ReliaQuest’s report finds identity-led intrusions drove persistent cloud access and SaaS data theft in June–August 2026, while attackers also relied on trusted tools, valid accounts, and SMB for evasion and lateral movement.
The article explains five uses for continuous, AI-agent-driven red teaming: mapping attack paths, validating detections, testing identity blast radius, retesting pentest findings, and emulating threat actors.
Forrester named ReliaQuest a Strong Performer in its Q3 2026 external threat intelligence evaluation, citing its security-data correlation, AI agent controls, and fit for enterprises with limited security staff.
ReliaQuest found that an unauthenticated email with an empty SMTP envelope sender can bypass Microsoft 365’s RejectDirectSend control while displaying an internal-looking From address. IP-restricted inbound connectors blocked the attempts in testing.
The article argues that MTTD can look faster when its clock starts only after logs are processed. It recommends measuring from the first observable suspicious event until an alert is triggered, consistently across security tools.
ReliaQuest details Gryxa, a financially motivated toolkit linked to a console listing 324 hosts. It uses RMM access, layered persistence, credential theft and endpoint-protection tampering, while collecting logs after defenders remove its visible implant.
ReliaQuest says it has signed an open letter with more than 100 industry leaders urging stronger cyber defenses and wider access to AI capabilities for defenders.
A caller impersonating a ReliaQuest security employee directed a teammate to a fake SSO page. The attacker briefly gained view-only access to one identity dashboard session; no applications or customer data were accessed.
ReliaQuest analyzes a custom web shell highly likely linked to Clop, deployed after exploitation of the Windchill CVE-2026-12569 flaw. The implant can decrypt stored credentials, map files for theft, and run additional code in memory.
ReliaQuest says its GreyMatter OT Engineer agent is available to help triage operational technology incidents by analyzing packet captures, enriching alerts with asset context, and correlating OT signals with IT telemetry.
ReliaQuest outlines five ways to address AI-related security risks, including automating response, governing enterprise AI use, limiting agent permissions, continuously testing defenses, and keeping governance aligned with adoption.
ReliaQuest offers four criteria for assessing agentic AI security tools: autonomous SOC work, relevant threat intelligence, coverage across existing systems without forced data centralization, and plain-language operation.