Learn how Red Canary engineered a super agent—blending ML, a rules engine, similarity, agentic AI, and LLMs—to classify phishing emails. With 94% accuracy, it makes the case for what a hybrid AI SOC can achieve.    

The Financial Times has a good article on how AI is changing the capabilities of video surveillance, with information from both Israel/Iran and Russia.

I wrote about this sort of thing a few years ago, how AI enables mass spying in the way that computers and networks enabled mass surveillance. The interesting development in the article is that AI allows people to ask natural language questions about video footage to AIs—and AIs can answer them.

In contrast with older tools restricted to a few dozen preset searches, these new tools allow an almost unlimited range of enquiries by enabling language-based searches on video.

That lets intelligence officers hunt through massive streams of videos using simple search terms, such as two men handing a bag to each other; a person who has changed their appearance, or has changed clothes multiple times in a day; or a vehicle that has recently been painted over, or has driven past the same spot several times in a short period.

“This is the holy grail of surveillance,” said a European official whose country uses the technology on its cities. “We are able to look for behaviour, not objects ­ it has created a world of new possibilities.”

We offer a practical roadmap for evolving informal, ad hoc threat hunting practices into a mature, scalable program—covering key friction points, structural strategies, and tooling approaches organizations need to grow effectively

Assistive AI agents aren't always helpful—it all depends on who they're working on behalf of.

Your "agentic coworker" is sending suspicious messages via Microsoft Teams. It's going to need to have a chat with the agentic HR department.

We kick off a new blog series with a primer on how to detect and respond to an autonomous agent escalating privileges and persisting in your Entra ID tenant

Don't miss this virtual event as we explore how to cut through alert fatigue, leverage AI and unified platforms to accelerate investigations, and apply actionable threat intelligence.

The post Virtual Event Today: Threat Detection & Incident Response Summit appeared first on SecurityWeek.

Used primarily for resource management, cgroups unlock valuable telemetry for investigating malicious processes on Linux

Unit 42 highlights the need for a comprehensive security strategy that spans every IT zone. Explore the full details here.

The post Essential Data Sources for Detection Beyond the Endpoint appeared first on Unit 42.

Our annual analysis brings you a year’s worth of security operations and intelligence insights, including how adversaries are both leveraging and targeting AI

How to use the open source Assemblyline tool to track browser extension updates and detect malicious code

We deconstruct a multi-step threat hunt for malicious OpenClaw AI agents, outlining our approach to identifying and mitigating risks posed by unauthorized AI skills.

How to detect and respond to OAuth consent attacks in Google Workspace

How to observe, detect, investigate and mitigate against overly permissive Entra app consent

Unit 42 research reveals most OT attacks begin in IT. Learn how edge-driven defense stops threats early and turns dwell time into advantage.

The post Bring the Fight to the Edge: Turning Time Into an Advantage in OT Security appeared first on Unit 42.

By integrating identity threat detection with MFA, organizations can protect sensitive data, maintain operational continuity, and reduce risk exposure.

The post Why Identity Security Must Move Beyond MFA appeared first on SecurityWeek.

The Predator spyware is more sophisticated and dangerous than previously realized.

The post Predator Spyware Turns Failed Attacks Into Intelligence for Future Exploits appeared first on SecurityWeek.

Everything you need to know to detect and prevent npm compromises from Shai-Hulud’s latest campaign

| Niccolo Arboleda | Guest Author Niccolo Arboleda is a cybersecurity enthusiast and student at the University of Toronto. He is usually found in his home lab studying different cybersecurity […]

The post At Home Detection Engineering Lab for Beginners appeared first on Black Hills Information Security, Inc..

Jordan Drysdale // Overview The following description of some of Impacket’s tools and techniques is a tribute to the authors, SecureAuthCorp, and the open-source effort to maintain and extend the code. […]

The post Impacket Defense Basics With an Azure Lab  appeared first on Black Hills Information Security, Inc..