July 2026 Summaries

Managed service providers (MSPs) and managed security service providers (MSSPs) face significant challenges in balancing the need for automation with the risks of tool sprawl and loss of control over client environments. This balance is crucial as data breaches with third-party involvement have increased dramatically, emphasizing the importance of maintaining control over security and operational processes. Xantrion, an MSP led by CTO Christian Kelly, has tackled these challenges by adopting a platform-based approach using Tines, which allows them to build intelligent workflows that are tailored to their specific needs without relying on multiple third-party tools. This strategy has enabled Xantrion to improve efficiency, reduce manual workloads, and enhance service delivery, while also differentiating themselves in the market. By focusing on internal development and leveraging platforms like Tines, Xantrion maintains greater control, reduces vendor dependencies, and becomes a trusted partner to their clients, ultimately enabling more meaningful and profitable work.

Clayton Christensen's concept of The Innovator's Dilemma illustrates how successful companies can fail by sticking to their winning strategies, leaving them vulnerable to disruptive newcomers. His follow-up, The Innovator's Solution, suggests companies should emulate these disruptors by forming independent teams that operate like startups. In 2025, Tines embraced this approach with Project 3B, aiming to create an AI-native tool for building apps and automations, despite the company's strong market position. The project, started by key product leaders Stephen and Eoghan, sought to address the growing issue of "wild code," where more people using AI increased security risks. By leveraging AI advancements, Tines aimed to create a scalable, secure product that maintained the trust of users and companies. Project 3B, developed with an emphasis on security and governance, demonstrated its potential at a company event, leading to positive customer interest and the expansion of the development team. Tines 3B emerged as the next generation of Tines, offering a secure AI environment for enterprise workflows, while Tines Stories continued to support existing customers.

In 2025, Tines achieved unprecedented success by tripling its enterprise customer base and significantly increasing its workforce and automated actions. Instead of resting on these laurels, Tines introduced Tines 3B, an AI-native environment designed to empower teams to build with AI while maintaining rigorous governance and security controls, addressing concerns over "wild code" that can arise from unregulated AI usage. Tines 3B offers a secure, code-first platform that provides IT and security teams with the tools they need to oversee AI-driven innovation across organizations, thus preventing security risks and managing AI expenses effectively. The introduction of Tines 3B reflects ongoing customer feedback and a commitment to innovation, allowing users of the existing Tines Stories platform to explore this new environment at no extra cost, with the potential for seamless integration of both systems.

In the spring of 2026, a software developer's security audit of a Node.js backend, largely generated with AI assistance, revealed no glaring security issues but highlighted significant challenges in understanding and maintaining the code. Despite the code's functionality, the lack of comprehension and rationale behind architectural decisions pointed to a growing problem of "wild code," where AI-generated scripts proliferate without adequate governance. This issue is exacerbated as organizations push for rapid AI adoption, leading to untracked AI usage, technical debt, and increased security risks. The phenomenon, driven by the speed of AI development and inadequate oversight, reflects a broader governance challenge, not merely a technology or personnel problem. Emphasizing the need for organization-wide governance, the text advocates for proactive measures to ensure AI-generated code is reliable and secure, urging business and IT leaders to collaboratively establish frameworks that balance innovation with control. This approach is not about restricting AI usage but about providing a secure environment for all teams to innovate responsibly, thus ensuring the quality and sustainability of AI-assisted outputs.

As AI tools empower employees without traditional coding experience to develop software, organizations face challenges in managing the resulting "wild code," which is software created beyond their ability to track and control. Despite measures like employee education, sandboxing, and governance committees, these strategies often fall short because they do not effectively address the root issue: the ease with which individuals can create and deploy software autonomously. Brad Rumph, Field CTO at Tines, emphasizes that governance should focus on continuous visibility and inventory of AI-generated code, rather than trying to predict and control behaviors after they occur. Tines 3B offers a solution by providing a single environment for building, running, and monitoring AI-assisted applications, ensuring governance is integrated from the start, and making the safest path also the most straightforward one for employees to follow.

Security Orchestration, Automation, and Response (SOAR) has evolved from its initial promise of automating the Security Operations Center (SOC) to requiring substantial management of playbooks, as security teams face tool proliferation and high alert volumes. The shift towards AI-driven SOC automation aims to bridge the gap by integrating deterministic workflows, agentic AI, and human oversight to intelligently manage alerts. Unlike legacy SOAR, which relies on predefined playbooks and fixed rules, AI SOC automation employs agentic reasoning to address novel threats, thus covering the full spectrum of alerts. This approach delineates tasks based on their predictability and impact, assigning deterministic workflows to predictable tasks, agentic AI to ambiguous ones, and human oversight to high-stake decisions. The transition to an AI-driven SOC involves a phased approach that begins with tuning alert quality and progresses to automating repetitive tasks, introducing AI-assisted triage, and eventually executing full agentic decision loops. Effective AI SOC platforms emphasize security, governance, integration depth, and builder accessibility, ensuring that AI-driven workflows are both efficient and accountable. The ultimate goal is to consolidate intelligent workflows on a single governed platform, allowing security teams to manage their responsibilities more effectively and reduce manual work, with AI handling bulk triage while humans focus on complex incidents.

Vulnerability remediation in organizations often suffers from coordination failures rather than technical ones, with delays occurring in the handoff between the team that identifies a vulnerability and the team responsible for fixing it. These delays create a gap where attackers can exploit vulnerabilities faster than they are addressed, despite frequent scans and extensive coverage. The vulnerability remediation workflow spans discovery, risk assessment, assignment, remediation, verification, and continuous monitoring, involving multiple teams and systems. Common failure modes during handoffs include fragmented ownership, competition with IT backlogs, SLA windows treated as targets, and lack of actionable context, leading to stalled remediation efforts. Effective workflows require automated ticket creation with accurate routing, contextual data beyond CVSS scores, SLA enforcement with automated escalation, and verification processes that confirm remediation success. Organizations that address these issues through structured workflows and cross-tool orchestration can significantly improve their vulnerability remediation efficiency, treating it as a collaborative process rather than a series of isolated tasks.

In 2025, malicious emails bypassed secure gateways every 19 seconds, leading to widespread credential theft and identity compromises, as static playbooks used by security teams often fail silently due to outdated APIs and detection drifts. The article outlines a modern phishing response workflow that aligns with NIST and SANS incident response models, automating the steps from email threat detection to containment and recovery. It emphasizes the importance of a dynamic, adaptable system that combines deterministic automation, AI reasoning, and human judgment, supported by a robust integration architecture to withstand vendor changes and emerging threats. The workflow involves multi-tool enrichment for user-reported phishing and automated containment actions when credentials are compromised, highlighting patterns used by security teams to efficiently manage threats at scale. By adopting a governance model with role-based access and versioned playbooks, teams can close the gap between what is reported and actual threat activity, enhancing incident response efficiency and reducing manual workloads.

IT teams face increasing pressure to manage a growing number of systems and users without additional staff, often turning to scripts and quick-fix tools that lead to script sprawl, maintenance burdens, and integration brittleness. This situation results in operational silos and a lack of visibility across workflows, causing automation efforts to stall at scale. A unified workflow platform, incorporating deterministic automation, agentic AI, and human-in-the-loop processes, offers a solution by providing a single governed surface for managing integration, automation, and governance, reducing tool sprawl, and freeing up teams to focus on strategic, judgment-intensive work. Such platforms ensure security-grade governance, role-based access control, and immutable audit trails from the outset, enabling IT and security teams to build and audit workflows efficiently. By consolidating automation efforts onto a single platform, organizations can enhance operational efficiency, mitigate key-person risk, and scale their IT processes without expanding headcount or hours worked, ultimately allowing teams to reclaim time for higher-impact tasks.

The text discusses the challenges and solutions related to incident management in organizations, particularly the coordination between security and IT teams during incidents such as ransomware attacks. It highlights the structural conflict where security and IT teams work from different perspectives, leading to inefficiencies and extended breach timelines. The traditional approach of equipping each team with better tools does not address the lack of coordination. The text emphasizes the importance of a shared lifecycle approach that integrates both teams' processes across all phases of incident management, from preparation to post-incident review. This includes aligning severity taxonomies, establishing shared containment actions, and using a common operating layer that supports deterministic automation, AI-assisted triage, and governed human sign-off. It introduces the Tines platform as an example of a solution that facilitates integrated incident management by connecting security and IT systems, enabling shared workflows, and maintaining governance. The text also notes changes in incident management frameworks, such as NIST SP 800-61 Revision 3, which expands responsibility beyond traditional security roles and emphasizes the need for platforms that support both security governance and IT service management.

Employee onboarding processes often fail at the intersections between HR, IT, and security systems due to the lack of automated handoffs, leading to inefficiencies and security risks such as overprivileged and orphaned accounts. A cross-team blueprint using a workflow platform can bridge these gaps by treating the HRIS as the authoritative trigger, the identity provider as the central system for account creation, and a workflow platform to coordinate the entire process. Automated onboarding involves a structured, software-driven provisioning workflow that creates, modifies, and revokes accounts and their privileges without manual intervention, integrating identity creation, license assignment, and security controls. The process is divided into four phases: HRIS trigger and identity creation, SaaS provisioning and access branching, security enrollment and hardware provisioning, and day-one verification and audit trail capture, all while ensuring compliance with governance frameworks like SOC 2 and ISO 27001. Organizations like Notion, Intercom, and Fortune Brands Innovations exemplify successful cross-team onboarding automation, showcasing significant time savings and enhanced cross-team visibility by consolidating workflows into a single orchestration layer, which eliminates errors and inefficiencies associated with fragmented systems.

AI agents in Tines Stories should be used selectively for tasks requiring reasoning, judgment, language generation, or analysis, while predictable work such as structured parsing, routing, formatting, and fixed decision logic should remain deterministic to reduce cost, errors, and verification needs. Reliable agents depend on clear separation between persistent system instructions and per-run prompts, specific and well-structured directions, relevant examples where needed, and real upstream data that limits guessing and hallucination. Configuration should match the task, using smaller models and low temperature settings for simple, consistent work, larger models for complex reasoning, and structured output schemas to support dependable downstream automation. Agents can be extended through custom tools, reusable stories, templates, MCP servers, and domain-specific skills, but tool descriptions and permissions should be carefully scoped. Security practices include least-privilege tool access, redacting sensitive data before it reaches prompts, limiting prompt-injection impact through narrow agent roles and validation or human approval, and auditing agent inputs, outputs, and tool calls. AI should be avoided for deterministic lookups, finite if/else workflows, and situations requiring perfectly identical outputs, with builders encouraged to begin with a narrowly defined use case and refine it over time.

Robust AI agents in Tines Stories are presented as systems that require efficient token use, narrow task scope, appropriate human oversight, resilient error handling, and continual performance verification. Recommended practices include trimming inputs and tool outputs, enforcing structured response schemas, selecting only necessary tools and skills, and dividing complex workflows among specialized agents to reduce cost, improve accuracy, and simplify debugging. Human-in-the-loop designs can allow agents to triage, draft responses, classify documents, and support self-service while escalating uncertain, sensitive, or high-risk decisions for review. Reliability measures include configuring retries and timeouts, monitoring token and credit thresholds, using metadata for custom safeguards, and explicitly routing failures. Because agent outputs are non-deterministic, the post recommends challenger agents, decision logging in Tines Records, randomized and targeted human-review sampling, honeypot tests, and feedback loops that analyze overrides and edge cases to refine prompts and skills over time.

Data sovereignty, a critical concern for organizations operating within the EU due to regulatory frameworks like GDPR, NIS2, and DORA, demands careful consideration of deployment models to avoid legal and reputational risks. Tines addresses these needs by offering versatile deployment options, including multi-tenant SaaS, dedicated-tenant SaaS, self-hosted, and a hybrid model, ensuring compliance without compromising operational flexibility. The multi-tenant SaaS model hosts EU customers within the AWS EU region, with Tines acting as a data processor under a Data Processing Agreement. The dedicated-tenant SaaS model provides isolated environments for organizations with stricter internal policies, offering region-specific hosting options like Dublin, Stockholm, and Zurich. For organizations requiring complete autonomy, the self-hosted model provides full control over data and infrastructure at the cost of increased operational responsibility. Alternatively, the hybrid model enables SaaS deployment while maintaining access to private network systems through Tines Tunnels, providing secure, outbound-only connections. These deployment strategies cater to a wide range of organizational needs, ensuring that data sovereignty and compliance requirements are met without sacrificing workflow efficiency.

On May 22, 2026, the Office of Management and Budget introduced a new risk-based, outcome-driven logging framework, M-26-14, replacing the previous M-21-31, to improve federal cybersecurity by focusing on actionable intelligence rather than exhaustive data collection. This framework prioritizes Continuous Event Monitoring (CEM) and Threat Hunting, Investigation, Response, and Forensics (THIRF), requiring logs to be searchable for six months and retrievable for 12 months while addressing issues like storage costs and alert fatigue. To aid in compliance with M-26-14, the Tines platform offers intelligent workflows that integrate AI and automation, allowing federal agencies to orchestrate existing tools without the need for specialized developers. The platform enables streamlined compliance with features like cURL to Tines, automated triage, parallel API calls for log enrichment, and audit-ready documentation, ensuring agencies can meet CISA's upcoming Logging Reference Architecture requirements efficiently.

Cloudflare's implementation of Mythos has revealed a critical flaw in traditional vulnerability triage models by demonstrating how low-severity vulnerabilities can be chained together into significant exploits, challenging the reliance on severity scores alone. With the mean time to exploit now at negative seven days, security teams must prioritize the speed at which they can determine their exposure to vulnerabilities over merely patching them. The old model of prioritizing vulnerabilities based on severity scores is outdated, as it fails to account for interconnected threats and real exposure risks. Instead, security teams need a comprehensive assessment approach that evaluates whether they are using the affected software, the environment's exposure level, the exploit's requirements, and existing compensating controls. The Tines App addresses this need by aggregating and normalizing data across various systems, providing a dynamic, customized dashboard to assess exposure efficiently. This shift from focusing on patching speed to time to answer ensures that security responses are informed by the actual threat landscape rather than incomplete severity assessments, allowing teams to stay ahead of rapidly weaponized vulnerabilities.