Hello. Though businesses have long relied on insurers to help contain damage after an attack, the bigger role of insurance in core cybersecurity strategies is starting to show up in the numbers.

That includes tighter budgets for cyber tools and weaker recruiting for security teams, amid a booming cyber insurance market. Take a look at the data and read our full story. 

Also today: 

• Rogue cyber workers get jail time
• Five Eyes nations warn that AI agents aren't properly governed in critical infrastructure
• Itron, a water and energy tech provider, acknowledges some customers affected in recent hack
• Top winner and loser in the WSJ Pro CyberIndex
• Ed-tech system Canvas disrupted after cyber incident
• And more

AI warning: The U.S., along with its Five Eyes national partners, warned that critical infrastructure operators need to rein in agentic AI tools, which are getting more access than they should. AI agents are making decisions without human input and should be part of existing cybersecurity oversight, the nations said. (CyberScoop)

Five key risks stand out, they said: 

• Too much privilege
• Configuration and design flaws
• Rogue actions
• Agents spreading vulnerabilities among each other
• No explainability

Water and energy tech provider Itron said Friday that a hack disclosed last month has resulted in "limited unauthorized access to certain customer-hosted systems." The company, in an update to the Securities and Exchange Commission, didn't describe the extent of the access or specify which customers are affected.

• Itron supplies technology to critical infrastructure, smart buildings and municipal systems across the U.S. In its first disclosure, on April 28, Itron said it "was informed" two weeks prior of unauthorized access to its own tech systems.

Prison time for rogue cyber workers: Two former cybersecurity professionals were sentenced to four years in federal prison for working with BlackCat ransomware gangs to attack U.S. companies, healthcare providers and other organizations. Ryan Goldberg of Georgia and Kevin Martin of Texas pleaded guilty in December for their roles in cyberattacks dating to 2023. (InfoSecurity Magazine)

• A third man—former ransomware negotiator Angelo Martino of Florida—pleaded guilty in April and awaits sentencing. 
• Related from WSJ Pro: Rogue Ransomware Negotiator Rattles Trust in Outside Data-Breach Responders

Hack at education company that provides popular Canvas system: Salt Lake City, Utah-based Instructure said it is investigating a cybersecurity incident after the ShinyHunters group claimed to have stolen student data. (Bleeping Computer)

• Instructure has notified some schools and universities about the investigation, including the University of Massachusetts, acknowledging disruptions to some Canvas systems.

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten and James Rundle. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.