Identity-Based Attacks Are Responsible for 85% of Ransomware in Education, Sophos Report Finds
Malicious email is the leading attack method, and recovery costs now average $2.26 million.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
How Do You Operationalize CTEM and Prove It's Working?
Having the right security platform is only part of the equation. Two organizations can have similar security stacks and still achieve very different outcomes depending on how they operationalize their Continuous Threat Exposure Management (CTEM) program. In this video, learn what separates reactive, ad hoc security validation from a mature CTEM program—including: See how a structured CTEM program can turn continuous security validation into measurable progress across your organization.
What Campaigns Like Grandoreiro Teach Us About Threat Detection
The recent Grandoreiro campaign detected by the WatchGuard Threat Lab team is a clear example of how today’s threats combine different techniques to make detection more difficult and operate more discreetly. In this case, the attack begins with a phishing email designed to persuade the user to click a link. From there, the victim is taken through several redirects and eventually downloads a compressed file from well-known services such as Dropbox or MediaFire.
Domain Monitor Now Catches the Impersonation Attempts Keyword Matching Was Built to Miss
Domain Monitor's detection engine has been rebuilt to catch impersonation domains that keyword matching was never built to find. This release covers the new evidence-based matching engine, per-keyword Low, Medium and High thresholds, and what's coming next as the improvements roll out in stages. Domain Monitor's detection engine has been rebuilt from the ground up.
The Art of Detection Engineering: Why Great Detections Are Built with You
Out-of-the-box detection content gives security teams a strong starting point from day one. Its full value emerges when that content is tuned to reflect the users, systems, workflows, and risks unique to your environment. This article walks through why tuning matters, how mature security teams approach it, and how Securonix helps turn expert-built detection content into high-fidelity security outcomes.
Sophos Managed Detection and Response (MDR) Overview
AI speed. Human judgment. Fully managed. Sophos MDR: the world's largest agentic SOC. Speak with an expert.
The Structure of Sophos Fusion
Sophos Fusion isn't another platform. It's an AI-native cyber defense system that connects security controls, intelligence, data, services, and human expertise into one coordinated defense. Watch Raja Patel explain the foundation of Sophos Fusion and how it's built for the AI era.
Threat Detection for AI for Enhanced Security Monitoring
Securonix has released a Value Package with OOTB policies for detecting threats across AI platform, identities, agents, data movement, endpoints, and network activity.
Evaluating AI systems at Corelight
AI system evaluation is the process of continuously assessing AI system capabilities, limitations, and performance through quantitative and qualitative measures. Across the system lifecycle, evals provide continuous assurance: Validating system behavior before deployment and detecting drift, bias, and reliability issues in production.
Hunting the Undead: Accelerating NetNTLMv1 Lookups Without GPUs
Outdated protocols, forgotten configurations, and legacy dependencies continue to create opportunities for attackers in modern environments. This research explores how NetNTLMv1 can still be leveraged today and how improvements in attack tooling are reducing the cost and complexity of exploiting it.
Episode 21 - Building AI Harnesses to Unify Detection and Response
Corelight Senior Security Engineer Jordan Hair joins Richard Bejtlich to break down how defense teams can leverage agentic AI harnesses to transform traditional security operations. By wrapping deterministic code around large language models, Hare created automated agents for alert triage, threat hunting, and detection engineering that shrink routine investigations from 45 minutes down to seconds.
Securing Black Hat's NOC: Lessons from James Pope of Corelight
Corelight’s James Pope joins Dark Reading’s Joan Goodchild at Black Hat USA to share lessons from more than a decade defending one of cybersecurity’s most unique network environments: the Black Hat Network Operations Center (NOC). As SOC lead for the Black Hat NOC since 2014, James helps oversee more than 100 analysts, threat hunters, and partners tasked with distinguishing legitimate security research from real attacks across a network built from scratch for the conference.
Sophos MDR: Define MDR Contacts in Sophos Central
A step-by-step tutorial showing you how to define your Sophos Managed Detection and Response (MDR) authorized contacts and threat response mode in Sophos Central. As a Sophos MDR customer, assigning authorized contacts lets you fully utilize the service. This instructs the Sophos MDR Operations team who to contact and how to take action during an active threat. You're prompted to take these steps in Sophos Central after activating a new Sophos MDR license, and you can modify this information at any time.
Threat Actor Dark Factory (The Future of Al Hacking?) | The X-Ops Brief
A criminal talked commercial AI models past their guardrails. Then stood up a "company" of AI agents that engineered, tested and refined malware. It began when Sophos analysts found a folder named "test" on an endpoint nobody recognised. Inside was the front end of a machine: Cobalt Strike profiles, a Telegram command channel, a hidden Sliver server behind Cloudflare and scripts written with the help of AI.
ClickFix campaign abuses Deno runtime for infostealer delivery
Counter Threat Unit (CTU) researchers investigated a June 2026 campaign in which threat actors used the Deno JavaScript runtime as a core execution mechanism within a ClickFix-driven intrusion chain. On June 3 and June 4, compromised WordPress sites served Cloudflare-themed ClickFix lures that prompted users to execute a clipboard-delivered PowerShell command. This command initiated an MSI-based staging process that installed Deno and enabled retrieval and execution of remote JavaScript.
Mythos: When Al becomes the attacker, the network becomes the first line of defense.
Cyber defense in the age of Mythos Advanced AI has fundamentally shifted the security landscape, shrinking the window for vulnerability exploitation from weeks to hours. When standard patching workflows can't keep pace, your network becomes your most critical line of defense. In this video, we explore how Corelight transforms network traffic into actionable security insights to power your SOC. The best data drives the best defense. Discover how to improve your SOC outcomes by up to 300% over legacy data.
Cybersecurity Threat Detection: A SOC Guide for 2026
You're probably living this already. Your SIEM is collecting more logs than anyone can read, your endpoint tool is firing alerts that look urgent until they aren't, and someone on the leadership team keeps asking whether the organization is “covered” without defining what covered means. That's the pressure behind cybersecurity threat detection in 2026. Teams don't need another disconnected console.
Sophos Announces Partnership with OpenAI to Bring Frontier AI to the Channel
A dedicated channel partnership brings frontier AI to the channel and service providers through Sophos Fusion, powering new security services partners can build on.
Your Microsoft Sentinel Has the Data. Does It Have the Detection Depth?
How behavior-driven analytics can improve detection coverage, reduce SOC engineering work, and maximize the value of your Sentinel investment.
Getting More Detection Value from Microsoft Sentinel
Detection engineering has become one of the least questioned costs in the modern SOC. Teams write queries, tune thresholds, maintain exceptions, and build enrichment logic because that work has gradually become part of running Microsoft Sentinel. While necessary, it still relies heavily on manual effort. Microsoft Sentinel gives security teams a strong foundation for collecting telemetry, investigating incidents, and orchestrating response.
7 Ways to Improve Microsoft Sentinel Detection Outcomes
See how Securonix Threat Analytics helps security teams improve detection coverage, reduce SOC engineering work, and maximize Microsoft Sentinel ROI. Microsoft Sentinel provides a strong foundation for security operations. As environments grow more complex, detecting sophisticated attacks often requires extensive engineering, custom KQL development, and ongoing content maintenance.