30
30
Hillingar - MirageOS Unikernels on NixOS
A technical write-up details Hillingar, enabling reproducible Nix-based builds and NixOS deployment of MirageOS OCaml unikernels such as authoritative DNS servers.
This blog post (published December 2022, updated February 2025) describes Hillingar, work from the author's master's thesis enabling reproducible builds and deployments of MirageOS OCaml unikernels using Nix and a custom NixOS module, demonstrated with an authoritative DNS server. MirageOS unikernels embed application and low-level OS code in a single kernel, allowing dead-code elimination that reduces attack surface and improves efficiency. The post covers challenges such as solving opam dependency version constraints when linking a single dependency set.
25
Proactive cyber defense for governments and enterprises
Google launches the Fairwind Program giving governments and enterprises access to Gemini 3.8 Flash Cyber and CodeMender for autonomous vulnerability discovery and patching.
Google announced the Fairwind Program, a limited-access offering bringing its cyber defense capabilities to government agencies, critical infrastructure operators, and trusted partners, with more than 650 participating organizations. It combines the Gemini 3.8 Flash Cyber model with the CodeMender harness to autonomously find, verify, and fix vulnerabilities, generating deployment-ready patches in minutes inside customers' cloud environments. Google also raised its total cybersecurity funding commitment above $100 million, including $36 million granted to 35 US cyber clinics supporting hospitals, school districts, and municipal utilities.
68
30
Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)
A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.
Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.
14
55
Recorded Future Launches Impact and Metrics Dashboard
Recorded Future releases an Impact and Metrics Dashboard aggregating risk-reduction, detection, and analyst-efficiency metrics for customer leadership reporting.
The dashboard pulls data from a customer's environment, alerts, integrations, threat detections, and analyst activity into six metric areas: platform-wide security value, threat prioritization, threat detection, digital risk protection, account and credential monitoring, and Recorded Future AI and Insikt Group research usage. It is available now to all Recorded Future customers, who are advised to configure Priority Intelligence Requirements in Settings so reporting maps to their intelligence program. The vendor cites its 2025 ROI Report across nearly 300 customers reporting 351.3% annual ROI and says customers aligning alerting to PIRs identified new threats 65% faster.
28
30
42
RightCrowd Pass unifies mobile, physical, and biometric credentials
RightCrowd launched Pass, a credentialing platform unifying mobile, physical, and biometric access credentials, cutting credential revocation from 12.2 minutes to under 60 seconds.
RightCrowd announced Pass, a solution that issues and manages mobile, physical, and biometric access credentials from a single platform instead of fragmented badge programs. Mobile credentials are provisioned through a web-based API and can be suspended or revoked individually or in groups in under 60 seconds, versus an average 12.2 minutes for handling a lost or damaged physical badge. Each mobile credential is tied to a device via two-factor authentication, works with HID, Wavelynx, and LEGIC infrastructure, and counts toward LEED and BREEAM sustainability credits. The product is available now to new and existing customers and can be added to current RightCrowd SmartAccess deployments.
20
Keepnet launches free SMS/Call Reporter for iOS
Keepnet launched a free iOS app, SMS/Call Reporter, letting users one-tap report smishing and vishing into corporate incident response pipelines.
Keepnet released the free SMS/Call Reporter app for iOS, letting users report suspicious SMS and voice phishing with one tap. For enterprise customers, reports flow into Keepnet Incident Responder alongside email phishing reports. The company cites Verizon 2026 DBIR data showing mobile phishing simulations achieve a 40% higher median click rate than email, and FBI IC3 2025 counted $798 million in smishing and vishing losses. An Android version is planned.
22
Google’s open-source HEIR lets AI work with data it can’t see
Google open-sourced HEIR, a compiler toolchain that converts pre-trained AI models to operate on homomorphically encrypted data without exposing it.
Google's HEIR (Homomorphic Encryption Intermediate Representation) is an open-source compiler toolchain and development platform for fully homomorphic encryption, announced in 2023 and now supporting four peer-reviewed publications. It compiles Python programs handling sensitive data into implementations that process encrypted inputs, supporting multiple FHE schemes, libraries, front-end languages, and hardware accelerators such as GPUs, TPUs, FPGAs, and custom ASICs. Demonstrated applications include private recommendations, credit card fraud detection, network intrusion detection, and hotword recognition.
30
55
42
30
30
30
12 Best Kubernetes Security Tools Compared (2026): Features & Pricing
GBHackers compares 12 Kubernetes security vendors including Sysdig, Wiz, Aqua, and Cisco Isovalent on features, pricing units, and procurement strategy.
GBHackers publishes a 2026 buying guide comparing 12 Kubernetes security vendors including Sysdig, Wiz, Aqua Security, SUSE NeuVector, Snyk, Cisco Isovalent, Palo Alto Networks, Fairwinds, Red Hat ACS, and Tigera. It argues CNCF-grade open source (Kubescape, Falco, Trivy, Calico, Cilium/Tetragon) provides free posture, runtime, and network policy coverage that resets price negotiations. Cisco's acquisition of Isovalent places the eBPF data plane under a networking giant, while the paid market focuses on multi-cluster policy, enforcement, and support. The piece emphasizes that pricing units (workload, node, cluster, developer, credits) heavily influence contract costs.
25
Scytale expands vendor risk management with AI-powered TPRM tools
Scytale launched AI-powered third-party risk management in its Vendors module, automating vendor discovery, risk scoring, and continuous vendor posture monitoring.
Scytale added AI-driven TPRM capabilities to its Vendors module, combining automatic vendor discovery from SSO providers and integrations with AI enrichment and dynamic risk scoring. The platform now continuously monitors vendors for breaches, data exposures, and vulnerabilities via third-party intelligence APIs, with proactive email notifications and auto-generated audit-ready security reports. It integrates with cross-framework control mapping for SOC 2, ISO 27001, GDPR, HIPAA, and SOX ITGC. Scytale cites Verizon's 2026 DBIR, which found 48% of breaches involved a third party, up 60% year over year.
20
Proofpoint SOC Analyst Agent Uses OpenAI Cyber Models
Proofpoint launched its SOC Analyst Agent in private preview, using OpenAI Daybreak models to automate security investigations with human-controlled remediation, GA expected end of Q3 2026.
The SOC Analyst Agent uses OpenAI Daybreak cyber models to enable natural-language investigations across Proofpoint alerts, logs, DLP events and user risk signals, and to automate recurring threat hunts, data security investigations and escalation reporting. It is currently in private preview with general availability expected by the end of Q3 2026, and it does not independently make account changes or take remediation actions. Proofpoint joined the OpenAI Daybreak Defense Network in June 2026 and is exploring additional uses for the models in threat research, data security and AI security workflows.
35
55
30
30
30
30
30
30
55
55
30
55
55
30
55
55
Top 10 Best AWS Security Tools in 2026
Editorial roundup ranking the ten best AWS security tools of 2026, from native GuardDuty and Security Hub to CNAPPs like Wiz and Prisma Cloud.
The article recommends enabling AWS-native services first: GuardDuty for threat detection, Security Hub for posture aggregation, the free IAM Access Analyzer, plus CloudTrail logging and Config rules. It then reviews third-party platforms including Wiz, Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Trend Micro Cloud One, and Orca Security. It is an editorial vendor assessment with pricing described by model only, highlighting cross-account correlation and attack-path prioritization as third-party differentiators.
15
Security Data Isn’t the Problem. Security Context Is.
Horizon3 blog argues security context, not data volume, is the SOC bottleneck, promoting its NodeZero integration with CrowdStrike Falcon Next-Gen SIEM.
Horizon3.ai published a vendor blog explaining how its NodeZero Proactive Security Platform integration with CrowdStrike Falcon Next-Gen SIEM brings validated exposure findings into existing security operations workflows. The post argues SOCs are now limited by confidence rather than visibility, needing context to decide which issues matter. It cites a global chemical manufacturer that validated exploitable exposures with NodeZero before completing a $2 billion merger.
15
Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point
Filigran introduces Attack Chaining in OpenAEV to continuously simulate multi-stage attack paths, exposing gaps that isolated MITRE ATT&CK technique testing misses.
Filigran announced Attack Chaining, a new scenario type in its OpenAEV platform that links individual techniques into automated, continuously-run multi-stage attack paths, using each step's real output (credentials, tokens, open ports) to branch dynamically toward a final objective. The article cites Filigran's State of Threat Management report, in which 93% of security leaders reported a business-impacting cyberattack in the past 12 months, 88% said AI accelerates attackers, and 84% blamed siloed tools and disconnected testing. The 2025 DGFiP breach is cited as an example where individually survivable weaknesses chained into a major intrusion. The feature includes conditional chaining logic, live attack path mapping, structured findings for identifying chokepoints, and predefined scope and safety guardrails.
18
12 Best Browser Isolation Solutions Compared (2026): Features & Pricing
2026 comparison ranks Zscaler, Cloudflare, Menlo Security, Garrison (Everfox), Authentic8 and Kasm among twelve remote browser isolation solutions.
Guide compares twelve RBI products across four architectures: pixel streaming, DOM/vector reconstruction, platform-embedded SSE isolation, and self-hosted containers. Zscaler and Cloudflare lead RBI delivered inside SSE platforms, while Menlo Security leads isolate-everything efficacy and Garrison (Everfox) provides hardware-grade isolation for government use. Most offerings price per user per month.
12