Google has added six features to Advanced Protection in Android 17. One of them targets a familiar problem in spyware investigations: the evidence often disappears from the phone once the attacker cleans up.
The question matters most to people such as journalists, who may suspect their device has been compromised and then find nothing left to examine. The new release addresses this by keeping a copy of security records away from the handset itself. People already using Advanced Protection will get a notification when the new capabilities reach their devices.
Logs that survive a cleanup
The headline feature is Intrusion Logging. It records security and network events on the device, including app activity. If a user suspects a compromise, they can download the logs, decrypt them and hand them to trusted security experts for analysis.
Organizations are writing policies for AI tools, but many cannot enforce them when an agent actually acts. That is the main finding of Delinea's 2026 Identity Security Report: The AI Enforcement Gap. The report describes AI agents that keep their permissions long after their work is finished.
The report surveyed IT and security leaders as well as employees. Identity security teams said they are worried about two things: the ongoing access AI agents have to company systems, and the actions these agents take on behalf of users.
"Written policy is only as good as your ability to enforce it at the moment an AI agent acts," said Art Gilliland, CEO of Delinea. "Our research echoes what I hear from leaders constantly: they have the AI policies in place, but they can't see or report on what their agents actually do."
Legit Security has expanded its Agentic Remediation feature so it now handles vulnerabilities in open-source dependencies, not only in code that a company writes itself. The goal is to take development teams from a vulnerability finding to a verified fix without anyone having to triage the issue by hand.
Until now, the agent worked on static analysis findings in first-party code, meaning code written by a company's own engineers. The new release points the same agent at packages pulled in from outside, which the company describes as the other major source of vulnerabilities in modern software.
Sophos has released Sophos CISO Advantage, a service that uses agentic AI to link day-to-day security operations with longer-term security strategy. The goal is to tell businesses where their cyber risk lies, which fixes to fund first, and whether things are getting better over time.
The company says the output is written in plain language so that business leaders, not only security staff, can understand it, approve budgets and act on it. Sophos describes the offering as a new market category.
From security data to a roadmap
CISO Advantage assesses an organization's environment and maps its controls against established frameworks. These include NIST CSF (the US National Institute of Standards and Technology's Cybersecurity Framework), CIS v8, Cyber Essentials Plus (a UK certification scheme), and NCSC CAF, the Cyber Assessment Framework published by the UK's National Cyber Security Centre.
DeepKeep has launched AI Lens for Developers, an extension to its AI usage control and runtime protection modules. It is built to give security teams oversight of coding agents that write, change and run code for developers.
The company says the tool brings policy enforcement, audit visibility and runtime security to agents such as Cursor and Claude Code. According to DeepKeep, this covers ground that most security programs have not had to deal with before.
Why coding agents are a problem
DeepKeep's announcement says 90% of developers use AI coding agents at work at least once a week. These agents run on the developer's endpoint. They can read local files, execute shell commands and call MCP (Model Context Protocol) tools directly on the machine.
Guy Fawkes News is financed by advertising. You can choose how you want to use this website:
With advertising: we load an advertising script from a third-party ad network. The ad network may set cookies, use your IP address and device information, and may process data outside the EU. We also count your visits for our own visitor statistics (with a random ID stored in your browser).
Ad-free for €0.99 per month: no advertising and no advertising tracking. Cancel at any time.
You can change your decision at any time via "Cookie Settings" at the bottom of every page.
