Only 5% of organizations have full trust in their cybersecurity vendors
Lack of verifiable transparency undermines cybersecurity decision making, according to Sophos-backed research.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
The Cybersecurity Trust Reality in 2026
New Sophos survey reveals only 5% of IT leaders say they fully trust their cybersecurity vendors When organizations select a cybersecurity vendor, they’re placing critical operational resilience — people, data, and revenue — into that supplier’s hands. Yet despite this reliance, most organizations lack confidence in the vendors they depend on to keep them secure, according to new Sophos research.
Axios npm package compromised to deploy malware
On March 30, 2026, a supply chain security attack targeted Axios, a widely used JavaScript HTTP client for web and Node.js applications. Third-party researchers identified that Axios versions 1.14.1 and 0.30.4 published to the npm registry were compromised following the apparent takeover of a legitimate maintainer account. An attacker published unauthorized package updates that appeared legitimate.
The High Cost of Low Trust: Our Commitment to Radical Transparency
Only 5% of organizations fully trust their cybersecurity providers. Let’s do better. In our industry, trust isn't an abstract concept. It’s the currency of cybersecurity – the foundation of every partnership we build and every protection we provide. However, a recent independent, vendor-agnostic survey of 5,000 cybersecurity decision-makers across 17 countries reveals a stark reality: we’re facing a trust crisis.
Stopping realworld attacks: Lessons from the cyber frontline
This white paper reveals the attack techniques most likely to drive highimpact incidents - and provides practical advice on how to stop them. By learning from realworld attacks, businesses can strengthen their resilience and meaningfully reduce their cyber risk.
The State of Ransomware in Financial Services 2025
369 IT and cybersecurity leaders reveal the ransomware realities for financial services providers today. The report examines how the causes and consequences of ransomware attacks on financial services providers have evolved over time. This year's edition also sheds light on previously unexplored areas, including the organizational factors that left providers exposed and the human toll ransomware takes on IT and cybersecurity teams in the financial services sector.
Navigating cybersecurity with an effective SOC
Security Operations Centers (SOCs) are essential for detecting and responding to cyber threats, but building the right model isn't one-size-fits-all. With talent shortages and rising threat complexity, many organizations are rethinking how to scale security operations. This guide breaks down the pros, cons, and trade-offs of in-house, hybrid, and outsourced SOC models. Find the SOC strategy that fits your needs, risk profile, and available resources.
Corelight and Microsoft: A smarter way to fight alert fatigue
For SOC teams, the battle against cyber threats can feel like trying to solve a 3D jigsaw puzzle in a bouncy house with missing pieces and a timer blasting every few seconds. Despite the increase in security spending, most teams still struggle with inefficient investigations, alert fatigue, and the non-stop guessing game of prioritizing threats. That’s why we’re excited about our latest integration with Microsoft Security that we hope will help address these persistently common challenges.
Where AI in the SOC is actually delivering - and where it isn't
Where AI in the SOC is actually delivering — and where it isn’t“We’ll have a generation of security professionals who can supervise AI but can’t function without it." For all the noise surrounding “agentic AI” in cybersecurity, security operations centers are still wrestling with the same fundamental questions: What does AI genuinely improve today? Where does it fall short? How can organizations tell the difference?
Incident responders, s'il vous plait: Invites lead to odd malware events
A phishing campaign targeting multiple organizations led to RMM installations – but not much else (yet). A threat actor experimenting, or an access-as-a-service attack underway? Sophos’ Managed Detection and Response (MDR) teams reported on a phishing campaign late last year that attempted to trick users into installing LogMeIn Resolve (formerly GoToResolve), a remote monitoring and management (RMM) tool, to acquire remote unattended access.
30 Years Driving Detection and Response in Hybrid Environments
Over the past 30 years, network security has evolved at the same pace as enterprise infrastructures. What began as a model centered on a clearly defined perimeter has given way to hybrid environments where on-premises infrastructure, cloud services, SaaS applications, remote users, and mobile devices coexist.
Episode 11 - The AI Maturity Journey: Data, Agents, and the Shift from Craft to Art
Richard Bejtlich talks with Vijit Nair, VP of Product at Corelight, about the evolving "AI Maturity Journey" for modern security teams. Vijit outlines a three-level spectrum of AI adoption, moving from basic human-driven assistance to automated swarms of agents, and eventually toward fully autonomous systems. They discuss why high-quality, unopinionated data remains the essential foundation for building trust in AI and how technologies like the Model Context Protocol (MCP) are turning human language into the primary interface for tool integration.
Cybersecurity for Education - Sophos Protected Classroom
Cybercriminals are targeting schools more than ever, drawn by sensitive student and staff data and the chance to disrupt learning. For educators already managing tight budgets and growing digital demands, a single breach can mean days of downtime and lasting reputational damage. Criminals are increasingly attracted by the valuable and sensitive information education establishments hold, and the opportunity to extort payments using ransomware or the threat of breach exposure.
Sophos Firewall ranked the #1 overall firewall solution in G2's Spring 2026 reports
Sophos Firewall ranked the overall firewall solution in G2’s Spring 2026 reports Why organizations are choosing Sophos Firewall to reduce exposure and strengthen resilience When organizations evaluate security products, they want real‑world proof of reliability, protection, and ease of management.
Corelight Agentic Triage demo
Corelight is excited to introduce Agentic Triage! In this demo, you can see how Agentic Triage helps SOC analysts filter through alerts and respond quickly to active threats. We combine generative AI with our industry leading log framework to identify the detections and cases that truly matter. This video shows how you can use Agentic Triage to quickly perform deep dives into open detections and make confident decisions to secure your network.
Corelight Agentic Triage overview
Corelight is excited to introduce Agentic Triage! In this demo, you can see how Agentic Triage helps SOC analysts filter through alerts and respond quickly to active threats. We combine generative AI with our industry leading log framework to identify the detections and cases that truly matter. This video shows how you can use Agentic Triage to quickly perform deep dives into open detections and make confident decisions to secure your network.
NICKEL ALLEY strategy: Fake it 'til you make it
Counter Threat Unit (CTU) researchers continue to investigate trends in Contagious Interview campaign activity conducted by NICKEL ALLEY, a threat group operating on behalf of the North Korean government. The group notoriously targets professionals in the technology sector by advertising fake job opportunities, deceiving prospective candidates through a fake job interview process, and ultimately delivering malware.
Oracle vulnerability (CVE-2026-21992) impacts core products
On March 20, 2026, Oracle disclosed a critical (CVSS score of 9.8) vulnerability (CVE-2026-21992) impacting two Oracle Fusion Middleware components: Oracle Identity Manager and Oracle Web Services Manager. An unauthenticated attacker could exploit the vulnerability to obtain network access via HTTP and remotely execute code. Critical functions of the products are exposed due to the lack of network-level authentication. As of this publication, there are no reports of active exploitation.
The global CISO landscape: A leadership gap too large to ignore
The global CISO landscape: A leadership gap too large to ignore Why the world needs scalable security leadership — and MSPs and MSSPs are key to delivery The 2026 CISO Report, published by Cybersecurity Ventures in partnership with Sophos, highlights a critical imbalance in global cybersecurity leadership. Despite decades of progress and near-universal CISO adoption in Fortune 500 and Global 2000 organizations, there are still only 35,000 CISOs worldwide serving an estimated 359 million businesses.
Fueling Cisco XDR with Corelight high-fidelity network evidence
From hunting threats to solving complex problems to coding on a couch, adventures in the Black Hat NOC (Network Operations Center) are always interesting. Over the last few months and several shows, I’ve had the privilege of working with one of the other NOC partners, Cisco, to design and test our first integration between Corelight Investigator and Cisco XDR.
From alerts to entities: Transforming the SOC with Corelight Agentic Triage
The cybersecurity landscape has fundamentally shifted in the last several years. Adversaries are no longer just using AI to draft phishing emails; they're deploying autonomous AI agents capable of executing end-to-end attack chains, from initial reconnaissance through lateral movement and data exfiltration. Anthropic's1 analysis of recent incidents indicates a rapid acceleration in attacker adoption of agentic workflows, dramatically shortening the time between initial access and impact.
Proactive Threat Detection: Securing Business Data Before It Becomes a Business Risk
Cybersecurity is no longer something businesses can afford to think about later. Most companies only realize the importance of strong protection after an issue disrupts operations, whether it is lost data, system downtime, or a security breach that affects clients. By then, the damage has already been done.
Featured Post
Managing Persistent Exposure: Why APT Defence Requires a Strategic Shift
Most organisations are wellequipped to respond to visible cyber incidents such as ransomware attacks, service outages, alert surges, or public disclosures. These events trigger established response processes: there is a clear catalyst, an observable impact, and a defined operational playbook.
Most Active Threat Actors by Industry: Who Is Targeting Your Sector Right Now?
Cyber threats are escalating rapidly, with ransomware groups multiplying and attacks becoming faster and more targeted than ever. This blog profiles four of the most active threat actors currently targeting key industries: IntelBroker, APT44 (Sandworm), Volt Typhoon, and APT45. From financially motivated cybercrime to state-sponsored espionage and infrastructure disruption, each group presents unique risks across sectors including technology, energy, government, and finance.
Why geopolitical tensions should raise cyber awareness
When geopolitical tensions rise, cybersecurity quickly becomes part of the public conversation. Government agencies issue warnings. Security teams increase monitoring. Headlines start asking which organizations could become targets if cyber operations escalate alongside physical conflict. But geopolitical conflict does not suddenly create cyber risk. What it does increase is the likelihood that existing weaknesses will be tested and pre-existing risks could be exposed.
How Can Organizations Improve Threat Detection and Response in Hybrid Cloud Environments?
Hybrid cloud environments rarely start as a carefully planned architecture. Most organizations reach that point gradually. A few workloads move to the cloud first. Then development teams adopt additional cloud services. Meanwhile, critical systems continue running on-premise because they cannot easily migrate. Over time, the result is an enterprise hybrid cloud environment that spans multiple infrastructure layers. From a business perspective, this flexibility is useful.
Sophos Protected Browser: Enforce access to critical resources
A step-by-step tutorial showing you how to use a federated identity provider (IDP) to enforce access to critical resources only through Sophos Protected Browser. The optional step to enforce the use of Protected Browser via Sophos Endpoint is also shown. Note: Microsoft Entra ID is used as the IDP in this Techvid. Ask questions and get expert answers in the Sophos Community.
Demystifying the Alphabet Soup That Is Detection and Response
It’s impossible to walk into a tradeshow these days without getting blasted by a wall of acronyms. Everywhere you look, vendors are cramming two to four perfectly serviceable words into a string of capital letters arranged to sound cooler than they actually are. This wouldn’t be so bad if it didn’t routinely derail meetings, product decisions, and sometimes whole strategies.
5 Ways Managed Security Services Protect Small and Mid-Sized Businesses
Cybersecurity has become a major concern for organizations of every size. However, small and mid-sized businesses often face a unique challenge: they must protect their systems and data without the large internal security teams that many enterprises rely on. At the same time, cybercriminals increasingly target smaller organizations because they may have fewer resources dedicated to cybersecurity.
AI-Aware Threat Detection for Cloud Workloads: 4 Attack Chains Most Security Stacks Miss
Your security stack was built for workloads that follow predictable code paths. AI agents don’t. They interpret prompts, generate code on the fly, invoke tools dynamically, and escalate privileges in ways no developer anticipated — all as part of normal operation. The signals that indicate a compromise in a traditional container are indistinguishable from an AI agent doing its job. And most detection tools can’t tell the difference. This isn’t a theoretical gap.
Built for Speed: Real-Time Cloud Threat Detection
In the cloud, speed is everything — especially for attackers. The fastest breakout times are measured in seconds, yet many traditional cloud detection approaches rely on delayed log delivery and batch processing. By the time an alert is generated, the damage may already be done.
Sophos Customers: Get started with the Support Portal
An overview of the Sophos Support Portal. Explore the available self-service resources, learn how to use Live Chat, create a Technical Support case, and more. Ask questions and get expert answers in the Sophos Community.
Sophos Partners: Get started with the Support Portal
An overview of the Sophos Support Portal. Explore the available self-service resources, learn how to use Live Chat, create a Technical Support case, and much more. Ask questions and get expert answers in the Sophos Community.