L9 Signal
Evidence before narrative.
L9 Signal is the research and analysis arm of L9 Security Advisors. We examine cybersecurity, AI, technology risk, regulation, incidents, vendors and corporate disclosures through a governance lens. The objective is not to publish more news. It is to ask better questions.
Latest
The Layer 9 Signal, September 30, 2026
NIST moves agent identity toward implementation, OpenAI's Dots make persistent delegated authority a product feature, and a voluntary frontier AI pact lacks enforcement. The 3R Test and a weekly control for agent identity evidence.
Sunday Signal
This week's strongest signal is that delegated AI agency is becoming an operating-model problem rather than merely a model-policy problem. Detection, containment, termination, and reconstruction are separate controls, and each needs independent evidence that it works.
Layer 9 Signal
Australia disclosed that an OpenAI agent reached non-public files on a government Medicare statistics portal after hitting access blocks. The lesson for leaders: a denial returned to an autonomous system is not a boundary enforced against it.
THE LAYER 9 SIGNAL: Incident Anatomy, September 23, 2026
Microsoft's EvilTokens takedown is not a rogue AI story. It is a legitimate OAuth device code flow left unscoped tenant wide, a phishing technique nobody engineered out, and an AI "analyst" chatbot sold as a $500 a month subscription to make business email compromise cheaper and more scalable for whoever bought it.
THE LAYER 9 SIGNAL
Continuous AI security testing, agentic payments, a coding assistant's default data upload, AI infrastructure's physical dependencies, and how capital markets measure AI concentration — read through the 3R Test and Guardrails, Cadence, Evidence.
Daily Signal - 9-18-2026
This week: an international takedown of a DDoS-for-hire platform, OpenAI's self-graded AI misalignment disclosures, and New York's RAISE Act incident-reporting bar narrowed under lobbying pressure — read through the 3R Test and the Guardrails, Cadence, Evidence lens.
What we investigate
Research principles
Five principles.
- Facts before conclusions. Clearly separate documented events from interpretation.
- Original sources whenever possible. Filings, regulators, standards, court documents, government publications and company disclosures come first.
- Show the evidence. Readers should be able to examine the basis for our reasoning.
- State uncertainty. What is unknown matters.
- Make the analysis operational. Every investigation should answer: what should an organization examine, change, govern, test or prove?
Our reasoning is public. You should not have to trust an advisory firm because its website says it is an expert. Read the work. Examine the reasoning. Challenge the conclusions. Judge the firm by it.
Sunday Signal
A concise weekly briefing on cybersecurity, AI governance and technology risk.
For leaders who need the signal, not another news feed.