AI is now everywhere in cybersecurity. But how much of it is actually making SOC teams’ jobs easier? Almost every vendor offers AI-powered solutions promising faster threat detection, automated malware analysis, and smarter investigations. For SOC teams, separating real value from AI branding has become a challenge of…
SkyW4lker (SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. By abusing Microsoft’s legitimate authentication process, the kit can give attackers access to corporate accounts without stealing passwords or bypassing MFA. This…
When an IOC hits the SOC, the clock is already running. An IP address, domain, file hash, or suspicious URL can trigger a detection, but an analyst still needs to understand what it is, whether it is connected to known malicious activity, and what happened around it. The longer it takes to build that context, the…
During triage, analysts may overlook valuable threat intelligence simply because they don’t know it exists. Previous investigations, related malicious activity, and industry-specific observations could provide the context needed to decide what to investigate next. Now, all that valuable context is finally within…
October marks Cybersecurity Awareness Month, a timely opportunity to look at how American organizations can strengthen their security operations. Among the biggest challenges SOC teams face is making sure they not only detect and investigate threats, but doing so quickly enough to make the right security decisions…
The DORA TLPT requirements push selected EU financial entities beyond standard penetration testing. TLPT must be based on realistic threat scenarios, relevant threat actors, and current intelligence about how attacks are actually carried out. That makes threat intelligence a core part of the process. It helps define…
Adding 10 new clients sounds like exactly the kind of problem an MSSP wants to have. More revenue, more accounts, more room to grow. But growth also brings more alerts, suspicious files and URLs, investigations, escalations, reports, and SLA commitments. And if too much of that work still depends on manual analyst…
ANY.RUN researchers tracked fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were tied to these campaigns, and the USA…
Every day, thousands of SOC and IR teams worldwide analyze suspicious files, emails, and links with ANY.RUN . Beyond individual investigations, this activity generates valuable data on emerging threats, industry trends, and SOC operational performance. Drawing on real-world investigations across thousands of…
Threat intelligence on its own is only data. Its value depends on how effectively SOC teams can turn it into action. Simply put, this was the premise of our recent webinar. The SOC and business impact of threat intelligence depends largely on how quickly analysts can use it to validate threats, make confident…