Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Inside the mind of a cybersecurity threat hunter part 3: hunting for adversaries moving inside your network

Welcome back to our threat hunting series with Corelight and CrowdStrike. In our previous posts, we armed you with techniques to spot adversaries during Initial Access and how they establish Persistence to maintain their foothold. Now, we're diving into the shadowy dance of Defense Evasion and Lateral Movement.

Zenity 2025 Year in Review: Building AI Security for the Enterprise

For security teams, the adoption of agents showed up operationally before it showed up strategically - creating new expectations and requirements. Risk is no longer tied to prompts or the model alone. It shows up in what agents do once they are connected to critical systems - coming from permissions they inherit, tools they invoke, and data they move.

From Finding to Fix: Remediation Orchestration When Asset Ownership Is Missing

Security teams don’t struggle to find issues. They struggle to move them forward. In this use case demo, we show how remediation coordination breaks down when assets have no clear owner, and how remediation orchestration restores accountability across teams, tools, and environments. You’ll see how security teams can move beyond manual handoffs, Slack messages, and guesswork by orchestrating remediation across teams, even when ownership is unclear or spans multiple domains.

Authenticate ggshield with GitGuardian (browser login, tokens, and api-status)

Now that ggshield is installed, the next step is to authenticate it with GitGuardian so it can scan and talk to the API. The most common method is browser-based login: ggshield auth login This opens your browser and prompts you to sign in through the GitGuardian dashboard. It automatically generates an access token for you and stores it safely in your local configuration. By default, the token is scoped for secret scanning, which is what most people need. We’ll revisit scopes later.

Garrett Hamilton & Todd Graham on How AI Agents Change the Way We Think About Security

Garrett Hamilton, CEO and Co-Founder of Reach Security, sits down with Todd Graham, Managing Partner at Microsoft’s venture fund M12, to discuss why modern cybersecurity programs struggle to reduce real risk — despite massive spending on tools. Recorded at Black Hat, the conversation explores how misconfigurations, unused controls, and operational blind spots create exposure long before attackers need advanced techniques.

Why Knowing ATT&CK Isn't Enough: Mapping Real Control Coverage with Reach

Security teams know the attack techniques. What they don’t always know is how those techniques actually land in their environment. Reach maps your existing controls to MITRE ATT&CK (and D3FEND) and shows—visually—︎ which techniques are covered︎ which tools provide that coverage︎ and where real gaps exist Because “we have the tool” isn’t the same as “the technique is stopped.”

DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport

Static credential practices — where certificates, keys, and tokens persist for months or years and are manually rotated — create systemic risk in DevOps pipelines. Rotating these secrets is time-consuming and costly. In fact, organizations may spend dozens of hours and involve multiple teams to rotate a single credential. Manual rotation quickly becomes impractical across thousands of service accounts. In this post, you will learn.

Bitsight Threat Intelligence Briefing: Top TTPs Leveraged by Threat Actors in 2025

As the global cyber threat landscape evolves, adversaries continue to refine and adapt their tactics. Bitsight threat intelligence indicates that there are several tactics, techniques, and procedures (TTPs) that are most commonly and consistently leveraged by threat actors. These attacks are not isolated; they’re systemic.

How Appknox reporting and analytics make security data usable across teams

Security reporting only works when the right people can use it. Appknox reporting and analytics are designed to help security leaders, AppSec teams, and developers work from the same data—without translation layers or manual fixes—so teams can meet targets for report delivery and act faster.