Executive Overview During 2026, the insider cyber threat landscape underwent a fundamental transformation driven by macroeconomic pressures, active monetization in the cyber-crime underground, and the widespread enterprise integration of autonomous artificial intelligence systems [1]. While negligent insiders misplacing devices or succumbing to phishing lures continue to account for a high volume of operational exposure, malicious…
Read More
Three real port cyberattacks show how stolen data, compromised software and ransomware disrupt operations—and what IT, OT and IoT teams can do.
Read MoreIn cybersecurity, there is a reality that every Delivery Manager faces daily: Defenders must succeed every single day, while attackers only need to succeed once. I recently had the opportunity to attend the SANS SEC450: SOC Analyst Training – Applied Skills for Cyber Defense Operations course. It was an intense, high-value journey focused on optimizing…
Read MoreWhen a cyber incident occurs, one of the first challenges is understanding what happened, which systems were involved, and what traces were left behind. In this context, Velociraptor can help: It’s an open-source DFIR tool that can collect and examine endpoint data in a centralized, targeted, and repeatable way. After completing a course focused on…
Read MoreA field briefing on space threat intelligence, for security teams that run zero satellites but depend on dozens of them I don’t work in the space industry. I don’t design satellites, operate ground stations, or even analyze orbital telemetry in real time. Worth saying upfront, because it’s the right starting point for this kind of…
Read More
Turning Relevant Campaigns into Actionable Security Content To prioritize detection rule deployment based on threats that could realistically affect our organization or customer environments, we’ve developed an intelligence-driven detection model. Rather than prioritizing rules solely by mapping MITRE ATT&CK techniques and addressing coverage gaps indiscriminately, the model uses threat intelligence to identify which campaigns, behaviors,…
Read MoreData exfiltration is rarely as obvious as a large file being copied to an attacker-controlled server. In many environments, sensitive information leaves through channels that look legitimate: a cloud storage service, a familiar application, an unusual destination country, or a removable device. This is where Elastic’s Data Exfiltration Detection (DED) package can help. Instead of…
Read MoreThe first half of 2026 marked a structural shift in how cyber criminals and state-sponsored groups achieve initial access. Rather than targeting corporate perimeters directly, adversaries have increasingly exploited the “web of trust”, generally known as supply chain attacks. This means compromising open-source code registries, developer utilities, and third-party SaaS integrations. According to threat intelligence…
Read MoreEvery red team engagement that involves a phishing scenario runs into the same wall sooner or later: You need a mail server you fully control, one that behaves like a real corporate mail system, sends and receives reliably, and does not torch your reputation the moment you use it. The answer is to compose your…
Read MoreAs threat analysts, we spend our days dissecting malicious code, tracking infrastructure, and reverse-engineering adversary tactics. But what happens when the threat actor refuses to even let us see the payload? In recent years, the Cyber Threat Intelligence (CTI) landscape has witnessed a massive shift. Adversaries have realized that the best way to protect their…
Read MoreCloud Security Posture Management describes a category of tools that inspect cloud environments for configuration problems like public storage, overly broad IAM permissions, disabled logging, and missing encryption. The category includes open-source projects like Prowler and ScoutSuite, as well as commercial platforms. Despite different pricing models and interfaces, they solve the same underlying problem in…
Read MoreThe View from the SOC From inside the SOC, authentication traffic never really stops. Most of it is ordinary business: people signing in, services renewing sessions, or developers moving between tools. Mixed into that stream is something far less ordinary: repeated, automated attempts to become someone else. That’s why identity work sits so close to…
Read MoreThe first half of 2026 has witnessed the transition of artificial intelligence from an experimental playground into a cyber warfare domain. In fact, threat actors have shifted from basic prompting toward highly automated, multi-stage operations. This shift is characterized by a bifurcation of threats. On one side, attacks exploiting inherent AI vulnerabilities and architectural boundaries,…
Read More1. Introduction The abuse of vulnerable drivers has become an increasingly common technique adopted by attackers to bypass modern security controls. This attack pattern, commonly referred to as Bring Your Own Vulnerable Driver (BYOVD), consists of loading legitimately signed but vulnerable drivers into the operating system in order to gain kernel-level privileges, disable security products,…
Read MoreIn cybersecurity, the gap between what we think we can detect and what we actually detect is often wider than we expect. Tools are configured, rules are written, playbooks are drafted, and yet, when a real attack unfolds, the telemetry is incomplete, the alerts are noisy, and the response is slower than it should be….
Read More