In this month's Threat Briefing, Nathanael Iversen looks at three incidents with a common thread: none required a novel exploit - each turned a single point of access into an organization-wide event because nothing was in place to contain it.
Advantest: When One Foothold Reaches the Whole Supply Chain
In February 2026, Advantest - the Tokyo-based maker of the test equipment that validates chips for Intel, Samsung, and TSMC - disclosed that an unauthorized third party had breached its network and deployed ransomware, with the company acknowledging attackers may have accessed portions of its systems.
The exposure here isn't the intrusion itself - it's what a flat network turns that intrusion into. One foothold on a business laptop can become a straight line to design files and production-adjacent systems feeding the global chip supply chain. Isolating critical assets in their own virtual chambers changes that math: every workload sits behind its own zero trust boundary, so the same intrusion gets boxed in immediately - lateral movement, command-and-control callbacks, and ransomware propagation all stop at the chamber wall. [See how Virtual Chambers contain a breach →]
A $5 Domain and an AI Agent That Followed the Wrong Instructions
Security researchers demonstrated a striking gap in Salesforce's Agentforce: its public lead-submission form accepted a generous 42,000-character description field - room enough to bury a hidden instruction. Paired with an expired domain researchers picked up for five dollars (which was still sitting on Agentforce's trusted allow-list), the setup showed how an AI agent asked to simply summarize a lead could instead read a buried instruction as a legitimate command and attempt to route customer data to an outside destination - no click required, no human in the loop. Salesforce has since patched the underlying trust-list gap, but the pattern it exposed hasn't gone anywhere: agents will act on the last instruction they see, regardless of where it came from.
That's the exact gap declared intent enforcement is built to close. Every agent session should start with a declared scope of what it's actually there to do. When a hidden instruction pushes the agent toward an unauthorized destination, an inline control like Zentera's AI Session Controller catches the mismatch and blocks the connection before anything leaves the building.
A Vendor's Broad Access, 1.8 Million Patients Exposed
Between late 2025 and February 2026, attackers compromised a third-party vendor with standing access into a major hospital system's network and sat there undetected for roughly three months, quietly copying files. When the breach surfaced, the scope was staggering: 1.8 million people's Social Security numbers, financial data, medical records, and biometric fingerprint and palm print data - information that, unlike a password, can never be reissued once exposed.
The root problem is one we see constantly: vendors get broad network trust instead of narrow, purpose-built access. Pairing virtual chambers with tight ZTNA and user access controls gives outside partners a scoped path to only the resources they actually need - so a compromised vendor account can't turn into a three-month, 1.8-million-record disaster, because the access path to get there simply isn't there to exploit. [See how ZTNA scopes third-party access →]
The Pattern
Different industries, different attack paths, same underlying failure: too much reachable from too few points of compromise. A flat network, an AI agent that trusts the last thing it's told, a vendor with standing access instead of scoped access - each is a version of the same problem, and each has the same fix. Segment the network. Enforce declared intent for agentic AI. Cap what any single identity - human, vendor, or AI - can reach.
Key Takeaways
If you need a better answer to internal segmentation, without ripping out subnets, VLANs, or zones, reach out and we will connect you with one of our solutions engineers. We can also walk you through how we lock down agentic activity in three distinct places.