ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “forensics”

23 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 29Industry 27Threat actor 22Ransomware 8AI safety & security 8Data breach 8Malware 8Policy & legal 8Research 5Tools 5Vulnerability 4AI policy 2AI industry 2Phishing & fraud 1
SeverityAllcritical 26high 38medium 21low 1info 53

2026 Cyber Insurance Trends Report: What's Changed and What You Need to Know

Huntress survey: CIRCIA reporting mandates now live, BEC claims exceed ransomware, exfiltration-heavy attacks cost twice as much, premiums rising.

Huntress's 2026 cyber insurance trends report, based on its own survey, finds 79% of respondents carry cyber insurance while 58% report shrinking coverage over five years. New CIRCIA federal reporting mandates and EU NIS2 requirements are reshaping policies, business email compromise now drives more claims than ransomware, and data exfiltration has replaced encryption as the dominant ransomware tactic at roughly twice the cost. After three years of declining premiums, rates are climbing again, and most businesses now refuse to pay ransoms.

Huntress · 15d agoIndustry1

AI is exposing a security structure built for yesterday’s threats

EY's Jeffrey Sallet argues AI-driven deepfakes and impersonation require integrating cybersecurity, physical security, HR and legal functions.

The opinion piece contends AI-powered impersonation, deepfakes and automated social engineering cross digital, physical and operational boundaries that siloed security programs cannot cover. It cites an EY survey of 250 corporate leaders where only 12% feel most prepared to detect a targeted physical attack, and describes transnational groups using deepfakes and stolen identities to bypass virtual HR hiring loops. The author urges unified cross-functional verification pipelines and shared threat intelligence between CISOs and chief security officers.

CSO Online · 2d agoIndustry

Cybersecurity jobs available right now: April 14, 2026

Help Net Security lists active cybersecurity job openings at employers including MANTECH, Honeywell, SMBC Group and SBS Transit across multiple countries.

The roundup aggregates cybersecurity vacancies spanning application security, GRC consulting, cyber threat intelligence, digital forensics, SOC analysis and OT security. Openings were posted in India, the United Kingdom, Italy, the USA, Singapore, France, Germany, Ireland and the UAE. Most roles were no longer accepting applications at publication. Named employers include Honeywell, MANTECH, TENEX.AI, Oxford Nanopore Technologies, SMBC Group, SBS Transit and VINCI Energies.

Help Net Security · 22d agoIndustry2

Knowledge Retention & Sharing in DF/IR

DFIR veteran reflects on knowledge retention and sharing gaps across the industry, from EnCase training to PCI forensics workflows.

A personal essay recounts decades in digital forensics and incident response, arguing the industry rarely moves beyond individual or tribal knowledge to operationalize lessons learned. Examples include building condition files and custom EnScripts for PCI investigations at IBM ISS X-Force, and the lack of shared investigative processes in early-career environments.

Lobsters · security · 7d agoIndustry

15 Minutes Saved Per Alert: How a Lean German Manufacturer Protects 10,000 Endpoints with ANY.RUN

A five-person security team at a German manufacturer protecting 10,000 endpoints cut triage time by 15 minutes per alert after adopting ANY.RUN's cloud sandbox.

Philipp Z., Security Lead at a leading German manufacturer, described how a five-person team protects 10,000 endpoints and users using ANY.RUN's Interactive Sandbox in a private cloud. The firm previously relied on a single air-gapped forensic laptop running Flare VM, which caused 5-10 minute setup delays, single-user bottlenecks, and selective triage. The switch reportedly saved roughly 15 minutes per alert and reduced forced wiping and reimaging of user machines. ANY.RUN data cited in the piece puts manufacturing security workloads 22% above other major industries.

ANY.RUN · 8d agoIndustry

Cybersecurity jobs available right now: June 9, 2026

Help Net Security lists open cybersecurity roles at firms like Lockheed Martin, ByteDance, Nordic Semiconductor, and General Motors across AppSec, cloud, and compliance.

A June 2026 roundup aggregates cybersecurity openings spanning application security, cloud security, compliance, reverse engineering, and deepfake forensics across the US, UK, Israel, Ireland, Norway, Singapore, India, and Canada. Most listed positions are marked as no longer accepting applications.

Help Net Security · 9d agoIndustry1

The story behind the intelligence

Cisco Talos newsletter features adversary-engagement podcast, flags AI guardrail 'safety penalty' slowing defenders, and recaps McKesson breach and PaperCut patching headlines.

The Threat Source newsletter spotlights the Beers with Talos podcast, in which researcher Azim Khodjibaev describes maintaining eight dark-web personas to identify prolific cybercriminals and support disruption efforts. Talos also argues frontier AI guardrails impose an AI 'safety penalty', citing a July 2026 incident where Hugging Face's primary cloud LLM refused to analyze forensic breach data and delayed response. Recapped headlines include ShinyHunters claiming theft of 284 million patient records from McKesson via vishing and Okta account takeover, Anthropic warning Claude users about infostealer malware, and PaperCut issuing emergency patches for chained vulnerabilities.

Cisco Talos · 13d agoIndustry

German Manufacturer Shrinks Security Alert Response While Protecting 10,000 Endpoints

Vendor case study: a German manufacturer's five-person SOC cut alert triage time using ANY.RUN's cloud sandbox across 10,000 endpoints.

ANY.RUN published a case study in which a five-person security team at an unnamed German manufacturer replaced an air-gapped forensic laptop with its cloud-managed interactive sandbox, protecting roughly 10,000 endpoints and 10,000 users. The vendor claims a median 15 minutes saved per alert, 20-40 daily tasks processed, a 2.5-minute alert-to-isolation target, and a 95% agreement rate between analyst and sandbox verdicts; all figures are vendor-supplied with the customer identity withheld. The writeup also describes detonating a multi-stage phishing chain from a PDF link to a password-protected ZIP to malware execution.

Cyber Security Newsupdated · 2h agofirst · 19h agoIndustry 3 sources

Top 10 Best Device Control & USB Security Tools in 2026

A 2026 scorecard ranks ten USB and device control tools, placing Safetica, Ivanti DeviceLock and DriveLock at the top.

The article compares ten device control and USB security tools using a weighted scorecard covering control granularity, platform coverage, DLP integration, operability and value. Safetica, Ivanti DeviceLock and DriveLock rank highest, with notes on cross-platform depth, Windows granularity and European compliance fit. The piece highlights ownership changes, including CoSoSys joining Netwrix and Digital Guardian joining Fortra, and stresses device control as part of Zero Trust and DLP strategies.

Cyber Security News · 7d agoIndustry

Cybersecurity jobs available right now: February 10, 2026

Help Net Security's roundup lists open cybersecurity roles at KPMG, Pentera, Google, Group-IB and others across multiple countries.

A job-board roundup featuring Cloud Security Engineer at KPMG (Israel), Cloud Security Researcher at Pentera (Israel), Cyber Defence Senior Analyst at Google (UK), and Cyber Investigation Specialist at Group-IB (UAE). Additional listings cover SOC operations, penetration testing, network architecture, OT/IT convergence and AI/ML security testing across Australia, Italy, the US, India, France, Ireland and the UAE. All listings are marked no longer accepting applications.

Help Net Security · 22d agoIndustry

Cybersecurity job ads demanding AI skills double in a year

AI skill requirements in G7 cybersecurity job postings doubled year-over-year to 28.5%, with AI-skill roles paying a 14.9% salary premium.

Research from the AI Workforce Consortium, Cornerstone and Indeed covering April 2024 to March 2026 found that 28.5% of G7 cybersecurity job postings between October 2025 and March 2026 required AI skills, double the 14.2% a year earlier. Lightcast salary data put median advertised pay for AI-skill postings 14.9% above the overall cybersecurity median in the US. Senior-titled postings grew 65% in six months while junior titles only recently returned to growth, and a Cisco survey of 8,000 security leaders flagged hands-on AI-agent experience and technical depth as the biggest entry-level gaps.

Help Net Security · 24d agoIndustry

Top 10 Best Microsoft Azure Security Tools in 2026

An editorial roundup of the ten best Azure security tools in 2026 names Defender for Cloud the native floor, with Wiz, Orca, and Prisma Cloud leading third-party options.

The brief reviews ten Azure security tools, positioning Microsoft Defender for Cloud's free foundational tier and published per-resource plans as the rational starting point for every Azure estate. Wiz and Orca are shortlisted for agentless attack-path correlation, Prisma Cloud for multicloud breadth, CrowdStrike for runtime protection, and Tenable for CIEM depth with Entra permission analytics. The piece emphasizes Azure's tight identity-infrastructure coupling via Entra ID as both an operational advantage and its most critical risk surface. Scoring is editorial, not lab-tested, with pricing compared by model only.

Cyber Security News · 2h agoIndustry

The true cost of a ransomware attack, with and without BCDR

Ransomware's true cost averages $5.08 million per incident versus a $139,875 median ransom, and mature BCDR strategies with immutable backups cut downtime and recovery expenses.

IBM's Cost of a Data Breach Report 2025 puts the average ransomware incident at $5.08 million, far above the $139,875 median ransom payment cited in Verizon's 2026 DBIR. Datto's State of BCDR Report 2025 found 60% of organizations believed they could recover within a day, but only 35% actually did. The Datto-sponsored piece argues mature BCDR with immutable WORM backups shortens downtime, citing a Techify case that restored 19 TB and returned a client to operations in under two hours without paying a ransom. It also flags compliance deadlines such as GDPR's 72-hour breach notification and the SEC's four-business-day disclosure rule.

BleepingComputer · 20h agoIndustry

Google Search Makes It Harder to See Where a Link Really Goes Before You Click

Google now routes some Search results through opaque google.com/goto redirects, weakening hover-to-verify anti-phishing checks.

Google has begun serving some organic search results as opaque google.com/goto?url= redirects whose destinations can only be resolved server-side by Google, likely to raise scraping costs for rank trackers and archival services. The change removes the pre-click hover preview of the true destination URL, undermining a long-standing anti-phishing habit for spotting lookalike, typosquatted, or search-optimized phishing domains. Security teams are advised to rely on layered defenses such as domain reputation, DNS and web filtering, browser isolation, and user training rather than hover text.

GBHackers · 1d agoIndustry

Cybersecurity jobs available right now: September 15, 2026

Help Net Security's weekly roundup lists cybersecurity job openings worldwide, from CISO roles to cloud security engineers at firms like Adobe, JPMorgan Chase, and PwC.

Help Net Security's September 15, 2026 job roundup lists cybersecurity openings across India, USA, UK, Australia, Canada, Israel, UAE, Ireland, and Denmark. Roles include a CISO at Texas Health and Human Services, a GenAI CBRNE Cyber Security Expert at Alice, and security engineering positions at Adobe, JPMorgan Chase, PwC, and the Reserve Bank of Australia. Several openings focus on AI security, including red-teaming AI models and securing AI agent platforms.

Help Net Security · 2d agoIndustry1

12 Best Ransomware Protection Solutions Compared (2026): Features & Pricing

GBHackers compares 12 ransomware protection solutions for 2026, recommending layered stacks of EDR prevention, managed detection, containment, and guaranteed recovery.

The editorial comparison argues no single product stops ransomware, recommending a layered strategy across prevention, early detection, blast-radius containment, and clean recovery. CrowdStrike and SentinelOne are named best-in-class EDR, Huntress and Sophos MDR for managed 24/7 coverage, ColorTokens for microsegmentation containment, and Rubrik and Acronis for guaranteed recovery. The guide notes ransomware is now professionalized with double extortion and encryption sprints measured in minutes.

GBHackersupdated · 2h agofirst · 6d agoIndustry 12 sources1

Top 10 Best Endpoint Encryption Software in 2026

A 2026 roundup of ten endpoint encryption products argues the engines are solved and buyers should choose management layers like Intune, Sophos, or Trellix.

The guide ranks ten endpoint encryption options, arguing BitLocker and FileVault have won the engine war so the real purchase decision is the management layer for compliance proof, key escrow, and cross-platform policy. Microsoft BitLocker with Intune is named the baseline for Windows estates, with Sophos, ESET, Trend Micro, Check Point, Trellix, and others covering mixed or regulated fleets. It also warns that TrueCrypt-lineage freeware is unmaintained and that Kaspersky cannot be sold to US customers.

Cyber Security News · 7d agoIndustry

The 12 Best Managed XDR Services, Compared and Priced

A comparison of twelve managed XDR providers covering pricing models, telemetry breadth, and distinguishing genuine MXDR from rebranded MDR services.

The article compares twelve managed XDR providers including Bitdefender, CrowdStrike, Palo Alto Unit 42, Trend Micro, Fortinet, Secureworks Taegis, Stellar Cyber, Ontinue, and ReliaQuest, highlighting pricing models and telemetry breadth. It explains that genuine MXDR must actively monitor identity, cloud, and email telemetry rather than merely ingest it, and typically costs 30-60% more than endpoint-only MDR. It also notes Sophos completed its approximately $859 million acquisition of Secureworks in February 2025.

GBHackers · 8d agoIndustry 3 sources2

Cybersecurity jobs available right now: July 21, 2026

Help Net Security lists current cybersecurity openings at Stellantis, Lloyds Banking Group, Los Alamos National Laboratory, and other organizations across the US, UK, and Europe.

Help Net Security's July 21, 2026 roundup of cybersecurity job listings includes Application Security Analyst at Stellantis, CRISO at CRISO Trustyfy in the UAE, Head of Cyber Defence Centre at Lloyds Banking Group, and insider threat, compliance, and engineer roles across the US. Many listed positions are no longer accepting applications. The listing also promotes a guide on succeeding at cybersecurity job interviews.

Help Net Security · 14d agoIndustry

Securing Your Business: The Vital Role of Cyber Insurance | Huntress

Huntress explains cyber insurance coverage types, insurer security requirements, and the shift toward documented evidence of controls.

Huntress outlines first-party and third-party cyber insurance coverage, including business interruption, data recovery, extortion, privacy liability, and regulatory fines. Insurers now commonly require EDR, MFA, security awareness training, patching, tested backups, least-privilege access, and incident response plans. With ransomware accounting for 91% of insurance losses in H1 2025 and average US breach costs at $10.22 million, underwriters increasingly demand evidence packs rather than self-attestation.

Huntress · 15d agoIndustry

Cybersecurity jobs available right now: May 19, 2026

Help Net Security's roundup lists cybersecurity openings across many countries, including CISO, threat intelligence, OT security, and AI security expert roles.

The roundup lists cybersecurity vacancies including CISO, SOC analyst, threat intelligence analyst, security engineer, OT security manager, and principal AI security expert positions. Employers include DataFence, Aldermore Bank, GDIT, Netcraft, Sonar, Sylvamo, MED-EL, and Crisis24 across the US, UK, India, Ireland, Australia, Austria, Canada, Germany, and the UAE. Nearly all listings were marked as no longer accepting applications at publication.

Help Net Security · 20d agoIndustry

Choose your fighter: Balancing competing requirements to select models for your AI SOC

Cisco Talos guidance explains how SOC teams should balance competing requirements when selecting AI models for SOC and DFIR tasks.

Cisco Talos published guidance on selecting models for security operations center (SOC) and digital forensics and incident response (DFIR) tasks. The piece argues that picking the best model is more involved than it may appear and requires balancing competing requirements. It is intended to help defenders structure their AI model evaluation process.

Cisco Talos · 22d agoIndustry

Cybersecurity jobs available right now: June 30, 2026

Help Net Security lists cybersecurity job openings across the US, UAE, France, Israel, Japan, Ireland, India, and Canada at major employers.

The roundup includes roles such as AI Offensive Security Engineer at AGAPI, Cloud Security Engineer at Spotify, IAM Engineer at Proton, DFIR in Israel, and a Senior Inspector overseeing NIS2 and AI regulation compliance in Ireland. Most listings were marked as no longer accepting applications, with a few still open including DFIR at Cye, IAM Engineer at Proton, and Detection Engineering at Saronic. The list covers employers across finance, infrastructure, and technology sectors.

Help Net Security · 28d agoIndustry1