Data Security Posture & DLP

Revyz, a Spin.ai company, announced Revyz Command Center for Bitbucket, extending its enterprise data protection platform from Jira and Confluence to source code and pipelines in Bitbucket Cloud, alongside the appointment of Justin Leader as Head of Partnerships, Atlassian Ecosystem. The launch, announced ahead of Atlassian Team '26 Europe in Amsterdam on October 6-8, adds granular recovery of specific repositories, branches, pipelines, or issues, run-to-run diff visibility, and AI code protection. Revyz, acquired by Spin.ai in April 2026, is a Platinum Atlassian Marketplace Partner whose platform is SOC 2 Type II compliant. Justin Leader founded HyperVelocity Consulting in 2014, growing it to $24M in revenue before its acquisition by Isos Technology in 2023, where he served as VP of Product, and brings 15 years of SaaS experience to overseeing global Atlassian ecosystem partner strategy. Revyz Command Center for Bitbucket is available today, with solution partners able to access the app and co-selling support through the updated Revyz Partner Program.

Thales announced CipherTrust Data Security Posture Management, which the company describes as the first purpose-built DSPM offering that lets organizations protect sensitive data directly through encryption, masking or tokenization natively within the platform. The unified as-a-service platform combines sensitive-data discovery and classification with posture, access, activity and behavioral context to prioritize material risks, and it provides discovery and risk visibility for both structured and unstructured data across cloud, on-premises and hybrid sources. Todd Moore, Vice President of Data Security Products at Thales, said organizations need to understand which sensitive data is truly at risk and take direct action to reduce it, adding that CipherTrust DSPM connects risks to protections such as encryption and tokenization rather than relying on permissions alone. The approach builds on more than 30 years of Thales expertise in data discovery, protection, key management, access control and activity analysis. Hiroji Sugito, Principal Data Security Engineer at Tokyo Electron Device, said the platform's ease of deployment and the accuracy of its data classification enable customers to quickly understand where their sensitive data is, who or what can access it, and how to protect it without slowing AI adoption.

Bedrock Data announced it has extended Agent DLP, its runtime data loss prevention for AI agents, to NVIDIA OpenShell, the open source agent runtime that is part of the NVIDIA Open Safety Platform. The integration adds a policy evaluation layer in which Bedrock Data evaluates a request payload once OpenShell authorizes the request, checking it against an enterprise's data policies and returning the decision OpenShell enforces at runtime. Bedrock Data supplies the data context and the decision through OpenShell's Supervisor Middleware, drawing on its Metadata Lake enterprise knowledge graph, which classifies data in place across cloud, SaaS, AI and on-premises environments at petabyte scale. The company said the integration lets restrictions travel with data across tables, tools and handoffs between agents, so actions that permissions allow can still be stopped when the data involved may not go where it is headed. Bedrock Data Agent DLP for NVIDIA OpenShell is available today to Bedrock Data customers as an OpenShell supervisor middleware service, and teams can run it first in observe-only mode before turning on enforcement.

Fortinet shares climbed to a fresh 52-week high of $175.23 on Sept. 21, 2026, before closing at $172.78, up roughly 3% on the session, extending a rally built on accelerating demand for its unified security platform. The company rolled out FortiSOC, a cloud-delivered security operations center embedding agentic AI across SIEM, SOAR, threat intelligence and identity-detection functions, and extended FortiEndpoint with AI visibility, governance and data-loss-prevention capabilities, while deepening its FortiAIGate integration with NVIDIA's accelerated computing stack. In the second quarter of 2026, billings rose 33% year over year to $2.37 billion, revenues grew 26% to $2.05 billion, and product revenues surged 52% to $773 million, with non-GAAP operating margin hitting a second-quarter record of 38% and free cash flow more than tripling to $966 million. Management raised full-year 2026 guidance to $8.02-$8.18 billion for revenues, $9.35-$9.55 billion for billings, and $3.41-$3.47 for non-GAAP EPS, with third-quarter guidance calling for revenues of $2.01-$2.10 billion. Fortinet shares have gained 120.7% year to date, and the Zacks Consensus Estimate for 2026 earnings is $3.42 per share, implying year-over-year growth of 23.91%.

Cyera announced a $400 million extension from Growth Equity at Goldman Sachs Alternatives to its Series G round, which was led by Evolution Equity, to accelerate its mission of building a unified platform that governs access for every human, machine, and AI agent across the enterprise. The new investment will continue to support new capabilities across Cyera's AI Security product roadmap, fuel deeper expansion in the federal market, and drive continued international growth across EMEA and APAC. Cyera has secured the data layer since day one and this year extended that control to agents acting on it, with Agent Guardian and Cyera Endpoint giving enterprises visibility and accountability across AI agents, tracking tool calls, database queries, and actions from the cloud to endpoint devices where local agents such as Claude Code and Cursor increasingly perform sensitive work. The acquisition of Oasis Security brings that visibility together with non-human identity management in a single system, connecting where sensitive data lives with who or what can actually reach it. Cyera, valued at over $12 billion, is backed by investors including Accel, Blackstone, Cyberstarts, Georgian, Lightspeed, and Sequoia, and its customers include Paramount, Chipotle, and Valvoline.

Varonis Systems, Inc. launched Varonis Data Lifecycle Management, a new capability that automatically identifies and remediates redundant, obsolete, and trivial data across enterprise environments using its existing Data Security Platform. The launch ties data cleanup directly to sensitivity, access, and activity context, aiming to reduce storage waste, improve AI output quality, and help organizations address compliance exposures from scattered sensitive information. The DLM tool stacks on top of Varonis Atlas, the AI security platform that went generally available in March 2026, which targets discovery, posture management, and runtime protection for AI workloads. Together, Atlas and DLM broaden Varonis' role from guarding unstructured data to governing how that data is stored, used, cleaned up, and exposed across Snowflake, Claude, Cursor, and other cloud and AI partnerships. Varonis Systems' narrative projects $1.1 billion revenue and $120.7 million earnings by 2029, yielding a $50.68 fair value, an 8% upside to its current price, while the most pessimistic analysts were already modeling about US$1.0 billion of 2029 revenue.

Cohesity introduced Cohesity Agent Resilience, a new Cohesity Data Cloud capability that will discover, protect, and recover the infrastructure behind enterprise AI agents. The capability is available now to select customers, with general availability targeted for the end of 2026, and launches with support for Amazon Bedrock AgentCore and Amazon Bedrock Agents, while Microsoft and Google agent platforms are on the roadmap. Cohesity also outlined its vision for Autonomous Cyber Resilience, which uses agentic workflows to automate its five-step cyber resilience framework, and introduced the Cohesity AI Resilience Academy, beginning with a free, self-paced Foundations of AI Resilience with Cohesity course that Catalyst attendees will get early access to immediately after the event. The company cited new research from the fifth annual Cohesity Global Cyber Resilience Report showing that 56% of organizations said they were not well prepared to detect or contain unintended actions by AI agents and automated workflows, while 58% were not very confident in their ability to verify the integrity of AI models and related data following a cyberattack. Cohesity also said customers with Cohesity Data Cloud Enterprise Edition and Cohesity DSPM can now automate the protection of newly discovered sensitive data that is not already protected.

Palantir Technologies, Nvidia, and Booz Allen Hamilton are restricting or threatening to drop advanced AI models from Anthropic and OpenAI unless the labs provide stronger data protections, according to Reuters. Palantir has pressed Anthropic to guarantee zero data retention before making its models available through Palantir's software, while Nvidia limits Anthropic's models to less sensitive internal tasks and prefers its own Nemotron models for proprietary work, and Booz Allen has forbidden staff from running Anthropic's commercial model on cybersecurity projects touching proprietary data. The pushback intensified after Anthropic introduced a 30-day data retention policy in June tied to the rollout of its Fable 5 model, saying it needed usage logs to detect sophisticated attacks that unfold across multiple sessions, though the company said it would not use the retained data to train its models. Anthropic responded by announcing Enterprise Frontier Safeguards, which lets enterprise customers store activity data in their own cloud infrastructure, including Amazon S3, Azure Blob Storage, or Google Cloud Storage, under their own encryption keys, with automated safety monitoring but no human review by Anthropic employees; the system is rolling out in phases, with broader availability targeted for later this fall. Last week, Palantir and Nvidia unveiled a platform pairing Palantir's software with Nvidia's open Nemotron models to let organizations run AI on their own data without exposing it to outside model providers, and Nvidia shares dropped roughly 3% on Monday as AI-related stocks broadly retreated.

BeyondTrust announced the first wave of native capabilities built on its Pathfinder platform at Black Hat USA 2026, extending privilege management to every identity that can hold or exercise privileged access. The four new capabilities—PathfinderAI & MCP Server, AI Agent Security, NHI Governance, and Workload Credentials—combine visibility, intelligence, and protection to help organizations discover, prioritize, govern, and protect privileged access across human, machine, workload, and AI identities. PathfinderAI enables natural-language investigation of identity risk, while the MCP Server allows AI agents like Microsoft Copilot and OpenAI to securely connect to BeyondTrust’s identity intelligence. AI Agent Security enforces real-time controls on what AI coworkers and autonomous agents can do on endpoints, and NHI Governance extends privileged access management to service accounts, API keys, and other non-human identities that often outnumber employees. Workload Credentials replaces static secrets with short-lived, auto-expiring credentials for CI/CD pipelines, Kubernetes services, and AI agents, eliminating the risk of leaked secrets. PathfinderAI, the MCP Server, AI Agent Security, and NHI Governance are available now through the Early Access program, with Workload Credentials early access opening soon.

Varonis Systems reported second-quarter 2026 non-GAAP earnings of 4 cents per share, beating the Zacks Consensus Estimate of 1 cent. Revenues reached $180 million, up from $152.2 million a year earlier and surpassing the consensus by 1.7%. The performance was driven by continued SaaS momentum, with SaaS revenues jumping to $171.7 million from $105.9 million, while legacy term license and maintenance revenues declined as customers migrated. The company returned to non-GAAP operating profit of $3.7 million, compared with a loss of $1.9 million in the prior-year quarter, and raised its full-year revenue outlook to between $735 million and $739 million, implying 18-19% year-over-year growth.

Health100, a CVS Health subsidiary, has earned the CARIN Code of Conduct for Consumer-Facing Applications Accreditation from DirectTrust for its mobile app. The accreditation followed a comprehensive independent third-party review that examined the app's transparency, consent, security, and other criteria to ensure trusted access and exchange of personal health information. DirectTrust President and CEO Scott Stuewe said the achievement gives health care stakeholders full confidence in exchanging private health information via an application that voluntarily sought verification. Tony Ambrozie, Senior Vice President and Chief Digital & Technology Officer at CVS Health and Health100, called the accreditation a milestone reinforcing the company's commitment to data privacy, security, and transparency.

Mr. Asadej Kongsiri, Director and Manager of the Stock Exchange of Thailand, issued a formal apology regarding the leak of shareholder data from Thailand Securities Depository Company Limited, or TSD, affecting approximately 200,000 individuals out of a total shareholder base of around 5 million. He confirmed that stock portfolios, back-end systems, and the wiset application remain secure. The leaked data includes full names, dates of birth, national ID numbers, addresses, phone numbers, emails, securities company names, securities trading account numbers, bank names, and bank account numbers, but does not include securities holdings, share quantities, portfolio values, or passwords. The Stock Exchange of Thailand has already closed all vulnerabilities and is deploying artificial intelligence technology to scan source code across the entire organization to enhance security. Investors are warned never to click on suspicious links. Meanwhile, cyber police are working with ThaiCERT to pursue the perpetrators across borders.

Synology has revealed that the ISO 27001 standard is shifting from being merely a compliance certificate to a crucial foundation for enterprise risk management, building cyber resilience in an era of intensifying cyber threats. Mr. Rahat Boontanjin, Country Manager for Thailand, stated that 72 percent of organizations worldwide see cyber risk as significantly increasing, and 71 percent of risk executives expect threats to severely impact business operations. He pointed out that the rise of agentic AI is creating new forms of risk, so organizations should use ISO 27001 as a control framework across four key areas: role-based data access permissions, data accuracy governance, rollback systems for AI errors, and continuous security measure improvements. Although a 2025 OpenText survey indicates that 52 percent of global organizations plan to increase investment in backup technology, many still face real-world system recovery failures. Synology has therefore launched the ActiveProtect Appliance, a solution designed to support cyber resilience approaches and the new era of ISO 27001, integrating immutable backup, logical air-gap, and automated backup verification technologies to close recovery gaps and help Thai organizations tackle cyber threats in the AI age.

New research from Jscrambler reveals that banking websites are transmitting sensitive customer information, including hashed identifiers, loan details, and financial intent signals, to third-party advertising, analytics, and personalization platforms without valid consent. The analysis of 14 financial institutions across Europe and the US found that tracking technologies fired without valid user consent on 9 sites, sending data to at least a dozen third parties including Google, Meta, TikTok, LinkedIn, Pinterest, Adobe, and Salesforce. Examples include a Spanish bank's mortgage process sending a customer's hashed email and phone number to TikTok's pixel endpoint, a Portuguese bank's account-opening flow sending email, name, age, and national tax number to Salesforce, and two other Portuguese institutions sharing full loan simulation details including a €27,000 loan with repayment terms to Google Analytics. The research also documented consent failures such as tags firing before cookie banner action, tags continuing after users rejected all, and consent choices not carrying into iframes or subdomains. Jscrambler recommends continuous runtime monitoring, enforcement controls to block unauthorized data exfiltration, and consent enforcement that extends across iframes and subdomains.

DATAMYTE has achieved ISO/IEC 27001:2022 certification for the information security management system supporting Digital Clipboard, its cloud-based, no-code manufacturing workflow platform. The certification, awarded by an independent body, validates that the ISMS meets the international standard, reinforcing the company's commitment to protecting operational, production, quality, and compliance data for over 1000 manufacturers including Ford, Boston Scientific, Northrop Grumman, CS Wind, Stellantis, Boeing, Tesla, Gillette, Borg Warner, Cabinetworks Group, Foxconn, Pepsico, and GM. CEO Joel Ronning stated that the certification provides independent confirmation of rigorous data protection standards, scaling with the platform and clients' evolving needs. Digital Clipboard enables organizations to digitize production workflows, inspections, audits, electronic work instructions, and other shop floor processes within a secure cloud environment, addressing the growing importance of cloud data security as manufacturers move away from paper-based quality processes.

Boundeal announced a controlled-disclosure data room configured for financial-sector mergers and acquisitions, responding to a rebound in dealmaking that saw global buyout-backed exit value rise 47 percent to $717 billion in 2025 and global M&A volume surge about 40 percent to roughly $4 trillion. The environment uses permission groups to separate strategic buyers, financial sponsors, lenders, legal advisers, and clean teams, with staged disclosure that expands access as a bidder advances and granular least-privilege controls at the folder and document level. Time-stamped audit trails, mandatory confidentiality agreements, and purpose-based access aim to prevent uncontrolled disclosure of fund economics, asset-level valuations, regulatory correspondence, and other sensitive data that can expose sellers to competitive harm, legal privilege loss, or supervisory risk. Boundeal is a virtual data room provider for M&A, due diligence, IPOs, fundraising, private credit, and restructurings, serving advisers, financial sponsors, corporate teams, and regulated institutions.