+Intertrace Insights
Running the program
Owners, boards, auditors, budgets and the incident you plan for before it happens.
- Pieces
- 57
- Threat research
- 16
- Updated
- Oct 20, 2026
10 pieces · newest first
Threat research20 min read
AI incident review: September–October 2026
A comprehensive public-source review of AI and agent security incidents disclosed September 17–October 17: evidence, activity dates, impact, remediation, and control lessons.
Intertrace Threat Research
Guide11 min read
An incident response playbook for an agent that crossed its authority
When an agent does something it should not, nothing was hacked in the usual sense and the standard playbook finds nothing. One fictional incident, followed from discovery to restore through five steps mapped to NIST SP 800-61 Rev. 3.
Intertrace
Guide11 min read
The first 90 days of an agent security program: authority first, policy later
A 30/60/90-day plan for the security lead just made accountable for agents already in production: find every agent that can act, put controls outside the model on the two or three that matter, and prove each phase on a real agent.
Intertrace
Guide9 min read
What an AI security incident costs, and how to model one for an agent
IBM's 2026 benchmark puts the average breach at USD 4.99 million, but an agent incident costs what the agent did. One fictional refund agent, one attack, two cost outcomes, and a model you can fill in with your own numbers.
Intertrace
Guide8 min read
What a board should ask about AI agents, and what good answers sound like
Seven questions a board can put to management about the AI agents the company runs, the strong and weak answers to listen for, and a one-page quarterly report management can fill in from real data.
Intertrace
Guide10 min read
Buying AI security: ten checks that separate real controls from theater
A buyer's checklist for AI security products: ten checks, why each matters and how to test it on your own agents, the claims to treat with suspicion, and a four-week proof of concept with a scorecard you set in advance.
Intertrace
Guide9 min read
What auditors ask about AI agents, and the evidence that answers them
Auditors and customer questionnaires now ask about AI agents. The six questions that come up, answered the way a reviewer tests them, how they map to SOC 2, ISO/IEC 42001 and the NIST AI RMF, and how to produce the evidence continuously.
Intertrace
News9 min read
August 2, 2026: what the EU AI Act now asks of agent deployers, and what NIST has started
The EU AI Act's general application date arrived days after the Digital Omnibus moved high-risk obligations to December 2027 and August 2028. Six decisions an agent deployer has to make now, in order, and where NIST's agent work stands.
Intertrace Threat Research
Guide9 min read
Why AI pilots stall at security review, and the kit that gets them through
AI pilots that impress in a demo often wait months in security review because nobody can say what the agent can touch or how it is stopped. The decisions to make before the review, in order, a six-part kit, and a ten-day path to approval.
Intertrace
Guide11 min read
Nobody owns the agents: fixing AI accountability before the first incident
Agents are built by one team, run on another team's credentials and act in a third team's systems, so when one misbehaves nobody answers for it. A teardown of one such afternoon, then four fixes ending in one rule: no owner, no credentials.
Intertrace
+Stay current
New research, the week it publishes.
Subscribe with RSS, or email support@intertrace.ai with a topic you want covered. To see the controls in action, try the Simulation Lab or read the documentation.