MITRE is giving businesses a forum to securely reveal the AI security skeletons in their closet in exchange for the greater good.

Earlier this month, MITRE announced the launch of its AI incident-sharing initiative, which seeks to boost collective awareness of threats and defenses related to AI-enabled systems. As part of the initiative, the not-for-profit organization has rolled out a public-facing platform where organizations can submit information on AI-enabled system incidents within their organization in exchange for membership in MITRE’s community of data receivers, where they can access protected and anonymized data on real-world AI incidents.

The new initiative is a part of MITRE’s Center for Threat-Informed Defense secure AI project, which looks to improve the community knowledge base of threats against AI-enabled systems. Collaborators on the project include CrowdStrike, Microsoft, and Cato Networks.

Quenching a need. Christina Liaghati, MITRE’s department manager for trustworthy and secure AI, told IT Brew that the initiative comes after the organization observed a growing need for real-world data on how AI-enabled systems are being “attacked in the wild.”

“The goal is to get more of that at-scale data outside of an organization’s single view in the hands of the community so they can really see and prioritize which AI assurance risks they’re mitigating as they’re deploying more and more AI-enabled systems,” she said.

Read the rest here.—BM

Time to consolidate.

That’s the message from IT professionals who are increasingly skeptical about using multiple third-party vendors for threat detection and other security needs. IT Brew has been hearing those concerns all year, primarily because using vendors leads to threat surface expansion and can result in worrying breaches.

Comcast customers got a wake-up call to the danger earlier this year when their information was leaked via a debt-collection agency used by the cable television company. The breach, which was revealed in an Oct. 3 filing with the state of Maine, affected 237,703 Comcast customers. Users may have had their “name, address, Social Security number, date of birth,” and other information revealed, Comcast said in a letter sent to affected customers.

Stat-tastic. A new study from cybersecurity firm Vectra AI found that a majority of respondents in security operations center (SOC) teams are losing confidence in vendors when it comes to tools and deploying AI. Security vendors overuse notifications and alarms, 62% of respondents said, and these “pointless” alerts are seen as being used to “avoid responsibility for a breach.” That was an increase from 2023’s survey, in which 42% of respondents said the same.

Read more here.—EH

That new help desk software, password manager, or employee recognition system sure seems convenient, but it doesn’t take much for that SaaS tool-du-jour to turn into “shelfware,” a term noting a platform that sits—ware, you ask?—on the shelf, unused.

Pros and analysts who spoke with IT Brew said IT can help keep SaaS off the shelf and on their fellow colleagues’ minds in four major ways.

Integration conversation. Brian Westfall, associate principal analyst at Gartner-owned Capterra, recommended IT pros answer integration questions before the company selects a tool. Can data from a new employee engagement tool, for example, be fed to a talent-management service like Workday?

“If [IT is] coming in after the purchase, just for implementation purposes, that’s too late,” Westfall said.

License to SaaS. As manager of a finops program and software assets, Lindbergh Matillano, director of cost optimization at tax compliance company Avalara, must forecast the correct number of licenses for a tool—a task made easier when an IT pro understands business drivers for the service’s use, he said. Most employees can do a headcount; the “tricky part,” Matillano noted, is determining who will actually use the software.

Keep reading here.—BH

Join IT Brew’s cybersecurity event on Oct. 31 in NYC or via livestream. Explore the future of cybersecurity with expert insights on quantum computing, AI, and cloud security. Don’t miss your chance to stay ahead—register now!