Nov 9, 2026

Interview - Danielle Russell - The Attack Surface Changed: Who Reassesses Risk After the Approval?

The attack surface now changes faster than any team can reassess it, as employees add integrations, grants, and agents to apps long after they were approved. Danielle Russell, VP of Product at Nudge Security, explains what continuous reassessment looks like in practice: which changes deserve a response, which work agentic AI can take on, and where analysts still make the call. She also makes the case that security still owns the risk after approval, even when it never saw the change that created it.

Segment Resources:

1. Modernize your TPRM program with adaptive risk management for SaaS and AI
2. Nudge Security Unveils Adaptive Risk Management press release
3. The security work nobody wants to do is the risk nobody’s watching
4. OAuth grants pile up faster than you can review them BleepingComputer

This segment is sponsored by Nudge Security. Visit https://securityweekly.com/nudge to learn more about them!

Topic Segment - Coordinated Disclosure

An AI-found PHP flaw sat unfixed since 2024, a PoC video leaked, and a vendor broke the embargo early, citing active exploits.

Coordinated disclosure in 2026 is:

• 75% - Too slow for AI world
• 13% - Vendor Credit Race
• 13% - This is fine ????????️????
• 0% - Working as designed
• 0% - Other (tell me)

Mike's thoughts: Only a few folks think coordinated disclosure is working as designed, based on last week’s vibe check. Everyone else lands somewhere between "too slow" and the dog sitting in the burning room. I think the old disclosure window was built for a world where a human found the bug, a human wrote the fix, and disclosed it responsibly (most of the time). Now AI finds flaws faster than vendors can ship patches, so any kind of embargo stops being a grace period. It becomes a head start for whoever else found the same bug. I don't think shorter deadlines fix this. The fix side has to get as fast as the find side, which is actually the hardest part of the puzzle to solve in cyber.

Enterprise Security News

Finally, in the enterprise security news,

1. A little funding
2. making software liable for cyber breaches
3. we have a new biggest bank heist ever!
4. more freezers defrosted
5. a company builds malware into their product on purpose
6. AI pentesting frameworks are lowering the script kiddy bar
7. AI hosting company hacks their competitor
8. there’s a new SSH bug that could be very, very bad
9. even MSPaint gets a vulnerability

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-484