GISDAYS 2026: IDM Implementation, VOC and SIEM Strategies, AI Security Platforms Take Center Stage

The third business day of GISDAYS 2026 focused on practical cybersecurity scenarios for businesses and critical infrastructure. Experts from Gazinformservice, Security Vision, R-Vision, Xello, Solar, and Positive Technologies presented on vulnerability management, identity and access management, and protecting AI systems. Key discussions covered the role of VOC as a complement to SOC, challenges in deploying Ankey IDM, and using indicators of compromise to improve SIEM efficiency. Speakers also addressed data leakage paths into the dark web and the need for Zero Trust models in distributed environments. The event concluded with the IB-Prophets panel forecasting trends in digital identity protection, multi-agent AI systems, and AI model security standards.

HabrOctober 30, 2026Translated from Russian

Read at source

The third business day of GISDAYS 2026 centered on applied scenarios for protecting businesses and critical infrastructure from vulnerabilities, data leaks, ransomware, and other threats. Participants explored risk management, incident response, and the search for solutions to safeguard the state, enterprises, and key sectors.

Leoniд Ilyin of Security Vision presented on VOC, explaining how Vulnerability Operations Center helps organizations move from drowning in vulnerabilities to managing risks. He stressed that VOC does not replace SOC but complements it by providing a structured vulnerability management process that reduces analyst workload through automation.

Alexander Davydov and Denis Tsvetkov from Gazinformservice discussed shortening the path to a working Ankey IDM deployment. They outlined the necessary stages of examination, design, approval, and analytics, noting that many organizations lack these processes internally. Future plans include AI models for request approval hints, role mining, personnel change analysis, and a chatbot for product knowledge base interaction.

Evgeny Petrov of Gazinformservice addressed the challenge of handling large volumes of IOCs to prevent analysts from wasting time on low-value alerts in SIEM systems. Egor Zakharenko of R-Vision described how log management was implemented to collect, filter, normalize, and forward events to external systems.

Artem Ilyin of Xello examined data leak pathways into the dark web and recommended Zero Trust access models for organizations with distributed environments. Evgeny Fedorov of Solar highlighted risks of AI agents executing attacker commands and proposed three security questions: who issued the command, why the action is being performed, and what data will be affected.

Evgeny Spiridonov of Positive Technologies discussed endpoint coverage benefits when combined with SIEM or NTA solutions. The IB-Prophets panel featured forecasts from Andrey Biychuk (MTS), Valery Bogdashov (R-Vision), Pavel Drogovoz (Bauman University), Mikhail Kader (UserGate), and Nikolay Nashivochnikov (Gazinformservice) on digital identity protection, data management evolution, multi-agent systems growth, and AI model security standards.

Sergey Ovchinnikov presented Efros Platform as a way to reduce the cost of security outcomes through unified context and data models. Lidia Vitkova introduced the MLSecOps platform for monitoring AI models and assessing their security in line with emerging national standards and FSTEC Order No. 117.

Security Vision Ankey IDM Efros Platform MLSecOps R-Vision

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in AI Security

AI Security

Noise in Embeddings Fails to Protect Data: 8 Schemes Tested, ~90% Documents Identified with Just 100 Known Pairs

A detailed evaluation of eight embedding protection schemes shows that adding noise does not prevent document identification attacks when an adversary knows even a small number of document-embedding pairs. The study tested Gaussian noise, secret rotations combined with noise, SAP/DCPE, binary LSH, random projections, product quantization, secret nonlinearities, and k-anonymous quantization on BEIR collections SciFact and NFCorpus using all-MiniLM-L6-v2 and bge-small-en-v1.5 models. Even when noise levels reduced retrieval quality by half, identification rates remained above 98% for most noise-based methods. With only 100 known pairs (roughly 2% of the corpus), linear alignment attacks recovered around 90% of mappings for several schemes. Product quantization offered better protection but required significant quality loss to bring identification below 50%. The findings highlight that protections evaluated only against text reconstruction attacks can still leak membership information in realistic partial-leak scenarios.

HabrOct 30, 2026Translated from Russian

AI Security

Logical Argument Claims Full Alignment of Superintelligent AGI Is Fundamentally Impossible

A detailed analysis argues that the AI alignment problem cannot be solved for systems exceeding human cognitive capabilities. The paper presents a formal proof showing that any control mechanism created by humans will inevitably be circumvented by a more intelligent agent. It draws on foundational theorems from logic and cybernetics to support the conclusion that alignment is not an engineering challenge but a logical impossibility. Recent 2025-2026 research papers reach similar conclusions using computability theory and diagonal arguments. The work concludes that the only way to guarantee alignment is to avoid creating superintelligence altogether. All proposed restrictions are described as temporary delays rather than permanent solutions.

HabrOct 29, 2026Translated from Russian

AI Security

Claude Account Bans Linked to IP Reputation, Device Environment and Payment Channels, But No Confirmed Formula

Discussions on the Chinese forum NodeSeek have highlighted observations from a user who reported bans on more than twenty paid Claude accounts. The user identified IP address reputation, device environment traces, and payment processor history as the main factors potentially triggering blocks by Anthropic. However, the original post does not present a unified scoring system or prove specific penalties for using Linux, browser-only access, or the Fable model. High query volume is described mainly as a rate-limit issue rather than an automatic account ban trigger. Community members remain divided, with some confirming isolated observations while others label the conclusions speculative and share contradictory experiences. No universal method to avoid blocks has emerged from the discussion.

AntiMalwareOct 29, 2026Translated from Russian