Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

sophos

Your training data is boring: Anomaly detection with LLMs

Nov 11, 2026 By Ben Gelman In Sophos
The Sophos AI team presents new research on anomaly detection Following on from research presented at Black Hat USA 2025, Sophos data scientists Ben Gelman, Tamas Nyiri, and Tibor Kristóf Lányi recently showcased new work on anomaly detection at BSides Las Vegas 2026. As promised, we’re sharing more details of that research (the recording of the talk is also available here). Supervised classifiers in cybersecurity are often trained on data that doesn't capture the most unusual examples.
Read Post

WAAP Sprawl: Simplifying Web and API Security in a Fragmented World

Nov 11, 2026 By LevelBlue In LevelBlue
As API usage surges and application environments evolve, organizations are increasingly relying on a mix of WAFs, DDoS protection, API security, and bot management tools, often from different vendors. While many have coverage across key areas, this fragmented approach leads to what we call WAAP sprawl: multiple tools, multiple vendors, and increased complexity. Can organizations effectively manage all of this?
View Video

Enterprise Strategy Group: Best Practices for Securing Your Gen AI Journey

Nov 11, 2026 By LevelBlue In LevelBlue
Many organizations that have historically been managing their security and network strategies independently from one another are looking to simplify and integrate their solution into a unified solution. In this instance, the value of a SASE solution is clear - but rolling out an effective implementation can be a challenge. This is where an MSSP can step in and provide the expertise to outline a proven strategy to move into a SASE solution that meets the customer where they are.
View Video
reach security

Disrupt PHP2Shell Post-Exploitation with CrowdStrike Controls

Nov 11, 2026 By Garrett Hamilton In Reach Security
Key Takeaways: Reachability determines exposure. Two servers with the same PHP2Shell vulnerability can face different levels of risk depending on accessible attack paths and existing protections. CrowdStrike can help disrupt post-exploitation activity. Falcon capabilities can detect or block malicious behaviors, including suspicious processes and command execution, even when a vulnerable service remains reachable. Effective protection depends on configuration.
Read Post
reach security

Don't Let Configuration Drift Reopen PHP2Shell Attack Paths

Nov 11, 2026 By Garrett Hamilton In Reach Security
Key Takeaways: Configuration drift can reopen attack paths. Changes to firewall rules, inspection settings, or endpoint policies can expose vulnerable systems that were previously protected. ‍ Vulnerability exposure changes even when the CVE doesn't. Security teams need to reassess reachability and existing protections as configurations and exploit intelligence evolve. ‍ Reach connects configuration drift to vulnerability exposure.
Read Post
Why Real New Social Accounts Get Mistaken for Fake Ones

Why Real New Social Accounts Get Mistaken for Fake Ones

Nov 11, 2026 By SecuritySenses In SecuritySenses
A real new account gets mistaken for a fake one because it shows the signals people are taught to check: a recent join date, a thin bio, a borrowed-looking photo, few posts and lopsided numbers. Only the join date is out of your hands. Fixing the rest before launch clears most of those flags.
Read Post
Google Workspace Security Audit Providers Compared: Scope, Timelines and Remediation

Google Workspace Security Audit Providers Compared: Scope, Timelines and Remediation

Nov 11, 2026 By SecuritySenses In SecuritySenses
Most Google Workspace tenants drift out of shape over time. Admin roles pile up, sharing defaults stay open, nd third-party apps collect permissions nobody remembers granting. A partner-led security audit is one of the quickest ways to find and close those gaps, but providers differ widely in what they check, how long they take and whether they help fix anything. This guide compares six providers offering Workspace security audits, using details from each provider's own service page. It also covers where automated scanning fits and what to agree in writing before any engagement starts.
Read Post
Why Your Google Ads Account Is Spending More and Converting Less

Why Your Google Ads Account Is Spending More and Converting Less

Nov 11, 2026 By SecuritySenses In SecuritySenses
Accounts rarely fail suddenly. They drift. Spend climbs a little each month, conversions flatten, and by the time someone notices, the cost per enquiry has doubled and nobody can point to the change that caused it. Usually there was no single change. There were six small ones. Here is where to look, roughly in the order that finds problems fastest.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.