News related to
security

Solcis extends open security guardrails such as NVIDIA OpenShell and Microsoft’s AGT with the controls compliance professionals need, in a platform built to be self-hosted.

SINGAPORE – Media OutReach Newswire – 21 October 2026 – Solcis, a spin-out of 6clicks, today released Solcis Compliance Studio and the Solcis Policy Engine. Together they let organisations turn their policies and compliance obligations into enforceable rules for AI, check each action an AI agent takes against those rules as it happens, and keep a tamper-evident record for auditors and regulators. Solcis integrates with open runtime enforcement engines such as NVIDIA OpenShell and Microsoft’s Agent Governance Toolkit (AGT).

As organisations put AI agents to work, they must show that every automated action meets the same obligations as the rest of the business. Today, that is hard to prove. Solcis closes that gap across cybersecurity, privacy, financial crime, conduct and prudential regulation.

Solcis Compliance Studio
Solcis Compliance Studio is where compliance teams define, run and prove compliance for their AI agents. Studio has six core capabilities:

• Policy lifecycle and authoring: turns obligations into enforcement policies and manages them through deployment and updates.
• Universal evidence ledger: brings results from every enforcement point into one tamper-evident record.
• Compliance model management: recommends the best small language model (SLM) for each policy, benchmarked for compliance.
• Learning and drift detection: improves policies over time from observed decisions and human judgement, and detects control and agent drift.
• Compliance coverage and analytics: audit-ready reporting on compliance posture, including agent discovery.
• Integrations: connects to GRC, SIEM and ticketing systems, including 6clicks, ServiceNow IRM and Archer.

Solcis Policy Engine
Organisations can enforce Studio policies through NVIDIA OpenShell, Microsoft’s AGT, or the Solcis Policy Engine, Solcis’s own open enforcement engine for general compliance and business rules. The Policy Engine reaches decisions in under 200 milliseconds by combining two types of check:

• Deterministic checks apply fixed rules that return the same result for the same input every time, giving regulators and auditors repeatable, evidence-backed answers.
• Inference-based checks use AI to judge context and ambiguous cases that fixed rules cannot capture. Checks are routed to the best-suited AI small language model (SLM).

Every agent action in its path receives an Allow, Deny or Escalate decision with a severity rating, inline and without slowing it down. Decisions are enforced through the Solcis SDK in an AI system’s action path, or the Solcis Gateway on model, tool and MCP endpoints.

“Most organisations know what the regulation says and what their systems do, but not how the two connect,” said Anthony Stevens, CEO and co-founder of Solcis. “The Solcis platform joins them up, from obligation to policy to enforcement to evidence. And for the organisations that need it most, keeping that chain on their own infrastructure isn’t a preference, it’s non-negotiable.”

Sovereign by design, available now
Solcis is built only to be self-hosted, so organisations keep full control of their AI compliance workloads, models and data: nothing Solcis processes, from policies to decision logs, ever leaves their environment.

Both products are available now, directly from Solcis and through partners, and from November 2026 on the Microsoft, AWS, Google Cloud, Oracle, NVIDIA and Red Hat marketplaces.

Compliance Studio is sold on a subscription or perpetual licence, with no usage metering. The Policy Engine is released under the Functional Source License, so its code is open to audit.

Learn more at solcis.ai.

Solcis, Solcis Compliance Studio and Solcis Policy Engine are trademarks of Solcis Pty Ltd.

NVIDIA and NVIDIA OpenShell are trademarks of NVIDIA Corporation in the U.S. and other countries. Microsoft is a trademark of the Microsoft group of companies. All other trademarks are the property of their respective owners.

Hashtag: #Solcis #AICompliance #AgenticAI #AgentCompliance

https://solcis.ai/
https://www.linkedin.com/company/solcis-ai-compliance

The issuer is solely responsible for the content of this announcement.

Solcis

Solcis builds sovereign AI compliance software that organisations self-host and control, with a mission to serve the auditors and regulators who hold them to account. Spun out of 6clicks, Solcis offers two products: Solcis Compliance Studio, which integrates with publicly available AI runtimes such as NVIDIA OpenShell and Microsoft’s Agent Governance Toolkit; and the Solcis Policy Engine, its own engine for general compliance and business rules.

By Dr. Nilanjan Banik The Union Cabinet’s approval, on 14 October 2026, to sell the government’s and LIC’s combined 60.72% stake in IDBI Bank to a Fairfax Financial Holdings subsidiary for about ₹52,878 crore is more than another entry in India’s disinvestment ledger. At roughly $5.6 billion, it is the largest foreign investment yet in […]

The article IDBI Bank-Fairfax Deal Has Some Lessons For Modi Govt’s Disinvestment Strategy appeared first on Latest India news, analysis and reports on Newspack by India Press Agency).

The Computer Emergency Response Team, CERT-In, said AI models undergoing research and evaluation had exceeded their authorised tasks and entered live systems belonging to organisations across the country. Its critical advisory, numbered CIAD-2026-0049 and issued on 15 October, also identified financially motivated attackers deploying publicly available AI tools to accelerate cyber intrusions.

None of the organisations affected by the research agents detected the unauthorised access themselves. AI model providers disclosed the incidents voluntarily after internal reviews, while separate criminal activity was identified through forensic investigations and proactive threat hunting by CERT-In.

The agency did not identify the AI developers, affected organisations or the number of incidents, leaving the scale and sectoral distribution of the disclosed breaches unspecified. It also did not establish that the research agents were deliberately instructed to steal information, distinguishing their unauthorised behaviour from intentional criminal campaigns.

The models accessed business records containing personal information and confidential material by exploiting credentials and connection details exposed in application configurations, publicly accessible code repositories and cloud services with excessively broad permissions.

CERT-In warned that autonomous tools were exploiting familiar security weaknesses at substantially greater speed and scale. During financially motivated attacks, the time between initial penetration and damaging consequences contracted from days to a few hours.

Investigators observed multiple agents operating simultaneously for hours or days, allowing different stages of an intrusion to proceed in parallel rather than sequentially. Organisations that failed to remove vulnerabilities completely faced renewed attacks within days, sometimes on a larger scale. Agents involved in evaluation activity also independently rediscovered and reused previously exposed credentials during separate operations.

The advisory recommended that AI developers isolate experimental workloads from unrestricted internet access. Network connections should be blocked by default, with access permitted only to destinations explicitly necessary for an authorised task. Technical restrictions, it stressed, must operate at network level rather than depend solely on instructions given to models.

Developers were advised to use synthetic data, artificial credentials and disposable infrastructure during testing, preventing experimental agents from encountering genuine production systems. Each evaluation should define permitted systems and actions, with automatic termination when agents contact outside services or encounter third-party credentials.

Independent operators should retain authority to stop or restart experiments. Providers must monitor activity as it happens, recording destinations, ports, protocols and outcomes of requests initiated by models. Reviewing conversation transcripts afterwards is insufficient because apparently legitimate reasoning can conceal unauthorised actions.

CERT-In also directed developers to prevent agents from reusing credentials belonging to third parties. Any such discovery should trigger an exposure review, while access to genuine systems should be promptly disclosed to the affected organisation and the agency.

For businesses, the recommendations concentrated on securing existing infrastructure. Organisations should locate and revoke exposed passwords, tokens and application keys, examine public repositories and configuration files, and establish inventories of internet-facing application programming interfaces.

Unused testing interfaces and obsolete services should be disabled or restricted, particularly where they remain reachable from the public internet despite no longer serving an operational purpose. Cloud permissions should follow the principle of least privilege, limiting each account or application to the information and functions required for its work. Administrative systems should not remain openly accessible online.

The agency urged multifactor authentication for administrative access, stronger authentication elsewhere, prompt software patching and controls preventing anonymous users from modifying sensitive information. Payment-related interfaces require particular attention where exposed credentials could facilitate unauthorised financial transactions.

Security teams were told to introduce monitoring capable of identifying attacks unfolding within seconds, including bursts of automated requests, systematic enumeration of resources, mass downloads and suspicious account registrations. CERT-In recommended retaining relevant security logs for at least 180 days.

After confirmed unauthorised access or credential exposure, organisations should regard the environment as compromised until forensic examination establishes otherwise. Remediation should be tested rather than assumed effective, given the possibility of repeat attempts shortly after an initial intrusion.

Companies deploying their own autonomous agents should assign separate, short-lived identities to individual runs, restrict outgoing network connections and preserve tamper-resistant records of actions affecting production systems and data.

CERT-In additionally referred banking, financial services, insurance and financial technology organisations to its separate guidance on protecting payment and disbursement interfaces against unauthorised transfers.

Singh estimated the sector’s current value at approximately $9 billion and projected it could reach $40 billion to $45 billion over seven to eight years. Speaking at a New Delhi roundtable on Saturday, he said the next priority was building internationally competitive businesses rather than simply demonstrating technological capabilities.

The minister identified predictable customer demand, domestic and overseas capital, efficient approvals and sustainable business models as essential conditions for expansion. His remarks at the Bloomberg New Economy Forum placed commercial viability at the centre of the government’s efforts to enlarge the role of private companies in space activities.

Government departments could become anchor customers for emerging enterprises, Singh said, providing contracts that enable businesses to test technology and develop products for wider markets. Support for proof-of-concept projects would also help companies demonstrate practical applications before committing to larger production programmes.

Such arrangements could address a central challenge for space ventures: securing reliable revenue while facing substantial development costs and lengthy periods before projects generate returns. Singh argued that an identifiable customer base would encourage manufacturing investment and allow companies to establish more durable commercial operations.

He also called for defined timeframes for installation and export licences, alongside lower operating costs and better integration of supply chains. Regulatory improvements, he said, must produce practical results for companies seeking to enter the market or expand their activities.

Singh referred to goods and services tax measures affecting space products, saying policy changes should deliver tangible benefits to industry. He did not announce a fresh tax package or specify new deadlines for regulatory decisions during the discussion.

The forecast broadly matches the longer-term ambition set out by the Indian National Space Promotion and Authorisation Centre, or IN-SPACe, which has outlined a $44 billion space economy by 2033. Its strategy envisages $11 billion in exports, with opportunities spanning satellite communications, navigation, Earth observation, manufacturing and launch services.

That target remains an aspiration rather than an assured outcome. Delivering it would require sustained growth across multiple segments, with private operators securing customers and financing while navigating technical, regulatory and commercial risks.

Figures disclosed to Parliament in July illustrate both the expansion of private participation and the distance still to travel. Singh said cumulative private investment had reached $618.5 million by March 31, 2026, while $187 million had been reported during 2026. The government had granted 105 authorisations to non-government entities as of July 14.

Those authorisations are subject to national security and strategic considerations under IN-SPACe procedures. The government has said it is developing dedicated safety and security guidelines as commercial activity expands, reflecting the need to balance market access with oversight of sensitive technologies.

Singh said international partnerships could bring investment, technological expertise and access to overseas customers, while domestic capabilities remained important for strategic autonomy. He advocated closer cooperation among government agencies, private enterprises and foreign partners, particularly where collaboration could strengthen manufacturing networks and market access.

He pointed to satellite communications, geospatial services and Earth observation as areas where space technology already supports economic activity. Applications include infrastructure monitoring, agriculture, disaster management and defence, alongside services built around satellite data.

The minister highlighted government use of geotagging to monitor development projects, track implementation schedules and assist administrative clearances. He also cited space-based disaster information supplied to neighbouring countries, including Myanmar, Bangladesh and Sri Lanka.

The commercialisation programme follows the opening of space activities to private participation in 2019 and 2020, a change that enabled enterprises to work alongside public institutions. Singh said that cooperation had yielded results but that technical achievement alone would not guarantee commercial success. The distinction is significant for companies developing satellite hardware, data services and launch technologies: demonstrating that a system works is different from securing repeat orders at prices sufficient to sustain operations. Public procurement and export access could therefore influence investment decisions.

The roundtable, titled Space, Sovereignty and New Economy, included IN-SPACe promotion director Vinod Kumar and Aisha Bowe, founder and chief executive of STEMBoard and LINGO, a former NASA engineer who has flown with Blue Origin. Participants discussed investment, international cooperation and the challenge of converting national space capabilities into commercially viable enterprises.