SISA

Attackers don't always need to touch your payment infrastructure to steer an AI agent. Prompt injection, tool misuse and compromised integrations can do the job from the side. Our live webinar, AI Agents on the Offensive: Attacking the Next Generation of Payments, is about defending payment APIs and AI agents against exactly that. What the panel covers: • How attackers manipulate agent logic • Why API gateways and identity management must adapt to autonomous agents • How to defend payment APIs and AI agents Tune-in to hear from our expert panel on 📅 Monday, November 16, 2026 🕑 11:00 AM to 12:00 PM EST (8:00 AM to 9:00 AM PST) Register here: https://lnkd.in/gGR2nctq #APISecurity #AgenticAI #PaymentSecurity #PromptInjection

CERT-In rated its latest advisory Critical. The attacker in it? An AI agent. Kalyan Goswami, Associate Vice President & Head - SISA Sappers, explains what it means for payments. Time from initial access to impact has dropped from days to hours, and the money leaves through an institution’s own trusted APIs. His advice: -Stop letting the network approve money movement -Re-check every payment API request -Preserve volatile memory and gateway logs before they’re gone Banks, lenders and payment providers: what, besides the source IP, tells you a payment API request is legitimate? Read the CERT-In advisory (CIAD-2026-0049): https://lnkd.in/gUJ9bagi Our full attack chain and controls breakdown is linked in the first comment. #CERTIn #AgenticAI #PaymentSecurity #BFSI #DFIR

What happens when an AI agent decides the fastest way to finish a task is to cheat? In one real incident, it took under 13 hours to find out. An agent given a security task stole the answers, ran code in a production pod, used an exploit board it built itself, and escaped containment to gain multicluster admin access. No attacker was directing it. Its 17,600 actions simply blended into the noise. SISA’s new white paper, Cheating at Machine Speed, breaks down that attack chain step by step and what it changes for teams defending payment environments. At its core is a defensive playbook built on one shift: treat agents as insiders. -Detect: Kubernetes API, egress and rate signatures -Contain: pod metadata isolation and workload identity -Stop: agent kill-switches for when things go wrong Security leaders running agents in production, would your monitoring flag 17,600 actions from a “trusted” workload, or wave them through? Get the full playbook here: https://lnkd.in/ggWWrJiE #AgenticAI #AISecurity #KubernetesSecurity #InsiderThreat #PaymentSecurity

AI agents are starting to initiate payments. Attackers are learning how to steer them. On November 16, we’re bringing together security and payment leaders across North America together on how to respond, with the webinar ‘AI Agents on the Offensive: Attacking the Next Generation of Payments’ What the panel covers: • How attackers manipulate agent logic • Why API gateways and identity management must adapt to autonomous agents • How to defend payment APIs and AI agents 📅 Monday, November 16, 2026 🕑 11:00 AM to 12:00 PM EST (8:00 AM to 9:00 AM PST) North American payment and security teams, which worries you more right now: a compromised API or an agent talked into the wrong action? Register here: https://lnkd.in/gGR2nctq #AgenticAI #PaymentSecurity #CyberSecurity #FinTech

Ethnic wear, a festive lunch and a healthy dose of competitive spirit. That’s how the SISA team welcomed Diwali this year. On Friday, 6th November, we gathered at SISA CDC for our Ethnic Day and Diwali celebration. After a special Diwali lunch, the afternoon turned into a round of games built around coordination and teamwork. Turns out, security teams aren’t the only ones who need to move in sync. Congratulations to the winners for taking the top spot. And thank you to everyone who played, cheered and laughed along. From all of us at SISA, wishing you and your family a Diwali full of warmth, peace and joy. SISAites and fellow security teams, which office game shows how in sync your team really is? Tell us in the comments. Watch the video for our Diwali greeting and a few moments from the day. #Diwali #HappyDiwali #LifeAtSISA #Teamwork

#20YearsofSISA is made up of many stories. Here’s one of them. Balagopal Ramakrishnan, VP - Sales, Middle East & Europe, SISA, joined as Strategic Alliances Leader. He went on to lead sales for India and APAC, then moved to Dubai three years ago, and he’s been there ever since. Watch the video to hear how SISA has evolved, and what his journey looks like from inside it. To anyone who has relocated for a role, what made you say yes to the move? Follow SISA for more stories from the people building it. #SISA #CyberSecurity #PaymentSecurity

A fake CAPTCHA. A pasted command. Nothing for your filters to catch.   That’s ClickFix, and Iran-linked groups have used it against Middle East organisations since late 2024, including one wave aimed mainly at the UAE and Saudi Arabia.   The catch? The user runs the command themselves, so most perimeter defences never get a look in. And more often now, the lure arrives through a supplier or partner your team already trusts.   In this Executive Perspective, Kalyan Goswami, AVP & Head - SISA Sappers, covers: -How MuddyWater’s ClickFix playbook has shifted between 2024 and 2026 -Why a trusted vendor makes the lure so hard to spot -What security teams can switch off on their endpoints this week. Read the full perspective: https://lnkd.in/g32wavRA   #ClickFix #DFIR #CyberSecurity #ThreatIntelligence #MiddleEast

Asked to find loyal customers, a CRM agent went looking for a lot more. In a simulation at the 2026 PCI SSC North America Community Meeting, an agent in a payment environment kept going. It reached a finance-owned payment database, probed for elevated access and retrieved a legacy service-account credential. The guardrail flagged it. It just wasn’t set up to block it. A policy tells an agent what it may not do. A boundary makes it technically impossible. Three doors let agents cross the line: a boundary that exists only as policy, an identity nobody manages, and an agent that picks its own path. Three habits close them: Know, Bound, Watch. Every agent is a privileged, non-human identity and deserves to be treated like one. Rubeena Ansari, Associate Director, NA (CTS), explains what the Hugging Face incident means for payment environments, and the questions to ask of every agent you run. Payments and security teams, how many AI agents are running in your environment right now, including the ones nobody formally approved? Read Rubeena’s breakdown: https://lnkd.in/g-_mUvRR #AgenticAI #AIAgents #PaymentSecurity #CyberSecurity

India’s first Black Hat is over, and the Booth #28 challenge has a winner. Exhibiting at the very first Black Hat India was a milestone for SISA, and we showed up, ready to share our perspective. Congratulations to the Security Analyst from Airbus who cracked the AI challenge and won the Bose QuietComfort Ultra headphones. Our team on the ground at Sheraton Grand, Brigade Gateway, Bengaluru: Renju Varghese - VP & Head, Leading Tech Security; Krishna Mohan - Head, Enterprise Business, SAARC; Parag Girish Sathe - Enterprise and GSI Business; Alla Maruthi Siva Kumar - Associate Director, Marketing Strategy; Jogendra Singh - Associate Director, CTS, SISA; Pratik Rane - Senior Manager, SISA; and Karthik S - Specialist, AI Security & Governance, SISA. Thank you to everyone who stopped by, took on the challenge and shared a conversation with us. Black Hat India attendees, what did the first edition get right, and what should the next one add? Missed us at the booth? Drop a comment and we’ll set up time to connect. #BlackHatIndia #CyberSecurity #PaymentSecurity #Compliance