The AI Malware Surge: Behavior, Attribution, and Defensive Readiness

Over the last year, AI-assisted malware development has evolved from an experimental practice into a common part of the attacker toolkit. In a rolling window from February 2025 to February 2026, Arctic Wolf Labs observed over 22,000 distinct files triggering AI-focused YARA rules across multiple malware repositories. These files included AI-generated code, large language model (LLM)-style scaffolding, runtime AI API integration, and DeepSeek-derived artifacts.

How To Protect Patient Data From Phishing Attacks

According to HIPAA Journal, phishing remains one of the most common and effective attack methods used against healthcare organizations and is a leading cause of healthcare data breaches. As healthcare becomes more digital, cybercriminals increasingly target clinicians and administrative staff to access Electronic Health Records (EHRs) and other Protected Health Information (PHI).

The Future of Intelligent SOC -- Customer Brown Bag -- March 19th, 2026

Join us as Christopher explores how to build a modern, intelligent SOC with decision-ready detection, shared adversary context, and automated response that empowers faster, more confident security operations, featuring the role of the Sumo Logic SOC Agent in streamlining investigations and accelerating response.

Gary Hibberd on InfoSec, GDPR and Owning Your Space

This episode explores why information security needs more wisdom, less noise and fewer empty promises about being “GDPR compliant.” It covers slowing down, valuing data properly, cutting through bad advice and why InfoSec professionals need to own their place as integral voices in modern organisations.  ⸻ For more information about us or if you have any questions you would like us to discuss email podcast@razorthorn.com. We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion..

Introducing IP Range Scanning: continuous Surface Monitoring for your entire network

Most organizations share a common, uncomfortable secret: they can’t answer basic questions about what is actually exposed on their IP ranges. As companies grow, whether through decades of history, global data centers, or regional allocations, they lose visibility of their IP footprint. Traditional manual reconnaissance is a point-in-time sync, often leaving security teams blind to what’s actually running on their infrastructure.

Spring 2026 GenAI Code Security Update: Despite Claims, AI Models Are Still Failing Security

The last six months have been nothing short of revolutionary for AI-powered coding. OpenAI‘s “Code Red” release brought us GPT-5.1 and 5.2. Google unveiled Gemini 3 with its touted “unprecedented reasoning capabilities.” Anthropic rolled out Claude 4.5 and 4.6, powering the increasingly ubiquitous Claude Code features. Enterprise adoption of tools like OpenClaw has exploded, with developers praising unprecedented productivity gains.

Identity and Access Management (IAM) Use Cases

Before the COVID-19 pandemic, when hybrid and remote work became common, Identity and Access Management (IAM) worked in the background. It was important, but mostly invisible outside IT and security teams. That’s not the case anymore. Today, identity shows up in almost every digital interaction. Employees move between devices. Customers expect sign-ins to just work. Compliance teams want clear answers about access trails. Industry trends reflect this shift.

SMB Cybersecurity Spending Rises: Zero Trust & Secure Access Now Essential

Cybersecurity is no longer just for large enterprises. Small and medium-sized businesses (SMBs) are boosting security investments as cyber risks increase and digital operations expand. According to Omdia, SMBs account for more than 99% of organizations worldwide. In 2025, these businesses increased their cybersecurity spending by 11%, reaching $64.3 billion. This surge reflects an important shift. SMBs are no longer treating cybersecurity as a reactive IT expense.

The Library That Holds All Your AI Keys Was Just Backdoored: The LiteLLM Supply Chain Compromise

We just published a deep breakdown of the Trivy supply chain attacks yesterday. Twenty-four hours later, we’re writing about the next one. Same threat actor. Different target. Worse implications. This time it’s LiteLLM, the Python library that acts as a universal API gateway for over 100 LLM providers. If you’re building anything with AI agents, MCP servers, or LLM orchestration, there’s a good chance LiteLLM is somewhere in your dependency tree.