Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

armo

Tool Call Analysis for AI Attack Detection: Reading What Rides Inside the Call

May 30, 2026 By Yossi Ben Naim In ARMO
A compromised agent doesn’t make a single call it isn’t allowed to make. It queries a table it’s authorized to read, calls a tool it’s authorized to use, sends to a domain that’s on the allowlist. Every call is legal. The attack is in the values it passes, and your tool-call log records all of it as a clean day’s work. A tool call has two layers. Almost every tool you run reads the first one: the call itself: which tool, in what order, at what rate.
Read Post
Securonix (ThreatQ) positioned as a Leader in the SPARK Matrix: Digital Threat intelligence Management, 2026 by QKS Group

Securonix (ThreatQ) positioned as a Leader in the SPARK Matrix: Digital Threat intelligence Management, 2026 by QKS Group

May 28, 2026 By Securonix In Securonix
The QKS Group SPARK Matrix™ provides competitive analysis & ranking of the leading DTIM vendors. Securonix (ThreatQ), with its comprehensive platform, has received strong ratings across technology excellence and customer impact.
Read Post

ITSP: Corelight launches Agentic AI that makes SOC triage 10x faster

May 28, 2026 By Corelight In Corelight
Modern SOCs face a difficult reality: attackers are moving faster while analysts are being asked to investigate more alerts than ever. Learn how agentic triage helps security teams move from alert overload to evidence-backed investigations. Rather than relying on opaque AI outputs, the approach uses expert-written playbooks and exposes the underlying queries and evidence so analysts can verify conclusions against raw network data.
View Video
CrowdStrike

CrowdStrike Named a Leader in Identity Threat Detection and Response

May 26, 2026 By Ryan Terry In CrowdStrike
Two recent industry reports validate CrowdStrike’s leadership in the identity threat detection and response (ITDR) market: Identity is the front line of modern cyberattacks. Today’s adversaries log in and use legitimate identities to move laterally, escalate privileges, and operate inside legitimate sessions as trusted users.
Read Post
tanium

Understanding continuous threat exposure management (CTEM)

May 22, 2026 By Tanium In Tanium
Continuous threat exposure management, or CTEM, is a five-stage program framework for continuously reducing real-world security exposure. It builds on vulnerability scanning by adding risk-informed prioritization, validation of exposure conditions and control effectiveness, and cross-team mobilization to drive remediation.
Read Post

Episode 15 - The Right Eyes: Mythos, and the Future of Vulnerability Discovery

May 21, 2026 By Corelight In Corelight
The emergence of advanced large language models like Anthropic's Mythos represents an epochal shift in cybersecurity, fundamentally altering how zero-day vulnerabilities are surfaced and remediated. In this episode, host Richard Bejtlich sits down with Corelight Co-founder Greg Bell to analyze the security implications of this AI-driven bug explosion, highlighting recent AI-assisted vulnerability discoveries across infrastructure mainstays like FreeBSD and Firefox.
View Video
sophos

GitHub internal repositories breached

May 20, 2026 By Sophos X-Ops In Sophos
A malicious VS Code extension led to cloned private repositories, reportedly offered for sale on a criminal forum On May 19-20, 2026, GitHub confirmed a security incident affecting its own internal systems. A threat actor self-identifying as TeamPCP, also tracked as UNC6780, compromised an employee’s developer device by way of a malicious Visual Studio Code extension and used that foothold to clone roughly 3,800 of GitHub’s internal repositories.
Read Post
sophos

Sophos Firewall and Synchronized Security

May 20, 2026 By Chris McCormack In Sophos
Sophos Firewall and Synchronized Security Synchronized Security is a unique capability you won’t get anywhere else. If you look at what’s required to properly secure a modern network, it breaks down into three pillars: hardening, protection, and detection and response. Or another way to look at it: being equal parts proactive and reactive - or what you need to do before, during, and after an attack.
Read Post
Scanning the Threat: Why Aerospace Relies on Laser Inspection

Scanning the Threat: Why Aerospace Relies on Laser Inspection

May 20, 2026 By SecuritySenses In SecuritySenses
Aviation travel demands absolute safety records for every single commercial flight across the globe. Microscopic flaws inside an airplane fuselage can quickly grow into catastrophic hazards under heavy atmospheric pressure at high altitudes. Maintenance crews must track these hidden structural issues constantly to safeguard passengers on their daily journeys.
Read Post
sophos

WantToCry ransomware remotely encrypts files

May 19, 2026 By Sophos Counter Threat Unit Research Team In Sophos
SophosLabs analysts investigated WantToCry ransomware attacks that involved the threat actors abusing the Server Message Block (SMB) service for initial access and then exfiltrating files to attacker-controlled infrastructure for remote encryption. The detection surface is significantly reduced because WantToCry operates without local malware execution, and there is no post-compromise activity beyond exfiltrating files and rewriting them to disk.
Read Post

Sophos Firewall Config Studio: Migrate to Sophos Firewall

May 19, 2026 By Sophos In Sophos
A step-by-step tutorial on using Config Studio to convert configurations from supported third-party firewalls and import them into Sophos Firewall. Learn how to review migration results, fix flagged issues, and complete the process with confidence. Ask questions and get expert answers in the Sophos Community.
View Video

Provably better data

May 19, 2026 By Corelight In Corelight
Every security vendor says their data is better. Corelight decided to test that claim directly. Using real nation-state attack scenarios, including Salt Typhoon-related activity, the same AI model was evaluated against multiple security data sources to measure investigation accuracy, threat visibility, and incident response coverage. The only variable was the data.
View Video
How Bot Detection Services Protect Your Website from Malicious Traffic

How Bot Detection Services Protect Your Website from Malicious Traffic

May 19, 2026 By SecuritySenses In SecuritySenses
Bot detection services are specialized tools designed to differentiate human users from automated bots on websites and applications. Their core function is to prevent malicious activities such as credential stuffing, fake account creation, scraping, and spam by verifying legitimate user behavior. Effective bot detection helps maintain security, protect user data, and ensure reliable site performance.
Read Post

Sophos Email: Configure Self Service Portal for end-users

May 15, 2026 By Sophos In Sophos
A step-by-step tutorial showing you how to grant access to and configure the Sophos Central Self Service Portal (SSP) for end-users. This web interface allows end-users to perform daily tasks related to email management and more (depending on the configuration) without the need of an administrator. Ask questions and get expert answers in the Sophos Community.
View Video
safeaeon

10 Cybersecurity Threats Every Organization Should Know

May 14, 2026 By SafeAeon Inc. In SafeAeon
Most attacks do not start with malware. They mostly start with access. Attackers find new ways to steal credentials, which they then use to gain unauthorized access. They also use legitimate tools to gain access to systems without triggering alerts. To repeat their actions across environments, they make use of automation. Modern attacks, such as phishing, ransomware, zero-day exploits, and insider threats, target both systems and users.
Read Post
sophos

Why AMOS matters: The macOS malware stealing data at scale

May 14, 2026 By Mohammed Zubair In Sophos
Sophos X-Ops looks at the Atomic macOS Stealer and its capabilities Sophos Managed Detection and Response (MDR) teams recently responded to a customer incident involving an infostealer infection on a macOS host. When we investigated, we found that the infostealer appeared to be a variant of AMOS (Atomic macOS), a well-known malware family we’ve written about before. The attack began with a ClickFix-style ruse, where a user was tricked into running a terminal command.
Read Post
Corelight

Data quality defines a ceiling for SOC performance

May 13, 2026 By Gregory Bell In Corelight
Defenders have long known that richer evidence improves security outcomes by enabling faster triage, deeper analysis, and more complete investigation. Although Corelight was founded on this premise, it’s been hard for us to quantify the impact of better network data - until now. Recently, we built an agentic test harness to measure the success of frontier LLMs in responding to real-world attack scenarios, using a range of source data.
Read Post
71% of Organizations Suffered At Least One Identity Breach in the Past Year, Sophos Research Finds

71% of Organizations Suffered At Least One Identity Breach in the Past Year, Sophos Research Finds

May 12, 2026 By Sophos In Sophos
State of Identity Security 2026 report finds human error and poor non-human identity management are the root causes of most attacks, as agentic AI accelerates the risk.
Read Post
sophos

Sophos Endpoint in action: Blocking a novel supply chain attack

May 12, 2026 By Mark Loman In Sophos
Sophos Endpoint in action: Blocking a novel supply chain attack How the unique anti-exploitation capabilities included with Sophos Endpoint blocked a supply chain attack. Sophos Endpoint is architected from the ground up to automatically block exploits, ransomware, and attacker techniques by default with zero manual tuning.
Read Post
sophos

The State of Identity Security 2026: Identity is the new perimeter

May 12, 2026 By Doug Aamoth In Sophos
The State of Identity Security 2026: Identity is the new perimeter Discover the causes and consequences of identity threats based on a survey of 5,000 organizations across 17 countries. In the modern cybersecurity landscape, the traditional network perimeter has dissolved. Today, identity as a perimeter keeps getting stronger and stronger. As organizations accelerate cloud adoption and integrate AI systems, the number of digital identities, both human and non-human, has grown exponentially.
Read Post

How Corelight identified a years-old network issue in 30 minutes

May 11, 2026 By Corelight In Corelight
A global cruise line operating across maritime and resort environments was struggling with inconsistent detections, alert overload, and limited visibility from its existing NDR platform. In this customer story, Jay Miller from Corelight walks through how the organization evaluated its network visibility strategy, identified long-standing gaps in detection coverage, and improved investigation workflows across a complex environment with intermittent connectivity at sea.
View Video
sophos

GPT-5.5-Cyber is here. What it means for defenders operating at the frontier.

May 11, 2026 By John Peterson In Sophos
GPT-5.5-Cyber is here. What it means for defenders operating at the frontier. OpenAI’s May 7 release of GPT-5.5 and the limited preview of GPT-5.5-Cyber put frontier AI in verified defenders’ hands. As a member of the Trusted Access for Cyber program, Sophos is using these models to sharpen what we already operate: an agentic SOC that resolves more than half of cases without a human, and an endpoint architecture purpose-built to stop AI-generated zero-days.
Read Post
sophos

Ransomware: AI changes the writer. It doesn't change the math.

May 11, 2026 By Mark Loman In Sophos
Ransomware: AI changes the writer. It doesn't change the math. Why most endpoint protection still treats ransomware as just another piece of malware, and what changes when you watch the data instead of the attacker. In 2013, CryptoLocker introduced the modern ransomware playbook. It also introduced something most of the industry has still not come to terms with: remote encryption.
Read Post
CrowdStrike

Inside CrowdStrike Automated Leads: A Transformative Approach to Threat Detections

May 11, 2026 By Daniel Brown - Thomas Hobson - Amogh Pradeep In CrowdStrike
Last summer we introduced Automated Leads, a transformative approach to threat detection designed to surface the subtle signs of an attack before it turns into a full-blown breach. It’s powered by CrowdStrike Signal (distinct from SGNL) and delivered via the CrowdStrike Falcon platform. Since that launch, the goal has remained the same: to move beyond the limitations of traditional alerting and give analysts a head start on detecting the most sophisticated adversaries.
Read Post

Sophos Email: Enterprise-grade, AI-powered email protection

May 11, 2026 By Sophos In Sophos
Sophos Email delivers enterprise-grade protection that keeps malicious messages out of user inboxes, elevates your defense against AI-powered adversaries, trains your employees to stay vigilant, and simplifies day-to-day security operations - all at a competitive price point.
View Video
sophos

Sophos named a Leader in the KuppingerCole Analysts Leadership Compass for Managed Detection and Response 2026

May 8, 2026 By Sophos In Sophos
Sophos named a Leader in the KuppingerCole Analysts Leadership Compass for Managed Detection and Response 2026 Sophos recognized across four leadership categories: Overall, Product, Innovation, and Market Sophos has been named an Overall Leader in the 2026 KuppingerCole Analysts Leadership Compass for Managed Detection and Response (MDR).
Read Post

Episode 14 - Harvest Now, Decrypt Later: The Shift to Post-Quantum Cryptography

May 7, 2026 By Corelight In Corelight
The emergence of quantum computing has introduced a definitive expiration date for classical encryption, fueling a "harvest now, decrypt later" strategy among sophisticated nation-state actors. In this episode, Vince Stoffer joins Richard Bejtlich to demystify Post-Quantum Cryptography (PQC) and explain why organizations must move beyond a "set it and forget it" mentality regarding their encryption standards.
View Video
sophos

Donuts and Beagles: Fake Claude site spreads backdoor

May 7, 2026 By Chaitanya Ghorpade In Sophos
A malicious imitation of Anthropic’s Claude site leads to DLL sideloading – and a backdoor As we reported on social media recently, Sophos X-Ops has been investigating reports of a fake Claude AI website distributing malware. Like other researchers, we thought this might be a PlugX-like campaign, given that the attack chain shares several characteristics with observed PlugX attacks.
Read Post
sophos

How AI-accelerated threat discovery is reshaping network security

May 7, 2026 By Barbara Hudson In Sophos
How AI-accelerated threat discovery is reshaping network security As vulnerabilities are discovered faster than ever, organizations must rethink how they reduce exposure and contain risk at the network edge. Claude Mythos Preview has reignited debate about AI-driven cyber attacks, but the real shift isn’t what AI finds, it’s how quickly issues at the network edge can turn into impact. This post explores what’s changed and how network security must adapt to keep up.
Read Post

The Hackers Who Left Their Entire Playbook Online

May 7, 2026 By Sophos In Sophos
A ransomware group called Warlock tore through more than 60 organisations in six months, targeting the nuclear energy, aerospace, and government sectors. They chain zero-days and neutralise antivirus software using signed Chinese drivers. This is how they operate and how the Sophos CTU tracked them across eleven incidents to expose their full playbook​
View Video
cyjax

CYJAX Launches Compromised Device Alerting to Detect Threats Earlier

May 7, 2026 By CYJAX In CYJAX
Detect compromised devices before attackers act. CYJAX’s new alerting identifies stealer malware infections and exposed credentials in near real time. CYJAX today announced the launch of Compromised Device Alerting, a new capability designed to help organisations identify compromised devices within their environment before attackers can act on stolen credentials.
Read Post
The New Vanguard: Strategic Leadership in the Age of Autonomous Threats

The New Vanguard: Strategic Leadership in the Age of Autonomous Threats

May 7, 2026 By SecuritySenses In SecuritySenses
The threat landscape of 2026 is no longer defined by the singular hacker or the isolated malware strain. We have entered the era of the "Autonomous Adversary"-a period where AI-driven social engineering, automated vulnerability discovery, and polymorphic code are the standard tools of state-sponsored and criminal actors alike. For the security professional, the traditional defensive perimeter has dissolved. To navigate this complexity, the industry is moving away from purely tactical responses toward a model of "Cyber-Resilience and Strategic Governance.".
Read Post
Corelight

5 signs it is time to upgrade your DIY Zeek deployment

May 5, 2026 By Matt Ellison In Corelight
You already know the immense value of open-source Zeek. It provides the absolute gold standard of network evidence, giving you the deep visibility required to defend your organization. You have the right strategic foundation, but the operational workload of managing a do-it-yourself (DIY) deployment at scale is likely draining your energy.
Read Post
armo

AI Threat Detection for Healthcare: Protecting Patient Data from AI-Mediated Attacks

May 1, 2026 By Shauli Rozen In ARMO
For six weeks, a mid-size hospital system’s CDS agent issued recommendations biased by a poisoned guideline summary. No detection alert fired. The drift — denial recommendations in cases sharing one specific clinical attribute — traced back to a guideline an outside contributor had quietly reweighted in editorial review. Every existing detection stack reported green. DLP: no PHI left the cluster. EHR audit log: agent reading and writing within scope. Network egress: normal traffic.
Read Post
sophos

Proof-of-concept exploit available for Linux 'Copy Fail' vulnerability (CVE-2026-31431)

May 1, 2026 By Sophos Counter Threat Unit Research Team In Sophos
On April 29, 2026, details about the ‘Copy Fail’ vulnerability (CVE-2026-31431) were publicly disclosed. This high-severity (CVSS score of 7.8) privilege escalation vulnerability impacts Linux distributions shipped since 2017. It allows an unprivileged local user to obtain root-level access on affected Linux systems by corrupting the kernel’s in-memory page cache of a privileged binary.
Read Post
sophos

AI finds the vulnerabilities, but exploiting them is a different problem.

May 1, 2026 By Mark Loman In Sophos
AI finds the vulnerabilities, but exploiting them is a different problem. How Sophos Endpoint defends in the AI era, and what the public record on Mythos shows. When Mozilla shipped Firefox 150 with fixes for 271 issues identified by Anthropic’s Mythos model, the headlines focused on the count. The detail that mattered was further down: Mozilla credited only three CVEs to the model. The remaining 268 were classified as defense-in-depth, hardening, or bugs in code paths that could not be exploited.
Read Post
sophos

AI just became the world's most dangerous exploit writer. Here's why Sophos Endpoint is built to stop it.

May 1, 2026 By Sophos In Sophos
AI just became the world's most dangerous exploit writer. Here's why Sophos Endpoint is built to stop it. AI-generated zero-days are here. Sophos Endpoint was architected to stop exploits that have never been seen before — blocking the techniques every attack must use, at the moment of execution, with no signature, no cloud lookup, and no configuration required.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.