30
Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
Triage & Response Bottlenecks Eating into MSSP Margins: How to Remove the Friction
ANY.RUN says manual triage bottlenecks erode MSSP margins and promotes its Threat Intelligence Lookup and sandbox to cut Tier 1 workload by up to 20%.
Vendor blog post from ANY.RUN describes recurring MSSP triage and response bottlenecks: manual alert validation, unnecessary Tier 2 escalations, manual handoffs, outdated threat data, and disconnected tools. It cites a healthcare MSSP case study where the Tier 1 closure rate rose from 20% to 70% and false escalations dropped 34% after adopting its tools. The piece claims ANY.RUN can reduce Tier 1 workload by up to 20%, letting MSSPs absorb more clients without proportional headcount growth.
18
ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response
ANY.RUN integrates its interactive sandbox, IOC lookups, and STIX/TAXII threat feeds natively into SentinelOne for faster automated malware triage.
ANY.RUN and SentinelOne launched connectors that embed interactive sandbox analysis and threat intelligence into the SentinelOne console via Singularity Hyperautomation. Suspicious files and URLs from alerts are automatically submitted to the ANY.RUN sandbox, with behavioral verdicts and risk scores returned into alert notes. On-demand IOC lookups draw on sandbox history from 16,000 organizations and 700,000 analysts. A separate STIX/TAXII feed streams verified malicious IPs, domains, and URLs through the SentinelOne Marketplace TAXII Connect app.
25
Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy
Elastic's InfoSec team raised AI alert-triage accuracy from 60% to 92% using three self-correcting agents integrated into Slack triage.
Elastic's InfoSec team deployed three AI agents that read detection-rule investigation guides and closure reasons from 30 days of historical cases to triage alerts. The agentic pipeline lifted triage accuracy from 60% to 92%. Analysts now clear most alerts with a single click in Slack.
35
Why The Vulnerability Backlog Is About To Get Worse
Recorded Future analysis says AI-driven vulnerability discovery and faster weaponization will grow the triage backlog while shrinking defenders' response windows.
Disclosed vulnerabilities rose from roughly 21,000 in 2021 to nearly 50,000 in 2025, while Recorded Future assessed only 446 as actively exploited in 2025. VulnCheck found nearly 29% of 2025 KEV entries were exploited on or before CVE publication. The authors argue AI-assisted discovery and automated exploit development will multiply credible reports, cut disclosure-to-exploit time toward minutes, and force re-evaluation of medium-severity flaws as exploit-chain components.
45
Emergency Department Revisit Quality Review Screening: Exploring Human Decision-Making and Artificial Intelligence Support
A retrospective study found GPT-4 over-flagged emergency department revisit cases while an LLM knowledge-graph screener achieved 83-100% positive predictive value.
In an exploratory retrospective study of 99 emergency department diagnosis pairs from a multihospital health system, clinicians and GPT-4 independently judged whether revisit pairs warranted further assessment. GPT-4 responses correlated poorly with clinicians, flagging 94% of pairs for follow-up, 4.4-13.3 times more than clinicians, though prompt engineering was minimal. An algorithm leveraging an LLM-populated knowledge graph (KGA) achieved 83-100% positive predictive value against at least one clinician rater, suggesting LLM-based screening could broaden revisit quality review without substantially increasing reviewer workload.
20
When the Whole Company Adopts AI: What It Does to Your SOC
Analysis of 16.9 million SOC alerts finds AI-related alerts at 0.43%, growing 685% since February, with 94.1% noise and 0.02% real attacks.
A review of roughly 16.9 million SOC alerts found about 73,000 (0.43%) were AI-related, a share that grew 685% between February and June 2026. Of AI-related alerts, 94.1% were noise, 5.8% genuine risks, and 0.02% real attacks; 79.8% received benign verdicts, 81.7% were automatically suppressed, and only 5.4% reached a human analyst. The only confirmed attacks were phishing campaigns that weaponized AI brand names as lures, while developer coding agents spawning shells and reading credential stores routinely tripped detections written before AI agents existed.
45
15 Minutes Saved Per Alert: How a Lean German Manufacturer Protects 10,000 Endpoints with ANY.RUN
A five-person security team at a German manufacturer protecting 10,000 endpoints cut triage time by 15 minutes per alert after adopting ANY.RUN's cloud sandbox.
Philipp Z., Security Lead at a leading German manufacturer, described how a five-person team protects 10,000 endpoints and users using ANY.RUN's Interactive Sandbox in a private cloud. The firm previously relied on a single air-gapped forensic laptop running Flare VM, which caused 5-10 minute setup delays, single-user bottlenecks, and selective triage. The switch reportedly saved roughly 15 minutes per alert and reduced forced wiping and reimaging of user machines. ANY.RUN data cited in the piece puts manufacturing security workloads 22% above other major industries.
18
Topological Fraud Detection in Latent Transaction Spaces
Researchers present a privacy-preserving fraud detection method combining unsupervised filtering and supervised classification on anonymized transaction embeddings for low-latency triage.
The paper describes fraud detection performed entirely on topologically anonymized transaction embeddings. It iterates unsupervised filtering followed by supervised classification ('sniping') to flag suspicious activity. The goal is ultra-low-latency, privacy-preserving triage for institutions without exposing personally identifiable information.
22
NOAH: Learning the Full Patient Journey. A Longitudinal Multimodal Time-Aware Model for Representation and Forecasting
Researchers introduce NOAH, a time-aware generative transformer trained on 559 million MIMIC clinical events to forecast multimodal patient trajectories.
NOAH is a task-agnostic, time-aware generative transformer trained on over 559 million clinical events from 431,000 hospital visits by 299,000 patients across the MIMIC dataset family. It uses bidirectional time integration and a variational latent space to model the stochastic evolution of patient states, natively processing medical images, time-series signals, categorical events, and structured or unstructured clinical records. The model supports autoregressive forecasting with optional time control, zero-shot classification, and counterfactual intervention simulation, with strong probing performance across clinical outcomes, 15 ICD chapters, and 29 comorbidities.
42
OpenAI Builds ‘Defense Factory’ as AI Agents Gain Ability to Chain Cyber Exploits
OpenAI unveiled a Defense Factory using AI agents to continuously discover, validate, patch, and verify vulnerabilities, warning the defender's window against agentic attackers is shrinking.
OpenAI describes a Defense Factory workflow where AI agents integrate source control, scanners, issue trackers, and secret stores to discover, reproduce, patch, and verify vulnerabilities under human oversight. The approach responds to agentic attackers that can retain knowledge across sessions and chain vulnerabilities into multi-stage attack paths faster than human triage can respond, which OpenAI calls a shrinking defender's window. During an internal security sprint involving 250+ people across 100+ service areas, agents closed 53 urgent or high-priority issues on day one, achieved 90.6% ownership-routing acceptance, cut 37% of findings as duplicates, and produced Codex-generated patches with a 0.53% rollback rate. Runtime validation reduced false positives to 0.81%, and each agent operates in isolated, reproducible environments with a control plane for policy and credentials.
58
Communicating Under Pressure: Best Practices for Service Providers
CISA, FBI, and international partners issued guidance on crisis communications for service providers during IT and OT outages, emphasizing clarity, transparency, and backup channels.
CISA, the FBI, and international partners published guidance on planning and executing clear, timely, audience-appropriate communications during IT and OT service outages, whether caused by cyber threat actors, human error, or natural hazards. The guidance stresses clarity, accountability, and transparency, and warns that outages at one organization can cascade across interconnected systems. It recommends critical infrastructure owners assume telecommunications may be unreliable and integrate backup communication methods into crisis plans, and points to CISA's CI Fortify initiative for OT isolation and recovery resources.
22
Cybersecurity jobs available right now: April 14, 2026
Help Net Security lists active cybersecurity job openings at employers including MANTECH, Honeywell, SMBC Group and SBS Transit across multiple countries.
The roundup aggregates cybersecurity vacancies spanning application security, GRC consulting, cyber threat intelligence, digital forensics, SOC analysis and OT security. Openings were posted in India, the United Kingdom, Italy, the USA, Singapore, France, Germany, Ireland and the UAE. Most roles were no longer accepting applications at publication. Named employers include Honeywell, MANTECH, TENEX.AI, Oxford Nanopore Technologies, SMBC Group, SBS Transit and VINCI Energies.
10
NOAH: Learning the Full Patient Journey. A Longitudinal Multimodal Time-Aware Model for Representation and Forecasting
Researchers introduce NOAH, a generative time-aware transformer trained on 559 million MIMIC clinical events to model and forecast patient trajectories.
NOAH is a task-agnostic, time-aware generative transformer designed to represent and forecast the full multimodal patient journey across medical images, time-series signals, categorical events, and clinical text. It was trained on over 559 million clinical events from 431,000 hospital visits covering 299,000 patients in the MIMIC dataset family. The architecture combines bidirectional time integration with a variational latent space to capture continuous patient state evolution and clinical stochasticity. NOAH supports autoregressive forecasting with time control, zero-shot classification, and counterfactual intervention simulation, with evaluations on 15 ICD chapters, 29 comorbidities, and time-to-event prediction.
40
An Empirical Analysis of CodeQL False Positives and Query Refinements for Java Vulnerabilities
Study of 167 Java CVE instances finds CodeQL false positives follow recurring patterns; query refinements remove 81.8% of reviewed ones.
Researchers ran CodeQL's Java security query suite on 167 CVE instances from 110 projects, manually reviewing 500 sampled false-positive paths and building a five-category taxonomy led by Missed Path Constraint or Sanitization (36.6%), Benign Execution Context (29.4%), and Missing Trust Boundary Modeling (27.6%). Guided by the taxonomy, query-level refinements removed 81.8% of reviewed false positives and 15.8% of reported paths across the selected queries while retaining 7 of 8 true positives. To address generalization, agentic coding tools given the refinement patterns as templates adapted them to new projects successfully in 56% and 62% of tasks, versus 28% without guidance.
34
OmniMed-FL: A Robust Multimodal Federated Learning Framework for Clinical Diagnosis
OmniMed-FL benchmarks multimodal federated learning for chest radiograph diagnosis across 3-20 clients, with FedProx leading under severe non-IID skew.
OmniMed-FL studies multimodal federated learning combining chest radiographs and clinical notes for five-class condition classification under HIPAA/GDDR-compliant decentralized training. It benchmarks eight fusion strategies, imputation rules, and federated baselines under Dirichlet non-IID partitioning across 3-20 hospital clients. With 5 clients and severe skew (alpha=0.1), FedProx scored 0.737 macro-F1 versus 0.662 for FedAvg and 0.297 for local-only training. Multimodal fusion beat unimodal inputs (0.956 vs 0.934 text, 0.664 images) on the synthetic corpus.
18
Cybersecurity jobs available right now: February 10, 2026
Help Net Security's roundup lists open cybersecurity roles at KPMG, Pentera, Google, Group-IB and others across multiple countries.
A job-board roundup featuring Cloud Security Engineer at KPMG (Israel), Cloud Security Researcher at Pentera (Israel), Cyber Defence Senior Analyst at Google (UK), and Cyber Investigation Specialist at Group-IB (UAE). Additional listings cover SOC operations, penetration testing, network architecture, OT/IT convergence and AI/ML security testing across Australia, Italy, the US, India, France, Ireland and the UAE. All listings are marked no longer accepting applications.
10
What researchers learned about building an LLM security workflow
Oslo and FFI researchers show structured agentic workflows lift LLM alert-triage accuracy from 0% to about 93% on malicious cases.
Researchers at the University of Oslo and the Norwegian Defence Research Establishment tested GPT-5-mini, Claude 3 Haiku, Qwen3:30B, and Gemma 3:27B on alerts from the AIT Log Data Set V1.1; given only alert descriptions and log summaries, all four models correctly flagged zero percent of true-positive cases involving reconnaissance, brute-force logins, and initial access. Wrapping the same models in a workflow with constrained SQL queries over Suricata logs, an evidence summarizer, and a verdict stage with revision loops raised malicious-case accuracy to an average of 93 percent, with GPT-5-mini identifying every malicious case across 100 runs. The authors flag it as a proof-of-concept on one synthetic scenario and note models skewed conservative on benign alerts, with GPT-5-mini marking every benign case uncertain.
55
57
Anchoring Clinical Events in Time: UID-Preserving Multimodal Reconstruction and Source-Grounded Adjudication
UID-preserving multimodal framework plus GAVEL LLM judge improves clinical timeline reconstruction, boosting event recovery 43% over prior matching.
The paper introduces a UID-preserving framework linking each narrative clinical event to its source span through text-only estimation, structured-evidence retrieval, timestamped source-row grounding, and joint revision. GAVEL, an LLM judge, compares UID-aligned timelines against narrative and structured records. Across six open-weight models and 40 mixed-critical-care summaries, GLM 5.2 multimodal revision improved temporal agreement without reducing event recovery and performed competitively with clinician annotations, while DeepSeek V3.2 did not benefit from multimodality. The pipeline achieves 43% increased event recovery with occurrence-level provenance.
30
Water sector passes, government sector fails attempts to spot and halt simulated CISA attack
CISA red teamers compromised both a government and a water organization; water defenders detected and contained the simulated attack, government defenders did not.
CISA's red team gained initial access, elevated domain privileges, and lateral movement into sensitive business systems and cloud resources at an unnamed government organization, whose SOC ignored low- and medium-severity EDR alerts buried under thousands of false positives. A water organization's SOC quarantined phishing-compromised workstations within 2, 10, and 20 minutes, and later detected and isolated intrusions reaching the OT DMZ bastion host. Both organizations underestimated cloud risk, lacked Microsoft Conditional Access for workload identities, and had no process to revoke compromised access and refresh tokens. This is one of CISA's rare public red-team reports since 2023.
55
57
Cyble Introduces Major Upgrade to its Executive Monitoring Module
Cyble upgraded Executive Monitoring in Cyble Vision, unifying impersonation, exposure, and mention findings with AI scoring and multi-channel alerting.
Cyble released a major upgrade to Executive Monitoring within its Cyble Vision platform, consolidating Mentions, Impersonations, Exposures, and a new Surface Mentions source (blog and news coverage) into a single findings stream. The release adds AI-generated verdicts and recommendations, per-executive Risk and Reputation scoring for board reporting, and richer onboarding with aliases, reference images, and addresses to cut same-name false positives. Alerting now supports data residency, bulk import, delivery via email, WhatsApp, and SMS, an Access API, and branded executive PDF reports; the upgrade is live with no customer action required.
15
Recorded Future Launches AI Alert Filtering
Recorded Future launched AI Alert Filtering to automatically triage threat intelligence alerts by relevance, letting analysts prioritize faster while retaining control.
Recorded Future announced general availability of AI Alert Filtering, powered by Recorded Future AI. The feature automates the first pass of filtering alerts by relevance so analysts can prioritize faster while keeping human control. It applies LLM-based automation to threat intelligence alert triage workflows.
25
ENISA: Frontier AI Is Changing the Speed of Cyberattacks. Europe Needs to Catch Up
ENISA warns frontier AI compresses attack lifecycles to minutes, with exploits possible within 15 minutes of disclosure and median 72-minute breach-to-exfiltration times.
ENISA's July 2026 paper 'ENISA's view on Cybersecurity in the Frontier AI Era' argues AI-assisted attackers may weaponize vulnerabilities within 15 minutes of disclosure and achieve initial-access-to-data-exfiltration in a median 72 minutes, creating a 'negative time-to-exploit' problem. The report cites one organisation whose CVE volume rose from roughly 80 in Q1 2025 to almost 500 in Q1 2026, then about 500 reports per day when frontier-AI tools were used. ENISA recommends machine-speed defence under 'Cybersecurity as Code', EPSS and VEX-based prioritisation, AI-assisted incident response with human oversight, and an assume-breached architecture.
50
Evaluating Time-Series Foundation Models and Multimodal Dietary Context for CGM Forecasting
Study finds zero-shot time-series foundation models underperform on CGM forecasting; fine-tuned Chronos-Bolt cuts RMSE up to 18.4% and dietary context adds signal.
The paper evaluates time-series foundation models for continuous glucose monitoring forecasting across eight public datasets covering Type 1 diabetes, Type 2 diabetes, and non-diabetes populations. Under a unified protocol, zero-shot foundation models did not consistently outperform baselines like Elastic Net and PatchTST, but lightweight fine-tuning did, with fine-tuned Chronos-Bolt reducing RMSE by 6.5%-18.4% in the T1D cohort and 8.6%-18.2% in the non-diabetes/T2D cohort. A residual-based fusion framework adding dietary context from CGMacros reduced overall RMSE by about 3% and postprandial RMSE by about 15% versus CGM-only baselines.
28
Keepnet launches free SMS/Call Reporter for iOS
Keepnet launched a free iOS app, SMS/Call Reporter, letting users one-tap report smishing and vishing into corporate incident response pipelines.
Keepnet released the free SMS/Call Reporter app for iOS, letting users report suspicious SMS and voice phishing with one tap. For enterprise customers, reports flow into Keepnet Incident Responder alongside email phishing reports. The company cites Verizon 2026 DBIR data showing mobile phishing simulations achieve a 40% higher median click rate than email, and FBI IC3 2025 counted $798 million in smishing and vishing losses. An Android version is planned.
22
30
CISA Urges Service Providers to Provide Transparent Updates During Major IT and OT Outages
CISA and FBI issued guidance urging service providers to deliver timely, transparent communications during major IT and OT outages.
CISA, with the FBI and international partners, released 'Communicating Under Pressure: Best Practices for Service Providers', urging providers to prepare crisis-communication procedures, provide timely status updates during IT/OT outages, and maintain out-of-band communication channels. The guidance warns that disruptions to telecom, cloud, energy, and water services can cascade across critical infrastructure. It aligns with CISA's CI Fortify initiative supporting IT/OT isolation and recovery.
30
Citrix UniconOS dual boot turns Windows endpoints into their own recovery device
Citrix released UniconOS dual boot in Release 7 2607, turning Windows endpoints into self-recovery devices after ransomware, failed updates or OS corruption.
Citrix announced dual boot in UniconOS Release 7 2607, which installs an isolated, hardened recovery environment alongside Windows in a separate partition protected by secure boot. If Windows is unavailable, users reboot into UniconOS and reconnect to applications via Citrix DaaS and SecurAccess with Chrome Enterprise. The capability is aimed at reducing reliance on spare hardware and central reimaging during ransomware or update failures, with automatic enrollment in UniconOS Management for fleet-wide boot policies.
25
57
FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching
FBI officials said AI is accelerating adversary capabilities while its new cyber strategy emphasizes continuous patching, cyber hygiene, and AI-enabled defense.
At the Billington CyberSecurity Summit and ahead of a new FBI cyber strategy, deputy assistant director Jason Bilnoski said AI is boosting the speed and capability of both criminal and nation-state attackers, while stressing that basic controls like MFA would still prevent most attacks. Colleen Ferranti urged a shift from quarterly Patch Tuesday cycles to continuous, risk-based patching as AI accelerates vulnerability discovery. The strategy pledges AI-enabled triage, malware analysis, attribution support, agentic AI adoption, expanded Computer Network Operations, ICS Coordinators in every field office, and a pledge on victim relief and privacy.
32
DynSHAP: Towards Explainable Dynamic Survival Analysis
DynSHAP extends SHAP explainability to dynamic survival analysis, treating time-feature pairs as Shapley players for longitudinal clinical predictions.
DynSHAP adapts marginal SHAP estimators to dynamic survival analysis by treating time-feature pairs as players in the Shapley game, handling longitudinal irregular inputs and functional survival outputs. Temporal DynSHAP learns linear feature dependencies over time and addresses them with conditional sampling. On synthetic data with ground-truth attributions it recovers temporally dependent features more accurately than marginal estimators, and it produces faithful attributions on two real-world clinical datasets across two DSA architectures.
22
CISA Warns of Chromium Type Confusion 0-Day Vulnerability Actively Exploited in Attacks
CISA added the actively exploited Chromium V8 type confusion zero-day CVE-2026-85046 to its KEV catalog, urging patching of Chrome, Edge, and Opera.
CISA added CVE-2026-85046, a V8 type confusion flaw (CWE-843) in Chromium-based browsers, to its Known Exploited Vulnerabilities catalog. A remote attacker can trigger arbitrary code execution inside the browser sandbox via a specially crafted HTML page. Google Chrome is directly affected, and Microsoft Edge, Opera, and other Chromium-based browsers may also be impacted depending on their V8 version. Google has released a Stable channel Chrome update, and CISA directs mitigations under Binding Operational Directive 26-04.
92
German Manufacturer Shrinks Security Alert Response While Protecting 10,000 Endpoints
Vendor case study: a German manufacturer's five-person SOC cut alert triage time using ANY.RUN's cloud sandbox across 10,000 endpoints.
ANY.RUN published a case study in which a five-person security team at an unnamed German manufacturer replaced an air-gapped forensic laptop with its cloud-managed interactive sandbox, protecting roughly 10,000 endpoints and 10,000 users. The vendor claims a median 15 minutes saved per alert, 20-40 daily tasks processed, a 2.5-minute alert-to-isolation target, and a 95% agreement rate between analyst and sandbox verdicts; all figures are vendor-supplied with the customer identity withheld. The writeup also describes detonating a multi-stage phishing chain from a PDF link to a password-protected ZIP to malware execution.
22
IDScan Confirms Data Breach Following 153 Million Driver’s Licenses Leaked on the Dark Web
IDScan.net confirms a breach after a marketplace advertised over 153 million US and Canadian driver's licenses, possibly exfiltrated continuously for over a year.
The Louisiana identity-verification firm detected unauthorized access on or around September 1, 2026, after the 'Nexus' identity theft service on the Exploit forum began advertising 170M+ people's records, including 153M+ driver's licenses, 10M+ ID cards, 3M+ travel documents, and 579,000 medical cards. Canadian records exceed 1.1 million, and the trove includes commercial licenses, Common Access Cards, and dispensary IDs, with a record for US Defense Secretary Pete Hegseth reportedly included. Nexus operators claim continuous exfiltration for over a year, with the license count growing by nearly 400,000 in 24 hours, suggesting the intrusion may be active. The FBI's New Orleans field office has opened a formal inquiry, and IDScan.net is offering free credit monitoring.
92
Performance of Clinical AI System and Physicians and Frontier Language Models in primary care diagnostics
Clinical AI system Doctorina achieved 82.0% primary-care diagnostic concordance versus 57.0% for physicians across 150 synthetic consultations.
The study compared Doctorina, eight physicians, and four standalone frontier language models on 150 synthetic Polish-language primary-care consultations. Doctorina achieved 82.0% Top-1 diagnostic concordance versus 57.0% for physicians (25.0-point difference, 95% CI 17.7-32.7) and 97.3% versus 85.0% primary-or-reference-differential concordance. Normalized workup and treatment scores were 89.4 versus 66.9 and 83.7 versus 61.2. Kimi K3 ranked next on diagnosis, while Claude Opus 5 led the closely spaced management estimates among Opus, Doctorina and Kimi.
26
57
Canada’s Hospital for Sick Children attacked by cybercriminals again as employee data stolen
Canada's Hospital for Sick Children reported a data theft incident exposing current and former employee data via a third-party application.
The Hospital for Sick Children (SickKids), Canada's largest pediatric health center, disclosed that hackers stole personal information of current and former employees, job applicants, and SickKids Foundation staff, likely through a third-party software application. The attack briefly took down the hospital's careers website but did not involve clinical systems or patient information. Affected individuals were notified and offered two years of credit monitoring. The hospital was previously hit by ransomware in 2022.
48
CISA Warns of N-able N-central RCE Vulnerability Exploited in the Wild
CISA added CVE-2026-86218, a CVSS 10.0 unauthenticated RCE in N-able N-central RMM, to its KEV catalog; on-premises admins must patch to 2026.3.1.14.
CISA added CVE-2026-86218, a CVSS 10.0 static code injection (CWE-96) enabling unauthenticated RCE in N-able N-central, to the Known Exploited Vulnerabilities catalog on September 8, 2026. The flaw affects all on-premises builds before 2026.3.1.14 across the 2025.4 through 2026.3 release lines; N-able shipped Hotfix 4 for 2026.3 on September 5-6, 2026. Huntress research indicates at least one customer's N-central instance was compromised on September 4, and federal civilian agencies must mitigate by September 11 under BOD 26-04. Hosted environments were patched server-side, but a compromised RMM server can serve as a single point of entry into entire MSP client bases.
84