Executive Summary
This week crystallized three converging pressures on enterprise security strategy. The Trump administration’s AI and cybersecurity executive order was withdrawn hours before its signing ceremony after last-minute lobbying by technology executives, leaving enterprises without federal direction on AI safety frameworks at the moment they need it most. Simultaneously, Verizon’s 2026 Data Breach Investigations Report delivered a structural warning that should inform every security budget conversation: vulnerability exploitation has overtaken credential theft as the leading breach entry point, third-party breaches surged 60% year-over-year to reach 48% of the total breach dataset, and shadow AI adoption among employees tripled to 45%. And the confirmed breach of approximately 3,800 GitHub internal repositories, via a poisoned developer IDE extension, demonstrated that supply chain risk has fully penetrated the engineering toolchain itself.
This report covers strategic IT security topics for executive leadership. For tactical CPS/ICS vulnerabilities, see the CPS Threat Intelligence report. For ransomware incidents, see the Ransomware Intelligence report.
Week of May 15 - May 22, 2026
Regulatory and Compliance
The week’s most significant regulatory development was the last-minute cancellation of the Trump administration’s AI and cybersecurity executive order. A signing ceremony had been arranged for Thursday, with technology and AI executives gathered at the White House, but the event was abruptly called off following phone calls from former AI and crypto adviser David Sacks and several major technology industry leaders. President Trump told reporters that he had pulled the order because it could interfere with American competitiveness on AI, stating that he did not want to do anything that would get in the way of that lead over China. The draft order, subsequently published in full, had proposed directing federal agencies to shore up cybersecurity defenses against AI-enabled attacks, establish a voluntary pre-deployment testing framework for advanced AI models with the NSA handling classified evaluations, and codify information-sharing arrangements between government and frontier AI developers. The order’s withdrawal creates a governance vacuum at a moment when enterprises are actively building AI strategies and looking for federal alignment signals.
A parallel political development underscored the internal tension around AI oversight. More than 60 Trump-aligned figures, including former adviser Steve Bannon, sent a letter urging the President to require government testing and approval of the most powerful AI models before public release. The letter reflects a growing divide within the administration between technology industry allies who opposed the executive order as regulatory overreach and a “Humans First” faction concerned about unchecked deployment of advanced systems.
In Europe, organizations operating under NIS2 scope have now passed the April 2026 active implementation deadline. Regulatory inspectors across member states expect demonstrable evidence of cybersecurity governance, incident reporting processes, supply chain security programs, and management training — not simply written policies. Organizations that have treated NIS2 compliance as a documentation exercise face material enforcement exposure. Separately, the Cyber Resilience Act’s first major deadline — mandatory reporting for actively exploited vulnerabilities — takes effect in September 2026, and the European Commission’s draft guidance from earlier this spring remains the definitive compliance reference for product manufacturers and software developers with EU market exposure.
AI Governance and Agentic AI
The UK’s National Cyber Security Centre, joined by CISA, the NSA, and cyber agencies from Australia, Canada, and New Zealand, published formal joint guidance this week on the secure adoption of agentic AI systems. The guidance argues that autonomy and complexity make agentic systems qualitatively different from conventional software: actions can occur faster than humans can review them, the range of tool and data access available to agents is broad, and the path from instruction to outcome is often difficult to audit. The Five Eyes agencies recommend that organizations start with bounded, low-risk tasks, never grant agents unrestricted access to sensitive data or critical systems, and resolve governance questions before deployment rather than after. Those governance questions include ownership of the agentic system, who approves its access permissions, who monitors its behavior in production, who handles incidents, and who holds authority to halt operations.
The timing of this guidance, published in the same week the US federal AI governance framework collapsed, reinforces its strategic importance. With no forthcoming federal executive order to establish a domestic baseline, the NCSC and Five Eyes joint publication is now the most authoritative current reference for enterprise agentic AI security programs. CISOs evaluating agentic AI deployments — whether in autonomous security operations, developer productivity tools, or customer-facing applications — should treat this guidance as the practical governance checklist for pre-deployment review.
The administration’s concurrent defense in federal court of its designation of Anthropic as a supply chain risk, even while it actively explored federal adoption of Anthropic’s models, illustrates how AI governance decisions are being shaped by geopolitical and commercial factors as much as by security rationale. Enterprises building multi-year AI strategies should plan for continued regulatory volatility and architect governance frameworks that can adapt across jurisdictions rather than optimizing for any single regulatory environment.
Board-Level Risk and CISO Strategy
Verizon’s 2026 Data Breach Investigations Report, released this week, provides the most important board-level security data of the year. The headline finding represents a structural shift: vulnerability exploitation now accounts for 31% of initial breach access, overtaking credential abuse at 13% for the first time. The median time to fully remediate a known exploited vulnerability increased to 43 days from 32 days the prior year, and only 26% of entries in the CISA Known Exploited Vulnerabilities catalog were fully remediated in 2025, down from 38%. Ransomware appeared in 48% of all breaches, up from 44%, though ransom payment rates continue to decline.
The third-party and shadow AI findings demand particular board-level attention. Breaches involving a third party increased 60% year-over-year, reaching 48% of the total breach dataset — meaning that in nearly half of all incidents, the attack path ran through a vendor, contractor, or service provider rather than directly through the organization itself. Meanwhile, employee use of unapproved shadow AI tools tripled to 45%, creating a data exposure channel that most existing data loss prevention controls are not calibrated to intercept. Mobile social engineering success rates increased 40%, reflecting the maturation of AI-assisted phishing toolkits that can generate convincing, contextually aware messages at scale.
For CISOs preparing board presentations, the DBIR offers concrete financial grounding for security investment decisions. The combination of slower patching, rising third-party exposure, AI-accelerated attack timelines, and widening shadow AI data leakage creates a compounding risk profile that justifies both accelerated vulnerability management investment and expanded vendor oversight programs.
Cloud Security Posture
The GitHub breach confirmed this week illustrates that cloud-hosted development infrastructure carries supply chain risk well beyond the repositories it hosts. A threat actor group known as TeamPCP gained unauthorized access to approximately 3,800 of GitHub’s own internal repositories after compromising an employee’s device through a poisoned version of the Nx Console VS Code extension, a widely used open-source developer productivity tool. TeamPCP demanded at least $50,000 for the exfiltrated data, and GitHub contained the incident by removing the malicious extension version, isolating the affected endpoint, and rotating critical credentials with highest-impact secrets prioritized. GitHub stated that customer data stored outside its internal repositories was not impacted, though the investigation remained ongoing at week’s end.
A separate incident reported this week involved a contractor whose public GitHub repository inadvertently exposed credentials for US government AWS GovCloud accounts and internal CISA systems. Two major credential exposure incidents originating from GitHub repositories in a single week reinforces a pattern security teams should treat as systemic: secrets routinely escape through development pipelines into version control systems where they persist long after they are no longer needed. Code repositories are not simply storage — they are live environments where credentials, tokens, and configuration data accumulate over time, often across contributor accounts that lack the same access controls as production systems.
Identity, Access Management and Zero Trust
The FBI issued a warning this week about Kali365, a phishing toolkit that enables attackers to harvest Microsoft 365 access tokens and bypass multi-factor authentication entirely. The tool functions by intercepting session cookies after a successful authentication event, allowing the attacker to replay the session without possessing the user’s password or MFA code. The Kali365 warning is one of several signals this year that MFA bypass has become a commodity capability available to broadly skilled threat actors rather than only sophisticated groups.
The CSO Online analysis of modern breach patterns, published this week alongside the DBIR findings, makes the strategic conclusion explicit: identity is the primary attack surface in enterprise environments, but the attack methods have evolved past simple credential theft. The dominant threat model now combines credential harvesting with session token theft, OAuth token abuse, and MFA interception techniques. Standard push-notification MFA — which was considered strong protection two years ago — is now routinely bypassed by commodity toolkits. The practical implication for security leaders is that MFA implementations relying on push notifications or SMS codes need to migrate toward phishing-resistant authentication methods, and that session validation through conditional access policies needs to extend beyond initial login to continuous, real-time authorization decisions throughout each session.
The identity-first zero trust architecture that has been a strategy document fixture for several years is now a direct response to a documented and operational threat model. Organizations still treating zero trust as a roadmap aspiration should treat this week’s FBI advisory and DBIR findings as evidence that migration timelines need acceleration.
Vendor and Supply Chain Risk
The GitHub breach’s attack vector deserves strategic attention beyond its immediate impact. The threat entered through the developer toolchain — a poisoned IDE extension — rather than through application code, network infrastructure, or a traditional vendor relationship. IDE plugins, build utilities, linting tools, and scaffolding frameworks are rarely subject to the same procurement security review as production software, yet they run with broad filesystem and credential access on developer machines that hold tokens, private keys, and direct access to production deployment pipelines. For organizations with mature software supply chain programs, the GitHub incident argues for extending Software Bills of Materials (SBOMs) and dependency risk practices explicitly to the developer tooling layer.
The DBIR’s finding that third-party breaches now represent 48% of the total incident dataset reinforces that vendor risk management has ceased to be a compliance activity and become a core security program. Organizations that conduct point-in-time vendor assessments and annual questionnaires are operating a controls framework calibrated to a threat environment from three years ago. Continuous monitoring of vendor security posture, integration of threat intelligence about vendor-related incidents, and explicit contractual requirements for vendor notification timelines are the minimum credible response to a supply chain risk landscape where nearly half of all breaches arrive through third parties.
Industry Surveys and Research
The 2026 Verizon Data Breach Investigations Report is the dominant research publication of this week and warrants direct distribution to security leadership. The key figures for executive presentations: vulnerability exploitation at 31% of initial access vectors, credential abuse at 13%, ransomware present in 48% of all breaches, third-party involvement in 48% of breaches and up 60% year-over-year, median remediation time at 43 days, only 26% of CISA Known Exploited Vulnerabilities catalog items fully remediated, and shadow AI adoption at 45% of employees. The report documents AI as already compressing attack timelines from months to hours.
The PwC Annual Threat Dynamics 2026 report, published in parallel, identifies identity attacks as surging on the back of AI-enhanced phishing and session hijacking capabilities, aligning with DBIR findings on AI’s role in expanding the scale and speed of credential harvesting operations. Taken together, these two reports establish a consistent picture of an enterprise threat environment where the combination of slower patching, faster exploitation, broader third-party exposure, and AI-augmented attacker capabilities has shifted the risk calculus in favor of defenders who invest in continuous, automated controls rather than periodic, manual ones.
Strategic Recommendations
The absence of a US federal AI governance framework following the executive order withdrawal is not a reason to defer enterprise AI security governance. The NCSC and Five Eyes guidance on agentic AI provides a practical pre-deployment checklist — covering ownership, access boundaries, monitoring authority, incident handling, and halt procedures — that organizations should adopt as the current baseline standard. Internal AI governance frameworks built on this foundation will be more adaptable to future regulation than programs designed around anticipated federal requirements that may not materialize.
The DBIR’s patching data represents a program failure signal that requires a direct response. A 43-day median remediation time against threat actors whose AI tooling compresses the exploitation window to hours means that patching programs are structurally behind. Security leaders should restructure prioritization around the CISA Known Exploited Vulnerabilities catalog as the minimum baseline, with automated detection and tracking tooling to drive that 26% remediation rate substantially higher.
The GitHub breach should prompt an immediate audit of developer tooling. Security teams should inventory which IDE extensions, build tools, and developer utilities run on engineering workstations, implement extension allowlisting policies, and treat developer tool dependencies as a supply chain risk category requiring the same scrutiny as production software dependencies.
The FBI’s Kali365 advisory and the broader identity attack surface data together make the case for accelerating migration to phishing-resistant authentication. Organizations should establish concrete deployment timelines for FIDO2 passkeys or hardware security keys — at minimum for privileged and remote-access use cases — and complement that with conditional access policies performing continuous session validation rather than evaluating risk only at initial login.
Third-party risk programs need to match the current threat environment where 48% of breaches run through vendors. Organizations should move from annual assessment cycles toward continuous monitoring, ensure contracts include security incident notification requirements with defined response windows, and explicitly cover developer and operational tooling in software supply chain security reviews.
Sources Referenced
RSS and Primary Sources - Axios: Trump AI executive order pulled - Axios: Draft AI executive order text published - Axios: AI executive order details and infighting - Axios: MAGA allies letter urging AI vetting - Axios: Anthropic blacklisting defended in court - Infosecurity Magazine: NCSC agentic AI guidance - Infosecurity Magazine: Verizon DBIR 2026 vulnerability exploitation findings - CSO Online: GitHub internal repositories breach confirmed - CSO Online: CISA contractor credential exposure via public GitHub - CSO Online: Identity as the primary attack surface - CSO Online: FBI warning on Kali365 OAuth stealers
Web Search Discoveries - Verizon: 2026 Data Breach Investigations Report - Help Net Security: DBIR 2026 detailed findings - CISA: Joint guidance on secure adoption of agentic AI - NCSC: Thinking carefully before adopting agentic AI - The Hacker News: GitHub TeamPCP breach analysis - Help Net Security: GitHub TeamPCP breach details - Federal News Network: White House studying AI security executive order - SecurityWeek: DBIR 2026 vulnerability exploitation overtakes credential theft - Industrial Cyber: DBIR critical infrastructure findings - Washington Post: Tech lobbying led Trump to cancel AI order - Nextgov/FCW: NSA role in voluntary AI model testing