Data Security Posture & DLP

Varonis Systems, Inc. launched Varonis Data Lifecycle Management, a new capability that automatically identifies and remediates redundant, obsolete, and trivial data across enterprise environments using its existing Data Security Platform. The launch ties data cleanup directly to sensitivity, access, and activity context, aiming to reduce storage waste, improve AI output quality, and help organizations address compliance exposures from scattered sensitive information. The DLM tool stacks on top of Varonis Atlas, the AI security platform that went generally available in March 2026, which targets discovery, posture management, and runtime protection for AI workloads. Together, Atlas and DLM broaden Varonis' role from guarding unstructured data to governing how that data is stored, used, cleaned up, and exposed across Snowflake, Claude, Cursor, and other cloud and AI partnerships. Varonis Systems' narrative projects $1.1 billion revenue and $120.7 million earnings by 2029, yielding a $50.68 fair value, an 8% upside to its current price, while the most pessimistic analysts were already modeling about US$1.0 billion of 2029 revenue.

Cohesity introduced Cohesity Agent Resilience, a new Cohesity Data Cloud capability that will discover, protect, and recover the infrastructure behind enterprise AI agents. The capability is available now to select customers, with general availability targeted for the end of 2026, and launches with support for Amazon Bedrock AgentCore and Amazon Bedrock Agents, while Microsoft and Google agent platforms are on the roadmap. Cohesity also outlined its vision for Autonomous Cyber Resilience, which uses agentic workflows to automate its five-step cyber resilience framework, and introduced the Cohesity AI Resilience Academy, beginning with a free, self-paced Foundations of AI Resilience with Cohesity course that Catalyst attendees will get early access to immediately after the event. The company cited new research from the fifth annual Cohesity Global Cyber Resilience Report showing that 56% of organizations said they were not well prepared to detect or contain unintended actions by AI agents and automated workflows, while 58% were not very confident in their ability to verify the integrity of AI models and related data following a cyberattack. Cohesity also said customers with Cohesity Data Cloud Enterprise Edition and Cohesity DSPM can now automate the protection of newly discovered sensitive data that is not already protected.

Palantir Technologies, Nvidia, and Booz Allen Hamilton are restricting or threatening to drop advanced AI models from Anthropic and OpenAI unless the labs provide stronger data protections, according to Reuters. Palantir has pressed Anthropic to guarantee zero data retention before making its models available through Palantir's software, while Nvidia limits Anthropic's models to less sensitive internal tasks and prefers its own Nemotron models for proprietary work, and Booz Allen has forbidden staff from running Anthropic's commercial model on cybersecurity projects touching proprietary data. The pushback intensified after Anthropic introduced a 30-day data retention policy in June tied to the rollout of its Fable 5 model, saying it needed usage logs to detect sophisticated attacks that unfold across multiple sessions, though the company said it would not use the retained data to train its models. Anthropic responded by announcing Enterprise Frontier Safeguards, which lets enterprise customers store activity data in their own cloud infrastructure, including Amazon S3, Azure Blob Storage, or Google Cloud Storage, under their own encryption keys, with automated safety monitoring but no human review by Anthropic employees; the system is rolling out in phases, with broader availability targeted for later this fall. Last week, Palantir and Nvidia unveiled a platform pairing Palantir's software with Nvidia's open Nemotron models to let organizations run AI on their own data without exposing it to outside model providers, and Nvidia shares dropped roughly 3% on Monday as AI-related stocks broadly retreated.

BeyondTrust announced the first wave of native capabilities built on its Pathfinder platform at Black Hat USA 2026, extending privilege management to every identity that can hold or exercise privileged access. The four new capabilities—PathfinderAI & MCP Server, AI Agent Security, NHI Governance, and Workload Credentials—combine visibility, intelligence, and protection to help organizations discover, prioritize, govern, and protect privileged access across human, machine, workload, and AI identities. PathfinderAI enables natural-language investigation of identity risk, while the MCP Server allows AI agents like Microsoft Copilot and OpenAI to securely connect to BeyondTrust’s identity intelligence. AI Agent Security enforces real-time controls on what AI coworkers and autonomous agents can do on endpoints, and NHI Governance extends privileged access management to service accounts, API keys, and other non-human identities that often outnumber employees. Workload Credentials replaces static secrets with short-lived, auto-expiring credentials for CI/CD pipelines, Kubernetes services, and AI agents, eliminating the risk of leaked secrets. PathfinderAI, the MCP Server, AI Agent Security, and NHI Governance are available now through the Early Access program, with Workload Credentials early access opening soon.

Varonis Systems reported second-quarter 2026 non-GAAP earnings of 4 cents per share, beating the Zacks Consensus Estimate of 1 cent. Revenues reached $180 million, up from $152.2 million a year earlier and surpassing the consensus by 1.7%. The performance was driven by continued SaaS momentum, with SaaS revenues jumping to $171.7 million from $105.9 million, while legacy term license and maintenance revenues declined as customers migrated. The company returned to non-GAAP operating profit of $3.7 million, compared with a loss of $1.9 million in the prior-year quarter, and raised its full-year revenue outlook to between $735 million and $739 million, implying 18-19% year-over-year growth.

Health100, a CVS Health subsidiary, has earned the CARIN Code of Conduct for Consumer-Facing Applications Accreditation from DirectTrust for its mobile app. The accreditation followed a comprehensive independent third-party review that examined the app's transparency, consent, security, and other criteria to ensure trusted access and exchange of personal health information. DirectTrust President and CEO Scott Stuewe said the achievement gives health care stakeholders full confidence in exchanging private health information via an application that voluntarily sought verification. Tony Ambrozie, Senior Vice President and Chief Digital & Technology Officer at CVS Health and Health100, called the accreditation a milestone reinforcing the company's commitment to data privacy, security, and transparency.

Mr. Asadej Kongsiri, Director and Manager of the Stock Exchange of Thailand, issued a formal apology regarding the leak of shareholder data from Thailand Securities Depository Company Limited, or TSD, affecting approximately 200,000 individuals out of a total shareholder base of around 5 million. He confirmed that stock portfolios, back-end systems, and the wiset application remain secure. The leaked data includes full names, dates of birth, national ID numbers, addresses, phone numbers, emails, securities company names, securities trading account numbers, bank names, and bank account numbers, but does not include securities holdings, share quantities, portfolio values, or passwords. The Stock Exchange of Thailand has already closed all vulnerabilities and is deploying artificial intelligence technology to scan source code across the entire organization to enhance security. Investors are warned never to click on suspicious links. Meanwhile, cyber police are working with ThaiCERT to pursue the perpetrators across borders.

Synology has revealed that the ISO 27001 standard is shifting from being merely a compliance certificate to a crucial foundation for enterprise risk management, building cyber resilience in an era of intensifying cyber threats. Mr. Rahat Boontanjin, Country Manager for Thailand, stated that 72 percent of organizations worldwide see cyber risk as significantly increasing, and 71 percent of risk executives expect threats to severely impact business operations. He pointed out that the rise of agentic AI is creating new forms of risk, so organizations should use ISO 27001 as a control framework across four key areas: role-based data access permissions, data accuracy governance, rollback systems for AI errors, and continuous security measure improvements. Although a 2025 OpenText survey indicates that 52 percent of global organizations plan to increase investment in backup technology, many still face real-world system recovery failures. Synology has therefore launched the ActiveProtect Appliance, a solution designed to support cyber resilience approaches and the new era of ISO 27001, integrating immutable backup, logical air-gap, and automated backup verification technologies to close recovery gaps and help Thai organizations tackle cyber threats in the AI age.

New research from Jscrambler reveals that banking websites are transmitting sensitive customer information, including hashed identifiers, loan details, and financial intent signals, to third-party advertising, analytics, and personalization platforms without valid consent. The analysis of 14 financial institutions across Europe and the US found that tracking technologies fired without valid user consent on 9 sites, sending data to at least a dozen third parties including Google, Meta, TikTok, LinkedIn, Pinterest, Adobe, and Salesforce. Examples include a Spanish bank's mortgage process sending a customer's hashed email and phone number to TikTok's pixel endpoint, a Portuguese bank's account-opening flow sending email, name, age, and national tax number to Salesforce, and two other Portuguese institutions sharing full loan simulation details including a €27,000 loan with repayment terms to Google Analytics. The research also documented consent failures such as tags firing before cookie banner action, tags continuing after users rejected all, and consent choices not carrying into iframes or subdomains. Jscrambler recommends continuous runtime monitoring, enforcement controls to block unauthorized data exfiltration, and consent enforcement that extends across iframes and subdomains.

DATAMYTE has achieved ISO/IEC 27001:2022 certification for the information security management system supporting Digital Clipboard, its cloud-based, no-code manufacturing workflow platform. The certification, awarded by an independent body, validates that the ISMS meets the international standard, reinforcing the company's commitment to protecting operational, production, quality, and compliance data for over 1000 manufacturers including Ford, Boston Scientific, Northrop Grumman, CS Wind, Stellantis, Boeing, Tesla, Gillette, Borg Warner, Cabinetworks Group, Foxconn, Pepsico, and GM. CEO Joel Ronning stated that the certification provides independent confirmation of rigorous data protection standards, scaling with the platform and clients' evolving needs. Digital Clipboard enables organizations to digitize production workflows, inspections, audits, electronic work instructions, and other shop floor processes within a secure cloud environment, addressing the growing importance of cloud data security as manufacturers move away from paper-based quality processes.

Boundeal announced a controlled-disclosure data room configured for financial-sector mergers and acquisitions, responding to a rebound in dealmaking that saw global buyout-backed exit value rise 47 percent to $717 billion in 2025 and global M&A volume surge about 40 percent to roughly $4 trillion. The environment uses permission groups to separate strategic buyers, financial sponsors, lenders, legal advisers, and clean teams, with staged disclosure that expands access as a bidder advances and granular least-privilege controls at the folder and document level. Time-stamped audit trails, mandatory confidentiality agreements, and purpose-based access aim to prevent uncontrolled disclosure of fund economics, asset-level valuations, regulatory correspondence, and other sensitive data that can expose sellers to competitive harm, legal privilege loss, or supervisory risk. Boundeal is a virtual data room provider for M&A, due diligence, IPOs, fundraising, private credit, and restructurings, serving advisers, financial sponsors, corporate teams, and regulated institutions.

Varonis Systems has been recognized as a Gartner Peer Insights Customers’ Choice for Data Security Posture Management for the third consecutive year, making it the only company to earn this distinction three years in a row in the DSPM category. The recognition is based on customer reviews, with 97% of users saying they would recommend Varonis, and the company receiving a 4.7 out of 5 rating for Product Capabilities, Sales Expertise, and Deployment Experience, as well as a 4.9 out of 5 rating for Support Experience. Customers highlighted Varonis’ breadth of coverage, ease of value realization, and quality of support. Chief Marketing Officer Rob Sobers stated that data security is critical as organizations adopt AI, and Varonis helps customers secure and govern the data that fuels AI initiatives.

Commvault Systems has signed a multiyear strategic agreement with Microsoft that will offer Commvault's AI and cyber-resilience technologies as a native independent software vendor service directly on Microsoft Azure. The deal enables Azure customers to integrate Commvault's data recovery, application restoration, and identity-resilience capabilities without complex third-party integrations, effectively making the platform plug-and-play for Microsoft's vast enterprise customer base. Commvault recently reported fourth-quarter revenue of $312 million, beating analyst estimates of $306.5 million, with adjusted EPS of $1.28 versus the $1.09 estimate. Total annual recurring revenue grew 21% year-over-year to $1.12 billion, while SaaS revenue increased 43% to $93 million. The stock has rebounded 71% in the past three months amid the Microsoft partnership and takeover interest from private equity firm Thoma Bravo, which is exploring options with Goldman Sachs.

Varonis Systems shares rose 7.09 percent on Tuesday to close at $35.03 after Bloomberg reported the company is exploring a potential sale. The data security firm is reviewing options with financial advisers following takeover interest from financial buyers including Blackstone, Thoma Bravo, and Vista Equity Partners. The report cited rapidly growing demand for data solutions and cybersecurity products. Separately, Varonis last month integrated its security platform with Anthropic's Claude AI to help organizations monitor AI usage and detect misuse.

Texas Attorney General Ken Paxton is opening an investigation into Carnival Corporation over an April data breach that compromised the personal data of more than 6 million people. The Civil Investigative Demand will determine if Carnival adequately safeguarded the personal information of the 800,000 Texans impacted by the breach and whether the company maintained reasonable procedures to protect this sensitive information as required by Texas law. In mid-April, Carnival’s information technology security team identified a breach in which an employee account was compromised, exposing names, contact information, dates of birth, payment information, passport and driver’s license information, and health information. Carnival officially reported the event on May 27 and began sending notifications to impacted passengers offering two free years of credit monitoring.