Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The China-based threat group uses DLL sideloading in these attacks Counter Threat Unit (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading.

This article is part of an ongoing series from Sophos frontline security operations specialists, sharing the expertise they use to strengthen our industry-leading Managed Detection and Response (MDR) service and defend customers against evolving AI-era threats. A 20% growth forecast for cybersecurity talent sounds significant. I believe it understates what we are going to see in Incident Response. The U.S.

Blocking an exfiltration means deciding, in the moment, whether the data leaving a device is sensitive. That turns a detection platform built for accuracy and scale into one that must also answer in milliseconds. Nightfall pioneered the AI-first approach to DLP. Instead of leaning on regular expressions and pattern matching alone, we use language-aware machine learning models that understand the context sensitive data appears in.

What if security teams could combine knowledge of which systems are vulnerable with evidence of how an attacker is actually moving through the network?

Cybersecurity Awareness Month encourages organizations to examine the controls behind everyday security habits. Training helps employees spot phishing and use strong authentication but does not resolve gaps in systems that govern access. Many organizations manage employee access through an identity provider (IdP) and single sign-on (SSO). However, not every AI or SaaS application connects to those systems.

Every MSP has heard the question in some form: how do you know this actually works? For most security products, the honest answer is a mix of vendor documentation, analyst reports, and your own experience. All useful, but none of it is a verdict from someone with no stake in the result. Spain’s public sector works differently. When government agencies there buy security products, they look to CPSTIC, a catalog run by Spain’s National Cryptologic Centre (CCN).

Some cyber incidents leave no margin for error, whether that's an attack that interrupts energy, water, or financial services, or a breach that triggers reporting obligations in several jurisdictions within hours. The UK National Cyber Security Centre (NCSC) created the Enhanced Level of its Cyber Incident Response (CIR) scheme for incidents like these. It recognizes providers that meet rigorous standards for high-quality incident response, at the highest level of risk.

Chris Kissel, Vice President of IDC Security & Trust, just drew a line in the sand for the AI SOC category with one simple sentence: “Vendors that can show their agents reason transparently, act within defined guardrails, and improve with each investigation will define this category. The rest will be measured against them.” We couldn’t agree more.

The quick answer: A disaster recovery (DR) plan is only a hypothesis until it’s tested under real conditions. Regular, scoped DR and cyber recovery testing, covering people, dependencies, data, and systems, exposes the gaps that a written plan can’t reveal. 11:11 Systems helps IT and business continuity leaders validate recovery readiness before a real incident forces the issue. Think of a DR plan like a fire escape map taped to the back of a hotel room door.