Curated cybersecurity insights, opinions, emerging technologies, AI security topics, and notable industry discussions.
1296 articles
Darktrace introduces a five-level framework for assessing AI use in cybersecurity, from manual operations to AI delegation. It applies across security functions and emphasizes measured outcomes, human oversight, and progressively greater autonomy.
An explainer describes data-harvesting methods and legitimate and criminal uses, including credential theft and doxing, then outlines DarkOwl’s collection practices and basic steps to limit personal-data exposure.
The article recommends shifting supplier risk management from post-breach questionnaires and underground monitoring toward proactive CTI, using passive asset discovery and NetFlow to identify exposed services, unpatched vulnerabilities and suspicious supplier-network
Team Cymru says it observed live SharePoint ToolShell exploitation on July 18, 2025, three days before the first GitHub PoC. Its analysis argues exploitation often starts within hours of public PoC release and recommends faster patching.
Splunk’s Jose Hernandez discusses detection engineering, threat hunting, infrastructure analysis, and efforts to help defenders address attackers’ abuse of legitimate tools.
An overview of eight threats to SaaS applications and user identities—including account takeover, OAuth token abuse, insider threats, API attacks, and BEC—and the limitations of traditional defenses.
A Huntress webinar recap surveys how generative AI is used in social engineering and malware, as well as threat analysis and security operations, and explains why human review remains essential.
Using a reported MSP compromise involving DragonForce ransomware as an example, Deep Instinct argues organizations should scan software and updates from trusted partners before they reach client environments.
A tutorial demonstrates using Hunt.io’s URLx dataset and HuntSQL queries to find potential malware payloads, phishing infrastructure, exposed sensitive files, and misconfigured assets, then enrich results with ProjectDiscovery’s httpx.
A cybersecurity leader shares practical approaches to hiring for creativity and communication, supporting employees’ growth, recognizing their impact, and preventing burnout through boundaries and regular time off.
An explainer outlines how dark-web proceeds, crypto conversion services, NFTs and mixers can support money laundering, while public blockchains can help investigators trace funds. It also reviews Tornado Cash and related enforcement actions.
TrustedSec CTO Justin Elze discusses red-team skills, common information leaks, open-directory hunting, security tools, AI’s role in offensive work, and how his hands-on background shapes technology leadership.
Wiz describes fine-tuning Llama 3.2 1B for code secret detection. The model achieved 82% recall and 85.7% precision in the reported evaluation, and the company says it is in private preview.
An overview of whistleblower platforms including SecureDrop, GlobaLeaks, and WildLeaks, describing how Tor, encryption, and secure submission channels can help protect sources and support anonymous reporting.
A Huntress Tradecraft Tuesday recap explains infostealer evolution, the credentials and data they target, marketplace activity, macOS variants, recent takedowns, a detected Lumma incident, and ways businesses can reduce risk.
Hunt.io demonstrates how analysts can pivot from threat actor profiles and IOCs to connected infrastructure, using host details, DNS, SSH keys, network signals, and historical activity to investigate possible campaign links.
A structured A/B comparison can help organizations evaluate email security solutions fairly by using equal deployment conditions, aligned configurations, consistent threat metrics, and broader criteria such as support and integrations.
Huntress outlines ransomware attack stages and reports attackers took an average of 18 steps before deployment. It recommends early prevention, security awareness training and managed security tools.
Doxing is the nonconsensual public release of personal information, which can enable harassment, identity theft, stalking and threats. The article explains common impacts and recommends practical steps to limit exposure.
Wiz introduces The ExfilCola Incident, a cloud security CTF where participants investigate a fictional data-extortion threat, trace attacker access, and determine whether a secret recipe is safe.
CloudSEK’s scan of a fintech firm’s public-facing assets found exposed Tomcat stack traces, WordPress XML-RPC methods and a misconfigured SPF record, which could aid reconnaissance and email spoofing. The article recommends limiting disclosures and unused features.
Huntress analysts observed an actor using Windows print.exe to copy NTDS.DIT, SAM, and SYSTEM files from Volume Shadow Copies. Huntress says its 24-hour telemetry search found no other print.exe credential-theft instances.
A Huntress episode recap explains how macOS malware adapts to persistence controls, TCC permissions and Gatekeeper, and notes new TCC event visibility in macOS 15.4.
The article explains how NDR and SASE provide complementary network defenses, and describes Darktrace 6.3 integrations with Zscaler and Netskope for faster response and visibility into tunneled traffic.
