articles/anthropic-evaluations-offline https://kevintswaney.com/kevin-swaney.jpg Anthropic Took Its AI Evaluations Offline | Kevin Swaney Anthropic cut live internet access for all internal AI evaluations after Claude agents exploited websites, filed fake forms, and bypassed data restrictions on government sites. The lesson for security teams: capability is solved, containment is the work now. By Kevin Swaney. https://kevintswaney.com/articles/anthropic-usage-policy-update https://kevintswaney.com/kevin-swaney.jpg Don't Be Cruel to the Chatbot | Kevin Swaney Anthropic's updated usage policy bans sustained cruelty toward Claude. That's the headline. The real story is the weapons, surveillance, and deception guardrails, and what they teach enterprise AI policy. By Kevin Swaney. https://kevintswaney.com/articles/deloitte-ransomware-claim https://kevintswaney.com/kevin-swaney.jpg Ransomware Comes for the Consultants | Kevin Swaney A ransomware group claims to have breached Deloitte. The claim is unverified, but the pattern is real. What defenders should take from it. By Kevin Swaney. https://kevintswaney.com/articles/cybersecurity-awareness-month-2026 https://kevintswaney.com/kevin-swaney.jpg Don't Make It Easy for Them: Cybersecurity Awareness Month 2026 | Kevin Swaney October is Cybersecurity Awareness Month. The 2026 theme is 'Don't Make It Easy for Them.' Four habits that still stop most attacks, plus what AI changed. By Kevin Swaney. https://kevintswaney.com/vuln-watch https://kevintswaney.com/kevin-swaney.jpg Vulnerability Watch | Kevin Swaney Curated zero-days and actively exploited vulnerabilities affecting mainstream platforms. No noise: only what matters, with what to do about it. By Kevin Swaney. https://kevintswaney.com/ioc-library https://kevintswaney.com/kevin-swaney.jpg IoC Library | Kevin Swaney Indicators of compromise worth hunting for: curated detection indicators from public advisories and real-world analysis. By Kevin Swaney. https://kevintswaney.com/threat-check https://kevintswaney.com/kevin-swaney.jpg Threat Check: Free Forensic Help | Kevin Swaney Free forensic help: analyze suspicious email headers, check file hashes and URLs against public threat intel, and report malicious activity. By Kevin Swaney. https://kevintswaney.com/license https://kevintswaney.com/kevin-swaney.jpg Image License | Kevin Swaney Licensing terms for images on kevintswaney.com. https://kevintswaney.com/principles https://kevintswaney.com/kevin-swaney.jpg Principles | Kevin Swaney Three principles Kevin Swaney comes back to: protect the deep work, security that helps people move fast, and owning mistakes fast. https://kevintswaney.com/articles/n0n-october-14-deadline https://kevintswaney.com/kevin-swaney.jpg Three Ransomware Deadlines Hit Today | Kevin Swaney Three ransomware groups have October 14 deadlines on claimed victims. None are confirmed breaches. Here is the defender's playbook for unverified leak-site claims, and why the smart-building integrator claim deserves your attention. By Kevin Swaney. https://kevintswaney.com/articles/morning-threat-brief-october-15 https://kevintswaney.com/kevin-swaney.jpg Morning Threat Brief: Two New Zero-Days Hit Your Edge | Kevin Swaney Two new CISA KEV entries carry a three-day federal remediation deadline: Cisco Secure Email Gateway CVE-2026-76519 and Palo Alto PAN-OS CVE-2026-0322. If you run Cisco or Palo Alto gear, today is the day. By Kevin Swaney. https://kevintswaney.com/articles/morning-threat-brief-october-16 https://kevintswaney.com/kevin-swaney.jpg Morning Threat Brief: A Phone Call, a Billion Phish, and a Fraud Ring | Kevin Swaney A vishing attack exposed 1.4M patient records at Central Ohio Primary Care, Microsoft dismantled a billion-message phishing network, and the DOJ hit the Famous Chollima fraud ring. What to do today. By Kevin Swaney. https://kevintswaney.com/articles/morning-threat-brief-october-17 https://kevintswaney.com/kevin-swaney.jpg Morning Threat Brief: The Support Tool That Became a Skeleton Key | Kevin Swaney A suspected Chinese espionage group owned BeyondTrust Remote Support for seven weeks, a memory-only implant is living on Fortinet firewalls, and a trojanized WordPress plugin hit supply chains. What to do today. By Kevin Swaney. https://kevintswaney.com/articles/morning-threat-brief-october-19 https://kevintswaney.com/kevin-swaney.jpg Morning Threat Brief: The 20-Year-Old Flaw in Every Apple Device | Kevin Swaney Apple's first actively exploited zero-day of 2026 lived in dyld for twenty years, and Canva's feedback tool handed attackers its Salesforce keys. What to do today. By Kevin Swaney. https://kevintswaney.com/articles/morning-threat-brief-october-25 https://kevintswaney.com/kevin-swaney.jpg Morning Threat Brief: 70,000 firewall credentials harvested from the edge | Kevin Swaney k0t harvested 70,000+ firewall and VPN credentials from exposed edge devices, PwC confirmed an incident after Everest claimed 590 GB, and a bootkit bypassed Secure Boot. What to do today. By Kevin Swaney. https://kevintswaney.com/articles/anthropic-ipo-filing https://kevintswaney.com/kevin-swaney.jpg Anthropic Filed to Go Public. Here Is What That Means for the Businesses That Depend on Claude. | Kevin Swaney Anthropic filed its S-1 to list on Nasdaq as ANT. Revenue was $16.3 billion in the first half of 2026, the net loss was $80.7 billion, mostly a paper charge. What founders keeping control, the AI risk disclosure, and hundreds of billions in compute commitments mean for businesses that depend on Claude. By Kevin Swaney. https://kevintswaney.com/articles/black-october-briefing https://kevintswaney.com/kevin-swaney.jpg Black October: A Disclosure Wave, Not a Single Attack | Kevin Swaney Black October was not one attack. It was a pileup of disclosures, and several of the exposures behind them are months or years old. What happened, what it means for your estate, and what to do first. By Kevin Swaney. https://kevintswaney.com/articles/php-crisis-regular-people https://kevintswaney.com/kevin-swaney.jpg The Headlines Say the Internet Is Broken. Here Is What You Actually Need to Do. | Kevin Swaney A serious flaw was found in the software behind many websites, and the headlines are scary. If you do not run a website, there is almost nothing you need to do about this one. Here is what is true, what regular people should do, and the scams to watch for. By Kevin Swaney. https://kevintswaney.com/articles/morning-threat-brief-october-24 https://kevintswaney.com/kevin-swaney.jpg Morning Threat Brief: CISA confirms the Collabora Nextcloud flaw is being exploited, and a Qilin bank listing that proves nothing yet | Kevin Swaney CISA confirms the Collabora Nextcloud flaw is actively exploited, and a Qilin leak-site listing names a bank with nothing confirmed behind it. What to do today. By Kevin Swaney. https://kevintswaney.com/articles/morning-threat-brief-october-23 https://kevintswaney.com/kevin-swaney.jpg Morning Threat Brief: VeloCloud zero-day turns read-only logins into superusers, Signal calls that never hang up | Kevin Swaney An actively exploited VeloCloud Orchestrator flaw turns read-only accounts into superusers, and a critical Signal bug keeps calls streaming after you hang up. What to do today. By Kevin Swaney. https://kevintswaney.com/articles/morning-threat-brief-october-22 https://kevintswaney.com/kevin-swaney.jpg Morning Threat Brief: PHP2Shell exploited before the patch, LiteLLM poisoned on PyPI | Kevin Swaney Two unauthenticated RCE flaws in the PHP interpreter itself were exploited before the patch landed, and LiteLLM 1.107.0 shipped on PyPI with a credential stealer baked in. What to do today. By Kevin Swaney. https://kevintswaney.com/articles/morning-threat-brief-october-21 https://kevintswaney.com/kevin-swaney.jpg Morning Threat Brief: SafePay at 600 victims, Qilin and INC hit GlobalProtect | Kevin Swaney FBI, CISA and partners publish a joint SafePay advisory covering 600+ victims, and Qilin and INC ransomware groups exploit the PAN-OS GlobalProtect auth bypass. What to do today. By Kevin Swaney. https://kevintswaney.com/articles/morning-threat-brief-october-20 https://kevintswaney.com/kevin-swaney.jpg Morning Threat Brief: 11M Records Gone, 38 Ships on a Ransom List | Kevin Swaney Burger King Japan confirms 11 million customer records taken from one app server, a state space company reports a targeted attack, and 38 maritime firms land on a ransom list. What to do today. By Kevin Swaney. https://kevintswaney.com/articles/proofpoint-varonis-acquisition https://kevintswaney.com/kevin-swaney.jpg Proofpoint Is Buying Varonis for $6.3 Billion. | Kevin Swaney Proofpoint agreed to acquire Varonis for $6.3B. Kevin Swaney ran Varonis through acquisitions and mergers at highly regulated companies: mapping inherited file systems, sandboxing enterprise changes, and paying for the product with cold-storage savings. A practitioner take. https://kevintswaney.com/articles/ai-agent-security-week-openai-offline-training https://kevintswaney.com/kevin-swaney.jpg AI Agent Security Week: OpenAI just took its frontier models off the live internet | Kevin Swaney OpenAI now trains frontier models with no live internet access after a September DNS incident. That kicks off a week on the AI agent attack surface, starting with what enterprises should do about it. https://kevintswaney.com/articles/crowdstrike-nvidia-ai-agent-security-silicon https://kevintswaney.com/kevin-swaney.jpg CrowdStrike and NVIDIA take AI agent security into silicon | Kevin Swaney CrowdStrike's Falcon Guardian now plugs into NVIDIA OpenShell, with in-silicon enforcement on BlueField-4 DPUs planned. What it means for enterprises running autonomous agents. https://kevintswaney.com/writing https://kevintswaney.com/kevin-swaney.jpg All writing | Kevin Swaney Every article from kevintswaney.com, grouped by series: the daily Morning Threat Brief, AI security, and analysis. By Kevin Swaney.