Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In Hunting Citrix NetScaler zero-days with Corelight, we explored how network evidence from Corelight’s Open Network Detection and Response (NDR) Platform can help identify candidate NetScaler appliances, observe DTLS use and hunt for suspicious activity.

Part 2 of 3 in our Rethinking Privileged Access series. Start with Part 1: The password was never the only problem. In Part 1, we drew the line between the vault-and-checkout model of legacy PAM and the session-and-Activities model of modern PAM with Netwrix Privilege Secure (NPS). One protects the password; the other eliminates the standing privilege behind it. That framing is a good starting point, but it understates the case. In Windows and Active Directory, the password is just the seed.

A legitimate sender does not mean legitimate content. Attackers have abused legitimate services such as DocuSign, SharePoint, Adobe Sign, Dropbox and Google Drive to exploit that trust for years. KnowBe4's Phishing Threat Trends Report Vol. 7, released April 2026, flagged this shift at the industry level: 22% of all phishing attacks are now sent through a legitimate platform, with attackers moving from impersonating a brand to abusing that brand's actual infrastructure.

When I got back from Black Hat USA, I was stunned. Of course, it’s easy to be overwhelmed by Black Hat. There is so much going on. Las Vegas casinos are loud and flashy. Going outdoors feels like standing on the surface of the sun. Everywhere you walk there are strong smells, and you hope it’s a delicious meal, but sometimes it’s not.

Accelerating security solutions for small businesses‍ Tagore offers strategic services to small businesses. A partnership that can scale‍ Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate. Standing out from competitors‍ Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market.

AI agents are moving beyond the browser and into the desktop applications professionals use every day. Egnyte is excited to announce a new collaboration with Microsoft to bring Egnyte AI to Windows 11 through Microsoft Execution Containers (MXC), enabling AI agents to work directly alongside desktop applications while operating within enterprise security boundaries.

An AI agent runs with your credentials and acts before you can stop it. Nine incidents show what that costs. Six controls limit the damage: sandbox the agent, scope its credentials, lock its configuration, log every call, scan the workspace first, and deny by default.

SOC metrics are quantifiable measures of how well a security operations center detects, investigates, and contains threats. The metrics that matter most are mean time to detect (MTTD), mean time to respond (MTTR), and incident closure rate, because together they show speed, effectiveness, and reliability, not just activity.

A conventional AI chatbot answers a question and stops there. An AI agent can plan a sequence of steps, choose which tools to call, use credentials, change systems, and hand work off to other agents, sometimes without a human reviewing each move. Security teams are under increasing pressure to keep pace.

Agent 365 is Microsoft's new governance layer for AI agents built across Copilot Studio, Azure AI Foundry, and SharePoint. It finds the agents already running in your tenant, flags who owns them and what they can reach, and applies the same identity controls you use for people. Most organizations have more agents out there than they think.