Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The Sophos AI team presents new research on anomaly detection Following on from research presented at Black Hat USA 2025, Sophos data scientists Ben Gelman, Tamas Nyiri, and Tibor Kristóf Lányi recently showcased new work on anomaly detection at BSides Las Vegas 2026. As promised, we’re sharing more details of that research (the recording of the talk is also available here). Supervised classifiers in cybersecurity are often trained on data that doesn't capture the most unusual examples.

In my last post I used an AI agent to work out the blast radius of a compromise, and the agent found something I had not been looking for: other AI agents inside the blast radius. On an administrator's workstation, AI coding assistants were running Model Context Protocol (MCP) servers that the administrator had set up, and those servers held privileged credentials for security tools and other administrative resources.

A new supply chain attack hits the news. A CVE with a dramatic name starts trending. A malicious package turns up in npm, PyPI, and Hugging Face. Within minutes, your Slack channels fill up, your CISO wants an update, and someone asks the question every DevSecOps professional dreads.

Insights from 217 IT and cybersecurity leaders across the retail sector in 17 countries whose organizations were hit by ransomware in the past year. This year’s State of Ransomware in Retail report showed significant improvement in the sector’s ransomware outcomes mixed with a few concerning new trends. Retail organizations paid less money to attackers than any other sector and had the fastest recovery times of any year in the survey’s history.

The Sophos AI team presents new research at BSides Sydney On November 7, 2026, Principal Data Scientist Younghoo Lee will present a talk at BSides Sydney entitled "Decode facts, then reason: Detecting obfuscated malicious agent skills with small LLMs." The talk presents a practical hybrid architecture for addressing a distinct software supply chain trust boundary: AI agent ‘skills’ that may be malicious, in contrast to their declared intent.

This year’s State of Ransomware survey showed financial services and insurance providers handing over less money to attackers than it did a year ago. Median ransom demands fell by two-thirds and median payments continued a three-year slide. The recovery story was less positive. The sector took a week longer to recover than last year, and its typical recovery bill is double the median across all sectors.