Cisco is extending Splunk AI to self-managed, private-cloud, and air-gapped environments while giving IT teams real-time visibility into agent behavior and token spending. The updates also add runtime guardrails, network-aware troubleshooting, and broader deployment options for Splunk Agent Observability.

Source

Perplexity is allowing OpenAI’s GPT-6 Astra to write communications, modify production software, monitor live systems, and create tests with substantially fewer human check-ins than earlier models. The shift moves Astra beyond code assistance toward supervised, end-to-end operation of the company’s search and answer platform.

Source

As organizations deploy more AI agents, you need visibility into what those agents do across your environment. Microsoft distributes agent activity monitoring across eight products: Agent 365, the Microsoft 365 admin center, Microsoft Purview, Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Entra ID, Microsoft Security Exposure Management, and Microsoft Intune. These tools share telemetry from Agent 365 observability and surface it in admin, compliance, identity, endpoint, and security dashboards. This article explains what each product does, which agent monitoring features it provides, and what licensing you need to use them.

Source

Microsoft Sentinel, Microsoft's cloud-based SIEM (Security Information and Event Management) platform, received several updates in August 2026. The most practical change for many administrators is multi-account support for Auth0, CrowdStrike Falcon, and Salesforce Service Cloud data connectors, now generally available. Microsoft also expanded User and Entity Behavior Analytics (UEBA) anomaly detection and completed the convergence of Microsoft Defender Threat Intelligence (MDTI) into a free connector.

Source

A corporate password found in an infostealer log should be treated as a possible live identity compromise, not just an old credential leak. Security teams need to determine within minutes whether the data includes active browser sessions, identity-provider access, VPN or RDP credentials, and then revoke sessions and reset passwords before attackers can use them.

Source