Login
Operating inside the lethal trifecta: Blast radius reduction in AI agent deployments
Seven things security teams can start doing today to reduce risk
Categories: Threat Research
Tags: AI, CISO
Reading view
QEMU abused to evade detection and enable ransomware delivery
The use of hidden virtual machines (VMs) enables long-term access, credential harvesting, data exfiltration, and PayoutsKing ransomware deployment
Categories: Threat Research
Tags: virtual machine, QEMU, PayoutsKing, GOLD ENCOUNTER, CitrixBleed2
The vulnerability flood is here. Here’s what it means – and how to prepare
We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond.
Categories: Sophos Insights
Tags: LLM, AI, Exploit, vulnerability, Active Adversary, Pacific Rim
We let OpenClaw loose on an internal network. Here’s what it found
Following our article on the challenges posed by agentic AI, we gave OpenClaw access to one of our legacy networks
Categories: Threat Research
Tags: OpenClaw, LLM, AI, penetration testing, Red Team, CISO, Sophos X-Ops
Is compliance complexity outpacing IT capacity?
No matter the country, industry, or company size, IT and cybersecurity teams report a heavy regulatory load and worry about staying aligned with requirements
Categories: Products & Services
Tags: CISO, Compliance
Sophos named a 2026 Gartner® Peer Insights™ Customers' Choice for Managed Detection and Response
Third consecutive time being named a Customers’ Choice for MDR
Categories: Products & Services
Tags: Gartner, Gartner Peer Insights, MDR, Sophos MDR, Third-Party Reviews
The Cybersecurity Trust Reality in 2026
New Sophos survey reveals only 5% of IT leaders say they fully trust their cybersecurity vendors
Categories: Products & Services, Sophos Insights
Tags: Trust, Privacy, Trust Center
The High Cost of Low Trust: Our Commitment to Radical Transparency
Only 5% of organizations fully trust their cybersecurity providers. Let’s do better.
Categories: Products & Services, Sophos Insights
Tags: Trust, Trust Center, Privacy
Incident responders, s'il vous plait: Invites lead to odd malware events
A phishing campaign targeting multiple organizations led to RMM installations – but not much else (yet). A threat actor experimenting, or an access-as-a-service attack underway?
Categories: Threat Research
Tags: STAC6405, infostealer, RMM, Phishing
NICKEL ALLEY strategy: Fake it ‘til you make it
Victimizing software developers via fake companies, jobs, and code repositories to steal cryptocurrency
Categories: Threat Research
Tags: NICKEL ALLEY, Contagious Interview, North Korea, clickfix
March Patch Tuesday visits 15 product families
Eight Critical-severity bugs – none in Windows – appear in 84-CVE haul
Categories: Threat Research
Tags: Patch Tuesday, x-ops, Microsoft, Windows, detection
Initial access techniques used by Iran-based threat actors
Analysis of attacks originating from Iran-linked threat groups reveals a preference for certain techniques
Categories: Threat Research
Tags: Iran, initial access
Evil evolution: ClickFix and macOS infostealers
Across three recent campaigns, Sophos X-Ops notes shifts in both lures and malware capabilities, as threat actors leveraging ClickFix techniques increasingly target macOS users with infostealers
Categories: Threat Research
Tags: MacOS, infostealer, clickfix, MacSync, Social engineering
Hacktivist campaigns increase as United States, Iran, and Israel conflict intensifies
Rising tensions have sparked an increase in regional hacktivist activity, but impact has been minimal
Categories: Threat Research
Tags: hacktivism, Iran, israel, Operation Epic Fury
Cyber Advisory: Increased Cyber Risk Amid U.S.–Israel–Iran Escalation
Insights and recommended defensive measures from Sophos X-Ops Counter Threat Unit
Categories: Security Operations
Tags: Sophos CTU, Iran, Operation Epic Fury
Cisco SD-WAN vulnerabilities (CVE-2026-20127, CVE-2022-20775) in active exploitation
Categories: Threat Research
Tags: advisory, vulnerability, SD-WAN
Sophos Workspace Protection is Now Available
We’re excited to announce the highly anticipated release of Sophos Workspace Protection has arrived.
Categories: Products & Services
Tags: Workspace
The Active Adversary Report: Safety in numbers
What a long, strange trip it’s been
Categories: Security Operations
Tags: Active Adversary
Stopping real-world attacks: Lessons for business leaders from the 2026 cyber frontline
Practical steps to reduce business cyber risk based on analysis of 661 incidents remediated by Sophos X-Ops as detailed in the Sophos Active Adversary Report 2026
Categories: Products & Services
Tags: MDR., Identity Security, ITDR, Secure by Design, XDR
Nowhere, man: The 2026 Active Adversary Report
AI headline hype didn’t deliver a sea change for practical defense — but one below-the-radar development should
Categories: Security Operations, Threat Research
Tags: Active Adversary, Active Adversary Report
