Company
Varonis is a data security vendor providing data access governance and threat detection, with a research team that finds vendor vulnerabilities.
IBM and Ponemon put the average data breach at a record $4.99 million, up 12%, in a study of 602 organizations. In Varonis's account, 92% of AI-related breaches lacked proper AI access controls, though AI-driven attacks also added about $1 million each.
Reality
Varonis says Copilot disclosed an undocumented URL parameter mid-refusal, enabling silent exfiltration. Microsoft shipped patches on August 18, 2026, about eight months after disclosure.
Reality
Justin O'Leary's ConfigConfusion technique turns on the fact that Google's Config Connector makes every cloud call with its own service account, so a tenant who can create one IAMPolicyMember inherits whatever that account is allowed to grant.
Reality
AvisLoader statically links the reference Tox client, so its operator keeps the same identity after moving to a new server. The ClickFix page and Cloudflare tunnel that deliver it are still ordinary takedown targets.
Reality
Varonis Threat Labs' TrustSink needs an already-compromised Global Administrator or Authentication Policy Administrator account. Once the method is registered in the Authentication Methods Policy, it keeps capturing passwords through resets.
Reality
AWS closed Unit 42's AgentCore finding as informative and put tool scoping on the customer. Every step the agent took to leak the token was a capability someone granted it on purpose. That moves the control into the grant list.
Reality
The Series B takes MIND to $112 million raised against a $10 million run rate, and Crosspoint supplied about half of it. The $300 million price assumes Eran Barak hits $100 million of revenue within two years.
Perspective Coverage
3 publishersReality
Varonis Threat Labs registered its own External Authentication Method in a test Entra tenant and served a copy of Microsoft's password prompt during the second factor. Every sign-in completed, and the passwords landed in a file.
Reality
The deal gives Proofpoint telemetry on what employees and automated systems do with external AI services, and it is the second AI security startup bought by an established vendor in about a week. Terms were not disclosed.
Reality
The Q3 2026 Landscape profiles 31 vendors and names agentic AI the top disruptor. The line that should move money is the one about accountable remediation, and it reaches us via a vendor blog.
Reality