Rethinking defense entirely

We know attackers are already using AI to operate at machine speed, running more frequent and more effective attacks. They're automating reconnaissance, standing up infrastructure, and pivoting faster than human analysts can triage an alert. We have seen the cyber kill chain that used to unfold step by step now happens in the blink of an eye, and defenders are struggling to keep up in a fight that no longer gives them time to react.

It's clear that organizations need to reduce risk, defend pre-attack, and act at machine speed. But beyond just moving faster, they may need to rethink defense entirely. Imagine not scrambling to keep pace with the threat landscape, but moving with it: changing as it changes and acting as fast as the attacker acts. That's a world where an autonomous defense system works alongside defenders, applying intelligence at the speed and scale today's threats demand.

Today at Mastercard RiskX in Arizona, we premiered an autonomous defense platform built into Recorded Future. The age of AI action has arrived, and we're excited to show you what's next. Read on to see how this capability came to be, why it's a fundamentally different way to defend, and how you can be a part of it.

From answers to actions

AI for threat intelligence has come a long way. In a short time, analysts and security leaders have gone from searching for answers to finding them fast, thanks to capabilities like AI Insights and Sessions in Recorded Future AI. At the core of it all is the Intelligence Graph®, which turns large sums of data and information into actionable insights, and gives Recorded Future AI the context to deliver the right answer to analysts in seconds.

That success created a new demand: Analysts and business leaders wanted this same intelligence, at the same speed, everywhere they worked — not just inside the Recorded Future Platform. That's why we built Recorded Future Model Context Protocol (MCP). Agents, whether ours or our customers', run across many tools and platforms. This gives them direct, standardized, and cost-efficient access to Recorded Future intelligence.

The Intelligence Graph®, Recorded Future AI's Insights and Sessions, and Recorded Future MCP have laid the foundation for what comes next: defending at the pace adversaries set. To keep up with adversaries, analysts need to act at their speed, confidently taking 10 actions where they once had time for one. They need to spend their time focused on business outcomes, not buried in process. Ultimately, they need a fundamentally different way to use intelligence and act. That's why we're building autonomous defense.

What autonomous defense can do

This is a different way to think about the day-to-day analyst workflow. Analysts can task Recorded Future’s autonomous defense with a goal, not just a question, and it will go from there: drawing on the Intelligence Graph®, deciding what the situation calls for, and delivering outputs directly into your team's existing tools across over 100 integrations. It can act on your behalf, clearing away work so your team can focus on the outcome, not the process.

Autonomous defense runs on the Intelligence Graph® with over 15 years of threat intelligence and analyst research, combined with your own organizational context through your Private Graph, so the system knows what's relevant before anything happens. It's the same intelligence layer customers already use across cyber operations, third-party risk, digital risk protection, and counter-fraud, now can be put to work taking agentic action. When your threat priorities shift or a new vulnerability surfaces, agents already understand why it matters to your environment and start acting in real time.

What this looks like from start to finish: A trigger like a new high-priority threat actor, a malicious website notification, or a critical third-party vulnerability starts the workflow. The Platform reasons through what matters, pulling intelligence and building a hunting package, checking a site's ownership to assess takedown eligibility, or drafting outreach and confirming approvals. Then it can act, including running the hunt and blocking the threat, initiating and monitoring a takedown, or notifying your third party and tracking remediation.

Agents default to fully autonomous execution, because defending at machine speed requires it, but teams that want human review first can dial back to managed autonomy. The result is a system, not just a model, that connects detection, investigation, and response into a single workflow. But a capability like this only matters if you can trust it, which is where Recorded Future’s autonomous defense sets itself apart.

A fundamentally different approach

AI security tools have exploded, but much of the industry feels oversold. Dashboards relabeled. SOAR engines rebranded, chatbots dressed up in analyst clothing. Security teams have grown skeptical of the pattern, and rightly so.

What makes Recorded Future's autonomous defense different?

1. Reasoning models and agent frameworks are becoming commodities. Nearly any vendor can wire up an agent loop. What's scarce is trustworthy, structured intelligence for those agents to reason over. That's what we've spent over 15 years building, and it's the foundation every Recorded Future agent runs on. Frontier models generally lack this training on relevant data.
2. It's grounded in the deepest threat intelligence available. Claims about a threat actor's infrastructure, a vulnerability's exploitation status, or a campaign's targeting come from the Intelligence Graph®: continuous analysis across open, dark, and technical web sources, enriched by Insikt Group's analysts. Not plausible-sounding guesses from general training data. Real intelligence, sourced, traceable, and trustworthy.
3. It's architecturally agentic, not superficially so. Most agents have to poll the world to notice that something has changed. Recorded Future agents subscribe to changes in the Intelligence Graph® and get real-time triggers the moment something relevant moves, so they act on signals instead of burning cycles searching for them. This isn't a chat interface bolted onto a search box. It's purpose-built for how security work actually happens.
4. Every output is auditable. Security teams can't operate on black-box AI. Trust requires transparency. Recorded Future shows its work, so every source, step, and conclusion can be traced. When it flags a threat as high priority, you can see exactly why.
5. Intelligence that ends in a chat window has limited value. Recorded Future delivers outputs into SIEM platforms, ticketing systems, communication tools, and the rest of your security stack where the work actually happens.

This is the beginning

We believe that what we're announcing today is a real leap in what security teams can accomplish: workflows that can eliminate critical threats, hours returned to the analyst, and coverage that wasn't previously achievable. And we're not stopping here.

We're already building expanded multi-agent architectures, where AI agents collaborate on complex, long-running investigations. We're building toward AI that monitors threat groups and updates intelligence continuously over weeks, not sessions. And we're extending the integration layer so Recorded Future AI doesn't just deliver intelligence into your stack, it participates in it.

This is a new era of defense, and we know that many of our customers are as excited about it as we are. If you're a Recorded Future customer and want to be part of what's next, apply for early access here. Autonomous defense is planned for general availability early next year.

Ransomware does not start when files are encrypted. By then, an attacker may already have obtained valid credentials, entered the network, moved between systems and established a command-and-control (C2) channel.

That gives defenders an earlier window to act. Ransomware threat intelligence helps security teams identify the actors, infrastructure and access methods connected to ransomware activity before an attack reaches its final stage. Instead of waiting for an endpoint alert or ransom note, teams can look for exposed credentials, malicious infrastructure and known attacker behavior, then act on the threats most relevant to their organization.

The need for that earlier view is growing. Modern ransomware operations may use Ransomware-as-a-Service (RaaS) models and double- or triple-extortion tactics, giving defenders more reason to identify warning signs before encryption.

Key takeaways

• Ransomware threat intelligence can expose signs of an attack before encryption, including compromised access and attacker infrastructure.
• IOCs remain useful, but TTPs provide longer-lasting context because attacker behavior changes less quickly than individual IP addresses or file hashes.
• Early disruption can focus on closing initial access paths or cutting communication between compromised systems and known C2 infrastructure.
• Recorded Future assists in connecting ransomware intelligence with organizational exposure, threat actor context and existing security workflows so teams can better prioritize action.

Why reactive ransomware defense is not enough

Reactive controls remain important, but they often cannot provide the external context security teams need to identify which ransomware threats are most likely to reach their environment.

Endpoint detection and response (EDR), network monitoring, and backups all have a role in ransomware defense. The problem is timing. If a team only acts after malicious behavior appears inside its environment, the attacker may already have gained access or started moving toward systems that matter.

This is where modern ransomware detection benefits from external intelligence. Security teams can compare what they see internally with information about active ransomware groups, infrastructure and exploitation activity outside their network.

IOCs show what happened. TTPs help anticipate what comes next.

Indicators of compromise (IOCs), such as malicious IP addresses, domains, and file hashes, can help security controls identify known threats. They also typically have a short shelf life when attackers rotate infrastructure or alter malware.

Tactics, techniques, and procedures (TTPs) describe how an adversary operates. MITRE ATT&CK organizes those behaviors across stages such as initial access, lateral movement and command and control.

A ransomware actor can quickly replace an IP address. Changing a working attack method takes more effort. Tracking both IOCs and TTPs gives defenders a stronger basis for deciding what to block now and what behavior to watch for next.

The goal is not to replace IOC-based detection. It is to add enough context to understand who may be behind an indicator, how it fits into an attack, and what the adversary is likely to attempt next.

How does Threat Intelligence help prevent ransomware attacks?

The best time to disrupt ransomware is before the attacker reaches the impact stage. Threat intelligence creates opportunities to act during initial access and C2 activity rather than relying on recovery after encryption.

External intelligence can reveal parts of the ransomware operation that are difficult to see from internal telemetry alone. That includes activity in criminal marketplaces as well as infrastructure connected to known threat actors.

Phase 1: Track the adversary outside your network

Initial access is often a business in its own right. Initial access brokers (IABs) obtain access to compromised organizations and advertise it to other criminals. Threat intelligence can surface compromised credentials and exposed Remote Desktop Protocol (RDP) access associated with an organization. It can also monitor IAB listings, actor chatter, and target discussions for warning signs before that access is used.

Monitoring those sources can give security teams a warning that credentials or access associated with their organization are exposed. A credential discovered for sale does not prove that a ransomware attack will follow, but it creates a specific risk that defenders can investigate before someone uses that access.

Threat intelligence can also connect ransomware groups with domains, IP addresses, and other infrastructure associated with their operations. Malware analysis and controlled sandbox testing can add newly observed indicators and behavioral information.

C2 intelligence is especially useful because command-and-control gives attackers a way to communicate with systems they have compromised. If defenders know the infrastructure associated with an active threat actor, they can look for related connections within their own network rather than waiting for the ransomware payload to execute.

Phase 2: Act at the point of disruption

Tracking only matters if the intelligence changes what the security team does.

At initial access, one priority is removing the opportunity before an attacker can use it. If exposed corporate credentials appear in criminal sources, the organization can investigate the affected account, reset credentials where needed, and review authentication activity for signs of misuse.

The same principle applies to vulnerabilities. A large vulnerability backlog does not indicate which flaw an attacker is likely to exploit first. Vulnerability intelligence adds evidence of exploitation activity, enabling teams to respond faster to weaknesses associated with active threats rather than relying on severity scores alone.

C2 creates another intervention point. High-confidence indicators associated with malicious infrastructure can be supplied to security controls so connections are blocked or detected earlier. If an endpoint begins communicating with known C2 infrastructure, the security team can investigate and isolate the affected system before the attacker progresses further.

Disruption does not always require taking criminal infrastructure offline. For an individual organization, breaking the attacker's access to its environment can be enough to stop that attack path.

These controls should sit alongside broader guidance on how to prevent ransomware, including identity protection, patching, and recovery planning. Threat intelligence makes those efforts more targeted by showing teams where an active threat is most likely to intersect with their environment.

Recorded Future turns ransomware intelligence into action

Recorded Future helps security teams connect external ransomware activity with their own exposure so they can spend less time sorting through threat data and more time acting on relevant risks.

Recorded Future’s ransomware mitigation capabilities bring together threat research, dark web intelligence and information about an organization's attack surface. Threat actor, industry and TTP context helps teams narrow their attention to ransomware threats that warrant attention.

Reduce research time with the Intelligence Graph^Ⓡ

A large feed of indicators can contribute to alert fatigue if analysts must investigate each item manually. Recorded Future's Intelligence Graph^Ⓡ connects information about threat actors with associated malware, infrastructure, and vulnerabilities.

That context helps analysts move from an isolated indicator to the relationships around it. Rather than treating every IOC as equally important, teams can assess how an indicator relates to an active threat and whether that threat is relevant to their organization.

Recorded Future uses AI to collect, process, and correlate threat data within the Intelligence Graph. This helps reduce repetitive research and enables teams to prioritize relevant findings.

Focus on the ransomware actors most relevant to your organization

Not every ransomware group has the same targets. Industry, geography and previous victim patterns can help analysts understand where a threat actor tends to focus.

Recorded Future's Ransomware Risk Profile provides a view of an organization's ransomware exposure. Victimology insights help teams understand which ransomware groups and TTPs are most relevant based on targeting patterns such as industry and geography.

This allows SOC and threat intelligence teams to tune detection and hunting around ransomware groups whose past activity makes them more relevant to the business rather than treating the entire ransomware landscape as equally urgent.

Put intelligence into existing security workflows

Threat intelligence loses value when an analyst has to move findings manually from one tool to another.

Recorded Future can deliver intelligence through APIs and integrations with security information and event management (SIEM), security orchestration, automation, and response (SOAR), and endpoint detection and response (EDR) tools. Depending on the configured workflow, intelligence can add context to alerts and support automated blocking of malicious infrastructure.

Build an intelligence-driven ransomware defense

Ransomware threat intelligence changes the point at which defenders can respond. Instead of treating encryption as the first clear sign of an attack, teams can look for the access, infrastructure and behavior that come earlier.

This does not replace EDR, access controls or backups. It gives those defenses external context. A vulnerability becomes more urgent when a ransomware actor is actively exploiting it. An exposed credential becomes an immediate investigation point when criminals are offering access to the organization. A C2 indicator becomes more useful when analysts can connect it to the actor and TTPs behind it.

That earlier context can reduce both the likelihood of a successful attack and the damage an attacker can cause. Given how ransomware affects businesses, moving the disruption point earlier in the attack lifecycle can protect far more than encrypted files.

Ready to stop ransomware before a breach occurs? Explore our product tours to get a feel for how Recorded Future automates the tracking and disruption of the most relevant threat actors targeting your industry.

Ransomware Threat Intelligence FAQs

What is the primary difference between a reactive and a threat intelligence-led disruption strategy for ransomware?

A reactive strategy focuses on detecting and recovering from ransomware after malicious activity reaches the environment. A threat intelligence-led strategy looks for earlier warning signs, such as exposed access, known threat actor behavior and malicious infrastructure, so teams can intervene before encryption occurs.

Is paying a ransom ever considered an effective disruption strategy?

Paying a ransom occurs after an organization has already been compromised, so it is generally not a preemptive disruption strategy. Threat intelligence-led disruption focuses on stopping the attacker earlier in the ransomware lifecycle.

Which stages of the ransomware attack lifecycle offer the best opportunities for external disruption via threat intelligence?

Reconnaissance and command and control (C2) provide valuable opportunities for disruption. Threat intelligence can identify exposed credentials, access being advertised by initial access brokers and infrastructure associated with known ransomware actors before those resources are used against the organization.

How does Recorded Future use AI to accelerate ransomware disruption?

Recorded Future uses AI to collect, process and correlate threat data within the Intelligence Graph. This helps analysts connect indicators with threat actors, infrastructure and TTPs, reducing manual research and helping teams identify ransomware threats that require attention faster.

Can Recorded Future help our organization identify and mitigate our most critical ransomware exposure points?

Recorded Future combines vulnerability and attack surface intelligence with external threat context to help teams identify exposures associated with active ransomware threats. This can help security teams prioritize remediation based on evidence of exploitation and organizational risk rather than severity scores alone.

What is victimology in the context of ransomware intelligence, and how is it used to protect an organization?

Victimology examines the types of organizations ransomware groups have targeted, including patterns related to industry and geography. Security teams can use those patterns alongside threat actor TTPs to identify ransomware groups that may be more relevant to their organization and adjust detection and hunting accordingly.

How is the rise of Ransomware-as-a-Service impacting the way organizations use threat intelligence for tracking?

Ransomware-as-a-Service can separate ransomware operators from the affiliates carrying out attacks. Threat intelligence teams therefore need to track more than a single malware family, including affiliate behavior, initial access activity and criminal-market sources that may reveal how attacks are being prepared.

Recorded Future's Insikt Group^Ⓡ, our team of threat intelligence analysts and security researchers, has been tracking a technique called ClickFix as it works its way into a growing number of brand impersonation campaigns. We recently hosted a webinar digging into that research, and what stood out wasn't just the technique itself. There's no malware automatically installed, no exploit, just a page convincing enough that the victim ends up doing the damage themselves. It is also a strong example of the detection capabilities built into Malicious Site Monitoring, a new use case included in Digital Risk Protection, and a good way to show what those capabilities are actually built to catch.

How ClickFix actually works

ClickFix works by mimicking the visual language people already trust, a CAPTCHA prompt, a familiar logo, a "verify you're human" screen, and using that trust to get someone to run a command on their own machine. There's no code being smuggled past a firewall. The victim is the delivery mechanism.

That's also what makes it hard to catch with traditional tools. A page built to look exactly like a real verification screen doesn't behave like malware, and it doesn't trip the same alarms as a page trying to exploit a browser. It succeeds because the person on the other end believes they're completing something routine.

It's not static, either. The instructions can change depending on the operating system a victim is running, one path for Windows, a different one for macOS, which means the "fix" itself adapts to the target. A single signature or a one-off takedown was never going to keep up with that. Catching this at scale means watching for the pattern, not waiting to recognize a specific file.

Malicious Site Monitoring

This kind of research and the product built to act on it aren't two separate things. Digital Risk Protection's Malicious Site Monitoring is built to catch this exact category of infrastructure, phishing domains, lookalike sites, brand impersonation, fast enough to matter. Disposable infrastructure like this is designed to do its damage and disappear before anyone gets around to reporting it, so speed isn't just a nice-to-have here, it's a necessity.

Underneath that speed is a detection process built in layers. Analyst-built signatures catch known patterns with precision. Content similarity analysis can catch campaigns that move in clusters. Attackers often reuse the same page template across dozens of disposable domains, so even though each domain name looks unrelated, the pages themselves share the same structure underneath. A separate component flags a familiar logo or brand mark through screenshot analysis and Optical Character Recognition (OCR). Machine learning is often able to catch what the other methods might miss, sites that don't resemble any known signature or template, by predicting risk from the page's characteristics rather than requiring a direct match. That layered approach is what makes it possible to evaluate a massive volume of candidate domains and URLs every single day without generating excessive false positives.

From detection to takedown

Finding a threat fast doesn't help much if the next steps are still manual. The real shift in how Digital Risk Protection operates is this: detection, triage, and action now live in the same workflow.

Not every detection needs a human to look at it immediately, and that distinction matters. A multi-stage detection funnel helps filter raw monitoring volume down to those that could need a response, and for malicious sites specifically, an AI Triage Agent reviews flagged detections and delivers a verdict before anything reaches an analyst's queue. Instead of triaging a wall of alerts, teams are looking at a shortlist of things that already have context attached, what was found, why it matters, and what to do about it.

And when something does need action, takedown doesn't require a separate process. Coordination happens directly from the alert, one click, instead of manually chasing down registrars and hosting providers one by one.

What this means going forward

ClickFix is one campaign type. It won't be the last one built this way, and it almost certainly won't be the most sophisticated one we see this year. The interesting story isn't any single technique, it's that the same detection engine tracking it in a research report is the one running in production, watching for the next one before it has a name.

If you want to see that detection-to-action workflow in practice, not just malicious sites, but the full picture across dark web monitoring, code repository exposure, impersonation, and identity monitoring, take a self-guided click-through of Digital Risk Protection or request a demo. If you're already a customer, your account team can walk you through what this looks like against your own brand.

Frequently asked questions

Is ClickFix something Digital Risk Protection can actually detect, or just something Insikt Group writes about?

Both. The detection methodology behind the ClickFix research, layered signature, similarity, and machine learning analysis, is the same engine running inside Malicious Site Monitoring today. The research isn't separate from the product; it's built on it.

Is the AI Triage Agent available for this use case?

Yes. Malicious Site Monitoring is one of two use cases, alongside Dark Web Brand Monitoring, where the AI Triage Agent is live today. It reviews flagged detections and delivers a verdict before anything reaches an analyst's queue.

How do I get access to Digital Risk Protection?

It's available as a standalone solution or as part of Recorded Future's Core, Professional, and Elite platform packages. If you already use Recorded Future for brand monitoring, it's available to activate directly in the platform. If you're new to Recorded Future, request a demo to see it in action.

The intelligence community has always done things the same way: Identify a potential source (a target); make a recruitment (an agent); train, brief, and run the agent in place to collect intelligence of value to decision makers.

A great agent gives the decision maker insight into intent, and a reasoning and decision advantage over his or her adversaries. In some circumstances, this advantage shapes destiny. Control over destiny is commonly called sovereignty.

AI has rapidly made reasoning ubiquitous; a commodity accessible to all at ever-decreasing marginal cost. In the age of AI, advantage accrues to those who use reason most effectively, make good decisions most quickly, and take actions most confidently. And who will do the bulk of this reasoning, make these decisions, and take these actions? Agents.

Agent Running in the Age of AI

Historically, agents were sources of intelligence but, in the age of AI, the new consumer of intelligence is an agent. Agents will be dependent on the quality and timeliness of the intelligence they receive to give them context, shape their priorities, drive their behavior, and ensure the quality of their actions. Every agent will need an intelligence layer it can trust. Recorded Future is that layer.

Recruiting and running human agents is hard and expensive, and very few have the resources and the expertise to do it well. One experienced MI6 officer might run a handful of agents at any one time. But the human-to-agent ratio is about to change dramatically as decision-making shifts from carbon to silicon, driving down the costs of agent running, but dramatically increasing our reliance on agent decisions and actions.

The best military and political outcomes often result from the seamless integration of different sources and types of intelligence to produce a true understanding of the threat or the objective to be met, enabling good decision-making and decisive actions. The Cuban Missile Crisis combined geospatial, human, and signals intelligence; the D-Day Landings combined signals, human, and meteorological intelligence. As frontier AI capabilities diffuse, and as agentic systems incorporate these capabilities into multi-agent workflows, the performance of these systems relative to others, and thus their ability to deliver advantage, will be determined by ongoing access to high-fidelity, multi-source intelligence.

This is already the case in the domain of cyber security. Intelligence-enriched systems and workflows learn more quickly, adapt more nimbly, and operate more efficiently and effectively than those they are competing with. The adoption rate of Recorded Future’s AI triage capabilities proves this hands down.

Intelligence platforms like Recorded Future, which shed light on threat actor tactics, techniques, and procedures (TTPs) in real time, and which scale with AI and agent capabilities, are the foundation for effective agentic systems. Intelligence-driven agent running will ensure better agentic decisions and actions, delivering an enduring advantage over adversaries.

As former CIA Director Bill Burns put it, “The foundation for good policy choices is good intelligence wisely used.” In the age of AI, agents will make those choices, and the value of good intelligence will be greater than ever.

Recorded Future was just named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026.

We’re incredibly proud of this acknowledgment, just as we are of every recognition we’ve received over the years. Behind every one of these industry evaluations is a lot of work that readers never see — including product demonstrations, customer reference calls, briefing presentations, and formal questionnaire submissions — all of it condensed into a single final report. But the most interesting part of any industry recognition is all the details and information that resides in the demos, decks, and responses, so we wanted to share some additional context on the factors that we believe contributed to our ranking this year.

Use this blog post as a companion guide when reading your complimentary copy of the Forrester Wave™ report, which you’ll find in the link below.

Get the report.

Superior support for Priority Intelligence Requirements

Priority Intelligence Requirements (PIRs) are foundational in helping security teams achieve meaningful outcomes, because they help shape data collection strategy and support the effective decision-making that enables machine-speed defense.

Recorded Future received the highest possible score in the PIR criterion. Forrester’s evaluation describes this score as for vendors that offer “superior support for features such as mechanisms to translate external PIRs meaningfully, advanced querying for building/optimizing PIRs, and structured management of General Intelligence Requirements.”

We’ve made PIRs a particular focus in the Recorded Future Platform, adding prebuilt PIRs and enabling customers to use them or define their own in our Impact and Metrics Dashboard. The dashboard surfaces metrics based on those requirements, so teams can more easily measure and better report on how successfully their programs are answering the key questions business leadership wants answered.

Extensive intelligence collection sources and deep and dark web monitoring

Intelligence is at the core of the modern security stack, and good intelligence is often what separates reactive security teams from proactive ones that can defend themselves pre-attack, at the first sign of threat.

To us, Forrester’s evaluation criteria show how important comprehensive intelligence collection is in providing security teams with full visibility across the threat landscape. Here are the different types of data sources we primarily index and analyze and how these data sources can be used for a multitude of use cases:

1. Technical intelligence — network traffic analysis across billions of daily data points from over 200 points of presence, internet-wide scanning and infrastructure monitoring, malware detonation and behavioral analysis, and vulnerability exploitation tracking
2. Underground intelligence — data gathered from criminal forums, marketplaces, and adversaries that can help identify stolen data and credentials, emerging attack techniques, threat actor intent, and ransomware victimology
3. Community intelligence — aggregated detections across customers that reveal patterns and campaign-level activity no single organization would usually catch on its own
4. Open-source intelligence — broader context from data leakage detection, code repository monitoring, social media monitoring, and web/HTML/DOM analysis to help catch brand abuse, impersonation, and exposed data

Threat hunting, vulnerability intelligence, third-party risk management, and more
We believe that receiving the highest possible scores in the Forrester Wave in criteria around multiple cybersecurity disciplines — including brand protection, third-party and supply chain intelligence, fraud intelligence, and threat hunting and vulnerability intelligence — demonstrate our commitment to providing powerful threat intelligence and defensive capabilities across the entire attack surface.

Figure 1: Unified threat intelligence visibility across the critical attack surfaces

As both human-directed and autonomous AI-powered attacks accelerate, security organizations, policymakers, and industry groups around the world are rethinking traditional approaches to defense.

Recorded Future CISO Jason Steer and Mastercard VP of Government Affairs and Policy Christian Ohanian recently sat down with Recorded Future’s Jon Miller to discuss how to build threat intelligence programs that can defend at machine speed, how emerging policy frameworks can help, and why high-quality intelligence is increasingly essential in this new era.

This blog offers highlights from the discussion. Watch the full event.

Evolving security standards and frameworks
Globally, security frameworks like the National Institute of Standards and Technology (NIST) Cyber AI Profile and Singapore’s cybersecurity guidelines are evolving to help organizations keep pace with new threats. According to Christian Ohanian, the goal is to encourage the adoption of AI to bolster resilience while also providing guidance on the kinds of AI-enabled threats organizations now face.

However, Ohanian pointed out that creating these standards involves debate. While some argue that frameworks should provide a clear, prioritized checklist to help resource-strapped teams improve their security programs, others believe that a "one-size-fits-all" approach fails to account for the unique risk profiles of different industries and organizations.

Jason Steer noted that while standards create a helpful taxonomy, the burden remains on CISOs to translate that language into business-specific risk decisions. “This is why intelligence is important,” he noted. “Every industry, every geography, has its own subtleties of attack, so leaning into ‘What are the real risks to my business?’ becomes the hardest part.”

The role of high-quality, purpose-fit intelligence
Ohanian noted that global security standards increasingly recognize that threat intelligence is a foundational component of modern defense. They’re also beginning to acknowledge that security organizations need to use AI and other autonomous solutions to improve the way they operationalize their intelligence. Framework discussions, he said, are now focused on “the importance of organizations looking really closely at how they can increase the speed of the way they’re using threat intelligence, how they can increase the accuracy of the prioritization of the alerts and warnings they’re getting.”

Ohanian emphasized that organizations must move beyond the simple acquisition of data and evaluate the intelligence sources feeding into their threat intelligence solutions. They need to look at "fit for purpose," ensuring that the intelligence aligns with the organization’s specific risk profile and governance requirements.

Steer agreed. “Coverage and collection at fast speed enable information to be brought together for people to assess the impact to their business,” he said. “But then it's only good if that information gets to the right people in the right tools.”

When it does, he said, high-quality intelligence can better fulfill its ultimate goal of providing “decision advantage”—enabling even less experienced SOC analysts to make quick, effective decisions.

Operationalizing security at machine speed
To begin operationalizing intelligence, organizations need to first know what they’re defending. Do they run software on-premise, in the cloud, or a combination of the two? Once they have a complete picture of the mission-critical systems they need to defend, Steer said, they’ll better understand the threats that might be targeting them.

Then, in order to achieve machine-speed defense against AI-driven attacks, organizations need the right API integrations. That way, they can send enriched, contextual threat data to their vulnerability tools and use AI to identify the clusters of high-risk activity where vulnerabilities intersect with active exploitation.

Steer noted that this shift will eventually allow security leaders to move away from trying to patch every single vulnerability—an impossible task—and toward a strategic, risk-based prioritization model. “Vulnerability prioritization is absolutely primed for AI to streamline and accelerate contextual decision-making at executive levels,” he said.

Driving toward an intelligence-led defense future
The consensus from the panel was clear: The future of cybersecurity lies in the convergence of AI, intelligence-led defense, and robust governance. While the X-factor of new threats—the ones that disrupt even the best-laid plans—will always exist, the goal is to reduce reactive panic and focus on strategic risk reduction.

For security practitioners, the takeaway is two-fold. First, they need to keep a close watch on the evolution of global security frameworks, as these documents will define industry expectations and communication standards, and they’ll give organizations a better understanding of where modern security is going in light of AI.

Second, practitioners need to focus on the quality of intelligence over quantity. By ensuring that their tools are enriched with actionable context, they can empower their teams to move from a state of constant, reactive chaos to one of calculated, proactive defense.

As Jon Miller noted, intelligence-led defense is the best way to ensure that when you move at machine speed, you’re moving in the right direction. “Speed without intelligence just means you're wrong, faster,” he said.

To get a customized walkthrough of Recorded Future’s machine-speed defense in action, take our interactive tour.

An alert may be the first sign a security team sees, but it rarely marks the beginning of an attack.

Before an intrusion reaches the network, threat actors may research targets, prepare infrastructure, trade stolen credentials, or discuss vulnerabilities they plan to exploit. Security teams that rely solely on internal alerts may miss earlier activity.

Proactive threat intelligence helps security teams identify and assess threats earlier by adding external context about adversaries, infrastructure, vulnerabilities, and emerging activity. That context can help teams decide what deserves attention first and act before a threat develops into a larger incident.

Reactive security still matters: organizations need detection, incident response, and recovery capabilities when attacks occur. But proactive intelligence adds visibility earlier in the process, so security teams are not forced to make every decision after an alert fires.

Key takeaways

• Proactive threat intelligence can reveal adversary activity, infrastructure, and exposure before suspicious behavior appears inside the organization
• Intelligence can show which vulnerabilities, threat actors, and external exposures are most relevant to an organization's environment
• A proactive security mindset informs decisions about patching, threat hunting, security controls, and risk remediation
• Automated collection and analysis can reduce manual intelligence work, so analysts can spend more time investigating relevant threats

How to shift to a proactive security mindset

Reactive security begins when something has already happened. An alert fires, suspicious activity appears, or an incident is confirmed. The security team then investigates what happened and decides how to contain the threat.

Proactive threat intelligence shifts part of that work earlier by helping teams understand which adversaries may target them, which vulnerabilities attackers are exploiting, and what infrastructure or techniques are associated with current campaigns. Instead of waiting for those threats to surface internally, teams can use threat intelligence to prepare and prioritize their response.

The goal is not to predict every attack. It is to reduce uncertainty early enough to make better security decisions.

That distinction matters when teams face more alerts, vulnerabilities, and threat information than they can address at once. Proactive intelligence provides context to determine which risks are most closely connected to the organization's assets, technology, industry, and exposure.

For security leadership, that context can also support risk management. Security leaders can compare threat likelihood, asset importance, and potential business impact rather than treating alert volume as a measure of risk. This helps connect intelligence priorities with CISO-level decisions about people, budget, and remediation.

Steps in a proactive intelligence program

A proactive intelligence program follows four interconnected steps: define intelligence requirements, collect relevant information, analyze it within an organizational context, and turn the findings into security actions.

1. Requirements: Define the security and business questions the intelligence program needs to answer. These may include which adversaries pose the greatest risk, which vulnerabilities need faster action, or where the organization has external exposure.
2. Collection: Gather information that can answer those questions. Internal telemetry remains useful, but proactive intelligence also depends on external visibility. Sources may include open-source intelligence (OSINT), technical forums, dark web sources, and illicit marketplaces where threat activity can appear before an internal alert.
3. Analysis: Connect those signals with organizational context. Analysts assess whether an adversary, vulnerability, or piece of infrastructure is relevant to the organization's assets and current threat profile.
4. Action: Use that context to make a security decision. Teams may change a patching priority, block malicious infrastructure, investigate exposed credentials, or begin a targeted threat hunt.

The cycle continues as threats and business priorities change. For operational cyber threat intelligence to support security operations, the process cannot stop at collection and analysis. Intelligence needs to reach the people and controls that can act on it, then feed new findings back into the next cycle.

Examples of proactive intelligence in action

Proactive intelligence creates value when it changes a security decision. Three use cases show how external context can move action earlier.

Use case 1: Prioritize vulnerabilities using real-world threat activity

Security teams generally cannot treat every published Common Vulnerabilities and Exposures (CVE) record as equally urgent. Severity scores describe the potential technical impact of a vulnerability, but severity alone does not show whether threat actors are exploiting it or how relevant it is to a specific organization.

Proactive threat intelligence adds exploitation context to the decision.

Recorded Future Vulnerability Prioritization provides information about current exploitation and threat activity that can help teams identify which vulnerabilities warrant faster attention. A vulnerability associated with active exploitation may require a different response from another vulnerability with a similar severity score but less evidence of current attacker activity.

This gives teams another factor for deciding what to address first. It also connects threat intelligence and vulnerability management, allowing patching decisions to reflect internal exposure alongside activity in the external threat environment.

Use case 2: Identify external risk before it becomes an internal incident

Not every meaningful security signal appears within systems an organization controls.

Threat actors may register domains that imitate a company, expose employee credentials, or discuss potential targets in criminal communities. Command-and-control infrastructure and other malicious assets can also be prepared outside the organization's environment before they are used in an attack.

Digital risk monitoring gives security teams visibility into that external activity.

Recorded Future Digital Risk Protection monitors external threats including malicious domains, credential exposure, brand impersonation, and dark web activity. Finding those signals earlier gives teams an opportunity to investigate and remediate exposure before it contributes to a larger security problem.

This expands the security team's view from what has already happened internally to what is developing outside the organization.

Use case 3: Give threat hunters a more focused starting point

Threat hunting is proactive, but analysts still need a useful hypothesis about what they are looking for.

Without external context, analysts may spend too much time selecting relevant threat actors, gathering intelligence from multiple sources, validating anomalies, and assembling findings for stakeholders. Proactive intelligence can reduce some of that manual work by giving hunters a clearer starting point.

If intelligence shows that a threat actor is targeting organizations in the same industry, analysts can review that actor's known techniques, malware, and infrastructure and determine which signals are relevant to search for in internal telemetry.

The intelligence does not replace threat hunting. It helps shape the hypothesis and narrow the investigation.

Recorded Future Cyber Operations connects external intelligence with investigation, hunting, detection, and response workflows, helping analysts reach relevant threat context faster. Intelligence can also add context to alerts in SIEM, SOAR, and EDR/XDR tools, helping teams determine whether internal activity relates to known external threats.

How a proactive security mindset reduces business risk

A proactive security mindset can reduce business risk by giving teams more time and context to address relevant threats before they cause greater disruption.

Security teams can direct limited resources toward vulnerabilities being actively exploited, external exposures that require remediation, or adversaries that present a stronger risk to the organization. Earlier context can also improve preparation if a threat later develops into an incident.

For security leaders, this creates a clearer link between intelligence work and business priorities. Instead of measuring value by the number of alerts or reports produced, teams can focus on whether intelligence changed a decision, reduced exposure, or helped security teams act sooner.

Recorded Future: The engine for proactive threat intelligence

External visibility creates its own challenge: scale.

Threat information can appear across public sources, technical data, criminal communities, and internal telemetry. Manually collecting and connecting that information can leave analysts spending more time finding data than deciding what it means.

Recorded Future's Intelligence GraphⓇ addresses that problem by indexing information from more than one million sources and connecting data about threat actors, infrastructure, vulnerabilities, and organizations. The value is not simply in collecting more information, but in connecting signals and adding context so teams can better determine which threats relate to their organization and what response those threats may require. Recorded Future applies that intelligence across security and risk workflows, as the examples below show.

Precision intelligence for different security teams

• Vulnerability Prioritization adds exploitation context to help vulnerability teams prioritize remediation beyond severity scores alone.
• Cyber Operations supports investigation, threat hunting, detection, and response. External intelligence can enrich existing security tools and help teams identify and act on relevant threats with less manual research.
• Digital Risk Protection monitors external exposure such as compromised credentials, malicious domains, and brand impersonation so teams can investigate risks outside infrastructure they directly control.

Recorded Future also extends proactive intelligence into other areas of business risk.

• Third-Party Risk provides external context about vendors and other organizations in the supply chain, helping teams assess changes in third-party exposure.
• Payment Fraud monitors external fraud signals such as compromised payment data and criminal activity so fraud teams can act earlier in the fraud lifecycle.

Together, these capabilities allow teams to apply external intelligence to the decisions they already make rather than treating threat intelligence as a separate research function.

Get ahead of the next threat

Moving beyond a reactive security cycle does not mean trying to predict every attack. It means giving security teams the external visibility and context to identify relevant threats earlier, prioritize them more accurately, and act before the available window closes.

Ready to move beyond the reactive cycle and adopt a proactive security mindset? See the Intelligence Graph in action and learn how proactive threat intelligence can help your team identify and address threats before they develop into major breaches targeting your organization. Schedule a personalized demo today.

Imagine the same detective working two different cases. In the first, every piece of evidence arrives as a disconnected fragment—names without relationships, events without timelines, motives without context. In the second, the connections among people, events, and evidence are already established before the detective walks in.

Which case does the detective solve faster?

The detective solves the second case much faster than the first, but not because the detective is more intelligent. Instead, the world is more intelligible. The difference is not reasoning ability; it is the organization of knowledge that represents the world and enables action.

Now, imagine two cybersecurity AI agents built on the same frontier language model, with the objective of defending against attacks. Both share a general understanding of vulnerabilities, attackers, and defensive techniques. One, however, operates over fragmented alerts, disconnected data sources, and inconsistent identifiers. The other agent reasons over a structured representation that captures relationships among assets, vulnerabilities, threat actors, detections, and organizational context. Similar to detectives, the difference in performance stems not from greater intelligence but from a more intelligible environment or even a living enterprise model.

This is my primary argument: Agentic intelligence is about constructing a representation of the operational world in which correct decisions become the expected outcome rather than a matter of chance. As agents begin taking actions rather than merely producing answers, the quality of those actions depends mostly on the context the agents inherit and whether it’s structured, current, and backed by trustworthy evidence.

To understand how this works for machines, it helps to examine human learning. Human progress has never depended on information alone. It has depended on organizing that information—deciding which sources to trust, connecting related facts, preserving context, and passing that knowledge forward. We inherit this structure through education, language, institutions, and shared practice. Remove it, and even sophisticated reasoning becomes little more than educated guesswork.

Intelligence doesn’t emerge in isolation. It depends on the quality of the representations we think with. The quality of reasoning depends not only on our ability to draw conclusions, but also on how well the world has been made intelligible before we begin. Trustworthy agents do not emerge from better prompts. They emerge from better operational world models. Humans develop reasoning by building increasingly rich mental models of the world through observation, interaction, and experience. Modern language models follow a different path. They learn statistical representations from vast amounts of data rather than through direct interaction with the environment. As a result, they possess broad knowledge but lack direct access to the current operational state of the world in which they must act.

This distinction is particularly important in cybersecurity. Human analysts continuously integrate observations, institutional knowledge, and information about operational state into a coherent mental model of their environment. AI agents must instead be provided with that operational model. Assets, identities, vulnerabilities, dependencies, relationships, policies, and evolving evidence cannot be inferred reliably from language alone—they must be represented explicitly in the world the agent reasons over. Foundation models are increasingly capable of planning, selecting tools, interpreting observations, and adapting their behavior. Their effectiveness, therefore, depends less on reasoning in isolation than on the quality of the representations they can access and the actions they can take. Those representations encompass not only organizational knowledge, like entities, relationships, provenance, policies, governance, and evolving state, but also the tools available to observe and change that state. Again, general models generate general answers.

During the development of enterprise AI agents at Recorded Future, we encountered many instructive examples. The first lesson came immediately. Early versions of our agents treated open-source information and Recorded Future’s proprietary intelligence with roughly equal weight. The result was generic, internet-scale responses rather than the expert-level analysis we intended. Through repeated experimentation, we changed the architecture so that the agent reasoned primarily over the Recorded Future Intelligence Graph®¹—a structured representation of the cyber threat landscape built from years of analyst research, enriched relationships, and investigative decisions. The agent learned to prioritize high-confidence analytical artifacts, such as Insikt Notes² and curated graph relationships, over weaker signals derived from open sources. The language model itself had not become more intelligent. What changed was the quality of the world it was given to reason about. The result was an agent that produced more authoritative analyses and acted with substantially greater consistency and confidence.

Frontier models are becoming easier to access every month. That means model choice is becoming a weaker source of competitive advantage than many organizations assume. What’s much harder to copy is a trustworthy representation of an organization’s operational knowledge. While production-grade orchestration remains challenging, it is unlikely to provide a durable moat for agentic systems in cybersecurity as frameworks, tooling, and implementation patterns continue to converge. What cannot be commoditized is a trusted operational representation of the organization. Agents struggle wherever knowledge remains implicit—in institutional expertise, undocumented conventions, or relationships no system has captured. Their performance ultimately reflects the quality of the world they can access.

Consider a seemingly simple Priority Intelligence Requirement (PIR): “What is a threat to our organization?” The answer is rarely explicit or universally agreed upon. It emerges from understanding the external threat landscape together with the organization’s own high-value assets, priorities, and risk posture. Constructing that representation is a deliberate analytical exercise, not a by-product of deploying an AI model. Once made explicit, however, it provides the foundation on which agents can reason consistently and act effectively. The differentiating question is therefore not, “Which agent framework do we use?” but, “What operational world do our agents reason over?” Organizations that invest in making their knowledge explicit, structured, and trustworthy will consistently derive more value from AI than those that deploy increasingly sophisticated models against fragmented operational knowledge. In this case, intelligence is truly an architecture rather than computation. To build a structured world for cybersecurity agents to operate in, enterprises should align with the following principles:

Structure before reasoning. An effective AI system does more than retrieve facts. Too many systems repeatedly reconstruct knowledge from unstructured information, wasting computational resources while producing inconsistent results. Instead, intelligent and trusted agents should inherit an organized representation of the world: relationships between entities, events, organizations, and evidence should already exist within a structured living knowledge system. The agent's responsibility is to reason over this established structure, not rediscover it with every interaction. The result can be greater consistency and reliable outcomes, particularly for tasks that depend on relationships across multiple sources. Whether it also lowers total cost depends on how the representation is constructed, maintained, and reused³.

We observed the same pattern when building an autonomous threat hunting capability in our Autonomous Threat Operations (ATO)⁴. The language model already understood cybersecurity concepts—it knew what YARA rules, Sigma rules, MITRE ATT&CK techniques, and behavioral indicators were. The breakthrough did not come from teaching more cybersecurity data. It came from explicitly representing investigations: translating detection rules into behavioral hunts, preserving relationships between evidence, maintaining provenance, and carrying forward prior investigative decisions. An investigation that once required analysts to repeatedly reconstruct context became dramatically faster because the context itself had become part of the system. Before the change, each run reconstructed the relationship between the rule, the relevant behavior, and prior investigative findings. After those relationships became a durable system state, the agent could begin from the current investigative position rather than restarting from the source material. As a result, the agent could act effectively around the clock at greater speed.

Provenance is inseparable from intelligence. Human experts are trained to question sources, recognize outdated information, and detect uncertainty. AI systems cannot make these judgments unless every piece of information carries evidence of its origin, relevance, and reliability. Provenance is what transforms data into trustworthy intelligence⁵. For operational intelligence, provenance should include the source; the precise evidence used and its freshness, confidence, and known contradictions; and the relationship between that evidence and the resulting claim. Without provenance, even sophisticated reasoning is reasoning built on assumptions rather than verified knowledge.

A major pain point for cyber threat intelligence (CTI) teams is that, on any given day, thousands of articles, social media posts, blog entries, and automated alerts may mention an entity of interest to them. Most are operationally irrelevant: news commentary, recycled reporting, speculative claims, or duplicate coverage. The intelligence value lies not in the volume of mentions but in understanding their provenance. Is the information derived from a trusted government advisory, firsthand reporting from an intrusion, or direct observations from a darknet forum? Or is it simply another outlet repeating yesterday’s story? Provenance enables an AI agent to distinguish original evidence from repetition, assess freshness and credibility, and focus attention on developments that materially change the threat landscape rather than amplifying noise.

Verification must be easier than investigation. Trust matters more than raw capability. An AI system that produces impressive answers but cannot explain how it reached them creates uncertainty rather than confidence. Every recommendation should be accompanied by sufficient evidence to make verification substantially easier than reproducing the investigation itself. This includes the observations used, material assumptions, uncertainty, contradictory evidence considered, and the conditions under which the recommendation should not be followed. If it doesn't, the technology has merely shifted labor instead of reducing it.

Transparency is the foundation on which trust is built. This principle increasingly aligns with emerging thinking in frontier AI governance, where trust depends not only on model capability but on rigorous verification of the evidence, processes, and claims underlying AI systems⁶.

A CISO, good friend, operating under significant resource constraints, once asked whether an AI agent could reliably recommend isolating compromised production servers. My answer was yes—but only under one condition. A threat analyst should never have to reconstruct the entire investigation just to decide whether to trust a recommendation coming from an AI agent (it is also very costly). Instead, the AI agent should present the evidence for the underlying conclusion, like the suspicious process it observed, the connection to known malicious infrastructure, the behavioral detections that fired, the supporting threat intelligence, the confidence of each finding, and any contradictory evidence it considered, but also the reasoning that connects those observations. Evidence alone is insufficient; the same facts can often support multiple competing hypotheses.

The goal is not for analysts to reconstruct every investigation from first principles, but to quickly assess whether the agent’s chain of reasoning is sound and whether the recommended action is proportionate to the available evidence. This becomes even more important as agents transition from advisory to autonomous roles. Defensive agents offered by the industry will increasingly be expected to isolate hosts, revoke credentials, or block communications before a human can intervene. In those settings, trust cannot depend on manual verification of every decision. It must be earned through consistently reliable reasoning, calibrated confidence, transparent evidence, and well-defined operational guardrails. Verifying the recommendation should take minutes; reconstructing it from raw telemetry could take hours. Otherwise, the AI has not reduced the workload—it has merely shifted it from investigation to verification.

Efficiency is an intellectual discipline. Many assume that more reasoning necessarily produces better intelligence, yet excessive computation often reflects poor system design rather than greater capability. Efficient intelligence is not about thinking longer; it is about thinking more precisely. A well-designed agent retrieves only what is relevant, avoids unnecessary repetition, and allocates computational effort where it genuinely adds value. Efficiency is not merely an economic concern—it is a measure of intellectual discipline⁷.

In my ongoing conversations with security leaders, one concern has surfaced repeatedly: Organizations cannot afford to reproduce the inefficiencies of alert fatigue with AI agents. Replacing thousands of alerts with thousands of autonomous actions would simply automate the noise. Agents are only as effective as the intelligence, policies, and evidence they operate upon. If the underlying representations contain duplicates, false positives, stale context, or conflicting evidence, autonomous systems will amplify those weaknesses at machine speed. The goal is therefore not to maximize agent activity but to maximize decision quality. The most valuable agent consistently performs the right actions while knowing when not to act.

Reasoning must be preserved, not just data. As organizations deploy multiple intelligent agents, preserving reasoning becomes as important as preserving data. What must persist is not an unrestricted transcript of prior reasoning, but a governed record of evidence examined, hypotheses considered, assumptions made, decisions taken, unresolved questions, confidence levels, and conclusions that have subsequently become stale or invalid. Intelligence is cumulative. Human collaboration succeeds because people exchange not only conclusions but also assumptions, uncertainties, confidence levels, and unresolved questions. Intelligent agents should communicate in the same manner: Each agent should inherit the complete investigative state rather than merely a final answer. This enables cumulative reasoning—each participant building on prior understanding rather than restarting the thinking process—and creates consistency, transparency, and trust across increasingly complex systems.

One of the most common cyber cases I encounter is a ransomware investigation involving multiple analysts, shifts, and, increasingly, specialized AI agents. Whether the next participant is human or machine, they should not begin with only the latest conclusion. They need to inherit the investigative state: the evidence already examined, assumptions made, confidence assigned, competing hypotheses, unresolved questions, and conclusions that have since been revised as new evidence emerged. Without that shared state, every handoff requires reconstructing why earlier decisions were made and which lines of inquiry were already explored. With it, the investigation progresses cumulatively rather than repeatedly restarting, reducing duplication while improving consistency, auditability, and decision quality.

Intelligence must outlive the interface. Technology platforms, user interfaces, and AI models will inevitably evolve, but high-quality intelligence should remain portable, structured, and universally accessible. Organizations should not become dependent on a single application or agent. Intelligence should function as a foundational layer that supports any workflow, regardless of where or how it is consumed.

Threat intelligence organizations have spent years enriching adversary profiles, linking infrastructure, documenting investigative decisions, and building behavioral knowledge—not to mention identifying all the IT debt organizations have. If that intelligence exists only inside one vendor’s application or is encoded in prompts for a single AI assistant, every platform migration forces the organization to rebuild years of accumulated knowledge. By contrast, when intelligence is represented independently (as structured entities, relationships, evidence, and provenance), it can support any analyst, detection engine, hunting agent, or future AI model without having to be recreated. Customer relationships, business policies, operational knowledge, and historical decisions should not be lost when an organization replaces its CRM, SIEM, or AI provider. The applications may change; the intelligence they rely upon should not. Durable intelligence becomes a shared asset that every future system can inherit. Every major platform migration exposes the same problem: Organizations have preserved their applications better than their intelligence.

None of this diminishes the human role; in fact, it centers it. Rather than forcing analysts to build every investigation from scratch, intelligent systems should prepare a structured foundation upon which human expertise can operate. AI becomes a collaborator rather than a substitute. The highest value of an intelligent agent is not that it thinks independently, but that it enables humans to think more effectively.

For decades, we have treated intelligence as something people consume: reports, recommendations, indicators, documents. Agentic systems are forcing us to take a different view. Intelligence has become part of the environment in which reasoning occurs. The competitive advantage will not belong to organizations possessing the largest models. It will belong to those who build trustworthy systems where knowledge is structured, evidence is transparent, reasoning is efficient, and human judgment remains central.

Models will change. Interfaces will disappear. Workflows will evolve. What remains is the architecture of enterprise intelligence itself.

In August 2026, Insikt Group® identified 73 high-impact vulnerabilities that should be prioritized for remediation, 43 of which had a Very Critical Recorded Future Risk Score. This represents a 14% decrease from last month. 31 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 32 were reported in open sources and validated by Insikt Group, seven were sourced through security vendor telemetry, and three were exclusively surfaced through honeypot data.

The 73 vulnerabilities in this blog affected products from 45 vendors, with Microsoft accounting for approximately 11% of the vulnerabilities. The remaining exposure spanned remote monitoring and management, virtualization, application delivery, collaboration, artificial intelligence, developer, analytics, identity, operational technology, content management, network edge, video surveillance, and endpoint technologies.

In August, Insikt Group created Nuclei templates to detect CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). Each of these vulnerabilities is featured in this blog. Additionally, Insikt Group had previously created templates to detect CVE-2026-3395 (MaxSite CMS) and CVE-2026-59800 (decolua 9Router), but their exploitation was reported in July, so they are not listed in the August 2026 Vulnerability Table. Additionally, Insikt Group created a Nuclei template to detect GitHub Issue #4255 affecting Apache Log4j, a deserialization allowlist bypass that Apache classified as a hardening gap rather than a Log4j vulnerability; as such, it was not assigned a CVE. These Nuclei templates are available to customers via the Recorded Future Intelligence Platform.

Quick reference: August 2026 vulnerability table

All 70 vulnerabilities below were actively exploited or operationally weaponized in August 2026. This table does not include the three CVEs that were primarily surfaced through honeypot data, which are available to Recorded Future Intelligence Platform customers via the CVE Monthly report. The table below also provides examples of public PoCs identified by Insikt Group. These PoCs were not tested for accuracy or efficacy. Vulnerability management teams should exercise caution and verify the validity of PoCs before testing.

Table 1: List of vulnerabilities that were actively exploited in August, 2026 based on Recorded Future data (excluding honeypot-sourced CVEs).

Key trends: August 2026

• August reporting showed two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT after compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in failed attempts against Langflow and n8n.
• 34 of the 73 vulnerabilities enabled remote code execution (RCE). They affected Microsoft productivity, database, server, and endpoint software; network edge and application delivery appliances; webmail, collaboration, content management, and web server platforms; AI, analytics, developer, and CI/CD services; and operational technology, product lifecycle management, file transfer, videoconferencing, and enterprise integration software.
• We identified public proof-of-concept (PoC) exploits and scanners for 53 of the 73 vulnerabilities.
• The most common weakness classes were CWE-94 (Code Injection) and CWE-502 (Deserialization of Untrusted Data) with seven each, followed by CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function) with six each.
• 17 vulnerabilities were at least five years old, and the oldest was approximately 16 years old.

Trend analysis: AI-assisted workflows scale exploitation and target selection

Insikt Group detailed how Chinese-speaking threat group, UAT-10147, combined conventional exploitation with agentic artificial intelligence (AI) during post-compromise operations against internet-facing Windows and Linux web servers. Cisco Talos observed the threat actor exploiting or weaponizing CVE-2019-18935 in Telerik UI for ASP.NET AJAX, CVE-2021-23758 in AjaxPro, CVE-2021-29441 and CVE-2021-29442 in Nacos, and CVE-2022-27925 in Zimbra for initial access. After compromise, UAT-10147 used CVE-2010-3904, CVE-2015-3246, CVE-2015-5287, CVE-2021-3156, CVE-2022-0847, and CVE-2022-0995 for local privilege escalation on Linux.

Figure 1: Risk Rules history on the Vulnerability Intelligence Card® for CVE-2021-23758 in Recorded Future (Source: Recorded Future)

Today, Recorded Future is announcing Automated Signature Creation, a new capability in Attack Surface Intelligence (ASI) to combat the speed of AI-generated exploits.

ASI continuously maps an organization’s external exposure, correlates newly surfaced vulnerabilities with real-world threat intelligence, and prioritizes response to enable defenders to remediate before adversaries can act.

This new function within ASI automatically creates signatures, pieces of detection logic that empowers the Recorded Future Platform to recognize a specific vulnerable or exposed condition across organization’s assets in real time.

With Automated Signature Creation now available, Recorded Future is helping to close the gap between AI-enabled threat discovery and enterprise defense.

Tackling the machine speed of exploitable vulnerabilities

It seems everything is moving quicker these days and the time to exploit a vulnerability is no different. A new generation of AI models is accelerating this challenge, demonstrating that they can automatically find zero-day vulnerabilities in major operating systems and web browsers — a skill that was previously exclusive to the most advanced government cyber units and research labs.

Back in 2020, we cited how Gartner confirmed that the time from discovery to exploitation dropped from 45 days to 15 days, between 2010 to 2020.

In our 2025 Malware and Vulnerability Trends report, we reported that weaponization occurred “within days of disclosure." Today, that window is measured in hours.

As a result, the status quo of traditional defenses and manual processes are no longer sufficient. Let’s look back at how we got here, from pre-existing detection methods to Recorded Future’s latest ASI enhancement to better defend against AI-accelerated vulnerabilities.

How we got here

In the past year, Recorded Future’s traditional approach of expert-authored signatures from the Insikt Group® was effective; they were high quality but moved at a human pace.

For example, in February 2025 we reported on the Trimble Cityworks: CVE-2025-0994, showcasing how manual signature creation worked. The Insikt Group built a Nuclei template (shared as a downloadable YAML file) specifically for CVE-2025-0994. This enabled defenders to test potentially vulnerable Trimble Cityworks instances prior to the patched version, serving as a detection and prioritization aid for helping teams figure out where to focus patching efforts first. This worked in conjunction with one of ASI’s core functions, scanning web infrastructure to identify internet-facing assets vulnerable to CVE-2025-0994.

Since that vulnerability disclosure a little over a year ago, we have ample evidence that the speed at which vulnerabilities are exploited has increased exponentially. Just recently, it was reported that OpenAI’s own agents went rogue and exploited a zero-day vulnerability in Artifactory, now infamously tied to the Hugging Face incident.

Incidents like this one, and the underlying vulnerabilities that facilitate them, are exactly why Recorded Future automated signature creation.

Now, in the face of an attack moving at machine speed, agentic processing generates production-ready detection signatures autonomously by turning a newly surfaced vulnerability into a deployable signature in as little as 31 minutes. As a result, the number of in-platform signatures produced has increased tenfold. Let’s take a closer look at how it works.

How automated signature creation works

So what does a signature in this context actually mean? Think of it like this: the signature is a piece of detection logic that says "go ask this asset this exact question; if the answer looks like this, it's vulnerable." It's the difference between "we found your assets" and "we found the ones a threat actor can potentially break into."

Automated signature creation works like a three-step early warning system. (See Figure 1)

1. The platform keeps a constant view of what your organization exposes to the internet such as domain records, certificates, and ownership data.
2. When a new vulnerability is flagged and matched against your scanned assets, it's checked against live threat activity rather than just a generic severity score. The system looks for evidence that threat actors are actually exploiting it, tying it to malware, ransomware or threat actor intent.
3. When Recorded Future Intelligence determines a CVE is relevant for detection, the system automatically processes it to generate a detection signature or product fingerprint in as little as 31 minutes.

Figure 1: CVE disclosures mapped to external assets kick off automated processes

For security teams, AI has generated both more excitement and more confusion than any technology in the last decade. As threat actors experiment with AI to hone their attacks, defenders are trying to determine which AI investments will help them measurably reduce risk.

Matthew Farmer, Accenture’s Managing Director of Security Operations in EMEA, joined Recorded Future’s co-founder Christopher Ahlberg and CTO and co-founder Staffan Truvé in a recent discussion to discuss the agentic SOC and what it takes to move from “AI theater” to real defense. Read on to see the key highlights from the discussion.

Avoiding the "productivity theater" trap

While AI is demonstrably transforming investigation and decision-making layers in SecOps, there’s a significant risk that organizations are falling into what Farmer calls "AI productivity theater."

"We can all agree that there's great production value around a lot of AI capabilities and AI products," he said. "But there are also organizations that are really struggling to achieve any kind of return on investment on their AI.”

The panel noted that the difference between success and failure doesn’t necessarily have anything to do with being in a regulated or non-regulated industry. It’s more about the ability to move past the theater by defining concrete KPIs.

“A lot of what people want to achieve with AI, we can already achieve with existing machine learning or SOAR automation capabilities,” Farmer said. So rather than simply deploying an AI solution for the sake of being AI-enabled, organizations need to ask whether they’re solving for cost improvement, risk reduction, or speed. They need to understand their KPIs so they can measure their true ROI.

Navigating technical and operational challenges

When it comes to bringing new AI solutions online, the panel noted that SOCs often face administrative, legal, and compliance limitations that eclipse any technical hurdles.

They also agreed that data quality and lack of context — “two sides of the same coin” according to Truvé — remain fundamental challenges.

Farmer noted that, “In the new world of tokenomics, it costs just as much money to troll through poor quality data as high-quality data.” It’s essential that security organizations feed only the best intelligence into their AI tools.

Assessing new risks, from democratization to agentic threats

Farmer said that security organizations used to ask a key question: “Do those [threat actors] with the capability have the motive, and do those with the motive have the capability?” We’re now in a world where non-capable threat actors can use AI to capably launch highly sophisticated attacks.

Threats are also becoming more structural. The panel highlighted "indirect prompt injection"—where agents are manipulated by the very instructions they read—as a new, distinct threat vector.

As companies deploy a digital workforce of AI agents, they should consider applying the same security principles of permissions, monitoring, and accountability to agents that they do to humans. But that may not be sufficient. "One big difference [between an agent and a human] is that an agent can spawn off a thousand clones of itself," Truvé said.

A critical challenge facing security teams is that the current observability space of SIEMs and traditional monitoring platforms isn’t built to track the internal state of an LLM.

"You can observe what ports they talk on, you can write that to a SIEM,” Ahlberg said. “But you’re not observing what’s happening inside the LLM.”

The panelists suggested that rather than relying solely on post-event observability, security teams should rethink how they control agents. Instead of setting up easily bypassed guardrails, security teams need to be better at constraining what each agent can do and ask for.

“You could imagine giving them a budget in terms of compute, communication, and delegation,” said Truvé. “These things run too fast. When you’re observing it, it’s already going to be too late.”

Preparing for the move to autonomous defense

According to the panelists, the shift toward autonomous defense is inevitable. "We can choose to go early, or we can choose to go late,” Farmer said. “But I think the decision is made for us."

However, it doesn’t need to take years to begin realizing big benefits from AI. To do so, security organizations should consider:

• Target high-friction areas, using AI to solve specific bottlenecks where addressable cost is low and ROI is immediate.
• Use outcome-based metrics, measuring success through model accuracy, escalation precision, and scan turnarounds rather than simple activity tracking.
• Assume breach, building defensive resilience that will pay dividends in the future.

On that last point, Farmer said he thinks that as teams grow more resilient, they develop a better appetite for deploying automated solutions — and that in turn strengthens their overall security posture.

The future of defense: Intelligence and speed at scale

According to the panel, the most profound change moving forward won’t just be the technology—it’ll be the velocity coupled with intelligence required for defense. "In three years, the main difference will be speed," Truvé predicted. "Defensive timelines will compress from days to minutes or seconds."

Ensuring security will require organizations to move past traditional constraints as they simply won't have time to manually ingest, analyze, and move intelligence. Taking detection engineering as an example, Farmer noted, “If we have to deliver more detection rules faster, we have to break that linear model between volume, speed, and headcount.” Consequently, SOCs will rely increasingly on high-quality, timely intelligence to enable rapid, automated decision-making.

As this shift occurs, the fundamental unit of work for a security analyst will evolve from handling individual alerts to managing and overseeing the agents that process them. In this new era, the human will remain essential—not as a manual processor of alerts, but as the architect who sets objectives, defines constraints, and monitors the behavior of the agents defending the enterprise.

Watch the full webinar here.

To see how your organization can use the Recorded Future Platform to better defend at machine speed, take our quick interactive tour.

Starting today, Recorded Future is launching AI Alert Filtering, an AI agent that automatically filters every Alert by relevance before an analyst opens it.

At scale, Alerts surface a lot of intelligence to work through, and the volume is only accelerating as threat actors are using AI to find vulnerabilities, spin up phishing infrastructure, and harvest credentials at a speed and scale that wasn't possible before. AI Alert Filtering turns that same AI advantage back on the problem, automating the first pass of Alert relevance so analysts spend their time on what actually warrants attention.

This gives analysts the benefit of seeing the highly relevant Alerts without giving up control. Customers with early access saw an average reduction in alert volume of around 63%, though results may vary based on rule configuration and use case.

Prioritizing intelligence at scale

Powered by Recorded Future AI, AI Alert Filtering takes on the first pass of prioritization, drawing on the Intelligence Graph® to classify references with the full context of Recorded Future's threat intelligence behind every call, not just the text of the reference itself. It sorts references by relevance, summarizes what came through, and explains its reasoning.

What we built

• High and Low Relevance sorting: Every reference inside a fired Alert is classified against the rule's intent. The High Relevance section loads first. Low Relevance items are still there if you need them; you're just not wading through them by default.
• AI summary at the top of every alert: Each Alert is delivered with a summary covering what came through, so analysts may quickly determine whether it demands immediate attention.
• Custom intent per rule: You can define exactly what the AI should prioritize, beyond the default intent Recorded Future ships with the rule. For example, "this is for ACME Bank, not ACME Center" sharpens results without rebuilding the rule from scratch.
• Optional auto-dismiss for empty alerts: When no references meet the relevance threshold, the Alert may be automatically dismissed instead of landing in your queue. Less to filter out, with the full details retained if you need to review it later.
• No data loss: AI Alert Filtering changes what gets surfaced, not what gets stored. The original, unfiltered Alert details are always available in the Portal.

Figure 1: Relevance sorting

Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense

Mexico has no shortage of cyber threats. Ransomware attacks are rising, criminal groups are exploiting stolen credentials and financial malware, and state-linked threat actors increasingly view the country’s government agencies, universities, and critical infrastructure as attractive targets. Mexico’s new National Cybersecurity Plan (hereinafter referred to as “Plan”), introduced in December 2025, recognizes many of these risks. However, it remains uncertain as to whether the government can build the institutions needed to address them proactively.

Mexico is ranked as a "Tier 2" nation in the ITU's 2024 Global Cybersecurity Index, placing it alongside Canada, Ecuador, and Uruguay in the upper ranks, trailing the United States (US) and Brazil, which have reached Tier 1 in the Americas. Despite that standing, Mexico is generally perceived by cyber experts as lagging behind international standards in institutional capacity-building, with international cooperation identified as an area requiring growth.

The question of whether the government can build the proper institutions has become more urgent in the aftermath of the FIFA World Cup 2026, which provided a high-profile stress test for Mexico’s digital defenses. With the tournament over and implementation of the government’s 2025-2030 cybersecurity plan beginning in earnest, Mexico faces a major opportunity to improve its cyber posture.

For this reason, the Plan represents a major opportunity for Mexican authorities to bring the country’s cyber readiness to the next level. Although there have been attempts to advance national cybersecurity policy, they have failed to gain traction. With this new Plan, President Claudia Sheinbaum's administration has committed to full implementation over the course of her term, aided by her party's majority control of Congress.

The Plan lays out a six-phase roadmap designed to gradually build Mexico’s cybersecurity capabilities through 2030, with later phases intended to deepen and institutionalize them.

• The 2025 Foundation Phase established a general framework for governance, risk management, incident reporting, and coordination, as well as initial steps to deepen international cooperation, including Mexico’s formal membership in the Latin America and Caribbean Cyber Competence Centre (LAC4) and a cybersecurity Memorandum of Understanding (MOU) with Brazil.
• The 2026 Expansion Phase, now underway, focuses on translating that framework into institutions through the passage of a new General Cybersecurity Law in Mexico, creation of a National Cybersecurity Operations Center, and integration of federal computer security incident response teams (CSIRTs).
• The 2027 Consolidation Phase would establish a National Cyber Range for red team and blue team exercises.
• The 2028 Maturation Phase would incorporate AI into cyber defense and develop a regional response center.
• The 2029 Leadership Phase aims to position Mexico as a cybersecurity services exporter across Latin America and the Caribbean.
• The 2030 Transformation Phase culminates in the establishment of a permanent Cybersecurity Observatory to track incidents, threats, and emerging technologies.

Threat Landscape

In a recent report, Insikt Group assessed Mexico's threat landscape across six persistent categories:

Ransomware is identified as the dominant threat. From January 2020 through April 2026, Insikt Group documented 223 ransomware incidents involving 64 groups and over 100 victims in Mexico. The top ransomware groups were LockBit, Qilin, CL0P, Kazu, and ALPHV (BlackCat), with government, manufacturing, information technology (IT), and food and beverage as the sectors most heavily impacted.