Certificate-pinned desktop apps bypass your proxy by default — Netskope's own docs say so — and local models generate no traffic at all. Why AI governance has to move to the device, with a CASB-vs-endpoint comparison and the telemetry that finds Ollama on a laptop.

Fourteen months of acquisitions rewrote the NHI map: CyberArk to Palo Alto for $25B, Astrix to Cisco, Entro to SailPoint, Oasis to Cyera. Who's still independent, what Okta and Microsoft now ship for agent identity, and the standards layer that should drive your scoring more than any logo.

Most TRiSM explainers quote a framework Gartner replaced in 2025. The current one has four layers, an acquisition wave tracing its lines ($32B of it from Google alone), and a paywall problem nobody talks about. Every claim here is labeled by where it really comes from.

One-third of analysts admit to ignoring full alert queues, so the SOC hired AI. Who ships what, why Microsoft's setup docs became the accidental governance benchmark, and five controls to demand before any agent closes an alert on its own.

Anthropic hands you 180 days, Purview flags prompt-injection attempts in the audit log, and OpenAI ships an append-only stream with a note telling you to keep it yourself. What four platforms actually export, the three SIEM integrations that exist today, and the gaps no native log covers.

A $250M acquisition, a $4.15B valuation, and not one independently verified accuracy number. We mapped both sides of the questionnaire-automation market and the only column that actually separates the tools: what stands behind the claim, and who checks the answer before it ships.

The Act has applied in general since 2 August 2026. The enforcers have powers, channels and very few staff — and, three weeks in, the tracker has exactly one row. What changed, who is designated, who signed, and what to watch.

On 24 July 2026 Microsoft auto-enabled OpenAI-operated GPT-5.6 in commercial Copilot tenants unless an admin chose "No users". The model is the least interesting part — the subprocessor terms, the excluded attestations and what your audit log can't tell you are the story.

Every pilot starts with a leader who believes they have 'a handful' of AI tools. Hour by hour, what discovery and inline inspection surface in three days — with the 2026 benchmarks from Check Point, Netskope, Cyberhaven, Harmonic, GitGuardian, 1Password and IBM beside each finding.

Four token-theft incidents in twelve months never touched a password. The six-step audit — inventory, scope classification, ghost grants, revocation, consent lockdown, continuous diff — with every command taken from Microsoft's and Google's documentation.

Comet has the most real enterprise story of any AI browser — MDM deployment, 500+ policies, telemetry, a CrowdStrike layer. It also has the deepest verified attack record of any AI browser. Both are true, and the decision framework follows from holding them together.

Completing the desktop-agent trilogy: Google's SPIFFE-based agent identity is genuinely best-in-class, its hooks return deny verdicts at the tool boundary — and neither covers remote MCP tools, while its policy engine is a Preview-status LLM judging an LLM. Both halves, honestly.