We offer a practical roadmap for evolving informal, ad hoc threat hunting practices into a mature, scalable program—covering key friction points, structural strategies, and tooling approaches organizations need to grow effectively

Assistive AI agents aren't always helpful—it all depends on who they're working on behalf of.

Your "agentic coworker" is sending suspicious messages via Microsoft Teams. It's going to need to have a chat with the agentic HR department.

We kick off a new blog series with a primer on how to detect and respond to an autonomous agent escalating privileges and persisting in your Entra ID tenant

Used primarily for resource management, cgroups unlock valuable telemetry for investigating malicious processes on Linux

Unit 42 highlights the need for a comprehensive security strategy that spans every IT zone. Explore the full details here.

The post Essential Data Sources for Detection Beyond the Endpoint appeared first on Unit 42.

Our annual analysis brings you a year’s worth of security operations and intelligence insights, including how adversaries are both leveraging and targeting AI

How to use the open source Assemblyline tool to track browser extension updates and detect malicious code

We deconstruct a multi-step threat hunt for malicious OpenClaw AI agents, outlining our approach to identifying and mitigating risks posed by unauthorized AI skills.

How to detect and respond to OAuth consent attacks in Google Workspace

How to observe, detect, investigate and mitigate against overly permissive Entra app consent

Unit 42 research reveals most OT attacks begin in IT. Learn how edge-driven defense stops threats early and turns dwell time into advantage.

The post Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security appeared first on Unit 42.

Everything you need to know to detect and prevent npm compromises from Shai-Hulud’s latest campaign