IT-Security Weekend 2026

Three Weeks. Three Wake-Up Calls.

If you work in the software industry, April 2026 was quite eventful. Three major security stories occurred in quick succession, and each one tells a different version of the same uncomfortable truth.

It began on April 8, when Anthropic announced that Claude Mythos Preview, their latest Frontier model, will not be publicly released. The reason sounds almost surreal: The model is too good to find critical vulnerabilities in operating systems and browsers. Instead of a public release, Anthropic provides access only to a small group of partners — through the "Project Glasswing" initiative, so defenders can close gaps before attackers catch up. If you want to see the whole story, here is a brief explanation.

A few days later the axios npm package was hijacked. The versions 1.14.1 and 0.30.4 of a package, which is downloaded 70 to 100 million times per week, were poisoned with a Remote Access Trojan — traced back to a state-supported North Korean group called Sapphire Sleet. Those who at the wrong moment npm install executed it, ran their code. Two to three hours of dwell time before anyone even noticed.

Then, on April 18 Vercel disclosed a breach — although no one hacked Vercel directly. An employee of a small AI tool called Context AI caught infostealer malware on his laptop. This gave the attackers a Google Workspace OAuth token. This token opened the way into Vercel's internal systems. In the end, customer credentials and source code ended up for sale in a hacker forum for 2 million dollars. A laptop. Two companies apart. One of the largest hosting providers on the web has still ended up within the sphere of influence.

When you look at the chain in each of these stories, none of them start where you would expect. The Anthropic story is about how cyber capabilities diffuse out of AI labs. The axios story shows how trust in package registries is crumbling. The Vercel story revolves around a single laptop, two companies removed from the actual victim. The pattern is unmistakable: the attack vectors are becoming subtler, more indirect, and harder to detect. And the impacts hit entire industries simultaneously.

Our Weekend

We didn't want to wait until the issue caught up with us. So we cleared the calendar and conducted an entire security workshop weekend — the IT Security Weekend 2026. It wasn't about "creating awareness" — awareness was never the problem. It was about clearly identifying where our specific vulnerabilities lie and having real changes live by Monday.

The weekend wasn't just work. We spent time together at the beach, had dinner together in the evenings, laughed a lot — and this mix was important. In the end, safety is a team issue, and a team that knows each other well reacts differently when things get serious.

A central component was our internal Security Test, which everyone on the team has gone through. The test covers practical scenarios — phishing attempts, handling secrets, recognizing suspicious OAuth requests, working securely with dependencies — and reveals where there are still blind spots in the team. The result is not tucked away in a drawer but determines where we will focus in the coming weeks. The complete test is available in our Security Test Document.

We have broken down the substantive discussion into three sources of risk, and they closely reflect the three stories mentioned above.

The first is the developer's device. This is the Vercel story. A single compromised laptop is enough to destabilize an entire infrastructure provider. The phrase "it's just my personal computer" no longer works once that computer has production access, stores OAuth tokens, or holds a session cookie for something important.

The second is the source code. Clean code is no longer just a matter of quality — it's also a matter of security. We standardize a security-first coding baseline to ensure vulnerabilities don't make it to production. Code review for security, not just for style. Secrets out of the repos. Defaults that fail safely rather than openly in case of doubt.

The third is external software. This is the axios lesson. The more you build and host yourself, the more valuable you become as a target. Where it makes sense, we want to rely on standardized, security-verified software instead of pulling in a random open-source package that just gets the job done the fastest. Every dependency is a trust decision.

What we have implemented

We didn't just talk. By the end of the IT Security Weekend 2026, three concrete things were live.

A practical hardening playbook, coordinated across all teams — disk encryption, OS firewalls, browser isolation, reviews of OAuth permissions, and clear principles for handling secrets on local machines. Additionally, security checks directly in the development workflow, instead of being tacked on at the end — dependency scanning, secret scanning, and signed commits run before code can even be merged.

However, the biggest leverage is our step in device management.

JumpCloud MDM: active device tracking instead of passive inventory list

We have JumpCloud MDM deployed on every company device — and that is significantly more than a classic MDM setup. Classic MDM knows which device belongs to which person and whether it is encrypted. That's usually about it.

JumpCloud is noticeably advancing. The system continuously scans the devices and builds a risk profile per employee on — not just per machine. It learns over time how a particular employee typically works: which programs are running, which networks are used, which login patterns are typical. As soon as a device deviates from this — unusual processes, new software from unexpected sources, login attempts at odd times, or suspicious network activity — the system automatically raises an alarm and alerts the responsible parties immediately.

This is exactly the mechanism that would have made the difference at Vercel. An infostealer on an employee's laptop doesn't stand out due to a single loud signal — it stands out due to a pattern that deviates from normal behavior. JumpCloud automatically detects exactly that, instead of waiting for someone to stumble upon it by chance.

Specifically, this means: outdated OS, missing encryption, unknown software, or suspicious traffic are not only visible at the next audit — but at the moment they occur.

Honors

An honest shoutout to Ari and Christian, who passed the entire security test without a single mistake. This sets the bar for the rest of us.

The Conclusion

If your team hasn't had a weekend like this by 2026, don't wait until the next breach forces you to. The threat model has shifted, and the costs of catching up later are no longer theoretical — right now, real companies with their data are in real hacker forums, with price tags in the millions.

The hardest part of security is not choosing the right tools. It is accepting that the way you worked last year is no longer safe today — and then quickly changing how you work.