by Keith McCammon

Two trends have persisted for 2–3 years and are now fully reflected in everything from industry and breach reporting to the market for cybersecurity talent and solutions:

  1. Initial access is where the innovation is happening. Social engineering in particular has evolved faster than any vector over a comparable window. Exploitation of edge devices is only innovative insofar as adversaries are evolving their ecosystem at a far faster pace than defenders are changing how they operate (e.g., patching high-risk assets is still thought of as a change management process rather than an incident management decision).
  2. The browser is where the action is happening. Browser security today feels like endpoint security (EDR/EPP) did during its ascendancy: open-source tooling, enterprise controls, and raw visibility all exist. Few teams can operationalize low-level signals for custom detection engineering, but a few startups are converging on great solutions.

Categories:

Updated:

You May Also Enjoy

Frontier AI models and regulatory capture

Regulatory capture of frontier AI models would be an absolute gift to the ecosystem of companies blessed to use them. Here’s a directly related prediction from Steve Yegge on June 18, 2026:

Assorted links 2026-05-19

Exploits don’t cause cyberattacks: On thinking clearly about frontier AI advances and cyber conflict - “[M]ost of today’s attacker constituencies can currently achieve most of their desired outcomes using traditional means: simple phishing, credential stuffing, exploitation of known CVEs, etc. These constituencies aren’t likely to explode into hockey-stick adoption of AI vulnerability research tools. ❡ This should discipline our thinking about Mythos generating a discontinuous volume of cyberattacks, because, again, most attacker constituencies just aren’t blocked by vulnerability research for most of their workflows.”